Skip to content
This repository was archived by the owner on May 3, 2024. It is now read-only.

Commit d1a8b26

Browse files
author
Kalyan Krishna
committed
approved with minor edits
1 parent 179aeec commit d1a8b26

File tree

5 files changed

+162
-73
lines changed

5 files changed

+162
-73
lines changed

‎5-AccessControl/2-call-api-groups/AppCreationScripts/BulkCreateGroups.ps1

+28-5
Original file line numberDiff line numberDiff line change
@@ -43,22 +43,45 @@ Function CreateGroupsAndAssignUser($user)
4343
$group = Get-MgGroup -Filter "DisplayName eq '$groupName'"
4444
$groupNameLower = $groupName.ToLower();
4545
$nickName = $groupNameLower.replace(' ','');
46+
4647
if ($group)
4748
{
48-
Write-Host "Group $($group.DisplayName) already exists"
49+
Write-Host "Group '$($group.DisplayName)' already exists"
50+
$newsg = $group
4951
}
5052
else
5153
{
52-
$newsg = New-MgGroup -DisplayName $groupName -MailEnabled:$False -MailNickName $nickName -SecurityEnabled
53-
Write-Host "Successfully created group '$($newsg.DisplayName)'"
54+
try
55+
{
56+
$newsg = New-MgGroup -DisplayName $groupName -MailEnabled:$False -MailNickName $nickName -SecurityEnabled
57+
Write-Host "Successfully created group '$($newsg.DisplayName)'"
58+
}
59+
catch
60+
{
61+
$_.Exception.ToString() | out-host
62+
$message = $_
63+
Write-Warning $Error[0]
64+
Write-Host "Unable to create group '$($newsg.DisplayName)'. Error is $message." -ForegroundColor White -BackgroundColor Red
65+
}
66+
}
67+
5468
$userId = $user.Id
5569
$params = @{
56-
"@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/{$userId}"
70+
"@odata.id"="https://graph.microsoft.com/v1.0/users/$userId"
5771
}
5872

73+
try
74+
{
5975
New-MgGroupMemberByRef -GroupId $newsg.Id -BodyParameter $params
6076
Write-Host "Successfully assigned user to group '$($newsg.DisplayName)'"
6177
}
78+
catch
79+
{
80+
$_.Exception.ToString() | out-host
81+
$message = $_
82+
Write-Warning $Error[0]
83+
Write-Host "Unable to assign user to group '$($newsg.DisplayName)'. Error is $message." -ForegroundColor White -BackgroundColor Red
84+
}
6285

6386
$val += 1;
6487
}
@@ -127,7 +150,7 @@ if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph")) {
127150
Install-Module "Microsoft.Graph" -Scope CurrentUser
128151
}
129152

130-
Import-Module Microsoft.Graph
153+
#Import-Module Microsoft.Graph
131154

132155
if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Authentication")) {
133156
Install-Module "Microsoft.Graph.Authentication" -Scope CurrentUser

‎5-AccessControl/2-call-api-groups/AppCreationScripts/BulkRemoveGroups.ps1

+14-3
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,18 @@ Function RemoveGroups
4545
$group = Get-MgGroup -Filter "DisplayName eq '$groupName'"
4646
if ($group)
4747
{
48-
Remove-MgGroup -GroupId $group.Id
49-
Write-Host "Successfully deleted '$($group.DisplayName)'"
48+
try
49+
{
50+
Remove-MgGroup -GroupId $group.Id
51+
Write-Host "Successfully deleted '$($group.DisplayName)'"
52+
}
53+
catch
54+
{
55+
$_.Exception.ToString() | out-host
56+
$message = $_
57+
Write-Warning $Error[0]
58+
Write-Host "Unable to remove group '$($newsg.DisplayName)'. Error is $message." -ForegroundColor White -BackgroundColor Red
59+
}
5060
}
5161
else
5262
{
@@ -73,7 +83,7 @@ Function ConfigureApplications
7383

7484
if ($tenantId -eq "")
7585
{
76-
Connect-MgGraph -Scopes "Organization.Read.All Group.ReadWrite.All" -Environment $azureEnvironmentName
86+
Connect-MgGraph -Scopes "User.Read.All Organization.Read.All Group.ReadWrite.All" -Environment $azureEnvironmentName
7787
}
7888
else
7989
{
@@ -102,6 +112,7 @@ Function ConfigureApplications
102112

103113
}
104114

115+
105116
$ErrorActionPreference = "Stop"
106117

107118
if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Authentication"))

‎5-AccessControl/2-call-api-groups/AppCreationScripts/Cleanup.ps1

+49-4
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,51 @@ param(
77
[string] $azureEnvironmentName
88
)
99

10+
if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Groups")) {
11+
Install-Module "Microsoft.Graph.Groups" -Scope CurrentUser
12+
}
13+
14+
Import-Module Microsoft.Graph.Groups
15+
16+
<#.Description
17+
This function creates a new Azure AD Security Group with provided values
18+
#>
19+
Function CreateSecurityGroup([string] $name, [string] $description)
20+
{
21+
Write-Host "Creating a security group by the name '$name'."
22+
$newGroup = New-MgGroup -Description $description -DisplayName $name -MailEnabled:$false -SecurityEnabled:$true -MailNickName $name
23+
return Get-MgGroup -Filter "DisplayName eq '$name'"
24+
}
25+
26+
<#.Description
27+
This function first checks and then creates a new Azure AD Security Group with provided values, if required
28+
#>
29+
Function CreateIfNotExistsSecurityGroup([string] $name, [string] $description, [switch] $promptBeforeCreate)
30+
{
31+
32+
# check if Group exists
33+
$group = Get-MgGroup -Filter "DisplayName eq '$name'"
34+
35+
if( $group -eq $null)
36+
{
37+
if ($promptBeforeCreate)
38+
{
39+
$confirmation = Read-Host "Proceed to create a new security group named '$name' in the tenant ? (Y/N)"
40+
41+
if($confirmation -eq 'y')
42+
{
43+
$group = CreateSecurityGroup -name $name -description $description
44+
}
45+
}
46+
else
47+
{
48+
Write-Host "No Security Group created!"
49+
}
50+
}
51+
52+
return $group
53+
}
54+
1055
<#.Description
1156
This function first checks and then deletes an existing Azure AD Security Group, if required
1257
#>
@@ -40,7 +85,7 @@ Function RemoveSecurityGroup([string] $name, [switch] $promptBeforeDelete)
4085
<#.Description
4186
This function assigns a provided user to a security group
4287
#>
43-
Function AssignUserToGroup([Microsoft.Graph.PowerShell.Models.MicrosoftGraphDirectoryObject]$userToAssign, [Microsoft.Graph.PowerShell.Models.MicrosoftGraphGroup]$groupToAssign)
88+
Function AssignUserToGroup([Microsoft.Graph.PowerShell.Models.MicrosoftGraphUser]$userToAssign, [Microsoft.Graph.PowerShell.Models.MicrosoftGraphGroup]$groupToAssign)
4489
{
4590
$owneruserId = $userToAssign.Id
4691
$params = @{
@@ -72,11 +117,11 @@ Function Cleanup
72117

73118
if ($tenantId -eq "")
74119
{
75-
Connect-MgGraph -Scopes "Organization.Read.All Application.ReadWrite.All Group.ReadWrite.All" -Environment $azureEnvironmentName
120+
Connect-MgGraph -Scopes "User.Read.All Organization.Read.All Application.ReadWrite.All Group.ReadWrite.All" -Environment $azureEnvironmentName
76121
}
77122
else
78123
{
79-
Connect-MgGraph -TenantId $tenantId -Scopes "Organization.Read.All Application.ReadWrite.All Group.ReadWrite.All" -Environment $azureEnvironmentName
124+
Connect-MgGraph -TenantId $tenantId -Scopes "User.Read.All Organization.Read.All Application.ReadWrite.All Group.ReadWrite.All" -Environment $azureEnvironmentName
80125
}
81126

82127
$context = Get-MgContext
@@ -147,7 +192,7 @@ if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph")) {
147192
Install-Module "Microsoft.Graph" -Scope CurrentUser
148193
}
149194

150-
Import-Module Microsoft.Graph
195+
#Import-Module Microsoft.Graph
151196

152197
if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Authentication")) {
153198
Install-Module "Microsoft.Graph.Authentication" -Scope CurrentUser

‎5-AccessControl/2-call-api-groups/AppCreationScripts/Configure.ps1

+50-49
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,46 @@ Function GetRequiredPermissions([string] $applicationDisplayName, [string] $requ
8585
}
8686

8787

88+
<#.Description
89+
This function takes a string input as a single line, matches a key value and replaces with the replacement value
90+
#>
91+
Function UpdateLine([string] $line, [string] $value)
92+
{
93+
$index = $line.IndexOf(':')
94+
$lineEnd = ''
95+
96+
if($line[$line.Length - 1] -eq ','){ $lineEnd = ',' }
97+
98+
if ($index -ige 0)
99+
{
100+
$line = $line.Substring(0, $index+1) + " " + '"' + $value+ '"' + $lineEnd
101+
}
102+
return $line
103+
}
104+
105+
<#.Description
106+
This function takes a dictionary of keys to search and their replacements and replaces the placeholders in a text file
107+
#>
108+
Function UpdateTextFile([string] $configFilePath, [System.Collections.HashTable] $dictionary)
109+
{
110+
$lines = Get-Content $configFilePath
111+
$index = 0
112+
while($index -lt $lines.Length)
113+
{
114+
$line = $lines[$index]
115+
foreach($key in $dictionary.Keys)
116+
{
117+
if ($line.Contains($key))
118+
{
119+
$lines[$index] = UpdateLine $line $dictionary[$key]
120+
}
121+
}
122+
$index++
123+
}
124+
125+
Set-Content -Path $configFilePath -Value $lines -Force
126+
}
127+
88128
<#.Description
89129
This function takes a string input as a single line, matches a key value and replaces with the replacement value
90130
#>
@@ -158,45 +198,6 @@ Function CreateAppRole([string] $types, [string] $name, [string] $description)
158198
$appRole.Value = $name;
159199
return $appRole
160200
}
161-
<#.Description
162-
This function takes a string input as a single line, matches a key value and replaces with the replacement value
163-
#>
164-
Function UpdateLine([string] $line, [string] $value)
165-
{
166-
$index = $line.IndexOf(':')
167-
$lineEnd = ''
168-
169-
if($line[$line.Length - 1] -eq ','){ $lineEnd = ',' }
170-
171-
if ($index -ige 0)
172-
{
173-
$line = $line.Substring(0, $index+1) + " " + '"' + $value+ '"' + $lineEnd
174-
}
175-
return $line
176-
}
177-
178-
<#.Description
179-
This function takes a dictionary of keys to search and their replacements and replaces the placeholders in a text file
180-
#>
181-
Function UpdateTextFile([string] $configFilePath, [System.Collections.HashTable] $dictionary)
182-
{
183-
$lines = Get-Content $configFilePath
184-
$index = 0
185-
while($index -lt $lines.Length)
186-
{
187-
$line = $lines[$index]
188-
foreach($key in $dictionary.Keys)
189-
{
190-
if ($line.Contains($key))
191-
{
192-
$lines[$index] = UpdateLine $line $dictionary[$key]
193-
}
194-
}
195-
$index++
196-
}
197-
198-
Set-Content -Path $configFilePath -Value $lines -Force
199-
}
200201
if ($null -eq (Get-Module -ListAvailable -Name "Microsoft.Graph.Groups")) {
201202
Install-Module "Microsoft.Graph.Groups" -Scope CurrentUser
202203
}
@@ -275,7 +276,7 @@ Function RemoveSecurityGroup([string] $name, [switch] $promptBeforeDelete)
275276
<#.Description
276277
This function assigns a provided user to a security group
277278
#>
278-
Function AssignUserToGroup([Microsoft.Graph.PowerShell.Models.MicrosoftGraphDirectoryObject]$userToAssign, [Microsoft.Graph.PowerShell.Models.MicrosoftGraphGroup]$groupToAssign)
279+
Function AssignUserToGroup([Microsoft.Graph.PowerShell.Models.MicrosoftGraphUser]$userToAssign, [Microsoft.Graph.PowerShell.Models.MicrosoftGraphGroup]$groupToAssign)
279280
{
280281
$owneruserId = $userToAssign.Id
281282
$params = @{
@@ -324,10 +325,10 @@ Function ConfigureApplications
324325
# Connect to the Microsoft Graph API, non-interactive is not supported for the moment (Oct 2021)
325326
Write-Host "Connecting to Microsoft Graph"
326327
if ($tenantId -eq "") {
327-
Connect-MgGraph -Scopes "Organization.Read.All Application.ReadWrite.All Group.ReadWrite.All" -Environment $azureEnvironmentName
328+
Connect-MgGraph -Scopes "User.Read.All Organization.Read.All Application.ReadWrite.All Group.ReadWrite.All" -Environment $azureEnvironmentName
328329
}
329330
else {
330-
Connect-MgGraph -TenantId $tenantId -Scopes "Organization.Read.All Application.ReadWrite.All Group.ReadWrite.All" -Environment $azureEnvironmentName
331+
Connect-MgGraph -TenantId $tenantId -Scopes "User.Read.All Organization.Read.All Application.ReadWrite.All Group.ReadWrite.All" -Environment $azureEnvironmentName
331332
}
332333

333334
$context = Get-MgContext
@@ -347,7 +348,6 @@ Function ConfigureApplications
347348

348349
Write-Host ("Connected to Tenant {0} ({1}) as account '{2}'. Domain is '{3}'" -f $Tenant.DisplayName, $Tenant.Id, $currentUserPrincipalName, $verifiedDomainName)
349350

350-
351351
# Create the client AAD application
352352
Write-Host "Creating the AAD application (msal-react-app)"
353353
# Get a 6 months application key for the client Application
@@ -400,10 +400,10 @@ Function ConfigureApplications
400400

401401
$newClaim = CreateOptionalClaim -name "groups"
402402
$optionalClaims.IdToken += ($newClaim)
403-
$newClaim = CreateOptionalClaim -name "groups"
404-
$optionalClaims.AccessToken += ($newClaim)
405-
$newClaim = CreateOptionalClaim -name "groups"
406-
$optionalClaims.Saml2Token += ($newClaim)
403+
# $newClaim = CreateOptionalClaim -name "groups"
404+
# $optionalClaims.AccessToken += ($newClaim)
405+
# $newClaim = CreateOptionalClaim -name "groups"
406+
# $optionalClaims.Saml2Token += ($newClaim)
407407

408408
# Add Optional Claims
409409

@@ -486,7 +486,7 @@ Function ConfigureApplications
486486

487487
if ($ownerAssigned -eq $false)
488488
{
489-
AssignUserToGroup -userToAssign $owner -groupToAssign $GroupAdmin
489+
AssignUserToGroup -userToAssign $user -groupToAssign $GroupAdmin
490490
$ownerAssigned = $true
491491
}
492492

@@ -495,7 +495,7 @@ Function ConfigureApplications
495495

496496
if ($ownerAssigned -eq $false)
497497
{
498-
AssignUserToGroup -userToAssign $owner -groupToAssign $GroupMember
498+
AssignUserToGroup -userToAssign $user -groupToAssign $GroupMember
499499
$ownerAssigned = $true
500500
}
501501
Write-Host "Don't forget to assign the users you wish to work with to the newly created security groups !" -ForegroundColor Red
@@ -533,6 +533,7 @@ Function ConfigureApplications
533533
Write-Host " - To support overage scenario, remember to provide admin consent for GroupMember.Read.All permission in the portal." -ForegroundColor Red
534534
Write-Host " - This script has created a group named 'GroupAdmin' for you. On Azure portal, navigate to Azure AD > Groups blade and assign some users to it." -ForegroundColor Red
535535
Write-Host " - This script has created a group named 'GroupMember' for you. On Azure portal, navigate to Azure AD > Groups blade and assign some users to it." -ForegroundColor Red
536+
Write-Host " - Security groups matching the names you provided have been created in this tenant (if not present already). On Azure portal, assign some users to it, and configure ID & Access tokens to emit Group IDs" -ForegroundColor Red
536537
Write-Host -ForegroundColor Green "------------------------------------------------------------------------------------------------"
537538

538539
if($isOpenSSL -eq 'Y')

0 commit comments

Comments
 (0)