SHARE
TWEET

Untitled

a guest Jul 16th, 2019 73 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #-----------------------------------------------------------
  2. # Script variables
  3. #-----------------------------------------------------------
  4. $principalNames = ""
  5. $apiPrincipalName = "Microsoft Graph"
  6. $apiRoleNames = "User.Read.All", "Group.Read.All"
  7.  
  8. #-----------------------------------------------------------
  9. # Some general prechecks - no actual execution logic here
  10. #-----------------------------------------------------------
  11.  
  12. function Write-Log {
  13.     param([string] $Title, [string] $Detail, [ConsoleColor] $Color)
  14.     Write-Host $Title -NoNewline
  15.     Write-Host $Detail -ForegroundColor $Color
  16. }
  17. function Test-Singular {
  18.     param ($obj)
  19.     $obj
  20.     if ($null -eq $obj) {
  21.         Write-Host "Not found." -ForegroundColor Red
  22.         return $false
  23.     } else {
  24.         if ($obj.length -gt 1) {
  25.             Write-Host "Found multiple objects when one expected. Listing..." -ForegroundColor Red
  26.             foreach ($one in $obj) {
  27.                 $one
  28.             }
  29.             return $false
  30.         }
  31.     }
  32.     return $true
  33. }
  34.  
  35. # Check if logged in
  36. try {
  37.     $tenantInfo = Get-AzureADTenantDetail -ErrorAction Ignore
  38. }
  39. catch {
  40.     Write-Host "Not logged in. Logging in... " -NoNewline
  41.     Connect-AzureAD
  42.     $tenantInfo = Get-AzureADTenantDetail | Out-Null
  43. }
  44.  
  45. Write-Log "Logged to " $($tenantInfo.displayName) Yellow
  46.  
  47. # Check Azure Module
  48. Write-Host "Checking AzureAD modules"
  49. $modules = Get-Module -Name "AzureAD*"
  50.  
  51. foreach ($module in $modules) {
  52.     Write-Log "Module " "$($module.Name) v$($module.Version)" Yellow
  53. }
  54.  
  55. #-----------------------------------------------------------
  56. # Business Logic - Assign permissions
  57. #-----------------------------------------------------------
  58.  
  59. # Looking for API principal
  60. Write-Log "Looking for service principal " $apiPrincipalName Cyan
  61.  
  62. $apiPrincipal = Get-AzureADServicePrincipal -SearchString $apiPrincipalName
  63. if (Test-Singular $apiPrincipal) {
  64.     Write-Log "API Principal App Id: " $apiPrincipal.AppId DarkGray
  65.     Write-Log "API Principal Object Id: " $apiPrincipal.ObjectId DarkGray
  66.  
  67.     foreach ($principalName in $principalNames) {
  68.         Write-Log "Looking for service principal " $principalName Cyan
  69.    
  70.         # Get Principal
  71.         $principal = Get-AzureADServicePrincipal -Filter "DisplayName eq '$principalName'"
  72.         if (Test-Singular $principal) {
  73.             Write-Log "Principal DisplayName Id: " $principal.DisplayName DarkGray
  74.             Write-Log "Principal App Id: " $principal.AppId DarkGray
  75.             Write-Log "Principal Object Id: " $principal.ObjectId DarkGray
  76.  
  77.             Write-Host "Getting current roles"
  78.             $principalRoles = Get-AzureADServiceAppRoleAssignedTo -ObjectId $principal.ObjectId
  79.             Write-Host "Found $($principalRoles.Count) roles"
  80.    
  81.             Write-Host Assigning permissions
  82.             foreach ($roleName in $apiRoleNames) {
  83.                 Write-Log "Assigning Role " $roleName Green
  84.                 $role = $apiPrincipal.AppRoles | Where-Object { $_.Value -eq $roleName }
  85.                 if (Test-Singular $role) {
  86.                     Write-Log "Role Id: " $role.Id DarkGray
  87.                     Write-Log "Role Description: " $role.Description DarkGray
  88.  
  89.                     $principalRole = $principalRoles | Where-Object { $_.Id -eq $role.Id }
  90.                    
  91.                     if ($null -ne $principalRole) {
  92.                         Write-Host "Principal already has $roleName assigned. Skipping..." -ForegroundColor DarkGreen
  93.                     } else {
  94.                         try
  95.                         {
  96.                             New-AzureADServiceAppRoleAssignment `
  97.                             -Id $role.Id `
  98.                             -ObjectId $principal.ObjectId `
  99.                             -PrincipalId $principal.ObjectId `
  100.                             -ResourceId $apiPrincipal.ObjectId
  101.                             Write-Log "Result " "Role Assigned." Green
  102.                         }
  103.                         Catch
  104.                         {
  105.                             $errorMessage = $_.Exception.Message
  106.                             if ($errorMessage -like '*Message: Insufficient privileges to complete the operation.*') {
  107.                                
  108.                                 $principalRoles = Get-AzureADServiceAppRoleAssignedTo -ObjectId $principal.ObjectId
  109.                                 $principalRole = $principalRoles | Where-Object { $_.Id -eq $role.Id }
  110.                                 if ($null -ne $principalRole) {
  111.                                     Write-Log "Info " "Known Error Ocurred. Checking assignment." Gray
  112.                                     Write-Log "" "Role Assigned. OK." Green
  113.                                 } else {
  114.                                     throw;
  115.                                 }
  116.                                
  117.                             } else {
  118.                                 throw;
  119.                             }
  120.                         }
  121.                     }
  122.                 }
  123.             }
  124.         }
  125.     }
  126. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!
 
Top