mirror of
https://github.com/Gerenios/AADInternals
synced 2026-06-08 11:09:38 +00:00
Thomas Naunheim
3329 lines
117 KiB
PowerShell
3329 lines
117 KiB
PowerShell
# This contains functions for getting Azure AD access tokens
|
|
|
|
# Tries to get access token from cache unless provided as parameter
|
|
# Refactored Jun 8th 2020
|
|
function Get-AccessTokenFromCache
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$ClientID,
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$Resource,
|
|
[switch]$IncludeRefreshToken,
|
|
[boolean]$Force=$false,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SubScope
|
|
)
|
|
Process
|
|
{
|
|
# Strip the trailing slash
|
|
$tResource = $Resource.TrimEnd("/")
|
|
|
|
# Check if we got the AccessToken as parameter
|
|
if([string]::IsNullOrEmpty($AccessToken))
|
|
{
|
|
# Check if cache entry is empty
|
|
# The audience can be resource name or resource id
|
|
if($Script:tokens.ContainsKey("$ClientId-$tResource"))
|
|
{
|
|
$cacheKey = "$ClientId-$tResource"
|
|
}
|
|
else
|
|
{
|
|
# Loop through the resource ids
|
|
foreach($resId in $Script:RESIDs.Keys)
|
|
{
|
|
if($Script:RESIDs[$resId] -eq $tResource)
|
|
{
|
|
if($Script:tokens.ContainsKey("$ClientId-$resId"))
|
|
{
|
|
$cacheKey = "$ClientId-$resId"
|
|
}
|
|
break
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
if([string]::IsNullOrEmpty($cacheKey))
|
|
{
|
|
# If token not found, try to find other tokens with the same resource
|
|
Write-Verbose "Access token for $ClientId-$tResource not found. Trying to find other clients for the resource"
|
|
foreach($cacheKey in $Script:tokens.Keys)
|
|
{
|
|
if($cacheKey.EndsWith($tResource) -or ($resId -ne $null -and $cacheKey.EndsWith($Script:RESIDs[$resId])))
|
|
{
|
|
Write-Verbose "Found token for ClientId $($cacheKey.Substring(0,36))"
|
|
$retVal=$Script:tokens[$cacheKey]
|
|
break
|
|
}
|
|
}
|
|
|
|
# If FOCI client, try to find refresh token for other FOCI client
|
|
if([string]::IsNullOrEmpty($retVal) -and (IsFOCI -ClientId $ClientID))
|
|
{
|
|
Write-Verbose "Access token for $ClientId-$tResource not found. Trying to find refresh token for other FOCI clients"
|
|
# Loop through cached refresh tokens
|
|
foreach($cacheKey in $Script:refresh_tokens.Keys)
|
|
{
|
|
# Extract the client id
|
|
[guid]$rtClientId = $cacheKey.Substring(0,36)
|
|
|
|
if(IsFOCI -ClientId $rtClientId)
|
|
{
|
|
Write-Verbose "Using refresh token for ClientId $rtClientId"
|
|
# If FOCI client, get access token with it's refresh_token
|
|
$tenantId = (Read-Accesstoken -AccessToken $Script:tokens[$cacheKey]).tid
|
|
$refresh_token = $Script:refresh_tokens[$cacheKey]
|
|
$retVal = Get-AccessTokenWithRefreshToken -Resource $Resource -ClientId $ClientID -RefreshToken $refresh_token -TenantId $tenantId -SaveToCache $True -SubScope $SubScope
|
|
break
|
|
}
|
|
}
|
|
}
|
|
|
|
if([string]::IsNullOrEmpty($retVal))
|
|
{
|
|
# Empty, so throw the exception
|
|
Throw "No saved tokens found. Please call Get-AADIntAccessTokenFor<service> -SaveToCache"
|
|
}
|
|
}
|
|
else
|
|
{
|
|
$retVal=$Script:tokens[$cacheKey]
|
|
}
|
|
}
|
|
else
|
|
{
|
|
# Check that the audience of the access token is correct
|
|
$tAudience=(Read-Accesstoken -AccessToken $AccessToken).aud.TrimEnd("/")
|
|
|
|
# The audience might be a GUID
|
|
if((($tAudience -ne $tResource) -and ($Script:RESIDs[$tAudience] -ne $tResource)) -and ($Force -eq $False))
|
|
{
|
|
# Wrong audience
|
|
Write-Warning "The audience of the access token ($tAudience) is wrong. Should be $tResource!"
|
|
}
|
|
# Just return the passed access token
|
|
$retVal=$AccessToken
|
|
}
|
|
|
|
# Check the expiration
|
|
if(Is-AccessTokenExpired($retVal))
|
|
{
|
|
# Use the same client id as the expired token
|
|
$ClientID = (Read-Accesstoken -AccessToken $retVal).appid
|
|
|
|
Write-Verbose "ACCESS TOKEN HAS EXPRIRED. Trying to get a new one with RefreshToken."
|
|
$retVal = Get-AccessTokenWithRefreshToken -Resource $Resource -ClientId $ClientID -RefreshToken (Get-RefreshTokenFromCache -AccessToken $retVal) -TenantId (Read-Accesstoken -AccessToken $retVal).tid -SaveToCache $true -IncludeRefreshToken $IncludeRefreshToken
|
|
}
|
|
|
|
# Return
|
|
return $retVal
|
|
}
|
|
}
|
|
|
|
# Returns refresh token from cache
|
|
# Apr 25th 2023
|
|
function Get-RefreshTokenFromCache
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='AccessToken',Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(ParameterSetName='ClientAndResource', Mandatory=$True)]
|
|
[String]$ClientID,
|
|
[Parameter(ParameterSetName='ClientAndResource', Mandatory=$True)]
|
|
[String]$Resource
|
|
)
|
|
Process
|
|
{
|
|
# Get clientid and resource from access token if provided
|
|
if($AccessToken)
|
|
{
|
|
$parsedToken = Read-AccessToken -AccessToken $AccessToken
|
|
$ClientID = $parsedToken.appid
|
|
$Resource = $parsedToken.aud
|
|
}
|
|
|
|
# Strip the trailing slash
|
|
$Resource = $Resource.TrimEnd("/")
|
|
|
|
return $Script:refresh_tokens["$ClientId-$Resource"]
|
|
}
|
|
}
|
|
|
|
|
|
# Gets the access token for AAD Graph API
|
|
function Get-AccessTokenForAADGraph
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for AAD Graph
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for AAD Graph, which is used for example in Provisioning API.
|
|
If credentials are not given, prompts for credentials (supports MFA).
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user. If not given, credentials are prompted.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos ticket
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Parameter Resource
|
|
Resource, defaults to "https://graph.windows.net"
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForAADGraph
|
|
|
|
.Example
|
|
PS C:\>$cred=Get-Credential
|
|
PS C:\>Get-AADIntAccessTokenForAADGraph -Credentials $cred
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant,
|
|
[switch]$SaveToCache,
|
|
[ValidateSet("https://graph.windows.net", "urn:ms-drs:enterpriseregistration.windows.net","urn:ms-drs:enterpriseregistration.microsoftonline.us")]
|
|
[String]$Resource="https://graph.windows.net",
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
Get-AccessToken -Credentials $Credentials -Resource $Resource -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894" -SAMLToken $SAMLToken -Tenant $Tenant -KerberosTicket $KerberosTicket -Domain $Domain -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
# Gets the access token for MS Graph API
|
|
function Get-AccessTokenForMSGraph
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for Microsoft Graph
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for Microsoft Graph, which is used in Graph API.
|
|
If credentials are not given, prompts for credentials (supports MFA).
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user. If not given, credentials are prompted.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSGraph
|
|
|
|
.Example
|
|
$cred=Get-Credential
|
|
Get-AADIntAccessTokenForMSGraph -Credentials $cred
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant,
|
|
[switch]$SaveToCache,
|
|
[switch]$SaveToMgCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
Get-AccessToken -Credentials $Credentials -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894" -SAMLToken $SAMLToken -KerberosTicket $KerberosTicket -Domain $Domain -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -Tenant $Tenant -OTPSecretKey $OTPSecretKey -TAP $TAP -SaveToMgCache $SaveToMgCache -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
# Gets the access token for enabling or disabling PTA
|
|
function Get-AccessTokenForPTA
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for PTA
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for PTA, which is used for example to enable or disable PTA.
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForPTA
|
|
|
|
.Example
|
|
PS C:\>$cred=Get-Credential
|
|
PS C:\>Get-AADIntAccessTokenForPTA -Credentials $cred
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
Get-AccessToken -Credentials $Credentials -Resource "https://proxy.cloudwebappproxy.net/registerapp" -ClientId "cb1056e2-e479-49de-ae31-7812af012ed8" -SAMLToken $SAMLToken -KerberosTicket $KerberosTicket -Domain $Domain -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
# Gets the access token for Office Apps
|
|
function Get-AccessTokenForOfficeApps
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for Office Apps
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for Office Apps.
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForOfficeApps
|
|
|
|
.Example
|
|
PS C:\>$cred=Get-Credential
|
|
PS C:\>Get-AADIntAccessTokenForOfficeApps -Credentials $cred
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
Get-AccessToken -Credentials $Credentials -Resource "https://officeapps.live.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894" -SAMLToken $SAMLToken -KerberosTicket $KerberosTicket -Domain $Domain -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
# Gets the access token for Exchange Online
|
|
function Get-AccessTokenForEXO
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for Exchange Online
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for Exchange Online
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForEXO
|
|
|
|
.Example
|
|
PS C:\>$cred=Get-Credential
|
|
PS C:\>Get-AADIntAccessTokenForEXO -Credentials $cred
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[ValidateSet("https://graph.microsoft.com","https://outlook.office365.com","https://outlook.office.com","https://substrate.office.com")]
|
|
[String]$Resource="https://outlook.office365.com",
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
# Office app has the required rights to Exchange Online
|
|
Get-AccessToken -Credentials $Credentials -Resource $Resource -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -SAMLToken $SAMLToken -KerberosTicket $KerberosTicket -Domain $Domain -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
# Gets the access token for Exchange Online remote PowerShell
|
|
function Get-AccessTokenForEXOPS
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for Exchange Online remote PowerShell
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for Exchange Online remote PowerShell
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Parameter Certificate
|
|
x509 device certificate.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForEXOPS
|
|
|
|
.Example
|
|
PS C:\>$cred=Get-Credential
|
|
PS C:\>Get-AADIntAccessTokenForEXOPS -Credentials $cred
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[switch]$SaveToCache,
|
|
|
|
[Parameter(Mandatory=$False)]
|
|
[System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$PfxFileName,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$PfxPassword,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
# Office app has the required rights to Exchange Online
|
|
Get-AccessToken -Credentials $Credentials -Resource "https://outlook.office365.com" -ClientId "a0c73c16-a7e3-4564-9a95-2bdf47383716" -SAMLToken $SAMLToken -KerberosTicket $KerberosTicket -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -Domain $Domain -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
# Gets the access token for SARA
|
|
# Jul 8th 2019
|
|
function Get-AccessTokenForSARA
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for SARA
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for Microsoft Support and Recovery Assistant (SARA)
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForSARA
|
|
|
|
.Example
|
|
PS C:\>$cred=Get-Credential
|
|
PS C:\>Get-AADIntAccessTokenForSARA -Credentials $cred
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
# Office app has the required rights to Exchange Online
|
|
Get-AccessToken -Resource "https://api.diagnostics.office.com" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -Credentials $Credentials -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
# Gets an access token for OneDrive
|
|
# Nov 26th 2019
|
|
function Get-AccessTokenForOneDrive
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for OneDrive
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for OneDrive Sync client
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForOneDrive
|
|
|
|
.Example
|
|
PS C:\>$cred=Get-Credential
|
|
PS C:\>Get-AADIntAccessTokenForOneDrive -Tenant "company" -Credentials $cred
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant="Common",
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
Get-AccessToken -Resource "https://$Tenant-my.sharepoint.com/" -ClientId "ab9b8c07-8f02-4f72-87fa-80105867a763" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
|
|
|
|
# Gets an access token for Azure Core Management
|
|
# May 29th 2020
|
|
function Get-AccessTokenForAzureCoreManagement
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for Azure Core Management
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for Azure Core Management
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForOneOfficeApps
|
|
|
|
.Example
|
|
PS C:\>$cred=Get-Credential
|
|
PS C:\>Get-AADIntAccessTokenForAzureCoreManagement -Credentials $cred
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
Get-AccessToken -Resource "https://management.core.windows.net/" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
# Gets an access token for SPO
|
|
# Jun 10th 2020
|
|
function Get-AccessTokenForSPO
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for SharePoint Online
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for SharePoint Online Management Shell, which can be used with any SPO requests.
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter Tenant
|
|
The tenant name of the organization, ie. company.onmicrosoft.com -> "company"
|
|
|
|
.Parameter Admin
|
|
Get the token for admin portal
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForSPO
|
|
|
|
.Example
|
|
PS C:\>$cred=Get-Credential
|
|
PS C:\>Get-AADIntAccessTokenForSPO -Credentials $cred -Tenant "company"
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
# Get access and refresh tokens
|
|
#$clientId = "fdd7719f-d61e-4592-b501-793734eb8a0e" # SharePoint Migration Tool
|
|
#$clientId = "9bc3ab49-b65d-410a-85ad-de819febfddc" # SPO Management shell
|
|
$clientId = "d3590ed6-52b3-4102-aeff-aad2292ab01c" # Microsoft Office
|
|
|
|
$graphTokens = Get-AccessToken -Resource "https://graph.microsoft.com" -ClientId $clientId -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -IncludeRefreshToken $True -OTPSecretKey $OTPSecretKey -TAP $TAP -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
|
|
# Get SPO root site url
|
|
$response = Call-MSGraphAPI -AccessToken $graphTokens[0] -ApiVersion Beta -API "sites/root" -QueryString "select=webUrl"
|
|
$SPOUrl = $response.webUrl.TrimEnd("/")
|
|
$tenant = $SPOUrl.Split(".")[0]
|
|
|
|
# Get SPO tokens
|
|
$SPOtokens = Get-AccessTokenWithRefreshToken -Resource "$($tenant).sharepoint.com" -ClientId $clientId -RefreshToken $graphTokens[1] -IncludeRefreshToken $true -TenantId "Common"
|
|
$SPOtokens_my = Get-AccessTokenWithRefreshToken -Resource "$($tenant)-my.sharepoint.com" -ClientId $clientId -RefreshToken $graphTokens[1] -IncludeRefreshToken $true -TenantId "Common"
|
|
$SPOtokens_admin = Get-AccessTokenWithRefreshToken -Resource "$($tenant)-admin.sharepoint.com" -ClientId $clientId -RefreshToken $graphTokens[1] -IncludeRefreshToken $true -TenantId "Common"
|
|
|
|
if($SaveToCache)
|
|
{
|
|
# Add tokens to cache
|
|
Add-AccessTokenToCache -AccessToken $graphTokens[0] -RefreshToken $graphTokens[1] -ShowCache $false
|
|
Add-AccessTokenToCache -AccessToken $SPOtokens[0] -RefreshToken $SPOtokens[1] -ShowCache $false
|
|
Add-AccessTokenToCache -AccessToken $SPOtokens_my[0] -RefreshToken $SPOtokens_my[1] -ShowCache $false
|
|
Add-AccessTokenToCache -AccessToken $SPOtokens_admin[0] -RefreshToken $SPOtokens_admin[1] -ShowCache $false
|
|
}
|
|
else
|
|
{
|
|
return @($SPOtokens[0],$SPOtokens_my[0],$SPOtokens_admin[0])
|
|
}
|
|
}
|
|
}
|
|
|
|
# Gets the access token for My Signins
|
|
# Jul 1st 2020
|
|
function Get-AccessTokenForMySignins
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for My Signins
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for My Signins, which is used for example when registering MFA.
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenForMySignins
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[switch]$SaveToCache,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
Get-AccessToken -ClientId 1b730954-1685-4b74-9bfd-dac224a7b894 -Resource "0000000c-0000-0000-c000-000000000000" -ForceMFA $true -Credentials $Credentials -SaveToCache $SaveToCache -KerberosTicket $KerberosTicket -Domain $Domain -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
|
|
# Gets an access token for Azure AD Join
|
|
# Aug 26th 2020
|
|
function Get-AccessTokenForAADJoin
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for Azure AD Join
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for Azure AD Join, allowing users' to register devices to Azure AD.
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Parameter BPRT
|
|
Bulk PRT token, can be created with New-AADIntBulkPRTToken
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter Tenant
|
|
The tenant name of the organization, ie. company.onmicrosoft.com -> "company"
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForAADJoin
|
|
|
|
.Example
|
|
PS C:\>$cred=Get-Credential
|
|
PS C:\>Get-AADIntAccessTokenForAADJoin -Credentials $cred
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$False)]
|
|
[Switch]$Device,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='BPRT',Mandatory=$True)]
|
|
[string]$BPRT,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant,
|
|
[switch]$SaveToCache,
|
|
[switch]$ForceMFA,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
if($Device)
|
|
{
|
|
Get-AccessTokenWithDeviceSAML -SAML $SAMLToken -SaveToCache $SaveToCache
|
|
}
|
|
else
|
|
{
|
|
Get-AccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -ForceMFA $ForceMFA -BPRT $BPRT -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
}
|
|
|
|
# Gets an access token for Intune MDM
|
|
# Aug 26th 2020
|
|
function Get-AccessTokenForIntuneMDM
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for Intune MDM
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for Intune MDM, allowing users' to enroll their devices to Intune.
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter BPRT
|
|
Bulk PRT token, can be created with New-AADIntBulkPRTToken
|
|
|
|
.Parameter Tenant
|
|
The tenant name of the organization, ie. company.onmicrosoft.com -> "company"
|
|
|
|
.Parameter Certificate
|
|
x509 device certificate.
|
|
|
|
.Parameter TransportKeyFileName
|
|
File name of the transport key
|
|
|
|
.Parameter PfxFileName
|
|
File name of the .pfx device certificate.
|
|
|
|
.Parameter PfxPassword
|
|
The password of the .pfx device certificate.
|
|
|
|
.Parameter Resource
|
|
The resource to get access token to, defaults to "https://enrollment.manage.microsoft.com/". To get access to AAD Graph API, use "https://graph.windows.net"
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForIntuneMDM
|
|
|
|
.Example
|
|
PS C:\>$cred=Get-Credential
|
|
PS C:\>Get-AADIntAccessTokenForIntuneMDM -Credentials $cred
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[switch]$ForceMFA,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='BPRT',Mandatory=$True)]
|
|
[string]$BPRT,
|
|
|
|
[switch]$SaveToCache,
|
|
|
|
[Parameter(Mandatory=$False)]
|
|
[System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$PfxFileName,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$PfxPassword,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TransportKeyFileName,
|
|
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$Resource="https://enrollment.manage.microsoft.com/",
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
Get-AccessToken -ClientId "29d9ed98-a469-4536-ade2-f981bc1d605e" -Resource $Resource -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -Certificate $Certificate -PfxFileName $PfxFileName -PfxPassword $PfxPassword -BPRT $BPRT -ForceMFA $ForceMFA -TransportKeyFileName $TransportKeyFileName -OTPSecretKey $OTPSecretKey -TAP $TAP -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
# Gets an access token for Azure Cloud Shell
|
|
# Sep 9th 2020
|
|
function Get-AccessTokenForCloudShell
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for Azure Cloud Shell
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for Azure Cloud Shell
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForOneOfficeApps
|
|
|
|
.Example
|
|
PS C:\>$cred=Get-Credential
|
|
PS C:\>Get-AADIntAccessTokenForCloudShell -Credentials $cred
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
# First, get an access token for admin.microsoft.com
|
|
$response = Get-AccessToken -Resource "https://admin.microsoft.com" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
|
|
if([string]::IsNullOrEmpty($response.Tenant))
|
|
{
|
|
$access_token = $response
|
|
}
|
|
|
|
# Get access token for management.core.windows.net using Admin API
|
|
Get-AccessTokenUsingAdminAPI -AccessToken $access_token -Resource "https://management.core.windows.net/" -SaveToCache $SaveToCache -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE
|
|
}
|
|
}
|
|
|
|
# Gets an access token for Teams
|
|
# Oct 3rd 2020
|
|
function Get-AccessTokenForTeams
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for Teams
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for Teams
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForTeams
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenForTeams -SaveToCache
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant,
|
|
[Parameter(Mandatory=$False)]
|
|
[ValidateSet("https://api.spaces.skype.com", "https://outlook.com", "https://*.microsoftstream.com", "https://graph.microsoft.com")]
|
|
[String]$Resource="https://api.spaces.skype.com",
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
Get-AccessToken -Resource $Resource -ClientId "1fec8e78-bce4-4aaf-ab1b-5451cc387264" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
|
|
# Gets an access token for Azure AD Management API
|
|
# Nov 11th 2020
|
|
function Get-AccessTokenForAADIAMAPI
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for Azure AD IAM API
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for Azure AD IAM API
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForAADIAMAPI
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenForAADIAMAPI -SaveToCache
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
# First get the access token for AADGraph
|
|
$AccessTokens = Get-AccessToken -Resource "https://graph.windows.net" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -IncludeRefreshToken $True -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
|
|
# Get the actual token
|
|
$AccessToken = Get-AccessTokenWithRefreshToken -Resource "74658136-14ec-4630-ad9b-26e160ff0fc6" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -SaveToCache $SaveToCache -RefreshToken $AccessTokens[1] -TenantId (Read-Accesstoken $AccessTokens[0]).tid -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE
|
|
|
|
if(!$SaveToCache)
|
|
{
|
|
return $AccessToken
|
|
}
|
|
}
|
|
}
|
|
|
|
# Gets an access token for MS Commerce
|
|
# Aug 27th 2021
|
|
function Get-AccessTokenForMSCommerce
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for MS Commerce
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for MS Commerce
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSCommerce
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenForMSCommerce -SaveToCache
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
Get-AccessToken -Resource "aeb86249-8ea3-49e2-900b-54cc8e308f85" -ClientId "3d5cffa9-04da-4657-8cab-c7f074657cad" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
# Gets an access token for MS Partner
|
|
# Sep 22nd 2021
|
|
function Get-AccessTokenForMSPartner
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for MS Partner
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for MS Partner
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForMSCommerce
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenForMSPartner -SaveToCache
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
# The correct client id would be 4990cffe-04e8-4e8b-808a-1175604b879f but that flow doesn't work :(
|
|
Get-AccessToken -Resource "fa3d9a0c-3fb0-42cc-9193-47c7ecd2edbd" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
# Gets an access token for admin.microsoft.com
|
|
# Sep 22nd 2021
|
|
function Get-AccessTokenForAdmin
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for admin.microsoft.com
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for admin.microsoft.com
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForAdmin
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenForAdmin -SaveToCache
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
Get-AccessToken -Resource "https://admin.microsoft.com" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
# Gets an access token for onenote.com
|
|
# Feb 2nd 2022
|
|
function Get-AccessTokenForOneNote
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for onenote.com
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for onenote.com
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForOneNote
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenForOneNote -SaveToCache
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
Get-AccessToken -Resource "https://onenote.com" -ClientId "1fec8e78-bce4-4aaf-ab1b-5451cc387264" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
# Gets an access token for for Access Packages
|
|
# Apr 24th 2023
|
|
function Get-AccessTokenForAccessPackages
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for Access Packages
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for Access Packages
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Example
|
|
Get-AADIntAccessTokenForAccessPackages
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessAccessPackages -SaveToCache
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
Get-AccessToken -Resource "https://elm.iga.azure.com" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
# Gets an access token for Windows Hello for Business
|
|
# May 20th 2023
|
|
function Get-AccessTokenForWHfB
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for Windows Hello for Business
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for Windows Hello for Business, allowing users to register WHfB key.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Example
|
|
$prttoken = Get-AADIntUserPRTToken -Method TokenProvider
|
|
Get-AADIntAccessTokenForWHfB -PRTToken $prttoken
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant="common",
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP
|
|
)
|
|
Process
|
|
{
|
|
# Prompt credentials as that's the only allowed method
|
|
$response = Prompt-Credentials -ClientID "dd762716-544d-4aeb-a526-687b73838a22" -Resource "urn:ms-drs:enterpriseregistration.windows.net" -RefreshTokenCredential $PRTToken -ForceNGCMFA $True -Credentials $Credentials -OTPSecretKey $OTPSecretKey -TAP $TAP -Tenant $Tenant
|
|
|
|
$parsedAccessToken = Read-Accesstoken -AccessToken $response.access_token
|
|
if([string]::IsNullOrEmpty($parsedAccessToken.DeviceId))
|
|
{
|
|
Write-Warning "No DeviceId claim present, device authentication failed. Expired PRT token?"
|
|
}
|
|
|
|
# Save to cache or return
|
|
if($SaveToCache)
|
|
{
|
|
Add-AccessTokenToCache -AccessToken $response.access_token -RefreshToken $response.refresh_token -ShowCache $true
|
|
}
|
|
else
|
|
{
|
|
return $response.access_token
|
|
}
|
|
}
|
|
}
|
|
|
|
# Gets an access token for compliance.microsoft.com
|
|
# Dec 13th 2024
|
|
function Get-AccessTokenForCompliance
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for compliance.microsoft.com
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for compliance.microsoft.com
|
|
|
|
.Parameter Credentials
|
|
Credentials of the user.
|
|
|
|
.Parameter PRT
|
|
PRT token of the user.
|
|
|
|
.Parameter SAML
|
|
SAML token of the user.
|
|
|
|
.Parameter UserPrincipalName
|
|
UserPrincipalName of the user of Kerberos token
|
|
|
|
.Parameter KerberosTicket
|
|
Kerberos token of the user.
|
|
|
|
.Parameter UseDeviceCode
|
|
Use device code flow.
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenForCompliance -SaveToCache
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(ParameterSetName='Credentials',Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$True)]
|
|
[String]$PRTToken,
|
|
[Parameter(ParameterSetName='SAML',Mandatory=$True)]
|
|
[String]$SAMLToken,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(ParameterSetName='Kerberos',Mandatory=$True)]
|
|
[String]$Domain,
|
|
[Parameter(ParameterSetName='DeviceCode',Mandatory=$True)]
|
|
[switch]$UseDeviceCode,
|
|
[Parameter(ParameterSetName='MSAL',Mandatory=$True)]
|
|
[switch]$UseMSAL,
|
|
[switch]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)]
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)]
|
|
[Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)]
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$CAE,
|
|
|
|
# ESTS
|
|
[Parameter(ParameterSetName='ESTS',Mandatory=$True)]
|
|
[string]$ESTSAUTH
|
|
)
|
|
Process
|
|
{
|
|
Get-AccessToken -Resource "80ccca67-54bd-44ab-8625-4b79c4dc7775" -ClientId "1fec8e78-bce4-4aaf-ab1b-5451cc387264" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH
|
|
}
|
|
}
|
|
|
|
# Gets the access token for provisioning API and stores to cache
|
|
# Refactored Jun 8th 2020
|
|
function Get-AccessToken
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for the given client and resource. Using the given authentication method. If not provided, uses interactive logon.
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for the given client and resource. Using the given authentication method. If not provided, uses interactive logon.
|
|
|
|
.Example
|
|
$at=Get-AADIntAccessToken -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -Resource "https://graph.microsoft.com"
|
|
|
|
.Example
|
|
Get-AADIntAccessToken -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -Resource "https://graph.microsoft.com" -SaveToCache $true -IncludeRefreshToken $true
|
|
AccessToken saved to cache.
|
|
|
|
Tenant : 9779e97e-de19-45be-87ab-a7ed3e86fa62
|
|
User : user@company.com
|
|
Resource : https://graph.microsoft.com
|
|
Client : d3590ed6-52b3-4102-aeff-aad2292ab01c
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(ParameterSetName='PRT',Mandatory=$False)]
|
|
[String]$PRTToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SAMLToken,
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$Resource,
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$ClientId,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant="common",
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$KerberosTicket,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Domain,
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$SaveToCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$SaveToMgCache,
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$IncludeRefreshToken=$false,
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$ForceMFA=$false,
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$ForceNGCMFA=$false,
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$UseDeviceCode=$false,
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$UseIMDS=$false,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$MsiResId,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$MsiClientId,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$MsiObjectId,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$BPRT,
|
|
[Parameter(Mandatory=$False)]
|
|
[System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$PfxFileName,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$PfxPassword,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TransportKeyFileName,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$RedirectUri,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$ESTSAUTH,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$SubScope,
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$UseMSAL=$false,
|
|
|
|
# PRT + SessionKey
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$RefreshToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SessionKey,
|
|
[Parameter(Mandatory=$False)]
|
|
$Settings,
|
|
|
|
# Continuous Access Evaluation
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$CAE
|
|
|
|
)
|
|
Begin
|
|
{
|
|
# List of clients requiring the same client id
|
|
$requireClientId=@(
|
|
"cb1056e2-e479-49de-ae31-7812af012ed8" # Pass-through authentication
|
|
"c44b4083-3bb0-49c1-b47d-974e53cbdf3c" # Azure Admin web ui
|
|
"1fec8e78-bce4-4aaf-ab1b-5451cc387264" # Teams
|
|
"d3590ed6-52b3-4102-aeff-aad2292ab01c" # Office, ref. https://docs.microsoft.com/en-us/office/dev/add-ins/develop/register-sso-add-in-aad-v2
|
|
"a0c73c16-a7e3-4564-9a95-2bdf47383716" # EXO Remote PowerShell
|
|
"389b1b32-b5d5-43b2-bddc-84ce938d6737" # Office Management API Editor https://manage.office.com
|
|
"ab9b8c07-8f02-4f72-87fa-80105867a763" # OneDrive Sync Engine
|
|
"d3590ed6-52b3-4102-aeff-aad2292ab01c" # SPO
|
|
"29d9ed98-a469-4536-ade2-f981bc1d605e" # MDM
|
|
"0c1307d4-29d6-4389-a11c-5cbe7f65d7fa" # Azure Android App
|
|
"6c7e8096-f593-4d72-807f-a5f86dcc9c77" # MAM
|
|
"4813382a-8fa7-425e-ab75-3b753aab3abb" # Microsoft authenticator
|
|
"8c59ead7-d703-4a27-9e55-c96a0054c8d2"
|
|
"c7d28c4f-0d2c-49d6-a88d-a275cc5473c7" # https://www.microsoftazuresponsorships.com/
|
|
"04b07795-8ddb-461a-bbee-02f9e1bf7b46" # Azure CLI
|
|
"ecd6b820-32c2-49b6-98a6-444530e5a77a" # Edge
|
|
"1950a258-227b-4e31-a9cf-717495945fc2" # Microsoft Azure PowerShell
|
|
"9ba1a5c7-f17a-4de9-a1f1-6178c8d51223" # Microsoft Intune Company Portal
|
|
)
|
|
}
|
|
Process
|
|
{
|
|
# Check the tenant id
|
|
if([string]::IsNullOrEmpty($Tenant))
|
|
{
|
|
$Tenant = "common"
|
|
}
|
|
|
|
if(![String]::IsNullOrEmpty($KerberosTicket)) # Check if we got the kerberos token
|
|
{
|
|
# Get token using the kerberos token
|
|
$OAuthInfo = Get-AccessTokenWithKerberosTicket -KerberosTicket $KerberosTicket -Domain $Domain -Resource $Resource -ClientId $ClientId -Tenant $Tenant
|
|
$access_token = $OAuthInfo.access_token
|
|
}
|
|
elseif(![String]::IsNullOrEmpty($PRTToken)) # Check if we got a PRT token
|
|
{
|
|
# Get token using the PRT token
|
|
$OAuthInfo = Get-AccessTokenWithPRTToken -Cookie $PRTToken -Resource $Resource -ClientId $ClientId -Tenant $Tenant -SubScope $SubScope
|
|
$access_token = $OAuthInfo.access_token
|
|
}
|
|
# Check if we got a PRT and session key
|
|
elseif(![String]::IsNullOrEmpty($Settings) -or (![String]::IsNullOrEmpty($RefreshToken) -and ![String]::IsNullOrEmpty($SessionKey)))
|
|
{
|
|
if($Settings)
|
|
{
|
|
$RefreshToken = $Settings.refresh_token
|
|
$SessionKey = $Settings.session_key
|
|
}
|
|
|
|
# Get token using the PRT token
|
|
$OAuthInfo = Get-AccessTokenWithSignedPRTRequest -Resource $Resource -ClientId $ClientId -SubScope $SubScope -RefreshToken $RefreshToken -SessionKey $SessionKey -CAE $CAE
|
|
$access_token = $OAuthInfo.access_token
|
|
}
|
|
elseif($UseDeviceCode) # Check if we want to use device code flow
|
|
{
|
|
# Get token using device code
|
|
$OAuthInfo = Get-AccessTokenUsingDeviceCode -Resource $Resource -ClientId $ClientId -Tenant $Tenant -CAE $CAE
|
|
$access_token = $OAuthInfo.access_token
|
|
}
|
|
elseif($UseIMDS) # Check if we want to use IMDS
|
|
{
|
|
# Get token using Azure Instance Metadata Service (IMDS)
|
|
$OAuthInfo = @{
|
|
"refresh_token" = $null
|
|
"access_token" = Get-AccessTokenUsingIMDS -ClientId $MsiClientId -ObjectId $MsiObjectId -AzureResourceId $MsiResId -Resource $Resource
|
|
}
|
|
$access_token = $OAuthInfo.access_token
|
|
}
|
|
elseif(![String]::IsNullOrEmpty($BPRT)) # Check if we got a BPRT
|
|
{
|
|
# Get token using BPRT
|
|
$OAuthInfo = @{
|
|
"refresh_token" = $BPRT
|
|
"access_token" = Get-AccessTokenWithRefreshToken -Resource "urn:ms-drs:enterpriseregistration.windows.net" -ClientId "b90d5b8f-5503-4153-b545-b31cecfaece2" -TenantId "Common" -RefreshToken $BPRT -SubScope $SubScope -CAE $CAE
|
|
}
|
|
$access_token = $OAuthInfo.access_token
|
|
}
|
|
elseif($UseMSAL) # Use MSAL
|
|
{
|
|
# Get token using Microsoft Authentication Library
|
|
$response = Get-AccessTokenUsingMSAL -TenantId $Tenant -ClientId $ClientId -Resource $Resource -RedirectUri $RedirectUri -SubScope $SubScope -CAE $CAE
|
|
$OAuthInfo = @{
|
|
"refresh_token" = $null
|
|
"access_token" = $response.AccessToken
|
|
}
|
|
$access_token = $OAuthInfo.access_token
|
|
}
|
|
else # Authorization code grant flow - can use SAML or interactive prompt
|
|
{
|
|
if(![string]::IsNullOrEmpty($SAMLToken))
|
|
{
|
|
# Get token using SAML token
|
|
$OAuthInfo = Get-OAuthInfoUsingSAML -SAMLToken $SAMLToken -ClientId $ClientId -Resource "https://graph.windows.net"
|
|
}
|
|
elseif(![string]::IsNullOrEmpty($ESTSAUTH))
|
|
{
|
|
# Get token using ESTSAUTH
|
|
$OAuthInfo = Prompt-Credentials -Resource $Resource -ClientId $ClientId -Tenant $Tenant -RedirectURI $RedirectUri -SubScope $SubScope -ESTSAUTH $ESTSAUTH -CAE $CAE
|
|
}
|
|
else
|
|
{
|
|
# Prompt for credentials
|
|
if( $ClientId -eq "d3590ed6-52b3-4102-aeff-aad2292ab01c" <# Office #> -or
|
|
$ClientId -eq "a0c73c16-a7e3-4564-9a95-2bdf47383716" <# EXO #> -or
|
|
($ClientId -eq "29d9ed98-a469-4536-ade2-f981bc1d605e" -and $Resource -eq "https://enrollment.manage.microsoft.com/") <# MDM #>
|
|
)
|
|
{
|
|
$OAuthInfo = Prompt-Credentials -Resource $Resource -ClientId $ClientId -Tenant $Tenant -ForceMFA $ForceMFA -ForceNGCMFA $ForceNGCMFA -Credentials $Credentials -OTPSecretKey $OTPSecretKey -TAP $TAP -RedirectURI $RedirectUri -SubScope $SubScope -CAE $CAE
|
|
}
|
|
else
|
|
{
|
|
$OAuthInfo = Prompt-Credentials -Resource "https://graph.windows.net" -ClientId $ClientId -Tenant $Tenant -ForceMFA $ForceMFA -ForceNGCMFA $ForceNGCMFA -Credentials $Credentials -OTPSecretKey $OTPSecretKey -TAP $TAP -RedirectURI $RedirectUri -SubScope $SubScope -CAE $CAE
|
|
}
|
|
|
|
# Just return null
|
|
if(!$OAuthInfo)
|
|
{
|
|
return $null
|
|
}
|
|
|
|
}
|
|
|
|
# Save the refresh token and other variables
|
|
$RefreshToken= $OAuthInfo.refresh_token
|
|
$ParsedToken= Read-Accesstoken($OAuthInfo.access_token)
|
|
$tenant_id = $ParsedToken.tid
|
|
|
|
# Save the tokens to cache
|
|
if($SaveToCache)
|
|
{
|
|
Write-Verbose "ACCESS TOKEN: SAVE TO CACHE"
|
|
Add-AccessTokenToCache -AccessToken $OAuthInfo.access_token -RefreshToken $OAuthInfo.refresh_token -ShowCache $false
|
|
}
|
|
|
|
# If the token client id or resource is different than requested, get correct one using refresh token
|
|
if(($ParsedToken.appid -ne $ClientId) -or ($ParsedToken.aud -ne $Resource))
|
|
{
|
|
$tokens = Get-AccessTokenWithRefreshToken -Resource $Resource -ClientId $ClientId -TenantId $tenant_id -RefreshToken $RefreshToken -SaveToCache $SaveToCache -IncludeRefreshToken $true -SubScope $SubScope -CAE $CAE
|
|
$OAuthInfo = [pscustomobject]@{
|
|
"access_token" = $tokens[0]
|
|
"refresh_token" = $tokens[1]
|
|
}
|
|
}
|
|
|
|
$access_token = $OAuthInfo.access_token
|
|
}
|
|
|
|
# Check is this current, new, or deprecated FOCI client
|
|
IsFOCI -ClientId (Read-Accesstoken -AccessToken $OAuthInfo.access_token).appid -FOCI $OAuthInfo.foci | Out-Null
|
|
$refresh_token = $OAuthInfo.refresh_token
|
|
|
|
# Check whether we want to get the deviceid and (possibly) mfa in mra claim
|
|
if(($Certificate -ne $null -and [string]::IsNullOrEmpty($PfxFileName)) -or ($Certificate -eq $null -and [string]::IsNullOrEmpty($PfxFileName) -eq $false))
|
|
{
|
|
try
|
|
{
|
|
Write-Verbose "Trying to get new tokens with deviceid claim."
|
|
$deviceTokens = Set-AccessTokenDeviceAuth -AccessToken $access_token -RefreshToken $refresh_token -Certificate $Certificate -PfxFileName $PfxFileName -PfxPassword $PfxPassword -BPRT $([string]::IsNullOrEmpty($BPRT) -eq $False) -TransportKeyFileName $TransportKeyFileName
|
|
}
|
|
catch
|
|
{
|
|
Write-Warning "Could not get tokens with deviceid claim: $($_.Exception.Message)"
|
|
}
|
|
|
|
if($deviceTokens.access_token)
|
|
{
|
|
$access_token = $deviceTokens.access_token
|
|
$refresh_token = $deviceTokens.refresh_token
|
|
|
|
$claims = Read-Accesstoken $access_token
|
|
Write-Verbose "Tokens updated with deviceid: ""$($claims.deviceid)"" and amr: ""$($claims.amr)"""
|
|
}
|
|
}
|
|
|
|
# Save the final tokens to cache
|
|
if($SaveToCache -and $OAuthInfo -ne $null -and $access_token -ne $null)
|
|
{
|
|
Add-AccessTokenToCache -AccessToken $access_token -RefreshToken $refresh_token -ShowCache $false
|
|
}
|
|
|
|
if($SaveToMgCache -and $OAuthInfo -ne $null -and $access_token -ne $null)
|
|
{
|
|
Write-Verbose "Saving access token to MS Graph SDK cache"
|
|
|
|
# Import the module if needed
|
|
$MgModule = "Microsoft.Graph.Authentication"
|
|
if(!(Get-Module -Name $MgModule))
|
|
{
|
|
try
|
|
{
|
|
# Import-Module doesn't throw an error, just prints it out.
|
|
Import-Module -Name $MgModule -ErrorVariable "moduleImportError" -ErrorAction SilentlyContinue
|
|
}
|
|
catch
|
|
{
|
|
Throw "$MgModule module could not be imported!"
|
|
}
|
|
if($moduleImportError)
|
|
{
|
|
Throw "$MgModule module could not be imported!"
|
|
}
|
|
}
|
|
|
|
# Initialize the graph session
|
|
[Microsoft.Graph.PowerShell.Authentication.Common.GraphSessionInitializer]::InitializeSession()
|
|
|
|
# Create the AuthContext
|
|
$authContext = [Microsoft.Graph.PowerShell.Authentication.AuthContext]::new()
|
|
$authContext.PSHostVersion = (Get-Host).Version
|
|
$authContext.Environment = "Global"
|
|
|
|
$authContext.AuthType = [Microsoft.Graph.PowerShell.Authentication.AuthenticationType]::UserProvidedAccessToken
|
|
$authContext.TokenCredentialType = [Microsoft.Graph.PowerShell.Authentication.TokenCredentialType]::UserProvidedAccessToken
|
|
$authContext.ContextScope = [Microsoft.Graph.PowerShell.Authentication.ContextScope]::Process
|
|
|
|
# Initialize the GraphSession and store the access token
|
|
$graphSession = [Microsoft.Graph.PowerShell.Authentication.GraphSession]::Instance
|
|
$graphSession.InMemoryTokenCache = [Microsoft.Graph.PowerShell.Authentication.Core.TokenCache.InMemoryTokenCache]::new([text.encoding]::UTF8.GetBytes($access_token))
|
|
$graphSession.AuthContext = $authContext
|
|
}
|
|
|
|
# Return
|
|
if([string]::IsNullOrEmpty($access_token))
|
|
{
|
|
Throw "Could not get Access Token!"
|
|
}
|
|
|
|
# Don't print out token if saved to cache!
|
|
if($SaveToCache -or $SaveToMgCache)
|
|
{
|
|
$pat = Read-Accesstoken -AccessToken $access_token
|
|
$attributes=[ordered]@{
|
|
"Tenant" = $pat.tid
|
|
"User" = $pat.unique_name
|
|
"Resource" = $Resource
|
|
"Client" = $ClientID
|
|
}
|
|
Write-Host "AccessToken saved to cache."
|
|
if($SaveToMgCache)
|
|
{
|
|
Write-Host "You may now use MS Graph SDK commands, e.g. Get-MgUser"
|
|
}
|
|
return New-Object psobject -Property $attributes
|
|
}
|
|
else
|
|
{
|
|
if($IncludeRefreshToken) # Include refreshtoken
|
|
{
|
|
return @($access_token,$refresh_token)
|
|
}
|
|
else
|
|
{
|
|
return $access_token
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
# Gets the access token using a refresh token
|
|
# Jun 8th 2020
|
|
function Get-AccessTokenWithRefreshToken
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets OAuth Access Token for the given client and resource using the given refresh token.
|
|
|
|
.DESCRIPTION
|
|
Gets OAuth Access Token for the given client and resource using the given refresh token.
|
|
For FOCI refresh tokens, i.e.,Family Refresh Tokens (FRTs), you can use any FOCI client id.
|
|
|
|
.Example
|
|
PS:\>$tokens=Get-AADIntAccessToken -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -Resource "https://graph.microsoft.com" -IncludeRefreshToken $true
|
|
PS:\>$at=Get-AADIntAccessTokenWithRefreshToken -ClientId "1fec8e78-bce4-4aaf-ab1b-5451cc387264" -Resource "https://graph.windows.net" -TenantId "company.com" -RefreshToken $tokens[1]
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[String]$Resource,
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$ClientId,
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$TenantId,
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$RefreshToken,
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$SaveToCache = $false,
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$IncludeRefreshToken = $false,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SubScope,
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$CAE
|
|
)
|
|
Process
|
|
{
|
|
# Set the body for API call
|
|
$body = @{
|
|
"resource"= $Resource
|
|
"client_id"= $ClientId
|
|
"grant_type"= "refresh_token"
|
|
"refresh_token"= $RefreshToken
|
|
"scope"= "openid"
|
|
}
|
|
|
|
# Set Continuous Access Evaluation (CAE) token claims
|
|
if($CAE)
|
|
{
|
|
$body["claims"] = Get-CAEClaims
|
|
}
|
|
|
|
if($ClientId -eq "ab9b8c07-8f02-4f72-87fa-80105867a763") # OneDrive Sync Engine
|
|
{
|
|
$url = "https://login.windows.net/common/oauth2/token"
|
|
}
|
|
else
|
|
{
|
|
$url = "$(Get-TenantLoginUrl -SubScope $SubScope)/$TenantId/oauth2/token"
|
|
}
|
|
|
|
# Debug
|
|
Write-Debug "ACCESS TOKEN BODY: $($body | Out-String)"
|
|
|
|
# Set the content type and call the API
|
|
$contentType="application/x-www-form-urlencoded"
|
|
try
|
|
{
|
|
$response=Invoke-RestMethod -UseBasicParsing -Uri $url -ContentType $contentType -Method POST -Body $body
|
|
}
|
|
catch
|
|
{
|
|
$errorMessage = "Unable to get tokens using refresh token"
|
|
try
|
|
{
|
|
$errorDetails = $_.ErrorDetails.Message | ConvertFrom-Json
|
|
if(-not [string]::IsNullOrEmpty($errorDetails.error_description))
|
|
{
|
|
$errorMessage = $errorDetails.error_description.Split("`n")[0]
|
|
}
|
|
}
|
|
catch {}
|
|
throw $errorMessage
|
|
}
|
|
|
|
|
|
# Debug
|
|
Write-Debug "ACCESS TOKEN RESPONSE: $response"
|
|
|
|
# Check is this current, new, or deprecated FOCI client
|
|
IsFOCI -ClientId (Read-Accesstoken -AccessToken $response.access_token).appid -FOCI $response.foci | Out-Null
|
|
|
|
# Save the tokens to cache
|
|
if($SaveToCache)
|
|
{
|
|
Write-Verbose "ACCESS TOKEN: SAVE TO CACHE"
|
|
Add-AccessTokenToCache -AccessToken $response.access_token -RefreshToken $response.refresh_token -ShowCache $false
|
|
}
|
|
|
|
# Return
|
|
if($IncludeRefreshToken)
|
|
{
|
|
return @($response.access_token, $response.refresh_token)
|
|
}
|
|
else
|
|
{
|
|
return $response.access_token
|
|
}
|
|
}
|
|
}
|
|
|
|
# Gets access token using device code flow
|
|
# Oct 13th 2020
|
|
function Get-AccessTokenUsingDeviceCode
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$ClientId,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Resource="https://graph.windows.net",
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$CAE
|
|
)
|
|
Process
|
|
{
|
|
# Check the tenant
|
|
if([string]::IsNullOrEmpty($Tenant))
|
|
{
|
|
$Tenant="Common"
|
|
}
|
|
|
|
# Create a body for the first request
|
|
$body=@{
|
|
"client_id" = $ClientId
|
|
"resource" = $Resource
|
|
}
|
|
|
|
# Invoke the request to get device and user codes
|
|
$authResponse = Invoke-RestMethod -UseBasicParsing -Method Post -Uri "https://login.microsoftonline.com/$tenant/oauth2/devicecode?api-version=1.0" -Body $body
|
|
|
|
Write-Host $authResponse.message
|
|
|
|
$continue = $true
|
|
$response = $null
|
|
$interval = $authResponse.interval
|
|
$expires = $authResponse.expires_in
|
|
|
|
# Create body for authentication subsequent requests
|
|
$body=@{
|
|
"client_id" = $ClientId
|
|
"grant_type" = "urn:ietf:params:oauth:grant-type:device_code"
|
|
"code" = $authResponse.device_code
|
|
"resource" = $Resource
|
|
}
|
|
|
|
# Set Continuous Access Evaluation (CAE) token claims
|
|
if($CAE)
|
|
{
|
|
$body["claims"] = Get-CAEClaims
|
|
}
|
|
|
|
|
|
# Loop while pending or until timeout exceeded
|
|
while($continue)
|
|
{
|
|
Start-Sleep -Seconds $interval
|
|
$total += $interval
|
|
|
|
if($total -gt $expires)
|
|
{
|
|
Write-Error "Timeout occurred"
|
|
return
|
|
}
|
|
|
|
# Try to get the response. Will give 40x while pending so we need to try&catch
|
|
try
|
|
{
|
|
$response = Invoke-RestMethod -UseBasicParsing -Method Post -Uri "https://login.microsoftonline.com/$Tenant/oauth2/token?api-version=1.0 " -Body $body -ErrorAction SilentlyContinue
|
|
}
|
|
catch
|
|
{
|
|
# This normal flow, always returns 40x unless successful
|
|
$details=$_.ErrorDetails.Message | ConvertFrom-Json
|
|
$continue = $details.error -eq "authorization_pending"
|
|
Write-Verbose $details.error
|
|
Write-Host "." -NoNewline
|
|
|
|
if(!$continue)
|
|
{
|
|
# Not authorization_pending so this is a real error :(
|
|
Write-Error $details.error_description
|
|
return
|
|
}
|
|
}
|
|
|
|
# If we got response, all okay!
|
|
if($response)
|
|
{
|
|
Write-Host ""
|
|
return $response
|
|
}
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
# Gets the access token using device SAML token
|
|
# Feb 18th 2021
|
|
function Get-AccessTokenWithDeviceSAML
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$SAML,
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$SaveToCache
|
|
)
|
|
Process
|
|
{
|
|
$headers = @{
|
|
}
|
|
|
|
|
|
$ClientId = "1b730954-1685-4b74-9bfd-dac224a7b894" #"dd762716-544d-4aeb-a526-687b73838a22"
|
|
$Resource = "01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9" #"urn:ms-drs:enterpriseregistration.windows.net"
|
|
|
|
# Set the body for API call
|
|
$body = @{
|
|
"resource"= $Resource
|
|
"client_id"= $ClientId
|
|
"grant_type"= "urn:ietf:params:oauth:grant-type:saml1_1-bearer"
|
|
"assertion"= Convert-TextToB64 -Text $SAML
|
|
"scope"= "openid"
|
|
}
|
|
|
|
# Debug
|
|
Write-Debug "ACCESS TOKEN BODY: $($body | Out-String)"
|
|
|
|
# Set the content type and call the API
|
|
$contentType = "application/x-www-form-urlencoded"
|
|
$response = Invoke-RestMethod -UseBasicParsing -Uri "https://login.microsoftonline.com/common/oauth2/token" -ContentType $contentType -Method POST -Body $body -Headers $headers
|
|
|
|
# Debug
|
|
Write-Debug "ACCESS TOKEN RESPONSE: $response"
|
|
|
|
# Save the tokens to cache
|
|
if($SaveToCache)
|
|
{
|
|
Write-Verbose "ACCESS TOKEN: SAVE TO CACHE"
|
|
Add-AccessTokenToCache -AccessToken $response.access_token -RefreshToken $response.refresh_token -ShowCache $false
|
|
}
|
|
else
|
|
{
|
|
# Return
|
|
return $response.access_token
|
|
}
|
|
}
|
|
}
|
|
|
|
# Logins to SharePoint Online and returns an IdentityToken
|
|
# TODO: Research whether can be used to get access_token to AADGraph
|
|
# TODO: Add support for Google?
|
|
# FIX: Web control stays logged in - clear cookies somehow?
|
|
# Aug 10th 2018
|
|
function Get-IdentityTokenByLiveId
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets identity_token for SharePoint Online for External user
|
|
|
|
.DESCRIPTION
|
|
Gets identity_token for SharePoint Online for External user using LiveId.
|
|
|
|
.Parameter Tenant
|
|
The tenant name to login in to WITHOUT .sharepoint.com part
|
|
|
|
.Example
|
|
PS C:\>$id_token=Get-AADIntIdentityTokenByLiveId -Tenant mytenant
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$Tenant
|
|
)
|
|
Process
|
|
{
|
|
# Set variables
|
|
$auth_redirect="https://login.microsoftonline.com/common/federation/oauth2" # When to close the form
|
|
$url="https://$Tenant.sharepoint.com"
|
|
|
|
# Create the form
|
|
$form=Create-LoginForm -Url $url -auth_redirect $auth_redirect
|
|
|
|
# Show the form and wait for the return value
|
|
if($form.ShowDialog() -ne "OK") {
|
|
Write-Verbose "Login cancelled"
|
|
return $null
|
|
}
|
|
|
|
$web=$form.Controls[0]
|
|
|
|
$code=$web.Document.All["code"].GetAttribute("value")
|
|
$id_token=$web.Document.All["id_token"].GetAttribute("value")
|
|
$session_state=$web.Document.All["session_state"].GetAttribute("value")
|
|
|
|
return Read-Accesstoken($id_token)
|
|
}
|
|
}
|
|
|
|
# Tries to generate access token using cached AADGraph token
|
|
# Jun 15th 2020
|
|
function Get-AccessTokenUsingAADGraph
|
|
{
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$Resource,
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$ClientId,
|
|
[switch]$SaveToCache
|
|
)
|
|
Process
|
|
{
|
|
# Try to get AAD Graph access token from the cache
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $null -Resource "https://graph.windows.net" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894"
|
|
|
|
# Get the tenant id
|
|
$tenant = (Read-Accesstoken -AccessToken $AccessToken).tid
|
|
|
|
# Get the refreshtoken
|
|
$refresh_token = Get-RefreshTokenFromCache -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "https://graph.windows.net"
|
|
|
|
if([string]::IsNullOrEmpty($refresh_token))
|
|
{
|
|
Throw "No refreshtoken found! Use Get-AADIntAccessTokenForAADGraph with -SaveToCache switch."
|
|
}
|
|
|
|
# Create a new AccessToken for Azure AD management portal API
|
|
$AccessToken = Get-AccessTokenWithRefreshToken -Resource $Resource -ClientId $ClientId -TenantId $tenant -RefreshToken $refresh_token -SaveToCache $SaveToCache
|
|
|
|
# Return
|
|
$AccessToken
|
|
}
|
|
}
|
|
|
|
# Apr 22th 2022
|
|
# Shows users stored in ESTS cookie
|
|
function Unprotect-EstsAuthPersistentCookie
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Decrypts and dumps users stored in ESTSAUTH or ESTSAUTHPERSISTENT
|
|
|
|
.DESCRIPTION
|
|
Decrypts and dumps users stored in ESTSAUTH or ESTSAUTHPERSISTENT using login.microsoftonline.com/forgetUser
|
|
|
|
.Parameter Cookie
|
|
Value of ESTSAUTH or ESTSAUTHPERSISTENT cookie
|
|
|
|
.Example
|
|
PS C:\>Unprotect-AADIntEstsAuthPersistentCookie -Cookie 0.ARMAqlCH3MZuvUCNgTAd4B7IRffhvoluXopNnz3s1gEl...
|
|
|
|
name : Some User
|
|
login : user@company.com
|
|
imageAAD : work_account.png
|
|
imageMSA : personal_account.png
|
|
isLive : False
|
|
isGuest : False
|
|
link : user@company.com
|
|
authUrl :
|
|
isSigned : True
|
|
sessionID : 1fb5e6b3-09a4-4ceb-bcad-3d6d0ee89bf7
|
|
domainHint :
|
|
isWindows : False
|
|
|
|
name : Another User
|
|
login : user2@company.com
|
|
imageAAD : work_account.png
|
|
imageMSA : personal_account.png
|
|
isLive : False
|
|
isGuest : False
|
|
link : user2@company.com
|
|
authUrl :
|
|
isSigned : False
|
|
sessionID : 1fb5e6b3-09a4-4ceb-bcad-3d6d0ee89bf7
|
|
domainHint :
|
|
isWindows : False
|
|
#>
|
|
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True,ValueFromPipeline)]
|
|
[String]$Cookie,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SubScope
|
|
)
|
|
Process
|
|
{
|
|
Remove-UserFromEstsAuthPersistentCookie -Cookie $Cookie -SessionID "00000000-0000-0000-0000-000000000000" -ShowContent $true
|
|
}
|
|
}
|
|
|
|
# Apr 22th 2022
|
|
# Removes a user from the ESTS cookie
|
|
function Remove-UserFromEstsAuthPersistentCookie
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Removes the given user from ESTSAUTH or ESTSAUTHPERSISTENT
|
|
|
|
.DESCRIPTION
|
|
Removes the given user from ESTSAUTH or ESTSAUTHPERSISTENT using login.microsoftonline.com/forgetUser
|
|
|
|
The signed in user or the only user can't be removed.
|
|
|
|
.Parameter Cookie
|
|
Value of ESTSAUTH or ESTSAUTHPERSISTENT cookie
|
|
|
|
.Parameter SessionID
|
|
The session ID to be removed
|
|
|
|
.Parameter UserName
|
|
The user to be removed
|
|
|
|
.Parameter ShowContent
|
|
If true, shows the content of the cookie instead of returning new cookie
|
|
|
|
.Example
|
|
PS C:\>$ESTSCookie = Remove-AADIntUserFromEstsAuthPersistentCookie -UserName "user@company.com" -Cookie "0.ARMAqlCH3MZuvUCNgTAd4B7IRffhvoluXopNnz3s1gEl..."
|
|
|
|
|
|
#>
|
|
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$Cookie,
|
|
[Parameter(ParameterSetName='ID',Mandatory=$True)]
|
|
[String]$SessionID,
|
|
[Parameter(ParameterSetName='User',Mandatory=$True)]
|
|
[String]$UserName,
|
|
[Parameter(Mandatory=$False)]
|
|
[boolean]$ShowContent=$False,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$SubScope
|
|
)
|
|
Process
|
|
{
|
|
if(![string]::IsNullOrEmpty($UserName))
|
|
{
|
|
# Get the list of users
|
|
$users = Unprotect-EstsAuthPersistentCookie -Cookie $Cookie
|
|
if($users.Count -eq 1)
|
|
{
|
|
Write-Warning "The only user can't be removed."
|
|
}
|
|
foreach($user in $users)
|
|
{
|
|
if($user.login -eq $UserName)
|
|
{
|
|
$SessionID = $user.sessionID
|
|
if($user.isSigned)
|
|
{
|
|
Write-Warning "Signed in user can't be removed"
|
|
}
|
|
break
|
|
}
|
|
}
|
|
|
|
if([string]::IsNullOrEmpty($SessionID))
|
|
{
|
|
throw "User $username not stored in the given token"
|
|
}
|
|
}
|
|
|
|
$session = New-Object Microsoft.PowerShell.Commands.WebRequestSession
|
|
$loginUrl = Get-TenantLoginUrl -SubScope $SubScope
|
|
$cookieDomain = $loginUrl.Split("/")[2]
|
|
|
|
$session.Cookies.Add((New-Object System.Net.Cookie("ESTSAUTHPERSISTENT", $Cookie, "/", $cookieDomain )))
|
|
$response = Invoke-WebRequest2 -Uri "$loginUrl/forgetuser?sessionid=$sessionID" -WebSession $session -ErrorAction SilentlyContinue
|
|
|
|
# Dump the content
|
|
if($ShowContent)
|
|
{
|
|
return $response.content | ConvertFrom-Json
|
|
}
|
|
else
|
|
{
|
|
# Return the new cookie
|
|
# For some reason, the web session is not updated with the new cookie :(
|
|
try
|
|
{
|
|
$ESTSCookie = Get-StringBetween -Start "ESTSAUTHPERSISTENT=" -End ";" -String $response.Headers.'Set-Cookie'
|
|
}
|
|
catch
|
|
{
|
|
Write-Warning "No ESTSAUTHPERSISTENT cookie was returned. The removed user/session didn't exist, the user was signed in, or there was just one user."
|
|
}
|
|
|
|
return $ESTSCookie
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
# Returns access token using Azure Instance Metadata Service (IMDS)
|
|
# Nov 8th 2022
|
|
|
|
function Get-AccessTokenUsingIMDS
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Gets access token using Azure Instance Metadata Service (IMDS)
|
|
|
|
.DESCRIPTION
|
|
Gets access token using Azure Instance Metadata Service (IMDS).
|
|
The ClientId of the token is the (Enterprise) Application ID of the managed identity.
|
|
|
|
.Parameter Resource
|
|
The App ID URI of the target resource. It also appears in the aud (audience) claim of the issued token.
|
|
|
|
.Parameter ObjectId
|
|
The ObjectId of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identities.
|
|
|
|
.Parameter ClientId
|
|
The ClientId of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identities.
|
|
|
|
.Parameter AzureResourceId
|
|
The Azure Resource ID of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identities.
|
|
|
|
.Example
|
|
PS C:\>Get-AADIntAccessTokenUsingIMDS -Resource https://management.core.windows.net | Add-AADIntAccessTokenToCache
|
|
|
|
Name :
|
|
ClientId : 686d728a-2838-458d-9038-2d9808781b9a
|
|
Audience : https://management.core.windows.net
|
|
Tenant : ef35ef41-6e54-43f8-bdf0-b89827a3a991
|
|
IsExpired : False
|
|
HasRefreshToken : False
|
|
AuthMethods :
|
|
Device :
|
|
|
|
PS C:\>Get-AADIntAzureSubscriptions
|
|
|
|
subscriptionId displayName state
|
|
-------------- ----------- -----
|
|
233cd967-f2d4-41eb-897a-47ac77c7393d Production Enabled
|
|
|
|
PS C:\>Get-AADIntAzureResourceGroups -SubscriptionId "233cd967-f2d4-41eb-897a-47ac77c7393d"
|
|
|
|
name location tags
|
|
---- -------- ----
|
|
Production-Norway norwayeast
|
|
Production-Germany westeurope
|
|
Production-US-West westus3
|
|
Production-Sweden swedencentral
|
|
Production-US-East eastus
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$Resource,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$ClientId,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$ObjectId,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AzureResourceId,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$ApiVersion="2018-02-01"
|
|
)
|
|
Process
|
|
{
|
|
# Construct the url
|
|
# Ref: https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http
|
|
|
|
$url = "http://169.254.169.254/metadata/identity/oauth2/token?api-version=$($ApiVersion)&resource=$($Resource)"
|
|
if($ClientId)
|
|
{
|
|
$url += "&client_id=$ClientId"
|
|
}
|
|
if($ObjectId)
|
|
{
|
|
$url += "&object_id=$ObjectId"
|
|
}
|
|
if($AzureResourceId)
|
|
{
|
|
$url += "&msi_res_id=$AzureResourceId"
|
|
}
|
|
|
|
# Create the header
|
|
$headers = @{
|
|
"Metadata" = "true"
|
|
}
|
|
|
|
# Invoke the request. Short timeout as this may be a computer not able to access IMDS.
|
|
$response = Invoke-RestMethod -UseBasicParsing -Uri $url -Method Get -Headers $headers -TimeoutSec 1
|
|
|
|
# Return
|
|
$response.access_token
|
|
}
|
|
}
|
|
|
|
# Gets app consent info
|
|
# Sep 13th 2024
|
|
function Get-AppConsentInfo
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Shows the consent information of the given application client id.
|
|
|
|
.DESCRIPTION
|
|
Shows the consent information of the given application client id by using authorization code flow.
|
|
|
|
.Parameter ClientId
|
|
The ClientId of the application which consent information you'd like to see
|
|
|
|
.Example
|
|
PS C:\>$creds = Get-Credential
|
|
PS C:\>Get-AADIntAppConsentInfo -Credentials $creds -ClientId "5a2d9517-0fe6-48ea-b09c-3c5ae4a3e7dc"
|
|
|
|
Name : www.myo365.site
|
|
VerifiedPublisher : Gerenios Oy
|
|
WebSite : www.gerenios.com
|
|
Created : 10/26/2017
|
|
TermsOfService :
|
|
PrivacyStatement :
|
|
Logo : https://secure.aadcdn.microsoftonline-p.com/c1c6b6c8-okmfqodscgr7krbq5-p48zooio1tqm9g2zcpryoikta/appbranding/ppgci70
|
|
wmk0edve-emzqa3tqk03sidrimjcehxhp-c/1033/bannerlogo?ts=636706112039062792
|
|
InDifferentTenant : True
|
|
Scopes : {@{label=Sign you in and read your profile; description=Allows you to sign in to the app with your work account and
|
|
let the app read your profile. It also allows the app to read basic company information.; adminLabel=Sign in and rea
|
|
d user profile; adminDescription=Allows users to sign in to the app, and allows the app to read the profile of signe
|
|
d-in users. It also allow the app to read basic company information of signed-in users.}}
|
|
ReplyUrls : {https://www.gerenios.com}
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$ClientId,
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(Mandatory=$False)]
|
|
[System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$PfxFileName,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$PfxPassword,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$RefreshTokenCredential
|
|
)
|
|
Process
|
|
{
|
|
# Get the config using the provided credentials
|
|
$config = Get-AuthorizationCode -ClientId $ClientId -Tenant "common" -AppConsent -OTPSecretKey $OTPSecretKey -TAP $TAP -RefreshTokenCredential $RefreshTokenCredential -Certificate $Certificate -PfxFileName $PfxFileName -PfxPassword $PfxPassword -Credentials $Credentials
|
|
|
|
if($config -eq $null)
|
|
{
|
|
Throw "Unable to get app information"
|
|
}
|
|
|
|
$appInfo = [pscustomobject][ordered]@{
|
|
"Name" = $config.sAppName
|
|
"VerifiedPublisher" = $config.sAppVerifiedPublisherName
|
|
"WebSite" = $config.sAppWebsite
|
|
"Created" = $config.sAppCreatedDate
|
|
#"Settings" = $config.urlAppSettings
|
|
"TermsOfService" = $config.urlAppTermsOfService
|
|
"PrivacyStatement" = $config.urlAppPrivacyStatement
|
|
"Logo" = $config.urlAppLogo
|
|
"InDifferentTenant" = $config.fAppInDifferentTenant
|
|
"Scopes" = $config.arrScopes
|
|
"ReplyUrls" = $config.arrAppReplyUrls
|
|
}
|
|
|
|
if([string]::IsNullOrEmpty($appInfo.Name))
|
|
{
|
|
Write-Warning "No information returned, maybe app is already consented?"
|
|
}
|
|
else
|
|
{
|
|
return $appInfo
|
|
}
|
|
}
|
|
}
|
|
|
|
# Dec 12th 2024
|
|
# Returns ESTSAUTH cookies
|
|
function Get-ESTSAUTHCookie
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Returns ESTSAUTH or ESTSAUTHPERSISTENT cookie
|
|
|
|
.DESCRIPTION
|
|
Returns ESTSAUTH or ESTSAUTHPERSISTENT cookie
|
|
|
|
.PARAMETER Persistent
|
|
Get ESTSAUTHPERSISTENT cookie
|
|
|
|
.Example
|
|
PS C:\>$ESTSAUTH = Get-AADIntESTSAUTHCookie
|
|
PS C:\>Get-AADIntAccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "https://graph.windows.net" -ESTSAUTH $ESTSAUTH
|
|
|
|
.Example
|
|
PS C:\>$ESTSAUTH = Get-AADIntESTSAUTHCookie -Persistent
|
|
PS C:\>Get-AADIntAccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "https://graph.windows.net" -ESTSAUTH $ESTSAUTH
|
|
|
|
.Example
|
|
PS C:\>$ESTSAUTH = Get-AADIntESTSAUTHCookie -Persistent -ForceMFA
|
|
PS C:\>Get-AADIntAccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "https://graph.windows.net" -ESTSAUTH $ESTSAUTH
|
|
#>
|
|
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Resource = "https://graph.windows.net",
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$ClientId = "1b730954-1685-4b74-9bfd-dac224a7b894",
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Tenant = "Common",
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$ForceMFA,
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$ForceNGCMFA,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$RefreshTokenCredential,
|
|
[Parameter(Mandatory=$False)]
|
|
[System.Management.Automation.PSCredential]$Credentials,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$OTPSecretKey,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$TAP,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$RedirectURI,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$SubScope,
|
|
[Parameter(Mandatory=$False)]
|
|
[switch]$Persistent
|
|
)
|
|
Process
|
|
{
|
|
# Set AMR values as needed
|
|
$amr = $null
|
|
if($ForceMFA)
|
|
{
|
|
$amr = "mfa"
|
|
}
|
|
elseif($ForceNGCMFA)
|
|
{
|
|
$amr = "ngcmfa"
|
|
}
|
|
|
|
Get-AuthorizationCode -Resource $Resource -ClientId $ClientId -Tenant $Tenant -AMR $amr -RefreshTokenCredential $RefreshTokenCredential -Credentials $Credentials -OTPSecretKey $OTPSecretKey -TAP $TAP -RedirectURI $RedirectURI -SubScope $SubScope -DumpESTSAUTH -KMSI $Persistent
|
|
}
|
|
} |