mirror of
https://github.com/Gerenios/AADInternals
synced 2026-06-08 11:09:38 +00:00
unknown
624 lines
24 KiB
PowerShell
624 lines
24 KiB
PowerShell
# This file contains functions for Microsoft App Proxy
|
|
|
|
Add-Type -AssemblyName System.Web
|
|
|
|
# Registers App proxy agent to the Azure AD
|
|
# Apr 2nd 2020
|
|
# May 5th 2022: Added UpdateTrust
|
|
function Register-ProxyAgent
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Registers a new MS App Proxy agent to Azure AD
|
|
|
|
.DESCRIPTION
|
|
Registers a new MS App Proxy agent to Azure AD. Currently Sync and PTA agents are supported.
|
|
|
|
.PARAMETER MachineName
|
|
Machine name used to register the proxy agent
|
|
|
|
.PARAMETER AgentType
|
|
Type of the proxy agent. One of "PTA","Sync"
|
|
|
|
.PARAMETER AgentGroup
|
|
The Agent group where to add the new agent.
|
|
|
|
.PARAMETER UpdateTrust
|
|
Instead of register a new agent, updates the trust of existing one. As a result, a new proxy certificate is created.
|
|
|
|
.PARAMETER Bootstrap
|
|
Filename of existing bootstrap configuration file.
|
|
|
|
.PARAMETER PfxFileName
|
|
The name of an existing proxy agent certificate used to update trust.
|
|
|
|
.PARAMETER PfxPassword
|
|
Password of the existing proxy agent certificate.
|
|
|
|
.Example
|
|
$pt=Get-AADIntAccessTokenForPTA
|
|
PS C:\>Register-AADIntProxyAgent -AccessToken $pt -MachineName server1.company.com -AgentType PTA -FileName server1-pta.pfx
|
|
|
|
.Example
|
|
$pt=Get-AADIntAccessTokenForPTA
|
|
PS C:\>Register-AADIntProxyAgent -AccessToken $pt -MachineName server2.company.com -AgentType Sync -FileName server2-sync.pfx
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$MachineName,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$FileName,
|
|
[Parameter(Mandatory=$True)]
|
|
[Validateset("PTA","Sync")]
|
|
[String]$AgentType,
|
|
[Parameter(Mandatory=$False)]
|
|
$AgentGroup,
|
|
[Parameter(Mandatory=$False)]
|
|
[bool]$UpdateTrust,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$Bootstrap,
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$PfxFileName,
|
|
[Parameter(Mandatory=$False)]
|
|
[string]$PfxPassword
|
|
|
|
)
|
|
Begin
|
|
{
|
|
$AgentInfo=@{
|
|
"PTA"= @{
|
|
"FeatureString" = "PassthroughAuthentication"
|
|
"UserAgent" = "PassthroughAuthenticationConnector/1.5.643.0"
|
|
|
|
}
|
|
"Sync"= @{
|
|
"FeatureString" = "SyncFabric"
|
|
"UserAgent" = "SyncFabricConnector/1.1.96.0"
|
|
|
|
}
|
|
}
|
|
}
|
|
Process
|
|
{
|
|
if($UpdateTrust)
|
|
{
|
|
# Load the old certificate
|
|
$cert = Load-Certificate -FileName $PfxFileName -Password $PfxPassword -Exportable
|
|
|
|
$tenantId = $cert.Subject.Split("=")[1]
|
|
}
|
|
else
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://proxy.cloudwebappproxy.net/registerapp" -ClientId "cb1056e2-e479-49de-ae31-7812af012ed8"
|
|
$tenantId = Get-TenantID -AccessToken $AccessToken
|
|
}
|
|
|
|
# Set some variables
|
|
$OSLanguage="1033"
|
|
$OSLocale="0409"
|
|
$OSSku="8"
|
|
$OSVersion="10.0.17763"
|
|
|
|
# Create a private key and do something with it to get it stored
|
|
$rsa=[System.Security.Cryptography.RSA]::Create(2048)
|
|
|
|
# Initialize the Certificate Signing Request object
|
|
$CN="" # The name doesn't matter
|
|
$req = [System.Security.Cryptography.X509Certificates.CertificateRequest]::new($CN, $rsa, [System.Security.Cryptography.HashAlgorithmName]::SHA256,[System.Security.Cryptography.RSASignaturePadding]::Pkcs1)
|
|
|
|
if($AgentType -eq "PTA")
|
|
{
|
|
# Key usage
|
|
$req.CertificateExtensions.Add([System.Security.Cryptography.X509Certificates.X509KeyUsageExtension]::new([System.Security.Cryptography.X509Certificates.X509KeyUsageFlags]::DigitalSignature -bor [System.Security.Cryptography.X509Certificates.X509KeyUsageFlags]::NonRepudiation -bor [System.Security.Cryptography.X509Certificates.X509KeyUsageFlags]::KeyEncipherment -bor [System.Security.Cryptography.X509Certificates.X509KeyUsageFlags]::DataEncipherment, $false))
|
|
# TLS Web client authentication
|
|
$oidCollection = [System.Security.Cryptography.OidCollection]::new()
|
|
$oidCollection.Add([System.Security.Cryptography.Oid]::new("1.3.6.1.5.5.7.3.2")) | Out-Null
|
|
$req.CertificateExtensions.Add([System.Security.Cryptography.X509Certificates.X509EnhancedKeyUsageExtension]::new($oidCollection, $true))
|
|
|
|
|
|
# Add the public Key to the request
|
|
$req.CertificateExtensions.Add([System.Security.Cryptography.X509Certificates.X509SubjectKeyIdentifierExtension]::new($req.PublicKey,$false))
|
|
|
|
# Create the signing request
|
|
$csr=$req.CreateSigningRequest()
|
|
|
|
}
|
|
elseif($AgentType -eq "Sync")
|
|
{
|
|
# This must be done this way cause MS CSR classes doesn't support attributes :(
|
|
$csr = NewCSRforSync -MachineName $MachineName -PublicKey $req.PublicKey.EncodedKeyValue.RawData
|
|
}
|
|
|
|
$b64Csr=[convert]::ToBase64String($csr)
|
|
|
|
# Create the request body
|
|
if($UpdateTrust)
|
|
{
|
|
if($Bootstrap -and (Test-Path $Bootstrap))
|
|
{
|
|
Write-Verbose "Loading bootstrap from $Bootstrap"
|
|
[xml]$config = Get-Content -Path $Bootstrap -Encoding UTF8
|
|
}
|
|
else
|
|
{
|
|
Write-Verbose "Getting bootstrap using $($cert.Thumbprint) as $MachineName"
|
|
[xml]$config = Get-BootstrapConfiguration -Certificate $cert -MachineName $MachineName
|
|
}
|
|
|
|
if(!$config)
|
|
{
|
|
Write-Error "Could not load bootstrap!"
|
|
return
|
|
}
|
|
|
|
$trustEndpoint = $config.BootstrapResponse.TrustRenewEndpoint
|
|
|
|
$body=@"
|
|
<TrustRenewalRequest xmlns="http://schemas.datacontract.org/2004/07/Microsoft.ApplicationProxy.Common.Registration.TrustRenewal" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
|
|
<Base64Csr xmlns="http://schemas.datacontract.org/2004/07/Microsoft.ApplicationProxy.Common.Registration">$b64Csr
|
|
</Base64Csr>
|
|
<TrustRenewalRequestSettings>
|
|
<SystemSettingsInformation i:type="a:SystemSettings" xmlns="http://schemas.datacontract.org/2004/07/Microsoft.ApplicationProxy.Common.RegistrationCommons" xmlns:a="http://schemas.datacontract.org/2004/07/Microsoft.ApplicationProxy.Common.Utilities.SystemSettings">
|
|
<a:MachineName>$machineName</a:MachineName>
|
|
<a:OsLanguage>$OSLanguage</a:OsLanguage>
|
|
<a:OsLocale>$OSLocale</a:OsLocale>
|
|
<a:OsSku>$OSSku</a:OsSku>
|
|
<a:OsVersion>$OSVersion</a:OsVersion>
|
|
</SystemSettingsInformation>
|
|
<ConnectorVersion>1.5.2482.0</ConnectorVersion>
|
|
</TrustRenewalRequestSettings>
|
|
</TrustRenewalRequest>
|
|
"@
|
|
# Renew trust and get the certificate
|
|
$response = Invoke-RestMethod -UseBasicParsing -Uri "$trustEndPoint/RenewTrustCertificate" -Method Post -Body $body -Headers @{"Content-Type"="application/xml; charset=utf-8"} -Certificate $cert
|
|
|
|
if($response.TrustRenewalResult.IsSuccessful.'#text' -eq "true")
|
|
{
|
|
# Get the certificate
|
|
$b64Cert = $response.TrustRenewalResult.Certificate.'#text'
|
|
}
|
|
else
|
|
{
|
|
# Something went wrong
|
|
Write-Error $response.TrustRenewalResult.ErrorMessage.'#text'
|
|
}
|
|
}
|
|
else
|
|
{
|
|
$body=@"
|
|
<RegistrationRequest xmlns="http://schemas.datacontract.org/2004/07/Microsoft.ApplicationProxy.Common.Registration" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
|
|
<Base64Csr>$b64Csr
|
|
</Base64Csr>
|
|
<AuthenticationToken>$AccessToken</AuthenticationToken>
|
|
<Base64Pkcs10Csr i:nil="true"/>
|
|
<Feature>ApplicationProxy</Feature>
|
|
<FeatureString>$($AgentInfo[$AgentType]["FeatureString"])</FeatureString>
|
|
<RegistrationRequestSettings>
|
|
<SystemSettingsInformation i:type="a:SystemSettings" xmlns="http://schemas.datacontract.org/2004/07/Microsoft.ApplicationProxy.Common.RegistrationCommons" xmlns:a="http://schemas.datacontract.org/2004/07/Microsoft.ApplicationProxy.Common.Utilities.SystemSettings">
|
|
<a:MachineName>$machineName</a:MachineName>
|
|
<a:OsLanguage>$OSLanguage</a:OsLanguage>
|
|
<a:OsLocale>$OSLocale</a:OsLocale>
|
|
<a:OsSku>$OSSku</a:OsSku>
|
|
<a:OsVersion>$OSVersion</a:OsVersion>
|
|
</SystemSettingsInformation>
|
|
<PSModuleVersion>1.5.643.0</PSModuleVersion>
|
|
<SystemSettings i:type="a:SystemSettings" xmlns:a="http://schemas.datacontract.org/2004/07/Microsoft.ApplicationProxy.Common.Utilities.SystemSettings">
|
|
<a:MachineName>$machineName</a:MachineName>
|
|
<a:OsLanguage>$OSLanguage</a:OsLanguage>
|
|
<a:OsLocale>$OSLocale</a:OsLocale>
|
|
<a:OsSku>$OSSku</a:OsSku>
|
|
<a:OsVersion>$OSVersion</a:OsVersion>
|
|
</SystemSettings>
|
|
</RegistrationRequestSettings>
|
|
<TenantId>$tenantId</TenantId>
|
|
<UserAgent>$($AgentInfo[$AgentType]["UserAgent"])</UserAgent>
|
|
</RegistrationRequest>
|
|
"@
|
|
# Register the app and get the certificate
|
|
$response = Invoke-RestMethod -UseBasicParsing -Uri "https://$tenantId.registration.msappproxy.net/register/RegisterConnector" -Method Post -Body $body -Headers @{"Content-Type"="application/xml; charset=utf-8"}
|
|
|
|
if($response.RegistrationResult.IsSuccessful -eq "true")
|
|
{
|
|
# Get the certificate
|
|
$b64Cert = $response.RegistrationResult.Certificate
|
|
}
|
|
else
|
|
{
|
|
# Something went wrong
|
|
Write-Error $response.RegistrationResult.ErrorMessage
|
|
}
|
|
}
|
|
|
|
if(![string]::IsNullOrEmpty($b64Cert))
|
|
{
|
|
|
|
# Convert certificate to byte array
|
|
$binCert = [convert]::FromBase64String($b64Cert)
|
|
|
|
# Create a new x509certificate
|
|
$cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($binCert,"",[System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::UserKeySet -band [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable)
|
|
|
|
# Get the instance Id (=Agent Id)
|
|
foreach($extension in $cert.Extensions)
|
|
{
|
|
if($extension.Oid.Value -eq "1.3.6.1.4.1.311.82.1")
|
|
{
|
|
$InstanceID = [guid]$extension.RawData
|
|
}
|
|
}
|
|
|
|
if([string]::IsNullOrEmpty($FileName))
|
|
{
|
|
$FileName = "$($MachineName)_$($tenantId)_$($InstanceID)_$($cert.Thumbprint).pfx"
|
|
}
|
|
|
|
# Store the private key so that it can be exported
|
|
$cspParameters = [System.Security.Cryptography.CspParameters]::new()
|
|
$cspParameters.ProviderName = "Microsoft Enhanced RSA and AES Cryptographic Provider"
|
|
$cspParameters.ProviderType = 24
|
|
$cspParameters.KeyContainerName ="AADInternals"
|
|
|
|
# Set the private key
|
|
$privateKey = [System.Security.Cryptography.RSACryptoServiceProvider]::new(2048,$cspParameters)
|
|
$privateKey.ImportParameters($rsa.ExportParameters($true))
|
|
$cert.PrivateKey = $privateKey
|
|
|
|
# Export the certificate to pfx
|
|
$binCert = $cert.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pfx)
|
|
Set-BinaryContent -Path $fileName -Value $binCert
|
|
|
|
# Remove the private key from the store
|
|
$privateKey.PersistKeyInCsp=$false
|
|
$privateKey.Clear()
|
|
|
|
|
|
|
|
if($UpdateTrust)
|
|
{
|
|
Write-Host "$AgentType Agent ($InstanceID) certificate renewed for $MachineName"
|
|
}
|
|
else
|
|
{
|
|
Write-Host "$AgentType Agent ($InstanceID) registered as $MachineName"
|
|
}
|
|
Write-Host "Certificate saved to $FileName"
|
|
|
|
# We need to register the agent to a group
|
|
if($AgentType -eq "Sync" -and [string]::IsNullOrEmpty($AgentGroup) -ne $true)
|
|
{
|
|
Add-ProxyAgentToGroup -AccessToken $AccessToken -Agent $InstanceID -Group $AgentGroup
|
|
}
|
|
}
|
|
|
|
|
|
|
|
}
|
|
}
|
|
|
|
# Gets list of publishing agents
|
|
# Apr 3rd 2020
|
|
function Get-ProxyAgents
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Shows the list of MS App Proxy agents
|
|
|
|
.DESCRIPTION
|
|
Shows the list of MS App Proxy authentication and provisioning agents
|
|
|
|
.Example
|
|
Get-AADIntProxyAgents | ft
|
|
|
|
id machineName externalIp status supportedPublishingTypes
|
|
-- ----------- ---------- ------ ------------------------
|
|
51f3afd9-685b-413a-aafa-bab0d556ea4b this.is.a.fake 67.35.155.73 active {authentication}
|
|
51a061a0-968d-48b8-951e-5ae9d9a0441f server1.company.com 93.188.31.116 inactive {authentication}
|
|
49c9ad46-c067-42f6-a678-dfd938c27789 server2.company.com 102.20.104.213 inactive {provisioning}
|
|
|
|
.Example
|
|
$pt=Get-AADIntAccessTokenForPTA
|
|
|
|
PS C:\>Get-AADIntProxyAgents -AccessToken $pt | pt
|
|
|
|
id machineName externalIp status supportedPublishingTypes
|
|
-- ----------- ---------- ------ ------------------------
|
|
51f3afd9-685b-413a-aafa-bab0d556ea4b this.is.a.fake 67.35.155.73 active {authentication}
|
|
51a061a0-968d-48b8-951e-5ae9d9a0441f server1.company.com 93.188.31.116 inactive {authentication}
|
|
49c9ad46-c067-42f6-a678-dfd938c27789 server2.company.com 102.20.104.213 inactive {provisioning}
|
|
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken
|
|
)
|
|
Begin
|
|
{
|
|
$publishingTypes = @( # Roles that can access the agent
|
|
#"appProxy" # ApplicationAdmin, GlobalAdmin
|
|
"authentication" # GlobalAdmin
|
|
"provisioning" # GlobalAdmin
|
|
"exchangeOnline" # GlobalAdmin
|
|
#"intunePfx" # GlobalAdmin
|
|
#"oflineDomainJoin" # GlobalAdmin
|
|
"adAdministration" # DirSyncAdmin, GlobalAdmin
|
|
#"unknownFutureValue" #
|
|
)
|
|
}
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://proxy.cloudwebappproxy.net/registerapp" -ClientId "cb1056e2-e479-49de-ae31-7812af012ed8"
|
|
|
|
# Get the tenant id and instance id from the certificate
|
|
$TenantId = Get-TenantID -AccessToken $AccessToken
|
|
|
|
$headers = @{
|
|
"Authorization" = "Bearer $AccessToken"
|
|
"x-ms-gateway-serviceRoot" =""
|
|
}
|
|
|
|
|
|
foreach($type in $publishingTypes)
|
|
{
|
|
$agents = Invoke-RestMethod -UseBasicParsing -Uri "https://$TenantId.admin.msappproxy.net/onPremisesPublishingProfiles('$type')/agents" -Method Get -Headers $headers -ErrorAction SilentlyContinue
|
|
|
|
# Return
|
|
if($agents)
|
|
{
|
|
$agents.value
|
|
}
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
# Gets list of agent groups
|
|
# Apr 6th 2020
|
|
function Get-ProxyAgentGroups
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Lists MS App Proxy agent groups
|
|
|
|
.DESCRIPTION
|
|
Lists MS App Proxy agent groups
|
|
|
|
.Example
|
|
Get-AADIntAgentProxyGroups
|
|
|
|
TenantId : ea664074-37dd-4797-a676-b0cf6fdafcd4
|
|
ConfigurationDisplayName : company.com
|
|
ConfigurationResourceName : company.com
|
|
ConfigurationPublishingType : provisioning
|
|
id : 4b6ffe82-bfe2-4357-814c-09da95399da7
|
|
displayName : Group-company.com-42660f4a-9e66-4a08-ac17-2a2e0d8b993e
|
|
publishingType : provisioning
|
|
isDefault : False
|
|
|
|
.Example
|
|
$pt=Get-AADIntAccessTokenForPTA
|
|
|
|
PS C:\>Get-AADIntProxyGroups -AccessToken $pt
|
|
|
|
TenantId : ea664074-37dd-4797-a676-b0cf6fdafcd4
|
|
ConfigurationDisplayName : company.com
|
|
ConfigurationResourceName : company.com
|
|
ConfigurationPublishingType : provisioning
|
|
id : 4b6ffe82-bfe2-4357-814c-09da95399da7
|
|
displayName : Group-company.com-42660f4a-9e66-4a08-ac17-2a2e0d8b993e
|
|
publishingType : provisioning
|
|
isDefault : False
|
|
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$AccessToken
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://proxy.cloudwebappproxy.net/registerapp" -ClientId "cb1056e2-e479-49de-ae31-7812af012ed8"
|
|
|
|
# Get the tenant id and instance id from the certificate
|
|
$TenantId = Get-TenantID -AccessToken $AccessToken
|
|
|
|
$headers = @{
|
|
"Authorization" = "Bearer $AccessToken"
|
|
"x-ms-gateway-serviceRoot" =""
|
|
}
|
|
|
|
$response = Invoke-RestMethod -UseBasicParsing -Uri "https://$TenantId.admin.msappproxy.net/onPremisesPublishingProfiles('provisioning')/agentGroups?`$expand=agents" -Method Get -Headers $headers
|
|
|
|
# return
|
|
$response.value
|
|
}
|
|
}
|
|
|
|
# Gets the list of proxy configurations
|
|
#function Get-ProxyConfigurations
|
|
|
|
# Creates a new proxy agent group
|
|
# Apr 6th 2020
|
|
function New-ProxyAgentGroup
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Creates an MS App Proxy agent group
|
|
|
|
.DESCRIPTION
|
|
Creates an MS App Proxy agent group
|
|
|
|
.Example
|
|
Get-AADIntAgentProxyGroups
|
|
|
|
TenantId : ea664074-37dd-4797-a676-b0cf6fdafcd4
|
|
ConfigurationDisplayName : company.com
|
|
ConfigurationResourceName : company.com
|
|
ConfigurationPublishingType : provisioning
|
|
id : 4b6ffe82-bfe2-4357-814c-09da95399da7
|
|
displayName : Group-company.com-42660f4a-9e66-4a08-ac17-2a2e0d8b993e
|
|
publishingType : provisioning
|
|
isDefault : False
|
|
|
|
.Example
|
|
$pt=Get-AADIntAccessTokenForPTA
|
|
|
|
PS C:\>Get-AADIntProxyGroups -AccessToken $pt
|
|
|
|
TenantId : ea664074-37dd-4797-a676-b0cf6fdafcd4
|
|
ConfigurationDisplayName : company.com
|
|
ConfigurationResourceName : company.com
|
|
ConfigurationPublishingType : provisioning
|
|
id : 4b6ffe82-bfe2-4357-814c-09da95399da7
|
|
displayName : Group-company.com-42660f4a-9e66-4a08-ac17-2a2e0d8b993e
|
|
publishingType : provisioning
|
|
isDefault : False
|
|
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$DisplayName,
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$ConfigurationDisplayName,
|
|
[Parameter(Mandatory=$True)]
|
|
[String]$ConfigurationResourceName
|
|
)
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://proxy.cloudwebappproxy.net/registerapp" -ClientId "cb1056e2-e479-49de-ae31-7812af012ed8"
|
|
|
|
# Get the tenant id and instance id from the certificate
|
|
$TenantId = Get-TenantID -AccessToken $AccessToken
|
|
|
|
$headers = @{
|
|
"Authorization" = "Bearer $AccessToken"
|
|
"x-ms-gateway-serviceRoot" =""
|
|
"Content-Type" = "application/json"
|
|
}
|
|
|
|
# First, create the agent group with the given name
|
|
$Body = "{""displayName"":""$DisplayName""}"
|
|
$response = Invoke-RestMethod -UseBasicParsing -Uri "https://$TenantId.admin.msappproxy.net/onPremisesPublishingProfiles('provisioning')/agentGroups" -Method POST -Headers $headers -Body $Body
|
|
|
|
$Body = "{""displayName"":""$ConfigurationDisplayName"",""resourceName"":""$ConfigurationResourceName"",""agentGroups"":[{""id"":""$($response.id)""}]}"
|
|
$response2 = Invoke-RestMethod -UseBasicParsing -Uri "https://$TenantId.admin.msappproxy.net/onPremisesPublishingProfiles('provisioning')/publishedResources" -Method POST -Headers $headers -Body $Body
|
|
|
|
# Extract the information and create the return value
|
|
$attributes=[ordered]@{}
|
|
|
|
$attributes["id"]=$response.id
|
|
$attributes["displayName"]=$response.displayName
|
|
$attributes["publishingType"]=$response.publishingType
|
|
$attributes["isDefault"]=$response.isDefault
|
|
|
|
$attributes["ConfigurationId"]=$response2.id
|
|
$attributes["ConfigurationDisplayName"]=$response2.displayName
|
|
$attributes["ConfigurationResourceName"]=$response2.resourceName
|
|
$attributes["ConfigurationPublishingType"]=$response2.publishingType
|
|
|
|
# return
|
|
New-Object PSObject -Property $attributes
|
|
}
|
|
}
|
|
|
|
# Adds the given agent to given group
|
|
# Apr 7th 2020
|
|
function Add-ProxyAgentToGroup
|
|
{
|
|
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$False)]
|
|
[String]$AccessToken,
|
|
[Parameter(Mandatory=$True)]
|
|
[guid]$Agent,
|
|
[Parameter(Mandatory=$True)]
|
|
[guid]$Group
|
|
)
|
|
|
|
Process
|
|
{
|
|
# Get from cache if not provided
|
|
$AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://proxy.cloudwebappproxy.net/registerapp" -ClientId "cb1056e2-e479-49de-ae31-7812af012ed8"
|
|
|
|
# Get the tenant id and instance id from the certificate
|
|
$TenantId = Get-TenantID -AccessToken $AccessToken
|
|
|
|
$body="{""@odata.id"":""https://$TenantId.admin.msappproxy.net:443/onPremisesPublishingProfiles('provisioning')/agentGroups('$($Group.toString())')""}"
|
|
|
|
$headers = @{
|
|
"Authorization" = "Bearer $AccessToken"
|
|
"x-ms-gateway-serviceRoot" =""
|
|
"Content-Type" = "application/json"
|
|
}
|
|
|
|
Invoke-RestMethod -UseBasicParsing -Uri "https://$TenantId.admin.msappproxy.net/onPremisesPublishingProfiles('provisioning')/agents('$($Agent.toString())')/agentGroups/`$ref" -Method Post -Headers $headers -Body $body
|
|
|
|
Write-Host "Agent ($($Agent.toString())) added to group ($($Group.toString()))"
|
|
}
|
|
}
|
|
|
|
# Export proxy agent bootstraps using the given certificates
|
|
# Nov 1st 2022
|
|
function Export-ProxyAgentBootstraps
|
|
{
|
|
<#
|
|
.SYNOPSIS
|
|
Export bootstraps of the given certificates.
|
|
|
|
.DESCRIPTION
|
|
Export boostraps of the given certificates. Uses the FQDN of the current computer as MachineName.
|
|
The filename of the bootstrap is same than the certificate with .xml extension
|
|
|
|
.Example
|
|
Export-AADIntProxyAgentBootstraps -Certificates PTA01.company.com_ea664074-37dd-4797-a676-b0cf6fdafcd4_4b6ffe82-bfe2-4357-814c-09da95399da7_A3457AEAE25D4C513BCF37CB138628772BE1B52.pfx
|
|
|
|
Bootstrap saved to: PTA01.company.com_ea664074-37dd-4797-a676-b0cf6fdafcd4_4b6ffe82-bfe2-4357-814c-09da95399da7_A3457AEAE25D4C513BCF37CB138628772BE1B52.xml
|
|
#>
|
|
[cmdletbinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$True)]
|
|
[String[]]$Certificates
|
|
)
|
|
|
|
Process
|
|
{
|
|
foreach($fileName in $Certificates)
|
|
{
|
|
if(Test-Path $fileName)
|
|
{
|
|
try
|
|
{
|
|
$certificate = Load-Certificate -FileName $fileName -Exportable
|
|
|
|
# Sleep a sec to get the cert properly loaded
|
|
Start-Sleep -Seconds 1
|
|
|
|
$bootStrap = Get-BootstrapConfiguration -MachineName (Get-ComputerName -FQDN) -Certificate $certificate
|
|
|
|
if($bootstrap -eq $null)
|
|
{
|
|
Throw "Could not get bootstrap"
|
|
}
|
|
$bootStrapFileName = "$($fileName.Substring(0,$fileName.LastIndexOf(".")-1)).xml"
|
|
Set-Content $bootStrapFileName -Value $bootStrap
|
|
Write-Host "Bootstrap saved to: $bootStrapFileName"
|
|
}
|
|
catch
|
|
{
|
|
Write-Warning "Could not get bootstrap for $fileName"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
} |