Skip to content

Commit 0d1a30c

Browse files
author
Taofeek F. Obafemi-Babatunde
authored
Find-MgGraphPermission (#809)
1 parent d09dce7 commit 0d1a30c

16 files changed

+6395
-21
lines changed

‎.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -226,6 +226,8 @@ _pkginfo.txt
226226
ClientBin/
227227
~$*
228228
*~
229+
.#*
230+
*#
229231
*.dbmdl
230232
*.dbproj.schemaview
231233
*.jfm

‎samples/2-ConnectToGraph.ps1

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ Connect-Graph
66
# Try to Get-User
77
Get-MgUser
88

9+
# Search for delegated permissions related to sites
10+
Find-MgGraphPermission sites -PermissionType Delegated
11+
912
# Grant more permissions
1013
Connect-Graph -Scopes "User.Read","User.ReadWrite.All","Mail.ReadWrite",`
1114
"Directory.Read.All","Chat.ReadWrite", "People.Read", `
@@ -17,3 +20,6 @@ Connect-Graph -Scopes "User.Read","User.ReadWrite.All","Mail.ReadWrite",`
1720

1821
# Forget all access tokens
1922
Disconnect-Graph
23+
24+
# Launch detailed permissions documentation
25+
Get-Help Find-MgGraphPermission -Online

‎samples/9-Applications.ps1

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ $app3 = New-MgApplication -displayName "ImplicitWebApp" `
2626
}
2727

2828
# Create an registration for an ASP.NET Web App
29+
$scopeId_UserRead = Find-MgGraphPermission User.Read -ExactMatch -PermissionType Delegated | Select-Object -ExpandProperty Id
2930
$app = New-MgApplication -displayName "AspNetWebApp" `
3031
-Web @{
3132
RedirectUris = "https://localhost:5001/signin-oidc"; `
@@ -36,7 +37,7 @@ $app = New-MgApplication -displayName "AspNetWebApp" `
3637
-RequiredResourceAccess @{ ResourceAppId = "00000003-0000-0000-c000-000000000000"
3738
ResourceAccess = @(
3839
@{
39-
Id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"
40+
Id = $scopeId_UserRead
4041
Type = "Scope"
4142
}
4243
)
@@ -56,7 +57,7 @@ $createAppParams = @{
5657
ResourceAppId = "00000003-0000-0000-c000-000000000000"
5758
ResourceAccess = @(
5859
@{
59-
Id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"
60+
Id = $scopeId_UserRead
6061
Type = "Scope"
6162
}
6263
)
@@ -76,18 +77,36 @@ $Certificate = Get-ChildItem -Path "Cert:\CurrentUser\My\$CertificateThumbprint"
7677
# Graph resource Id
7778
$GraphResourceId = "00000003-0000-0000-c000-000000000000"
7879

79-
# Graph permissions constants
80-
$UserReadAll = @{ Id = "df021288-bdef-4463-88db-98f22de89214"; Type = "Role" }
81-
$GroupReadAll = @{ Id = "5b567255-7703-4780-807c-7be8301ae99b"; Type = "Role" }
82-
$MailboxSettingsRead = @{ Id = "40f97065-369a-49f4-947c-6a255697ae91"; Type = "Role" }
83-
$MailSend = @{ Id = "b633e1c5-b582-4048-a93e-9f11b44c7e96"; Type = "Role" }
80+
# Show friendly Graph permission names given their unique identifiers
81+
Find-MgGraphPermission | Where-Object Id -in @(
82+
'df021288-bdef-4463-88db-98f22de89214'
83+
'5b567255-7703-4780-807c-7be8301ae99b'
84+
'40f97065-369a-49f4-947c-6a255697ae91'
85+
'b633e1c5-b582-4048-a93e-9f11b44c7e96'
86+
)
8487

8588
# Create an application registration.
89+
$requiredPermissions = 'Group.Read.All', 'Mail.Send', 'MailboxSettings.Read', 'User.Read.All' |
90+
Find-MgGraphPermission -ExactMatch -PermissionType Application
91+
92+
$resourceAccess = foreach ( $permission in $requiredPermissions ) {
93+
@{ Id = $permission.Id; Type = 'Role' }
94+
}
95+
8696
$AppName = "ScriptedGraphPSApp"
8797
$app4 = New-MgApplication -"ClientCredentialApp" $AppName `
8898
-SignInAudience "AzureADMyOrg" `
89-
-RequiredResourceAccess @{ ResourceAppId = $graphResourceId; ResourceAccess = $UserReadAll, $GroupReadAll, $MailboxSettingsRead, $MailSend } `
99+
-RequiredResourceAccess @{ ResourceAppId = $graphResourceId; ResourceAccess = $resourceAccess } `
90100
-KeyCredentials @(@{ Type = "AsymmetricX509Cert"; Usage = "Verify"; Key= $Certificate.RawData })
91101

92102
# Create corresponding service principal.
93103
New-MgServicePrincipal -AppId $app4.AppId
104+
105+
# Show permissions assigned to the application in the organization
106+
# using friendly permission names instead of just the unique identifiers
107+
$servicePrincipal4 = Get-MgServicePrincipal -Filter "appId eq '$($app4.AppId)'"
108+
Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $servicePrincipal4.id |
109+
Select-Object appRoleId |
110+
Find-MgGraphPermission
111+
112+

‎src/Authentication/Authentication/Microsoft.Graph.Authentication.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22
<PropertyGroup>
3-
<Version>1.6.0</Version>
3+
<Version>1.7.0</Version>
44
<LangVersion>7.1</LangVersion>
55
<TargetFramework>netstandard2.0</TargetFramework>
66
<OutputType>Library</OutputType>

‎src/Authentication/Authentication/Microsoft.Graph.Authentication.format.ps1xml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,5 +32,50 @@
3232
</TableRowEntries>
3333
</TableControl>
3434
</View>
35+
36+
<View>
37+
<Name>Permission</Name>
38+
<ViewSelectedBy>
39+
<TypeName>Microsoft.Graph.Custom.Permission</TypeName>
40+
</ViewSelectedBy>
41+
<GroupBy>
42+
<PropertyName>PermissionType</PropertyName>
43+
<Label>PermissionType</Label>
44+
</GroupBy>
45+
<TableControl>
46+
<TableHeaders>
47+
<TableColumnHeader>
48+
<Label>Id</Label>
49+
</TableColumnHeader>
50+
<TableColumnHeader>
51+
<Label>Consent</Label>
52+
</TableColumnHeader>
53+
<TableColumnHeader>
54+
<Label>Name</Label>
55+
</TableColumnHeader>
56+
<TableColumnHeader>
57+
<Label>Description</Label>
58+
</TableColumnHeader>
59+
</TableHeaders>
60+
<TableRowEntries>
61+
<TableRowEntry>
62+
<TableColumnItems>
63+
<TableColumnItem>
64+
<PropertyName>Id</PropertyName>
65+
</TableColumnItem>
66+
<TableColumnItem>
67+
<PropertyName>Consent</PropertyName>
68+
</TableColumnItem>
69+
<TableColumnItem>
70+
<PropertyName>Name</PropertyName>
71+
</TableColumnItem>
72+
<TableColumnItem>
73+
<PropertyName>Description</PropertyName>
74+
</TableColumnItem>
75+
</TableColumnItems>
76+
</TableRowEntry>
77+
</TableRowEntries>
78+
</TableControl>
79+
</View>
3580
</ViewDefinitions>
3681
</Configuration>

‎src/Authentication/Authentication/Microsoft.Graph.Authentication.nuspec

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?xml version="1.0"?>
22
<package>
33
<metadata>
4-
<version>1.4.2</version>
4+
<version>1.7.0</version>
55
<id>Microsoft.Graph.Authentication</id>
66
<description>Microsoft Graph PowerShell authentication module</description>
77
<authors>Microsoft</authors>
@@ -24,6 +24,7 @@
2424
<file src="artifacts\Microsoft.Graph.Authentication.Core.dll" />
2525
<file src="artifacts\Microsoft.Graph.Core.dll" />
2626
<file src="artifacts\StartupScripts\*" target="StartupScripts" />
27+
<file src="artifacts\custom\" target="custom" />
2728
<file src="artifacts\Dependencies\Newtonsoft.Json.dll" target="Dependencies" />
2829
<file src="artifacts\Dependencies\Microsoft.Graph.Auth.dll" target="Dependencies" />
2930
<file src="artifacts\Dependencies\Microsoft.IdentityModel.JsonWebTokens.dll" target="Dependencies" />

‎src/Authentication/Authentication/Microsoft.Graph.Authentication.psd1

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
#
44
# Generated by: Microsoft
55
#
6-
# Generated on: 3/12/2021
6+
# Generated on: 8/4/2021
77
#
88

99
@{
@@ -12,7 +12,7 @@
1212
RootModule = './Microsoft.Graph.Authentication.psm1'
1313

1414
# Version number of this module.
15-
ModuleVersion = '1.6.0'
15+
ModuleVersion = '1.7.0'
1616

1717
# Supported PSEditions
1818
CompatiblePSEditions = 'Core', 'Desktop'
@@ -63,13 +63,13 @@ DotNetFrameworkVersion = '4.7.2'
6363
# TypesToProcess = @()
6464

6565
# Format files (.ps1xml) to be loaded when importing this module
66-
FormatsToProcess = './Microsoft.Graph.Authentication.format.ps1xml'
66+
FormatsToProcess = 'Microsoft.Graph.Authentication.format.ps1xml'
6767

6868
# Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
6969
# NestedModules = @()
7070

7171
# Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
72-
FunctionsToExport = @()
72+
FunctionsToExport = 'Find-MgGraphPermission'
7373

7474
# Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export.
7575
CmdletsToExport = 'Connect-MgGraph', 'Disconnect-MgGraph', 'Get-MgContext',

‎src/Authentication/Authentication/Microsoft.Graph.Authentication.psm1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ $null = Import-Module -Name (Join-Path $PSScriptRoot 'Microsoft.Graph.Authentica
44

55
if (Test-Path -Path "$PSScriptRoot\StartupScripts" -ErrorAction Ignore)
66
{
7-
Get-ChildItem "$PSScriptRoot\StartupScripts" -ErrorAction Stop | ForEach-Object {
7+
Get-ChildItem "$PSScriptRoot\StartupScripts" -Filter *.ps1 -ErrorAction Stop | ForEach-Object {
88
. $_.FullName
99
}
1010
}

‎src/Authentication/Authentication/StartupScripts/ExportCustomCommands.ps1

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# ------------------------------------------------------------------------------
2+
# Copyright (c) Microsoft Corporation. All Rights Reserved. Licensed under the MIT License. See License in the project root for license information.
3+
# ------------------------------------------------------------------------------
4+
5+
# Load custom commands
6+
$customScriptCommandDirItem = Get-Item $PSScriptRoot -ErrorAction Ignore
7+
if ( $customScriptCommandDirItem ) {
8+
$customScriptCommandDir = join-path $customScriptCommandDirItem.FullName ../custom
9+
10+
Get-ChildItem $customScriptCommandDir -Filter *.ps1 -ErrorAction Stop | ForEach-Object {
11+
. $_.FullName
12+
}
13+
}
14+
15+
# Export custom script commands without removing the
16+
# binary cmdlets. Custom script commands are functions,
17+
# the cmdlets are.. cmdlets. We must explicitly specify
18+
# both functions and cmdlets at export; if only one of
19+
# these classes is specified, nothing of the other
20+
# class will be exported.
21+
Export-ModuleMember -Function * -Cmdlet *
22+

‎src/Authentication/Authentication/build-module.ps1

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -80,16 +80,21 @@ if ($LastExitCode -ne 0) {
8080

8181
# Ensure out directory exists and is clean.
8282
Remove-Item -Path $outDir -Recurse -ErrorAction Ignore
83-
New-Item -Path $outDir -ItemType Directory
84-
New-Item -Path $outDeps -ItemType Directory
85-
New-Item -Path $outCore -ItemType Directory
86-
New-Item -Path $outDesktop -ItemType Directory
83+
New-Item -Path $outDir -ItemType Directory | out-null
84+
New-Item -Path $outDeps -ItemType Directory | out-null
85+
New-Item -Path $outCore -ItemType Directory | out-null
86+
New-Item -Path $outDesktop -ItemType Directory | out-null
8787

8888
# Copy manifest.
8989
Copy-Item -Path "$cmdletsSrc/$ModulePrefix.$ModuleName.format.ps1xml" -Destination $outDir
9090
Copy-Item -Path "$cmdletsSrc/$ModulePrefix.$ModuleName.psm1" -Destination $outDir
9191
Copy-Item -Path "$cmdletsSrc/$ModulePrefix.$ModuleName.psd1" -Destination $outDir
92-
Copy-Item -Path "$cmdletsSrc/StartupScripts" -Recurse -Destination $outDir
92+
Copy-Item -Path "$cmdletsSrc/StartupScripts" -Filter *.ps1 -Recurse -Destination $outDir
93+
94+
# Copy custom commands
95+
96+
Copy-Item -Path "$cmdletsSrc/custom" -Filter *.ps1 -Recurse -Destination $outDir
97+
Copy-Item -Path "$cmdletsSrc/custom" -Filter *.json -Recurse -Destination $outDir -Force
9398

9499
# Core assemblies to include with cmdlets (Let PowerShell load them).
95100
$CoreAssemblies = @('Microsoft.Graph.Authentication.Core', 'Microsoft.Graph.Core')
@@ -114,4 +119,4 @@ Get-ChildItem -Path "$cmdletsSrc/bin/$Configuration/$netStandard/publish/" |
114119
Where-Object { -not $Deps.Contains($_.Name) -and $_.Extension -in $copyExtensions } |
115120
ForEach-Object { Copy-Item -Path $_.FullName -Destination $outDir }
116121

117-
Write-Host -ForegroundColor Green '-------------Done-------------'
122+
Write-Host -ForegroundColor Green '-------------Done-------------'

0 commit comments

Comments
 (0)