/// <summary> /// Tries to get a token for the provided audience /// </summary> /// <param name="tokenAudience">Audience to try to get a token for</param> /// <param name="orRoles">The specific roles to request access to (i.e. Group.ReadWrite.All). Optional, will use default groups assigned to clientId if not specified.</param> /// <returns><see cref="GenericToken"/> for the audience or NULL if unable to retrieve a token for the audience on the current connection</returns> internal GenericToken TryGetToken(TokenAudience tokenAudience, AzureEnvironment azureEnvironment, string[] orRoles = null, string[] andRoles = null, TokenType tokenType = TokenType.All) { GenericToken token = null; switch (tokenAudience) { case TokenAudience.MicrosoftGraph: if (ConnectionMethod == ConnectionMethod.DeviceLogin || ConnectionMethod == ConnectionMethod.GraphDeviceLogin) { var officeManagementApiScopes = Enum.GetNames(typeof(OfficeManagementApiPermission)).Select(s => s.Replace("_", ".")).Intersect(Scopes).ToArray(); // Take the remaining scopes and try requesting them from the Microsoft Graph API var scopes = Scopes.Except(officeManagementApiScopes).ToArray(); token = GraphToken.AcquireApplicationTokenDeviceLogin(PnPConnection.PnPManagementShellClientId, scopes, DeviceLoginCallback(null, false), AzureEnvironment); } else { if (!string.IsNullOrEmpty(Tenant)) { if (Certificate != null) { token = GraphToken.AcquireApplicationToken(Tenant, ClientId, Certificate, AzureEnvironment); } else if (ClientSecret != null) { token = GraphToken.AcquireApplicationToken(Tenant, ClientId, ClientSecret, AzureEnvironment); } else if (Scopes != null) { var officeManagementApiScopes = Enum.GetNames(typeof(OfficeManagementApiPermission)).Select(s => s.Replace("_", ".")).Intersect(Scopes).ToArray(); // Take the remaining scopes and try requesting them from the Microsoft Graph API var scopes = Scopes.Except(officeManagementApiScopes).ToArray(); if (scopes.Length > 0) { token = PSCredential == null?GraphToken.AcquireApplicationTokenInteractive(PnPManagementShellClientId, scopes, azureEnvironment) : GraphToken.AcquireDelegatedTokenWithCredentials(PnPManagementShellClientId, scopes, PSCredential.UserName, PSCredential.Password, azureEnvironment); } else { throw new PSSecurityException($"Access to {tokenAudience} failed because you did not connect with any permission scopes related to this service (for instance 'Group.Read.All')."); } } } } break; case TokenAudience.OfficeManagementApi: if (!string.IsNullOrEmpty(Tenant)) { if (Certificate != null) { token = OfficeManagementApiToken.AcquireApplicationToken(Tenant, ClientId, Certificate, AzureEnvironment); } else if (ClientSecret != null) { token = OfficeManagementApiToken.AcquireApplicationToken(Tenant, ClientId, ClientSecret, AzureEnvironment); } else if (Scopes != null) { var scopes = Enum.GetNames(typeof(OfficeManagementApiPermission)).Select(s => s.Replace("_", ".")).Intersect(Scopes).ToArray(); // Take the remaining scopes and try requesting them from the Microsoft Graph API if (scopes.Length > 0) { token = PSCredential == null?OfficeManagementApiToken.AcquireApplicationTokenInteractive(PnPManagementShellClientId, scopes, azureEnvironment) : OfficeManagementApiToken.AcquireDelegatedTokenWithCredentials(PnPManagementShellClientId, scopes, PSCredential.UserName, PSCredential.Password, azureEnvironment); } else { throw new PSSecurityException($"Access to {tokenAudience} failed because you did not connect with any permission scopes related to this service (for instance 'ServiceHealth.Read')."); } } } break; case TokenAudience.SharePointOnline: // This is not a token type we can request on demand return(null); } if (token != null) { var validationResults = ValidateTokenForPermissions(token, tokenAudience, orRoles, andRoles, tokenType); if (!validationResults.valid) { throw new PSSecurityException($"Access to {tokenAudience} failed because the app registration {ClientId} in tenant {Tenant} is not granted {validationResults.message}"); } return(token); } // Didn't have a token yet and unable to retrieve one return(null); }
/// <summary> /// Connect using the parameter set AADWITHSCOPE /// </summary> /// <param name="credentials">Credentials to authenticate with for delegated access or NULL for application permissions</param> /// <returns>PnPConnection based on the parameters provided in the parameter set</returns> private PnPConnection ConnectAadWithScope(PSCredential credentials, AzureEnvironment azureEnvironment) { // Filter out the scopes for the Microsoft Office 365 Management API var officeManagementApiScopes = Enum.GetNames(typeof(OfficeManagementApiPermission)).Select(s => s.Replace("_", ".")).Intersect(Scopes).ToArray(); // Take the remaining scopes and try requesting them from the Microsoft Graph API var graphScopes = Scopes.Except(officeManagementApiScopes).ToArray(); PnPConnection connection = null; // If we have Office 365 scopes, get a token for those first if (officeManagementApiScopes.Length > 0) { var officeManagementApiToken = credentials == null?OfficeManagementApiToken.AcquireApplicationTokenDeviceLogin(PnPConnection.PnPManagementShellClientId, officeManagementApiScopes, PnPConnection.DeviceLoginCallback(this.Host, true), azureEnvironment) : OfficeManagementApiToken.AcquireDelegatedTokenWithCredentials(PnPConnection.PnPManagementShellClientId, officeManagementApiScopes, credentials.UserName, credentials.Password); connection = PnPConnection.GetConnectionWithToken(officeManagementApiToken, TokenAudience.OfficeManagementApi, InitializationType.InteractiveLogin, credentials, disableTelemetry: NoTelemetry.ToBool()); } // If we have Graph scopes, get a token for it if (graphScopes.Length > 0) { var graphToken = credentials == null?GraphToken.AcquireApplicationTokenDeviceLogin(PnPConnection.PnPManagementShellClientId, graphScopes, PnPConnection.DeviceLoginCallback(this.Host, true), azureEnvironment) : GraphToken.AcquireDelegatedTokenWithCredentials(PnPConnection.PnPManagementShellClientId, graphScopes, credentials.UserName, credentials.Password, AzureEnvironment); // If there's a connection already, add the AAD token to it, otherwise set up a new connection with it if (connection != null) { //connection.AddToken(TokenAudience.MicrosoftGraph, graphToken); } else { connection = PnPConnection.GetConnectionWithToken(graphToken, TokenAudience.MicrosoftGraph, InitializationType.InteractiveLogin, credentials, disableTelemetry: NoTelemetry.ToBool()); } } connection.Scopes = Scopes; return(connection); }