Workloads/Fabric.ps1
|
function Connect-MSCloudLoginFabric { [CmdletBinding()] param() $InformationPreference = 'SilentlyContinue' $ProgressPreference = 'SilentlyContinue' $source = 'Connect-MSCloudLoginFabric' if ($Script:MSCloudLoginConnectionProfile.Fabric.AuthenticationType -eq 'ServicePrincipalWithThumbprint') { Add-MSCloudLoginAssistantEvent -Message "Attempting to connect to Fabric using AAD App {$ApplicationID}" -Source $source try { Connect-MSCloudLoginFabricWithCertificateThumbprint $Script:MSCloudLoginConnectionProfile.Fabric.ConnectedDateTime = [System.DateTime]::Now.ToString() $Script:MSCloudLoginConnectionProfile.Fabric.Connected = $true $Script:MSCloudLoginConnectionProfile.Fabric.MultiFactorAuthentication = $false Add-MSCloudLoginAssistantEvent -Message "Successfully connected to Fabric using AAD App {$ApplicationID}" -Source $source } catch { throw $_ } } else { throw 'Specified authentication method is not supported.' } } function Connect-MSCloudLoginFabricWithCertificateThumbprint { [CmdletBinding()] param() $ProgressPreference = 'SilentlyContinue' $source = 'Connect-MSCloudLoginFabricWithCertificateThumbprint' Add-MSCloudLoginAssistantEvent -Message 'Attempting to connect to Fabric using CertificateThumbprint' -Source $source $tenantId = $Script:MSCloudLoginConnectionProfile.Fabric.TenantId try { $Certificate = Get-Item "Cert:\CurrentUser\My\$($Script:MSCloudLoginConnectionProfile.Fabric.CertificateThumbprint)" -ErrorAction SilentlyContinue if ($null -eq $Certificate) { Add-MSCloudLoginAssistantEvent 'Certificate not found in CurrentUser\My, trying LocalMachine\My' -Source $source $Certificate = Get-ChildItem "Cert:\LocalMachine\My\$($Script:MSCloudLoginConnectionProfile.Fabric.CertificateThumbprint)" -ErrorAction SilentlyContinue if ($null -eq $Certificate) { throw 'Certificate not found in LocalMachine\My nor CurrentUser\My' } } # Create base64 hash of certificate $CertificateBase64Hash = [System.Convert]::ToBase64String($Certificate.GetCertHash()) # Create JWT timestamp for expiration $StartDate = (Get-Date '1970-01-01T00:00:00Z' ).ToUniversalTime() $JWTExpirationTimeSpan = (New-TimeSpan -Start $StartDate -End (Get-Date).ToUniversalTime().AddMinutes(2)).TotalSeconds $JWTExpiration = [math]::Round($JWTExpirationTimeSpan, 0) # Create JWT validity start timestamp $NotBeforeExpirationTimeSpan = (New-TimeSpan -Start $StartDate -End ((Get-Date).ToUniversalTime())).TotalSeconds $NotBefore = [math]::Round($NotBeforeExpirationTimeSpan, 0) # Create JWT header $JWTHeader = @{ alg = 'RS256' typ = 'JWT' # Use the CertificateBase64Hash and replace/strip to match web encoding of base64 x5t = $CertificateBase64Hash -replace '\+', '-' -replace '/', '_' -replace '=' } # Create JWT payload $JWTPayLoad = @{ # What endpoint is allowed to use this JWT aud = "$($Script:MSCloudLoginConnectionProfile.Fabric.AuthorizationUrl)/$TenantId/oauth2/v2.0/token" # Expiration timestamp exp = $JWTExpiration # Issuer = your application iss = $Script:MSCloudLoginConnectionProfile.Fabric.ApplicationID # JWT ID: random guid jti = [guid]::NewGuid() # Not to be used before nbf = $NotBefore # JWT Subject sub = $Script:MSCloudLoginConnectionProfile.Fabric.ApplicationID } # Convert header and payload to base64 $JWTHeaderToByte = [System.Text.Encoding]::UTF8.GetBytes(($JWTHeader | ConvertTo-Json)) $EncodedHeader = [System.Convert]::ToBase64String($JWTHeaderToByte) $JWTPayLoadToByte = [System.Text.Encoding]::UTF8.GetBytes(($JWTPayload | ConvertTo-Json)) $EncodedPayload = [System.Convert]::ToBase64String($JWTPayLoadToByte) # Join header and Payload with "." to create a valid (unsigned) JWT $JWT = $EncodedHeader + '.' + $EncodedPayload # Get the private key object of your certificate $PrivateKey = ([System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($Certificate)) # Define RSA signature and hashing algorithm $RSAPadding = [Security.Cryptography.RSASignaturePadding]::Pkcs1 $HashAlgorithm = [Security.Cryptography.HashAlgorithmName]::SHA256 # Create a signature of the JWT $Signature = [Convert]::ToBase64String( $PrivateKey.SignData([System.Text.Encoding]::UTF8.GetBytes($JWT), $HashAlgorithm, $RSAPadding) ) -replace '\+', '-' -replace '/', '_' -replace '=' # Join the signature to the JWT with "." $JWT = $JWT + '.' + $Signature # Create a hash with body parameters $Body = @{ client_id = $Script:MSCloudLoginConnectionProfile.Fabric.ApplicationID client_assertion = $JWT client_assertion_type = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer' scope = $Script:MSCloudLoginConnectionProfile.Fabric.Scope grant_type = 'client_credentials' } $Url = "$($Script:MSCloudLoginConnectionProfile.Fabric.AuthorizationUrl)/$TenantId/oauth2/v2.0/token" # Use the self-generated JWT as Authorization $Header = @{ Authorization = "Bearer $JWT" } # Splat the parameters for Invoke-Restmethod for cleaner code $PostSplat = @{ ContentType = 'application/x-www-form-urlencoded' Method = 'POST' Body = $Body Uri = $Url Headers = $Header } $Request = Invoke-RestMethod @PostSplat # View access_token $Script:MSCloudLoginConnectionProfile.Fabric.AccessToken = 'Bearer ' + $Request.access_token Add-MSCloudLoginAssistantEvent -Message 'Successfully connected to the Fabric API using Certificate Thumbprint' -Source $source } catch { throw $_ } } |