functions/entitlementManagement/accessPackages/Test-TmfAccessPackage.ps1
|
function Test-TmfAccessPackage { <# .SYNOPSIS Test desired configuration against a Tenant. .DESCRIPTION Compare current configuration of a resource type with the desired configuration. Return a result object with the required changes and actions. #> [CmdletBinding()] Param ( [string[]] $SpecificResources, [System.Management.Automation.PSCmdlet] $Cmdlet = $PSCmdlet ) begin { Test-GraphConnection -Cmdlet $Cmdlet $resourceName = "accessPackages" $tenant = (Invoke-MgGraphRequest -Method GET -Uri ("$script:graphBaseUrl/organization?`$select=displayname,id")).value } process { $definitions = @() if ($SpecificResources) { foreach ($specificResource in $SpecificResources) { if ($specificResource -match "\*") { if ($script:desiredConfiguration[$resourceName] | Where-Object {$_.displayName -like $specificResource}) { $definitions += $script:desiredConfiguration[$resourceName] | Where-Object {$_.displayName -like $specificResource} } else { Write-PSFMessage -Level Warning -String 'TMF.Error.SpecificResourceNotExists' -StringValues $filter -Tag 'failed' $exception = New-Object System.Data.DataException("$($specificResource) not exists in Desired Configuration for $($resourceName)!") $errorID = "SpecificResourceNotExists" $category = [System.Management.Automation.ErrorCategory]::NotSpecified $recordObject = New-Object System.Management.Automation.ErrorRecord($exception, $errorID, $category, $Cmdlet) $cmdlet.ThrowTerminatingError($recordObject) } } else { if ($script:desiredConfiguration[$resourceName] | Where-Object {$_.displayName -eq $specificResource}) { $definitions += $script:desiredConfiguration[$resourceName] | Where-Object {$_.displayName -eq $specificResource} } else { Write-PSFMessage -Level Warning -String 'TMF.Error.SpecificResourceNotExists' -StringValues $filter -Tag 'failed' $exception = New-Object System.Data.DataException("$($specificResource) not exists in Desired Configuration for $($resourceName)!") $errorID = "SpecificResourceNotExists" $category = [System.Management.Automation.ErrorCategory]::NotSpecified $recordObject = New-Object System.Management.Automation.ErrorRecord($exception, $errorID, $category, $Cmdlet) $cmdlet.ThrowTerminatingError($recordObject) } } } $definitions = $definitions | Sort-Object -Property displayName -Unique } else { $definitions = $script:desiredConfiguration[$resourceName] } foreach ($definition in $definitions) { foreach ($property in $definition.Properties()) { if ($definition.$property.GetType().Name -eq "String") { $definition.$property = Resolve-String -Text $definition.$property } } $result = @{ Tenant = $tenant.displayName TenantId = $tenant.Id ResourceType = 'AccessPackage' ResourceName = (Resolve-String -Text $definition.displayName) DesiredConfiguration = $definition } try { $resource = (Invoke-MgGraphRequest -Method GET -Uri ("$script:graphBaseUrl/identityGovernance/entitlementManagement/accessPackages?`$filter=(displayName eq '{0}')&`$expand=accessPackageResourceRoleScopes(`$expand=accessPackageResourceRole,accessPackageResourceScope)" -f [System.Web.HttpUtility]::UrlEncode($definition.displayName))).Value if (("oldNames" -in $definition.Properties()) -and (-not ($resource))) { foreach ($oldName in $definition.oldNames) { $resource = (Invoke-MgGraphRequest -Method GET -Uri ("$script:graphBaseUrl/identityGovernance/entitlementManagement/accessPackages?`$filter=(displayName eq '{0}')&`$expand=accessPackageResourceRoleScopes(`$expand=accessPackageResourceRole,accessPackageResourceScope)" -f [System.Web.HttpUtility]::UrlEncode($oldName))).Value if ($resource) {break} } } } catch { Write-PSFMessage -Level Warning -String 'TMF.Error.QueryWithFilterFailed' -StringValues $filter -Tag 'failed' $exception = New-Object System.Data.DataException("Query with filter $filter against Microsoft Graph failed. Error: $_") $errorID = 'QueryWithFilterFailed' $category = [System.Management.Automation.ErrorCategory]::NotSpecified $recordObject = New-Object System.Management.Automation.ErrorRecord($exception, $errorID, $category, $Cmdlet) $cmdlet.ThrowTerminatingError($recordObject) } switch ($resource.Count) { 0 { if ($definition.present) { $result = New-TestResult @result -ActionType "Create" } else { $result = New-TestResult @result -ActionType "NoActionRequired" } } 1 { $result["GraphResource"] = $resource if ($definition.present) { $changes = @() foreach ($property in ($definition.Properties() | Where-Object {$_ -notin "present", "sourceConfig", "oldNames"})) { $change = [PSCustomObject] @{ Property = $property Actions = $null } switch ($property) { "catalog" { <# Currently not possible to update! #> } "isRoleScopesVisible" { <# Currently not possible to update! #> } "accessPackageResourceRoleScopes" { $existingRoleScopes = @() if ($resource.accessPackageResourceRoleScopes.accessPackageResourceRole.originId) { $existingRoleScopes = $resource.accessPackageResourceRoleScopes.accessPackageResourceRole.originId } $roleOriginIds = @() foreach ($roleScope in $definition.accessPackageResourceRoleScopes) { switch ($roleScope.resourceType) { "AadGroup" {$roleOriginIds += [pscustomObject]@{ "id" = $roleScope.roleOriginId() "roleDisplayName" = $roleScope.displayName "resourceType" = $roleScope.resourceType } } "Application" { $catalogID = Resolve-AccessPackageCatalog -InputReference $definition.catalog $accessPackageResourceId = Resolve-AccessPackageResource -InputReference $roleScope.resourceIdentifier -CatalogId $catalogID -SearchInDesiredConfiguration if ($accessPackageResourceId -match $script:guidRegex) { $roleOriginIds += [pscustomObject]@{ "id" = (Invoke-MgGraphRequest -Method GET -Uri ("$script:graphBaseUrl/identityGovernance/entitlementManagement/accessPackageCatalogs/{0}/accessPackageResourceRoles?`$filter=(originSystem eq 'AadApplication' and accessPackageResource/id eq '{1}' and displayname eq '{2}')" -f $catalogID,$accessPackageResourceId,$roleScope.resourceRole)).value.originId "roleDisplayName" = $roleScope.displayName "resourceType" = $roleScope.resourceType } } else { $roleOriginIds += [pscustomObject]@{ "id" = $accessPackageResourceId "roleDisplayName" = $roleScope.displayName "resourceType" = $roleScope.resourceType } } } } } $compare = Compare-Object -ReferenceObject $existingRoleScopes -DifferenceObject $roleOriginIds.id if ($compare) { $change.Actions = @{} if ($compare.SideIndicator -contains "=>" -and -not $ReturnSetAction) { $change.Actions["Add"] = @() foreach ($difference in ($compare | Where-Object {$_.SideIndicator -eq "=>"}).InputObject) { $roleToAdd = $roleOriginIds | Where-Object {$_.id -eq $difference} $change.Actions["Add"] += $roleToAdd } #$change.Actions["Add"] = ($compare | Where-Object {$_.SideIndicator -eq "=>"}).InputObject } if ($compare.SideIndicator -contains "<=" -and -not $ReturnSetAction) { $change.Actions["Remove"] = ($compare | Where-Object {$_.SideIndicator -eq "<="}).InputObject } } } default { if ($definition.$property -ne $resource.$property) { $change.Actions = @{"Set" = $definition.$property} } } } if ($change.Actions) {$changes += $change} } if ($changes.count -gt 0) { $result = New-TestResult @result -Changes $changes -ActionType "Update"} else { $result = New-TestResult @result -ActionType "NoActionRequired" } } else { $result = New-TestResult @result -ActionType "Delete" } } default { Write-PSFMessage -Level Warning -String 'TMF.Test.MultipleResourcesError' -StringValues $resourceName, $definition.displayName -Tag 'failed' $exception = New-Object System.Data.DataException("Query returned multiple results. Cannot decide which resource to test.") $errorID = 'MultipleResourcesError' $category = [System.Management.Automation.ErrorCategory]::NotSpecified $recordObject = New-Object System.Management.Automation.ErrorRecord($exception, $errorID, $category, $Cmdlet) $cmdlet.ThrowTerminatingError($recordObject) } } $result } } } |