functions/test-d365entraintegration.ps1


<#
    .SYNOPSIS
        Test the Entra Id integration
         
    .DESCRIPTION
        Validates the configuration of the web.config file and the certificate for the environment
         
        If any of the configuration is missing or in someway incorrect, it will prompt and stating corrective actions needed
         
    .EXAMPLE
        PS C:\> Test-D365EntraIntegration
         
        This will validate the settings inside the web.config file.
        It will search for Aad.Realm, Infrastructure.S2SCertThumbprint, GraphApi.GraphAPIServicePrincipalCert
        It will search for the certificate that matches the thumbprint.
         
        A result set example:
         
        EntraAppId Thumbprint Subject Expiration
        ---------- ---------- ------- ----------
        e068e004-8bec-48c3-a36f-2ab4982ee738 0768175DF3DFDEA3FA78925ADC1E588707649335 CN=CHEAuth 2/5/2026 8:09:28 AM
         
    .NOTES
        Based on: https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/dev-tools/secure-developer-vm#external-integrations
         
        Author: Mötz Jensen (@Splaxi)
#>

function Test-D365EntraIntegration {
    param (
    )

    if (-not ($Script:IsAdminRuntime)) {
        Write-PSFMessage -Level Critical -Message "It seems that you ran this cmdlet <c='em'>non-elevated</c>. Testing the Entra integration requires you to run this cmdlet from an elevated console. Please exit the current console and start a new with `"Run As Administrator`""
        Stop-PSFFunction -Message "Stopping because the function is not run elevated"
        return
    }

    # Check web.config
    $webConfigFile = Join-Path -Path $Script:AOSPath $Script:WebConfig
    
    if (-not (Test-PathExists -Path $webConfigFile -Type Leaf -ErrorAction SilentlyContinue -WarningAction SilentlyContinue)) {
        Write-PSFMessage -Level Host -Message "Unable to find the web.config file."
        Stop-PSFFunction -Message "Stopping because the web.config file could not be found"
    }
    
    $config = @{}

    [xml]$xml = Get-Content $webConfigFile
    $nodes = ($xml.configuration.appSettings).ChildNodes

    $config.AadRealm = $nodes | Where-Object -Property Key -eq "Aad.Realm" | Select-Object -First 1 -ExpandProperty value
    $config.S2SCertThumbprint = $nodes | Where-Object -Property Key -eq "Infrastructure.S2SCertThumbprint" | Select-Object -First 1 -ExpandProperty value
    $config.GraphAPIServicePrincipalCert = $nodes | Where-Object -Property Key -eq "GraphApi.GraphAPIServicePrincipalCert" | Select-Object -First 1 -ExpandProperty value
    
    if ([System.String]::IsNullOrWhiteSpace($config.AadRealm)) {
        Write-PSFMessage -Level Host -Message "The <c='em'>'Aad.Realm'</c> value is empty. This indicates that you need to run the <c='em'>'New-D365EntraIntegration'</c> cmdlet."
        Stop-PSFFunction -Message "Stopping because the 'Aad.Realm' value is empty"
    }
    
    if ([System.String]::IsNullOrWhiteSpace($config.S2SCertThumbprint)) {
        Write-PSFMessage -Level Host -Message "The <c='em'>'Infrastructure.S2SCertThumbprint'</c> value is empty. This indicates that you need to run the <c='em'>'New-D365EntraIntegration'</c> cmdlet."
        Stop-PSFFunction -Message "Stopping because the 'Infrastructure.S2SCertThumbprint' value is empty"
    }

    if ([System.String]::IsNullOrWhiteSpace($config.GraphAPIServicePrincipalCert)) {
        Write-PSFMessage -Level Host -Message "The <c='em'>'GraphApi.GraphAPIServicePrincipalCert'</c> value is empty. This indicates that you need to run the <c='em'>'New-D365EntraIntegration'</c> cmdlet."
        Stop-PSFFunction -Message "Stopping because the 'GraphApi.GraphAPIServicePrincipalCert' value is empty"
    }

    if ((-not [System.String]::IsNullOrWhiteSpace($config.S2SCertThumbprint)) -and $config.S2SCertThumbprint -ne $config.GraphAPIServicePrincipalCert) {
        Write-PSFMessage -Level Host -Message "The <c='em'>'Infrastructure.S2SCertThumbprint'</c> and the <c='em'>'GraphApi.GraphAPIServicePrincipalCert'</c> value do not match each other. This indicates that you have a <c='em'>corrupted</c> configuration. Running the <c='em'>'New-D365EntraIntegration'</c> cmdlet could assist with fixing the configuration."
        Stop-PSFFunction -Message "Stopping because the 'Infrastructure.S2SCertThumbprint' and 'GraphApi.GraphAPIServicePrincipalCert' values do not match"
    }

    if (Test-PSFFunctionInterrupt) { return }

    # Check wif.config
    $wifConfigFile = Join-Path -Path $Script:AOSPath $Script:WifConfig
    
    if (-not (Test-PathExists -Path $wifConfigFile -Type Leaf -ErrorAction SilentlyContinue -WarningAction SilentlyContinue)) {
        Write-PSFMessage -Level Host -Message "Unable to find the wif.config file."
        Stop-PSFFunction -Message "Stopping because the wif.config file could not be found"
    }
    
    [xml]$xml = Get-Content $wifConfigFile
    $nodes = ($xml.'system.identityModel'.identityConfiguration.securityTokenHandlers.securityTokenHandlerConfiguration.audienceUris).ChildNodes
    $config.AudienceUri = $nodes | Where-Object { $_.value -like "*$($config.AadRealm)*" } | Select-Object -First 1 -ExpandProperty value

    if ([System.String]::IsNullOrWhiteSpace($config.AudienceUri)) {
        Write-PSFMessage -Level Host -Message "The <c='em'>'AudienceUri'</c> value is empty. This indicates that you have a <c='em'>corrupted</c> configuration. Try running the <c='em'>'New-D365EntraIntegration'</c> cmdlet to fix the configuration."
        Stop-PSFFunction -Message "Stopping because the 'AudienceUri' value is empty"
    }
    elseif ($config.AadRealm -ne $config.AudienceUri) {
        Write-PSFMessage -Level Host -Message "The <c='em'>'Aad.Realm'</c> and the <c='em'>'AudienceUri'</c> value do not match each other. This indicates that you have a <c='em'>corrupted</c> configuration. Try running the <c='em'>'New-D365EntraIntegration'</c> cmdlet to fix the configuration."
        Stop-PSFFunction -Message "Stopping because the 'Aad.Realm' and 'AudienceUri' values do not match"
    }

    if (Test-PSFFunctionInterrupt) { return }

    # Check certificate
    $certStoreLocation = "Cert:\LocalMachine\My"
    
    $certEntra = Get-ChildItem -Path $certStoreLocation -ErrorAction SilentlyContinue | Where-Object { $_.Thumbprint -eq $config.S2SCertThumbprint } | Select-Object -First 1
    
    if ($null -eq $certEntra) {
        Write-PSFMessage -Level Host -Message "Unable to find any certificate in the certificate store <c='em'>'$certStoreLocation'</c> that matches the thumbprint <c='em'>'$($config.S2SCertThumbprint)'</c>."
        Stop-PSFFunction -Message "Stopping because no certificate matching the thumbprint was found"
        return
    }

    [PSCustomObject][ordered]@{
        EntraAppId = $config.AadRealm.replace("spn:", "")
        Thumbprint = $config.S2SCertThumbprint
        Subject    = $certEntra.Subject
        Expiration = $certEntra.NotAfter
    }
}