Skip to content
This repository was archived by the owner on May 31, 2023. It is now read-only.

Commit 4fc4750

Browse files
vletouxvletoux
committed
PingCastleCloud 1.0.0.0
1 parent 56416a9 commit 4fc4750

10 files changed

+425
-114
lines changed

‎Analyzer/Analyzer.cs

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -336,6 +336,16 @@ private void AnalyzePolicies()
336336
ExtractNetworkPolicy(policy);
337337
}
338338
}
339+
340+
var ms = new MicrosoftGraph(new PRTCredential());
341+
var authorizationPolicies = ms.GetAuthorizationPolicy();
342+
if (authorizationPolicies != null && authorizationPolicies.Count > 0)
343+
{
344+
var authorizationPolicy = authorizationPolicies[0];
345+
data.PolicyGuestUserRoleId = authorizationPolicy.guestUserRoleId;
346+
data.PolicyAllowEmailVerifiedUsersToJoinOrganization = authorizationPolicy.allowEmailVerifiedUsersToJoinOrganization;
347+
}
348+
339349
}
340350

341351
private void ExtractNetworkPolicy(GraphAPI.PolicyResponse policy)

‎Data/HealthCheckCloudData.cs

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -332,6 +332,10 @@ public class HealthCheckCloudData : JsonSerialization<HealthCheckCloudData>
332332
public bool UsersPermissionToCreateLOBAppsEnabled { get; set; }
333333
public bool UsersPermissionToReadOtherUsersEnabled { get; set; }
334334
public bool UsersPermissionToUserConsentToAppEnabled { get; set; }
335+
336+
public string PolicyGuestUserRoleId { get; set; }
337+
public bool? PolicyAllowEmailVerifiedUsersToJoinOrganization { get; set; }
338+
335339
public List<HealthCheckCloudDataForwardingMailboxes> ForwardingMailboxes { get; set; }
336340
public int GlobalScore { get; set; }
337341
public int MaturityLevel { get; set; }

‎PingCastleCloud.csproj

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,10 @@
9292
<Compile Include="RESTServices\Azure\ProvisioningApi.cs" />
9393
<Compile Include="RESTServices\RESTClientBase.cs" />
9494
<Compile Include="Credentials\CertificateCredential.cs" />
95+
<Compile Include="Rules\GuestUserAccessRestriction2.cs" />
96+
<Compile Include="Rules\GuestUserAccessRestriction1.cs" />
97+
<Compile Include="Rules\UserRegisterApplications.cs" />
98+
<Compile Include="Rules\UserConsentCompanyData.cs" />
9599
<Compile Include="Rules\ADConnectVersion1.cs" />
96100
<Compile Include="Tokens\ChallengeResponse.cs" />
97101
<Compile Include="Tokens\CookieManager.cs" />
@@ -109,11 +113,6 @@
109113
<Compile Include="Rules\CustomRulesSettings.cs" />
110114
<Compile Include="Rules\RuleAttribute.cs" />
111115
<Compile Include="Rules\RuleBase.cs" />
112-
<Compile Include="Rules\RuleDescription.Designer.cs">
113-
<AutoGen>True</AutoGen>
114-
<DesignTime>True</DesignTime>
115-
<DependentUpon>RuleDescription.resx</DependentUpon>
116-
</Compile>
117116
<Compile Include="Rules\RuleSet.cs" />
118117
<Compile Include="Tasks.cs" />
119118
<Compile Include="Template\TemplateManager.cs" />
@@ -126,8 +125,6 @@
126125
</ItemGroup>
127126
<ItemGroup>
128127
<EmbeddedResource Include="Rules\RuleDescription.resx">
129-
<Generator>ResXFileCodeGenerator</Generator>
130-
<LastGenOutput>RuleDescription.Designer.cs</LastGenOutput>
131128
<SubType>Designer</SubType>
132129
</EmbeddedResource>
133130
<EmbeddedResource Include="UI\AuthenticationDialog.resx">

‎Program.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -219,7 +219,7 @@ private bool CheckCertificate()
219219
return true;
220220
}
221221

222-
const string basicEditionLicense = "PC2H4sIAAAAAAAEAO29B2AcSZYlJi9tynt/SvVK1+B0oQiAYBMk2JBAEOzBiM3mkuwdaUcjKasqgcplVmVdZhZAzO2dvPfee++999577733ujudTif33/8/XGZkAWz2zkrayZ4hgKrIHz9+fB8/In7NX+PX+DV+A/r/r/F7/nf/y/E/+m//mr82/drS/5/9GvWvkdN/6a9x+mvMfo2CPit+jerXWNLf1a9xTv++pL+Xv8bFr3Hya2S/RkPfltx279cY/xq7v8YO/btDf23T/19Q+5Z+ntPPmn5O6eeC/svprynByOjN9NdYE4z81wAaf9Cv8Wv8Gr/G7/Sn/jb/yh/67+R/SvL3/a9/4R/9F/9j//m/+uf+bqtf8J/8wskf80v+gu/+1v/e3/3yfzj9hf/ZF//HL/v9/vzf/S/O/ozf/2/9q17/y3/Qt36/v+Uf+11+q8e/8f/RFn/E3/vb/cPlT/1P//Cf9OPlP3H4Z/57v8bf/M9s/aK/47f6w7df/BG/8t/8U/6sp//Cf/pbfvVPfHr4t/yVP/hXfvvZr//X/zWXf0b7r/8rf9K/+Auyv+uf+XP+mfkf+ff+c7/L/wNcbrwUFAEAAA==";
222+
const string basicEditionLicense = "PC2H4sIAAAAAAAEAO29B2AcSZYlJi9tynt/SvVK1+B0oQiAYBMk2JBAEOzBiM3mkuwdaUcjKasqgcplVmVdZhZAzO2dvPfee++999577733ujudTif33/8/XGZkAWz2zkrayZ4hgKrIHz9+fB8/In7NX+PX+DV+A/r/r/F7/g/Lf+v1v/Nr/tr068/Q/5/9GvWvkdN/6a9x+mvMfo3i12jp/9WvsaS/q1/jnP59SX8vf42LX+Pk18h+jYa+LantCf1b/Rprap/+Gru/xvjX2OH/p7/GNv3/BX3T0s9z+lnTzyn9XNB/Of01JVgZvZvSu82vkf8aQOcP+jV+jV/j1/7Ff9N/9i//Br/Hm3/37/on/4Lf+w/+k/+Kv+M/+c/+xeR//DP++U/+qn/iP9j/Lf62v/Ojv+DP+Wf/x//wJ37v5W99/p/+dn/WP/BPFP/323/wL/grR3/H3/e3PTj7p3+T13/er9y5m/0+f8PlH3v36X/76u5f9OS3/GP+9v/58tWf9E//Le2v8Ut/WfK3/FH/+O/wj/4F9/+gf+lP/1+//D9//7/uv/iVZ82f8zv9Cb/rn/0n/xl/8m/y2/+1v+/fOBv9Of8Pw8+pIRwBAAA=";
223223
string _serialNumber;
224224
public string GetSerialNumber()
225225
{

‎RESTServices/Azure/MicrosoftGraph.cs

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616

1717
namespace PingCastleCloud.RESTServices
1818
{
19-
[AzureService("535fb089-9ff3-47b6-9bfb-4f1264799865", "https://graph.microsoft.com")]
19+
[AzureService("1b730954-1685-4b74-9bfd-dac224a7b894", "https://graph.microsoft.com")]
2020
public class MicrosoftGraph : RESTClientBase<MicrosoftGraph>, IAzureService
2121
{
2222
public MicrosoftGraph(IAzureCredential credential) : base(credential)
@@ -32,15 +32,45 @@ protected override string BuidEndPoint(string function, string optionalQuery)
3232
return builder.ToString();
3333
}
3434

35-
public string GetMe()
35+
public GraphAPI.User GetMe()
3636
{
37-
return CallEndPoint<string>("me");
37+
return CallEndPoint<GraphAPI.User>("me");
38+
}
39+
40+
public List<AuthorizationPolicy> GetAuthorizationPolicy()
41+
{
42+
return CallEndPointWithPaggingAsync<object, AuthorizationPolicy>("policies/authorizationPolicy", null).GetAwaiter().GetResult();
3843
}
3944

4045
// message=Insufficient privileges to complete the operation.
4146
public string GetTenantRelationships(string tenantId)
4247
{
4348
return CallEndPoint<string>("tenantRelationships/findTenantInformationByTenantId(tenantId='" + tenantId + "')");
4449
}
50+
51+
public class AuthorizationPolicy
52+
{
53+
public string id { get; set; }
54+
public string allowInvitesFrom { get; set; }
55+
public bool allowedToSignUpEmailBasedSubscriptions { get; set; }
56+
public bool allowedToUseSSPR { get; set; }
57+
public bool allowEmailVerifiedUsersToJoinOrganization { get; set; }
58+
public bool blockMsolPowerShell { get; set; }
59+
public string description { get; set; }
60+
public string displayName { get; set; }
61+
public List<object> enabledPreviewFeatures { get; set; }
62+
public string guestUserRoleId { get; set; }
63+
public List<string> permissionGrantPolicyIdsAssignedToDefaultUserRole { get; set; }
64+
public UserRolePermissions defaultUserRolePermissions { get; set; }
65+
}
66+
67+
public class UserRolePermissions
68+
{
69+
public bool allowedToCreateApps { get; set; }
70+
public bool allowedToCreateSecurityGroups { get; set; }
71+
public bool allowedToCreateTenants { get; set; }
72+
public bool allowedToReadBitlockerKeysForOwnedDevice { get; set; }
73+
public bool allowedToReadOtherUsers { get; set; }
74+
}
4575
}
4676
}

‎Rules/GuestUserAccessRestriction1.cs

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
//
2+
// Copyright (c) Vincent LE TOUX for Ping Castle. All rights reserved.
3+
// https://www.pingcastle.com
4+
//
5+
// Licensed under the Non-Profit OSL. See LICENSE file in the project root for full license information.
6+
//
7+
using PingCastleCloud.Data;
8+
using System;
9+
using System.Collections.Generic;
10+
using System.Linq;
11+
using System.Text;
12+
using System.Threading.Tasks;
13+
14+
namespace PingCastleCloud.Rules
15+
{
16+
[RuleModel("GuestUserAccessRestriction1")]
17+
[RuleComputation(RuleComputationType.TriggerOnPresence, 25)]
18+
[RuleMaturityLevel(1)]
19+
public class GuestUserAccessRestriction1 : RuleBase
20+
{
21+
protected override int? AnalyzeDataNew(HealthCheckCloudData healthCheckCloudData)
22+
{
23+
if (string.Equals(healthCheckCloudData.PolicyGuestUserRoleId, "a0b1b346-4d3e-4e8b-98f8-753987be4970", StringComparison.OrdinalIgnoreCase))
24+
{
25+
AddRawDetail(healthCheckCloudData.PolicyGuestUserRoleId);
26+
}
27+
return null;
28+
}
29+
30+
}
31+
}

‎Rules/GuestUserAccessRestriction2.cs

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
//
2+
// Copyright (c) Vincent LE TOUX for Ping Castle. All rights reserved.
3+
// https://www.pingcastle.com
4+
//
5+
// Licensed under the Non-Profit OSL. See LICENSE file in the project root for full license information.
6+
//
7+
using PingCastleCloud.Data;
8+
using System;
9+
using System.Collections.Generic;
10+
using System.Linq;
11+
using System.Text;
12+
using System.Threading.Tasks;
13+
14+
namespace PingCastleCloud.Rules
15+
{
16+
[RuleModel("GuestUserAccessRestriction2")]
17+
[RuleComputation(RuleComputationType.TriggerOnPresence, 0)]
18+
[RuleMaturityLevel(4)]
19+
public class GuestUserAccessRestriction2 : RuleBase
20+
{
21+
protected override int? AnalyzeDataNew(HealthCheckCloudData healthCheckCloudData)
22+
{
23+
if (string.Equals(healthCheckCloudData.PolicyGuestUserRoleId, "10dae51f-b6af-4016-8d66-8c2a99b929b3", StringComparison.OrdinalIgnoreCase))
24+
{
25+
AddRawDetail(healthCheckCloudData.PolicyGuestUserRoleId);
26+
}
27+
return null;
28+
}
29+
30+
}
31+
}

0 commit comments

Comments
 (0)