azure-pim-cli 0.1.0__py3-none-any.whl

azure_pim_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

azure_pim_cli/__main__.py

@@ -0,0 +1,4 @@
+from .cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

azure_pim_cli/acrs_primer.py

@@ -0,0 +1,189 @@
+"""Prime an acrs=c1 (step-up MFA) Graph token via portal.
+
+The Graph PIM activation POST refuses tokens lacking the `acrs=c1` claim
+(`RoleAssignmentRequestAcrsValidationFailed`). Portal handles this by calling
+MSAL with a claims challenge; if the user has a cached MFA session
+(`kmsi`/`dvc_cmp`), portal upgrades silently and retries. We can't do that
+step-up in raw Python (no refresh token), but we CAN drive portal to do it for
+us via Playwright over CDP.
+
+Flow:
+  1. Attach to authenticated Chrome (debug port 9222).
+  2. Navigate to PIM Activation blade.
+  3. Click Activate on the first eligible row.
+  4. Fill reason, submit.
+  5. Sniff the resulting Graph POST — its Authorization header contains a fresh
+     token with `acrs=c1`. Return that token.
+
+If cached MFA has lapsed, portal shows an MFA modal in the visible browser
+window — user completes it, script picks up the token afterwards. No signal
+file / TEMP handshake needed.
+"""
+
+from __future__ import annotations
+
+import base64
+import json
+import sys
+import threading
+import time
+
+from playwright.sync_api import sync_playwright
+
+ACTIVATION_URL = (
+    "https://portal.azure.com/#view/Microsoft_Azure_PIMCommon/ActivationMenuBlade/~/aadgroup"
+)
+
+
+def _has_c1(token: str) -> bool:
+    try:
+        payload = token.split(".")[1]
+        payload += "=" * (-len(payload) % 4)
+        claims = json.loads(base64.urlsafe_b64decode(payload))
+    except Exception:
+        return False
+    acrs = claims.get("acrs") or []
+    if isinstance(acrs, str):
+        acrs = [acrs]
+    return "c1" in [str(a).lower() for a in acrs]
+
+
+def prime_acrs(cdp_endpoint: str, justification: str = "acrs prime", timeout: int = 180) -> str:
+    """Drive portal to fire a Graph POST bearing an acrs=c1 token; return that token.
+
+    Raises RuntimeError on timeout / capture failure.
+    """
+    token_holder: dict[str, str] = {}
+    token_event = threading.Event()
+
+    def on_req(request):
+        if token_event.is_set():
+            return
+        try:
+            url = request.url
+            method = request.method
+        except Exception:
+            return
+        if "graph.microsoft.com" not in url:
+            return
+        if method != "POST":
+            return
+        if "assignmentScheduleRequests" not in url:
+            return
+        auth = request.headers.get("authorization", "")
+        if not auth.lower().startswith("bearer "):
+            return
+        candidate = auth.split(" ", 1)[1]
+        if not _has_c1(candidate):
+            return
+        token_holder["token"] = candidate
+        token_event.set()
+
+    with sync_playwright() as pw:
+        browser = pw.chromium.connect_over_cdp(cdp_endpoint)
+        ctx = browser.contexts[0]
+
+        # Register on ALL current + future pages (portal iframes fire XHRs)
+        for existing in ctx.pages:
+            existing.on("request", on_req)
+        ctx.on("page", lambda p: p.on("request", on_req))
+
+        # Prefer a portal tab; else new tab
+        page = None
+        for pg in ctx.pages:
+            if "portal.azure.com" in (pg.url or ""):
+                page = pg
+                break
+        if page is None:
+            page = ctx.new_page()
+        page.on("request", on_req)
+
+        print("[acrs] navigating portal tab to activation blade...", file=sys.stderr)
+        try:
+            page.goto(ACTIVATION_URL, wait_until="commit", timeout=60_000)
+        except Exception as e:
+            print(f"[acrs] nav warning: {e}", file=sys.stderr)
+
+        # Wait for eligibility grid to render
+        try:
+            page.wait_for_selector('button:has-text("Activeren")', timeout=30_000)
+        except Exception as e:
+            raise RuntimeError(f"activation blade did not load: {e}")
+
+        # Click first grid-row Activate (skip sidebar tab button by scoping to gridcell)
+        print("[acrs] clicking first Activate on eligibility row...", file=sys.stderr)
+        try:
+            page.locator('[role="gridcell"] button:has-text("Activeren")').first.click(
+                timeout=10_000
+            )
+        except Exception:
+            # Fallback: any visible Activeren, but skip the sidebar tab (has "in-/uitschakelen")
+            btns = page.locator(
+                'button:has-text("Activeren"):not(:has-text("in-/uitschakelen"))'
+            ).all()
+            if not btns:
+                raise RuntimeError("could not find any Activate button on grid.")
+            btns[0].click()
+
+        # Wait for confirmation panel with reason textbox
+        try:
+            page.wait_for_selector(
+                'textbox[aria-label*="Reden"], textarea[aria-label*="Reden"], [role="textbox"][aria-label*="Reden"]',
+                timeout=15_000,
+            )
+        except Exception:
+            # Portal panel loads a bit slower sometimes
+            time.sleep(2)
+
+        # Fill reason
+        print("[acrs] filling reason + submitting...", file=sys.stderr)
+        try:
+            page.get_by_role("textbox", name="Reden").first.fill(justification)
+        except Exception:
+            try:
+                page.locator('[role="textbox"][aria-label*="Reden"]').first.fill(justification)
+            except Exception as e:
+                print(
+                    f"[acrs] warn: could not fill reason ({e}); portal may accept empty for silent step-up.",
+                    file=sys.stderr,
+                )
+
+        # Click the panel Activate (bottom-most button in the aside/complementary panel)
+        try:
+            # Aside panel Activate — usually the last visible Activate button
+            panel_buttons = page.get_by_role("button", name="Activeren").all()
+            # Pick a panel button (not the row buttons). The confirmation panel
+            # button follows all row buttons; taking the last one is reliable.
+            panel_buttons[-1].click()
+        except Exception as e:
+            raise RuntimeError(f"could not click confirmation Activate button: {e}")
+
+        print(f"[acrs] waiting for acrs=c1 POST (up to {timeout}s)...", file=sys.stderr)
+        print(
+            "[acrs] if MFA prompt appears in the browser, complete it — script will pick up the token.",
+            file=sys.stderr,
+        )
+
+        deadline = time.time() + timeout
+        while time.time() < deadline:
+            if token_event.wait(timeout=2):
+                break
+
+        if not token_event.is_set():
+            raise RuntimeError("no acrs=c1 token captured after portal prime (timeout).")
+
+        token = token_holder["token"]
+        print("[acrs] captured acrs=c1 token.", file=sys.stderr)
+        return token
+
+
+if __name__ == "__main__":
+    import argparse
+
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--cdp-endpoint", default="http://localhost:9222")
+    ap.add_argument("--justification", default="acrs prime")
+    ap.add_argument("--timeout", type=int, default=180)
+    a = ap.parse_args()
+    tok = prime_acrs(a.cdp_endpoint, a.justification, a.timeout)
+    print(tok)

azure_pim_cli/cache.py

@@ -0,0 +1,67 @@
+"""Cache load/save + NEW-diff for eligible PIM group assignments.
+
+JSON schema matches Activate-PimGroup.ps1 so an existing PS cache seeds the diff.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from datetime import UTC, datetime
+from pathlib import Path
+
+from dateutil import parser as dateparser
+
+CACHE_MAX_HOURS = 24
+
+
+def cache_dir() -> Path:
+    if os.environ.get("LOCALAPPDATA"):
+        d = Path(os.environ["LOCALAPPDATA"]) / "pim_activate"
+    else:
+        d = Path.home() / ".pim_activate"
+    d.mkdir(parents=True, exist_ok=True)
+    return d
+
+
+def cache_file() -> Path:
+    return cache_dir() / "eligible_cache.json"
+
+
+def load() -> dict | None:
+    f = cache_file()
+    if not f.exists():
+        return None
+    try:
+        return json.loads(f.read_text(encoding="utf-8"))
+    except Exception:
+        return None
+
+
+def is_fresh(cache: dict, principal_id: str) -> bool:
+    if not cache or cache.get("principalId") != principal_id:
+        return False
+    fetched = cache.get("fetchedAt")
+    if not fetched:
+        return False
+    try:
+        age = datetime.now(UTC) - dateparser.isoparse(fetched)
+    except Exception:
+        return False
+    return age.total_seconds() < CACHE_MAX_HOURS * 3600
+
+
+def save(principal_id: str, eligible: list[dict]) -> None:
+    payload = {
+        "fetchedAt": datetime.now(UTC).isoformat(),
+        "principalId": principal_id,
+        "eligible": eligible,
+    }
+    cache_file().write_text(json.dumps(payload, indent=2), encoding="utf-8")
+
+
+def mark_new(current: list[dict], previous: list[dict] | None) -> list[dict]:
+    prev_ids = {e["groupId"] for e in (previous or [])}
+    for e in current:
+        e["isNew"] = bool(prev_ids) and e["groupId"] not in prev_ids
+    return current

azure_pim_cli/chrome_launcher.py

@@ -0,0 +1,188 @@
+"""Launch Chrome with remote debugging port, using a copy of the user's real profile.
+
+Why: Intune device compliance cookies live in the user's real Chrome profile. Playwright's
+own persistent profile lacks them, so Conditional Access refuses portal sign-in with
+"U kunt op dit moment geen toegang krijgen". Copying the real profile into a debug-
+friendly directory sidesteps both Intune's remote-debugging-port block (which only fires
+on the managed real profile) and the CA compliance check (cookies came along in the copy).
+
+Flow:
+    1. If debug port already responding -> reuse (fast path).
+    2. Else kill running chrome.exe (debug port requires exclusive use).
+    3. Copy real profile -> C:\\temp\\chrome_pim_profile (skip if target exists unless refresh).
+    4. Launch chrome.exe --remote-debugging-port=<port> --user-data-dir=<copy> <start-url>.
+    5. Poll /json/version until ready, return CDP endpoint URL.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+import time
+import urllib.error
+import urllib.request
+from pathlib import Path
+
+DEFAULT_PORT = 9222
+DEFAULT_COPY_PROFILE = Path(r"C:\temp\chrome_pim_profile")
+DEFAULT_START_URL = (
+    "https://portal.azure.com/#view/Microsoft_Azure_PIMCommon/ActivationMenuBlade/~/aadgroup"
+)
+
+
+def _chrome_exe() -> str:
+    candidates = [
+        r"C:\Program Files\Google\Chrome\Application\chrome.exe",
+        r"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe",
+        os.path.expandvars(r"%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe"),
+    ]
+    for p in candidates:
+        if os.path.isfile(p):
+            return p
+    raise RuntimeError(f"chrome.exe not found in any of: {candidates}")
+
+
+def _default_source_profile() -> Path:
+    return Path(os.environ["LOCALAPPDATA"]) / "Google" / "Chrome" / "User Data"
+
+
+def _port_alive(port: int) -> bool:
+    try:
+        with urllib.request.urlopen(f"http://localhost:{port}/json/version", timeout=1) as r:
+            return r.status == 200
+    except (urllib.error.URLError, ConnectionResetError, OSError):
+        return False
+
+
+def _wait_ready(port: int, timeout: float = 30.0) -> bool:
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        if _port_alive(port):
+            return True
+        time.sleep(0.5)
+    return False
+
+
+def _kill_chrome() -> None:
+    subprocess.run(["taskkill", "/F", "/IM", "chrome.exe"], capture_output=True)
+
+
+def _copy_profile(src: Path, dst: Path) -> None:
+    dst.parent.mkdir(parents=True, exist_ok=True)
+    # robocopy /E all subdirs, /XJ skip junctions (avoids symlink loops in Chrome cache),
+    # /R:1 /W:1 minimise retries on locked files, /NFL /NDL /NJH /NJS quiet output.
+    subprocess.run(
+        [
+            "robocopy",
+            str(src),
+            str(dst),
+            "/E",
+            "/XJ",
+            "/R:1",
+            "/W:1",
+            "/NFL",
+            "/NDL",
+            "/NJH",
+            "/NJS",
+            "/NC",
+            "/NS",
+            "/NP",
+        ],
+        capture_output=True,
+    )
+
+
+def launch_debug_chrome(
+    port: int = DEFAULT_PORT,
+    copy_profile: Path = DEFAULT_COPY_PROFILE,
+    source_profile: Path | None = None,
+    start_url: str = DEFAULT_START_URL,
+    force_profile_refresh: bool = False,
+) -> str:
+    """Ensure a Chrome with debug port is running against a profile that has Intune cookies.
+
+    Returns CDP endpoint URL (http://localhost:<port>).
+    """
+    if _port_alive(port) and not force_profile_refresh:
+        print(f"[chrome] debug port {port} already responding; reusing.", file=sys.stderr)
+        return f"http://localhost:{port}"
+    if _port_alive(port) and force_profile_refresh:
+        print(
+            "[chrome] --refresh-chrome-profile set; restarting Chrome to apply fresh profile.",
+            file=sys.stderr,
+        )
+
+    exe = _chrome_exe()
+    src = source_profile or _default_source_profile()
+
+    print("[chrome] killing chrome.exe (need exclusive debug port)...", file=sys.stderr)
+    _kill_chrome()
+    time.sleep(1)
+
+    need_copy = (
+        force_profile_refresh or not copy_profile.exists() or not any(copy_profile.iterdir())
+    )
+    if need_copy:
+        if not src.exists():
+            raise RuntimeError(f"source profile not found: {src}")
+        print(
+            f"[chrome] copying profile {src} -> {copy_profile} (may take 30-90s)...",
+            file=sys.stderr,
+        )
+        _copy_profile(src, copy_profile)
+    else:
+        print(
+            f"[chrome] reusing existing profile copy at {copy_profile} "
+            "(pass --refresh-chrome-profile to re-copy).",
+            file=sys.stderr,
+        )
+
+    args = [
+        exe,
+        f"--remote-debugging-port={port}",
+        f"--user-data-dir={copy_profile}",
+        "--no-first-run",
+        "--no-default-browser-check",
+        start_url,
+    ]
+    print(
+        f"[chrome] launching: {exe} --remote-debugging-port={port} --user-data-dir={copy_profile}",
+        file=sys.stderr,
+    )
+
+    # DETACHED_PROCESS = 0x00000008; keeps Chrome alive after Python exits.
+    creationflags = 0x00000008 if os.name == "nt" else 0
+    subprocess.Popen(args, creationflags=creationflags, close_fds=True)
+
+    print(f"[chrome] waiting for debug port {port}...", file=sys.stderr)
+    if not _wait_ready(port):
+        raise RuntimeError(
+            f"Chrome debug port {port} not responding after 30s. "
+            "Chrome may be blocked by policy or failed to launch."
+        )
+    print(f"[chrome] ready at http://localhost:{port}", file=sys.stderr)
+    print("[chrome] complete portal sign-in in the new Chrome window if prompted.", file=sys.stderr)
+    return f"http://localhost:{port}"
+
+
+if __name__ == "__main__":
+    import argparse
+
+    p = argparse.ArgumentParser(description="Launch Chrome with debug port on a copied profile.")
+    p.add_argument("--port", type=int, default=DEFAULT_PORT)
+    p.add_argument("--copy-profile", default=str(DEFAULT_COPY_PROFILE))
+    p.add_argument("--source-profile", default=None)
+    p.add_argument(
+        "--refresh", action="store_true", help="Re-copy real profile even if target exists."
+    )
+    p.add_argument("--url", default=DEFAULT_START_URL)
+    a = p.parse_args()
+    endpoint = launch_debug_chrome(
+        port=a.port,
+        copy_profile=Path(a.copy_profile),
+        source_profile=Path(a.source_profile) if a.source_profile else None,
+        start_url=a.url,
+        force_profile_refresh=a.refresh,
+    )
+    print(endpoint)