cartography 0.93.0rc1__py3-none-any.whl → 0.123.0__py3-none-any.whl

cartography/intel/duo/users.py

@@ -21,9 +21,9 @@ def sync_duo_users(
     neo4j_session: neo4j.Session,
     common_job_parameters: Dict[str, Any],
 ) -> None:
-    '''
+    """
     Sync Duo Users
-    '''
+    """
     users = _get_users(client)
     transformed_users = _transform_users(users)
     _load_users(neo4j_session, transformed_users, common_job_parameters)
@@ -32,77 +32,78 @@ def sync_duo_users(
 
 @timeit
 def _get_users(client: duo_client.Admin) -> List[Dict[str, Any]]:
-    '''
+    """
     Fetch all users data
     https://duo.com/docs/adminapi#users
-    '''
+    """
     logger.info("Fetching Duo users")
     return client.get_users()
 
 
 @timeit
 def _transform_users(users: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
-    '''
+    """
     Reformat the data before loading
-    '''
-    logger.info(f'Transforming {len(users)} duo users')
+    """
+    logger.info(f"Transforming {len(users)} duo users")
     transformed_users = []
     for user in users:
         transformed_user = {
-            'alias1': user['alias1'],
-            'alias2': user['alias2'],
-            'alias3': user['alias3'],
-            'alias4': user['alias4'],
-            'created': user['created'],
-            'email': user['email'],
-            'firstname': user['firstname'],
-            'is_enrolled': user['is_enrolled'],
-            'last_directory_sync': user['last_directory_sync'],
-            'last_login': user['last_login'],
-            'lastname': user['lastname'],
-            'notes': user['notes'],
-            'phones': [
-                dumps({
-                    **phone,
-                    'number': None,
-                })
-                for phone in user['phones']
+            "alias1": user["alias1"],
+            "alias2": user["alias2"],
+            "alias3": user["alias3"],
+            "alias4": user["alias4"],
+            "created": user["created"],
+            "email": user["email"],
+            "firstname": user["firstname"],
+            "is_enrolled": user["is_enrolled"],
+            "last_directory_sync": user["last_directory_sync"],
+            "last_login": user["last_login"],
+            "lastname": user["lastname"],
+            "notes": user["notes"],
+            "phones": [
+                dumps(
+                    {
+                        **phone,
+                        "number": None,
+                    },
+                )
+                for phone in user["phones"]
             ],
-            'realname': user['realname'],
-            'status': user['status'],
-            'tokens': [dumps(token) for token in user['tokens']],
-            'u2ftokens': [dumps(u2ftoken) for u2ftoken in user['u2ftokens']],
-            'user_id': user['user_id'],
-            'username': user['username'],
-            'webauthncredentials': [
+            "realname": user["realname"],
+            "status": user["status"],
+            "tokens": [dumps(token) for token in user["tokens"]],
+            "u2ftokens": [dumps(u2ftoken) for u2ftoken in user["u2ftokens"]],
+            "user_id": user["user_id"],
+            "username": user["username"],
+            "webauthncredentials": [
                 dumps(webauthncredential)
-                for webauthncredential
-                in user['webauthncredentials']
+                for webauthncredential in user["webauthncredentials"]
             ],
         }
         transformed_users.append(transformed_user)
-        for group in user['groups']:
+        for group in user["groups"]:
             match_user = {
                 **transformed_user,
-                'group_id': group['group_id'],
+                "group_id": group["group_id"],
             }
             transformed_users.append(match_user)
-        for phone in user['phones']:
+        for phone in user["phones"]:
             match_user = {
                 **transformed_user,
-                'phone_id': phone['phone_id'],
+                "phone_id": phone["phone_id"],
             }
             transformed_users.append(match_user)
-        for token in user['tokens']:
+        for token in user["tokens"]:
             match_user = {
                 **transformed_user,
-                'token_id': token['token_id'],
+                "token_id": token["token_id"],
             }
             transformed_users.append(match_user)
-        for webauthncredential in user['webauthncredentials']:
+        for webauthncredential in user["webauthncredentials"]:
             match_user = {
                 **transformed_user,
-                'webauthnkey': webauthncredential['webauthnkey'],
+                "webauthnkey": webauthncredential["webauthnkey"],
             }
             transformed_users.append(match_user)
     return transformed_users
@@ -114,22 +115,25 @@ def _load_users(
     users: List[Dict[str, Any]],
     common_job_parameters: Dict[str, Any],
 ) -> None:
-    '''
+    """
     Load the users into the database
-    '''
-    logger.info(f'Loading {len(users)} duo users')
+    """
+    logger.info(f"Loading {len(users)} duo users")
     load(
         neo4j_session,
         DuoUserSchema(),
         users,
-        DUO_API_HOSTNAME=common_job_parameters['DUO_API_HOSTNAME'],
-        lastupdated=common_job_parameters['UPDATE_TAG'],
+        DUO_API_HOSTNAME=common_job_parameters["DUO_API_HOSTNAME"],
+        lastupdated=common_job_parameters["UPDATE_TAG"],
     )
 
 
 @timeit
-def _cleanup_users(neo4j_session: neo4j.Session, common_job_parameters: Dict[str, Any]) -> None:
-    '''
+def _cleanup_users(
+    neo4j_session: neo4j.Session,
+    common_job_parameters: Dict[str, Any],
+) -> None:
+    """
     Cleanup endpoints
-    '''
+    """
     GraphJob.from_node_schema(DuoUserSchema(), common_job_parameters).run(neo4j_session)

cartography/intel/duo/web_authn_credentials.py

@@ -8,7 +8,9 @@ import neo4j
 
 from cartography.client.core.tx import load
 from cartography.graph.job import GraphJob
-from cartography.models.duo.web_authn_credential import DuoWebAuthnCredentialSchema as Schema
+from cartography.models.duo.web_authn_credential import (
+    DuoWebAuthnCredentialSchema as Schema,
+)
 from cartography.util import timeit
 
 logger = logging.getLogger(__name__)
@@ -20,9 +22,9 @@ def sync(
     neo4j_session: neo4j.Session,
     common_job_parameters: Dict[str, Any],
 ) -> None:
-    '''
+    """
     Sync
-    '''
+    """
     data = _get(client)
     transformed_data = _transform(data)
     _load(neo4j_session, transformed_data, common_job_parameters)
@@ -31,37 +33,37 @@ def sync(
 
 @timeit
 def _get(client: duo_client.Admin) -> List[Dict[str, Any]]:
-    '''
+    """
     Fetch all data
     https://duo.com/docs/adminapi#endpoints
-    '''
-    logger.info(f'Fetching data for {Schema.label}')
+    """
+    logger.info(f"Fetching data for {Schema.label}")
     return client.get_webauthncredentials()
 
 
 @timeit
 def _transform(data: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
-    '''
+    """
     Reformat the data before loading
-    '''
-    logger.info(f'Transforming {len(data)} items for {Schema.label}')
+    """
+    logger.info(f"Transforming {len(data)} items for {Schema.label}")
     transformed_data = []
     for datum in data:
         transformed_datum = {
             # The admin property may be null if the cred is attached to a user
-            'admin': datum.get('admin'),
-            'credential_name': datum['credential_name'],
-            'date_added': datum['date_added'],
-            'label': datum['label'],
-            'user': datum['user'],
-            'webauthnkey': datum['webauthnkey'],
+            "admin": datum.get("admin"),
+            "credential_name": datum["credential_name"],
+            "date_added": datum["date_added"],
+            "label": datum["label"],
+            "user": datum["user"],
+            "webauthnkey": datum["webauthnkey"],
         }
         transformed_data.append(transformed_datum)
         # The user property may be null if the cred is attached to an admin
-        if datum.get('user'):
+        if datum.get("user"):
             match_datum = {
                 **transformed_datum,
-                'user_id': datum['user']['user_id'],
+                "user_id": datum["user"]["user_id"],
             }
             transformed_data.append(match_datum)
     return transformed_data
@@ -73,22 +75,25 @@ def _load(
     data: List[Dict[str, Any]],
     common_job_parameters: Dict[str, Any],
 ) -> None:
-    '''
+    """
     Load the data into the database
-    '''
-    logger.info(f'Loading {len(data)} items for {Schema.label}')
+    """
+    logger.info(f"Loading {len(data)} items for {Schema.label}")
     load(
         neo4j_session,
         Schema(),
         data,
-        DUO_API_HOSTNAME=common_job_parameters['DUO_API_HOSTNAME'],
-        lastupdated=common_job_parameters['UPDATE_TAG'],
+        DUO_API_HOSTNAME=common_job_parameters["DUO_API_HOSTNAME"],
+        lastupdated=common_job_parameters["UPDATE_TAG"],
     )
 
 
 @timeit
-def _cleanup(neo4j_session: neo4j.Session, common_job_parameters: Dict[str, Any]) -> None:
-    '''
+def _cleanup(
+    neo4j_session: neo4j.Session,
+    common_job_parameters: Dict[str, Any],
+) -> None:
+    """
     Cleanup nodes
-    '''
+    """
     GraphJob.from_node_schema(Schema(), common_job_parameters).run(neo4j_session)

cartography/intel/entra/__init__.py

@@ -0,0 +1,160 @@
+import asyncio
+import logging
+
+import neo4j
+from azure.identity import ClientSecretCredential
+from msgraph import GraphServiceClient
+
+from cartography.config import Config
+from cartography.intel.entra.app_role_assignments import sync_app_role_assignments
+from cartography.intel.entra.applications import sync_entra_applications
+from cartography.intel.entra.federation.aws_identity_center import sync_entra_federation
+from cartography.intel.entra.groups import sync_entra_groups
+from cartography.intel.entra.ou import sync_entra_ous
+from cartography.intel.entra.service_principals import sync_service_principals
+from cartography.intel.entra.users import get_tenant
+from cartography.intel.entra.users import load_tenant
+from cartography.intel.entra.users import sync_entra_users
+from cartography.intel.entra.users import transform_tenant
+from cartography.util import timeit
+
+logger = logging.getLogger(__name__)
+
+
+@timeit
+async def sync_tenant(
+    neo4j_session: neo4j.Session,
+    tenant_id: str,
+    client_id: str,
+    client_secret: str,
+    update_tag: int,
+) -> None:
+    """
+    Sync tenant information as a prerequisite for all other Entra resource syncs.
+
+    :param neo4j_session: Neo4j session
+    :param tenant_id: Entra tenant ID
+    :param client_id: Azure application client ID
+    :param client_secret: Azure application client secret
+    :param update_tag: Update tag for tracking data freshness
+    """
+    credential = ClientSecretCredential(
+        tenant_id=tenant_id,
+        client_id=client_id,
+        client_secret=client_secret,
+    )
+    client = GraphServiceClient(
+        credential, scopes=["https://graph.microsoft.com/.default"]
+    )
+
+    # Fetch tenant and load it
+    tenant = await get_tenant(client)
+    transformed_tenant = transform_tenant(tenant, tenant_id)
+    load_tenant(neo4j_session, transformed_tenant, update_tag)
+
+
+@timeit
+def start_entra_ingestion(neo4j_session: neo4j.Session, config: Config) -> None:
+    """
+    If this module is configured, perform ingestion of Entra data. Otherwise warn and exit
+    :param neo4j_session: Neo4J session for database interface
+    :param config: A cartography.config object
+    :return: None
+    """
+
+    if (
+        not config.entra_tenant_id
+        or not config.entra_client_id
+        or not config.entra_client_secret
+    ):
+        logger.info(
+            "Entra import is not configured - skipping this module. "
+            "See docs to configure.",
+        )
+        return
+
+    common_job_parameters = {
+        "UPDATE_TAG": config.update_tag,
+        "TENANT_ID": config.entra_tenant_id,
+    }
+
+    async def main() -> None:
+        # Load tenant first as a prerequisite for all resource syncs
+        await sync_tenant(
+            neo4j_session,
+            config.entra_tenant_id,
+            config.entra_client_id,
+            config.entra_client_secret,
+            config.update_tag,
+        )
+
+        # Run user sync
+        await sync_entra_users(
+            neo4j_session,
+            config.entra_tenant_id,
+            config.entra_client_id,
+            config.entra_client_secret,
+            config.update_tag,
+            common_job_parameters,
+        )
+
+        # Run group sync
+        await sync_entra_groups(
+            neo4j_session,
+            config.entra_tenant_id,
+            config.entra_client_id,
+            config.entra_client_secret,
+            config.update_tag,
+            common_job_parameters,
+        )
+
+        # Run OU sync
+        await sync_entra_ous(
+            neo4j_session,
+            config.entra_tenant_id,
+            config.entra_client_id,
+            config.entra_client_secret,
+            config.update_tag,
+            common_job_parameters,
+        )
+
+        # Run application sync
+        await sync_entra_applications(
+            neo4j_session,
+            config.entra_tenant_id,
+            config.entra_client_id,
+            config.entra_client_secret,
+            config.update_tag,
+            common_job_parameters,
+        )
+
+        # Run service principals sync
+        await sync_service_principals(
+            neo4j_session,
+            config.entra_tenant_id,
+            config.entra_client_id,
+            config.entra_client_secret,
+            config.update_tag,
+            common_job_parameters,
+        )
+
+        # Run app role assignments sync
+        await sync_app_role_assignments(
+            neo4j_session,
+            config.entra_tenant_id,
+            config.entra_client_id,
+            config.entra_client_secret,
+            config.update_tag,
+            common_job_parameters,
+        )
+
+        # Run federation sync (after all resources are synced)
+        await sync_entra_federation(
+            neo4j_session,
+            config.update_tag,
+            config.entra_tenant_id,
+            common_job_parameters,
+        )
+
+    # Execute syncs in sequence
+    asyncio.run(main())