roadrecon 1.5.0__py3-none-any.whl → 1.6.1__py3-none-any.whl

roadtools/roadrecon/gather.py

@@ -25,6 +25,7 @@ from roadtools.roadlib.metadef.database import (
 from sqlalchemy import bindparam, func, text
 from sqlalchemy.dialects.postgresql import insert as pginsert
 from sqlalchemy.orm import sessionmaker
+from datetime import datetime
 
 warnings.simplefilter('ignore')
 token = None
@@ -124,11 +125,14 @@ def checktoken():
         auth.tokendata = token
         if 'useragent' in token:
             auth.set_user_agent(token['useragent'])
+        if 'originheader' in token:
+            auth.set_origin_value(token['originheader'])
         if 'refreshToken' in token:
+            print("- Attempting token refresh -")
             token = auth.authenticate_with_refresh(token)
             headers['Authorization'] = '%s %s' % (token['tokenType'], token['accessToken'])
             expiretime = time.time() + token['expiresIn']
-            print('Refreshed token')
+            print('+ Refreshed token +')
             return True
         elif time.time() > expiretime:
             print('Access token is expired, but no access to refresh token! Dumping will fail')

roadtools/roadrecon/plugins/policies.py

@@ -129,6 +129,11 @@ class AccessPoliciesPlugin():
             return self.session.query(ServicePrincipal).filter(ServicePrincipal.objectId.in_(uid)).all()
         return self.session.query(ServicePrincipal).filter(ServicePrincipal.objectId == uid).first()
 
+    def _get_serviceprincipalrule(self, rule):
+        if isinstance(rule, list):
+            return [', '.join(rule)]
+        return [rule]
+
     def _get_role(self, rid):
         if isinstance(rid, list):
             return self.session.query(DirectoryRole).filter(DirectoryRole.roleTemplateId.in_(rid)).all()
@@ -174,6 +179,7 @@ class AccessPoliciesPlugin():
             'Groups' : self._get_group,
             'Roles': self._get_role,
             'ServicePrincipals': self._get_serviceprincipal,
+            'ServicePrincipalFilterRule': self._get_serviceprincipalrule,
             'GuestsOrExternalUsers': self._translate_guestsexternal
         }
         ot = ''
@@ -206,6 +212,9 @@ class AccessPoliciesPlugin():
                 elif ctype == 'GuestsOrExternalUsers':
                     ot += 'Guests or external user types: '
                     ot += ', '.join([escape(uobj) for uobj in objects])
+                elif ctype == 'ServicePrincipalFilterRule':
+                    ot += 'Service Principals matching the following filter: '
+                    ot += ', '.join([escape(sprule) for sprule in objects])
                 else:
                     raise Exception('Unsupported criterium type: {0}'.format(ctype))
             else:
@@ -229,6 +238,8 @@ class AccessPoliciesPlugin():
                     break
                 if 'Office365' in clist:
                     ot += 'All Office 365 applications'
+                if 'MicrosoftAdminPortals' in clist:
+                    ot += 'All Microsoft Admin Portals'
                 objects = self._get_application(clist)
                 if objects is not None: 
                     if len(objects) > 0:

roadtools/roadrecon/server.py

@@ -41,7 +41,7 @@ class RTModelSchema(ma.SQLAlchemyAutoSchema):
 class UsersSchema(ma.Schema):
     class Meta:
         model = User
-        fields = ('objectId', 'objectType', 'userPrincipalName', 'displayName', 'mail', 'lastDirSyncTime', 'accountEnabled', 'department', 'lastPasswordChangeDateTime', 'jobTitle', 'mobile', 'dirSyncEnabled', 'strongAuthenticationDetail', 'userType')
+        fields = ('objectId', 'objectType', 'userPrincipalName', 'displayName', 'mail', 'lastDirSyncTime', 'accountEnabled', 'department', 'lastPasswordChangeDateTime', 'jobTitle', 'mobile', 'dirSyncEnabled', 'strongAuthenticationDetail', 'userType', 'searchableDeviceKey')
 
 class DevicesSchema(ma.Schema):
     class Meta:
@@ -323,7 +323,8 @@ def get_mfa():
             'has_app': has_app,
             'has_phonenr': has_phonenr,
             'has_fido': has_fido,
-            'strongAuthenticationDetail': user.strongAuthenticationDetail
+            'strongAuthenticationDetail': user.strongAuthenticationDetail,
+            'searchableDeviceKey': user.searchableDeviceKey
         })
     return jsonify(out)