roadrecon 1.6.0__py3-none-any.whl → 1.6.2__py3-none-any.whl

roadtools/roadrecon/gather.py

@@ -723,8 +723,17 @@ def main(args=None):
             dburl = 'sqlite:///' + args.database
     else:
         dburl = args.database
+    try:
+        _, tokendata = Authentication.parse_accesstoken(token['accessToken'])
+    except KeyError:
+        print('No access token found in tokenfile')
+        return
+    if tokendata['aud'] not in ('https://graph.windows.net', 'https://graph.windows.net/', '00000002-0000-0000-c000-000000000000'):
+        print(f"Wrong token audience, got {tokendata['aud']} but expected https://graph.windows.net")
+        print("Make sure to request a token with -r https://graph.windows.net")
+        return
 
-    headers['Authorization'] = '%s %s' % (token['tokenType'], token['accessToken'])
+    headers['Authorization'] = f"Bearer {token['accessToken']}"
 
     seconds = time.perf_counter()
     loop = asyncio.get_event_loop()

roadtools/roadrecon/plugins/policies.py

@@ -129,6 +129,11 @@ class AccessPoliciesPlugin():
             return self.session.query(ServicePrincipal).filter(ServicePrincipal.objectId.in_(uid)).all()
         return self.session.query(ServicePrincipal).filter(ServicePrincipal.objectId == uid).first()
 
+    def _get_serviceprincipalrule(self, rule):
+        if isinstance(rule, list):
+            return [', '.join(rule)]
+        return [rule]
+
     def _get_role(self, rid):
         if isinstance(rid, list):
             return self.session.query(DirectoryRole).filter(DirectoryRole.roleTemplateId.in_(rid)).all()
@@ -174,6 +179,7 @@ class AccessPoliciesPlugin():
             'Groups' : self._get_group,
             'Roles': self._get_role,
             'ServicePrincipals': self._get_serviceprincipal,
+            'ServicePrincipalFilterRule': self._get_serviceprincipalrule,
             'GuestsOrExternalUsers': self._translate_guestsexternal
         }
         ot = ''
@@ -206,6 +212,9 @@ class AccessPoliciesPlugin():
                 elif ctype == 'GuestsOrExternalUsers':
                     ot += 'Guests or external user types: '
                     ot += ', '.join([escape(uobj) for uobj in objects])
+                elif ctype == 'ServicePrincipalFilterRule':
+                    ot += 'Service Principals matching the following filter: '
+                    ot += ', '.join([escape(sprule) for sprule in objects])
                 else:
                     raise Exception('Unsupported criterium type: {0}'.format(ctype))
             else:
@@ -222,18 +231,20 @@ class AccessPoliciesPlugin():
                 ot += ', '.join([escape(action) for action in clist])
             else:
                 if 'All' in clist:
-                    ot += 'All applications'
+                    ot += 'All resources'
                     break
                 if 'None' in clist:
                     ot += 'None'
                     break
                 if 'Office365' in clist:
-                    ot += 'All Office 365 applications'
+                    ot += 'All Office 365 applications '
+                if 'MicrosoftAdminPortals' in clist:
+                    ot += 'All Microsoft Admin Portals '
                 objects = self._get_application(clist)
                 if objects is not None: 
                     if len(objects) > 0:
                         if ctype == 'Applications':
-                            ot += 'Applications: '
+                            ot += 'Resources: '
                             ot += ', '.join([escape(uobj.displayName) for uobj in objects])
         return ot
 
@@ -510,9 +521,9 @@ class AccessPoliciesPlugin():
                 print(policy.objectId)
             detail = json.loads(policy.policyDetail[0])
             if detail['State'] == 'Reporting':
-                out['name'] += ' (<strong>Report only</strong>)'
+                out['name'] += ' (<i>Report only</i>)'
             elif detail['State'] != 'Enabled':
-                out['name'] += ' (<strong>Disabled</strong>)'
+                out['name'] += ' (<i>Disabled</i>)'
             if should_print:
                 pp.pprint(detail)
             try:
@@ -524,6 +535,7 @@ class AccessPoliciesPlugin():
                     print('Invalid policy - no conditions')
                 continue
             out['who'] = self._parse_who(conditions)
+            out['status'] = escape(detail['State'])
             out['applications'] = self._parse_application(conditions)
             out['authflows'] = self._parse_authflows(conditions)
             out['platforms'] = self._parse_platform(conditions)
@@ -601,7 +613,9 @@ class AccessPoliciesPlugin():
         for out in ol:
             table = '<thead><tr><td colspan="2">{0}</td></tr></thead><tbody>'.format(out['name'])
             table += '<tr><td>Applies to</td><td>{0}</td></tr>'.format(out['who'])
-            table += '<tr><td>Applications</td><td>{0}</td></tr>'.format(out['applications'])
+            if out['status'] != 'Enabled':
+                table += '<tr><td>Policy state</td><td>{0}</td></tr>'.format(out['status'])
+            table += '<tr><td>Resources</td><td>{0}</td></tr>'.format(out['applications'])
             if out['platforms'] != '':
                 table += '<tr><td>On platforms</td><td>{0}</td></tr>'.format(out['platforms'])
             if out['devices'] != '':

roadtools/roadrecon/server.py

@@ -507,9 +507,24 @@ def get_allroles():
                 'scopeNames': snames,
                 'scopeIds': sids
             }
-            _, principal = resolve_objectid(assignment.principalId)
+            principalType, principal = resolve_objectid(assignment.principalId)
             aobj['principal'] = principal
+
             roleobj['assignments'].append(aobj)
+            if principalType == 'Group':
+                group = db.session.get(Group, assignment.principalId)
+                for member in group.memberUsers:
+                    mp = users_schema.dump([member])[0]
+                    mp['displayName'] = f"{principal['displayName']} member: {mp['displayName']}"
+                    roleobj['assignments'].append({
+                        'type': 'assignment',
+                        'scope': assignment.resourceScopes,
+                        'scopeTypes': stypes,
+                        'scopeNames': snames,
+                        'scopeIds': sids,
+                        'principal': mp
+                    })
+
         for assignment in role.eligibleAssignments:
             stypes, snames, sids = translate_rolescopes(assignment.resourceScopes)
             aobj = {
@@ -519,9 +534,22 @@ def get_allroles():
                 'scopeNames': snames,
                 'scopeIds': sids
             }
-            _, principal = resolve_objectid(assignment.principalId)
+            principalType, principal = resolve_objectid(assignment.principalId)
             aobj['principal'] = principal
             roleobj['assignments'].append(aobj)
+            if principalType == 'Group':
+                group = db.session.get(Group, assignment.principalId)
+                for member in group.memberUsers:
+                    mp = users_schema.dump([member])[0]
+                    mp['displayName'] = f"{principal['displayName']} member: {mp['displayName']}"
+                    roleobj['assignments'].append({
+                        'type': 'eligible',
+                        'scope': assignment.resourceScopes,
+                        'scopeTypes': stypes,
+                        'scopeNames': snames,
+                        'scopeIds': sids,
+                        'principal': mp
+                    })
         allroles.append(roleobj)
     return jsonify(allroles)