roadrecon 1.6.1__py3-none-any.whl → 1.6.2__py3-none-any.whl

roadtools/roadrecon/gather.py

@@ -723,8 +723,17 @@ def main(args=None):
             dburl = 'sqlite:///' + args.database
     else:
         dburl = args.database
+    try:
+        _, tokendata = Authentication.parse_accesstoken(token['accessToken'])
+    except KeyError:
+        print('No access token found in tokenfile')
+        return
+    if tokendata['aud'] not in ('https://graph.windows.net', 'https://graph.windows.net/', '00000002-0000-0000-c000-000000000000'):
+        print(f"Wrong token audience, got {tokendata['aud']} but expected https://graph.windows.net")
+        print("Make sure to request a token with -r https://graph.windows.net")
+        return
 
-    headers['Authorization'] = '%s %s' % (token['tokenType'], token['accessToken'])
+    headers['Authorization'] = f"Bearer {token['accessToken']}"
 
     seconds = time.perf_counter()
     loop = asyncio.get_event_loop()

roadtools/roadrecon/plugins/policies.py

@@ -231,20 +231,20 @@ class AccessPoliciesPlugin():
                 ot += ', '.join([escape(action) for action in clist])
             else:
                 if 'All' in clist:
-                    ot += 'All applications'
+                    ot += 'All resources'
                     break
                 if 'None' in clist:
                     ot += 'None'
                     break
                 if 'Office365' in clist:
-                    ot += 'All Office 365 applications'
+                    ot += 'All Office 365 applications '
                 if 'MicrosoftAdminPortals' in clist:
-                    ot += 'All Microsoft Admin Portals'
+                    ot += 'All Microsoft Admin Portals '
                 objects = self._get_application(clist)
                 if objects is not None: 
                     if len(objects) > 0:
                         if ctype == 'Applications':
-                            ot += 'Applications: '
+                            ot += 'Resources: '
                             ot += ', '.join([escape(uobj.displayName) for uobj in objects])
         return ot
 
@@ -521,9 +521,9 @@ class AccessPoliciesPlugin():
                 print(policy.objectId)
             detail = json.loads(policy.policyDetail[0])
             if detail['State'] == 'Reporting':
-                out['name'] += ' (<strong>Report only</strong>)'
+                out['name'] += ' (<i>Report only</i>)'
             elif detail['State'] != 'Enabled':
-                out['name'] += ' (<strong>Disabled</strong>)'
+                out['name'] += ' (<i>Disabled</i>)'
             if should_print:
                 pp.pprint(detail)
             try:
@@ -535,6 +535,7 @@ class AccessPoliciesPlugin():
                     print('Invalid policy - no conditions')
                 continue
             out['who'] = self._parse_who(conditions)
+            out['status'] = escape(detail['State'])
             out['applications'] = self._parse_application(conditions)
             out['authflows'] = self._parse_authflows(conditions)
             out['platforms'] = self._parse_platform(conditions)
@@ -612,7 +613,9 @@ class AccessPoliciesPlugin():
         for out in ol:
             table = '<thead><tr><td colspan="2">{0}</td></tr></thead><tbody>'.format(out['name'])
             table += '<tr><td>Applies to</td><td>{0}</td></tr>'.format(out['who'])
-            table += '<tr><td>Applications</td><td>{0}</td></tr>'.format(out['applications'])
+            if out['status'] != 'Enabled':
+                table += '<tr><td>Policy state</td><td>{0}</td></tr>'.format(out['status'])
+            table += '<tr><td>Resources</td><td>{0}</td></tr>'.format(out['applications'])
             if out['platforms'] != '':
                 table += '<tr><td>On platforms</td><td>{0}</td></tr>'.format(out['platforms'])
             if out['devices'] != '':

roadtools/roadrecon/server.py

@@ -507,9 +507,24 @@ def get_allroles():
                 'scopeNames': snames,
                 'scopeIds': sids
             }
-            _, principal = resolve_objectid(assignment.principalId)
+            principalType, principal = resolve_objectid(assignment.principalId)
             aobj['principal'] = principal
+
             roleobj['assignments'].append(aobj)
+            if principalType == 'Group':
+                group = db.session.get(Group, assignment.principalId)
+                for member in group.memberUsers:
+                    mp = users_schema.dump([member])[0]
+                    mp['displayName'] = f"{principal['displayName']} member: {mp['displayName']}"
+                    roleobj['assignments'].append({
+                        'type': 'assignment',
+                        'scope': assignment.resourceScopes,
+                        'scopeTypes': stypes,
+                        'scopeNames': snames,
+                        'scopeIds': sids,
+                        'principal': mp
+                    })
+
         for assignment in role.eligibleAssignments:
             stypes, snames, sids = translate_rolescopes(assignment.resourceScopes)
             aobj = {
@@ -519,9 +534,22 @@ def get_allroles():
                 'scopeNames': snames,
                 'scopeIds': sids
             }
-            _, principal = resolve_objectid(assignment.principalId)
+            principalType, principal = resolve_objectid(assignment.principalId)
             aobj['principal'] = principal
             roleobj['assignments'].append(aobj)
+            if principalType == 'Group':
+                group = db.session.get(Group, assignment.principalId)
+                for member in group.memberUsers:
+                    mp = users_schema.dump([member])[0]
+                    mp['displayName'] = f"{principal['displayName']} member: {mp['displayName']}"
+                    roleobj['assignments'].append({
+                        'type': 'eligible',
+                        'scope': assignment.resourceScopes,
+                        'scopeTypes': stypes,
+                        'scopeNames': snames,
+                        'scopeIds': sids,
+                        'principal': mp
+                    })
         allroles.append(roleobj)
     return jsonify(allroles)