AADConsole/Program.cs at main · robertmwolf/AADConsole · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
usingAzure.Identity;
usingMicrosoft.Extensions.Configuration;
usingMicrosoft.Graph;
usingMicrosoft.Graph.Models;
usingMicrosoft.Identity.Client;
usingSystem;
usingSystem.Collections.Generic;
usingSystem.Threading.Tasks;

namespaceConsole_Interactive_MultiTarget
{
internalclassProgram
{
privatestaticPublicClientApplicationOptionsappConfiguration=null;
privatestaticIConfigurationconfiguration;
privatestaticstringMSGraphURL;

// The MSAL Public client app
privatestaticIPublicClientApplicationapplication;

privatestaticasyncTaskMain(string[]args)
{
// Using appsettings.json for our configuration settings
varbuilder=newConfigurationBuilder()
.SetBasePath(System.IO.Directory.GetCurrentDirectory())
.AddJsonFile("appsettings.json");

configuration=builder.Build();

appConfiguration=configuration
.Get<PublicClientApplicationOptions>();

string[]scopes=new[]{"https://graph.microsoft.com/.default"};

GraphServiceClientgraphClient=awaitInitializeGraphServiceClient(appConfiguration,scopes);


//call different endpoint
UserCollectionResponseusers=(UserCollectionResponse)awaitCallUsersAsync(graphClient);
Console.WriteLine(users.Value);

stringuserid="281b2d29-d2b2-4431-be30-d51d4809ae42";//object id of rowol account, is in the group and is authorized
stringunauthorizeduser="91d3b422-2a90-433b-9fdd-f5009c1a9ae1";//object id of some other user account, is NOT in the group and is unauthorized

stringACEGroupID="7bdc4358-5206-419c-be77-88764674c567";//authorized group for ACE, retrieve from config

stringAceUserGroup="7bdc4358-5206-419c-be77-88764674c567";//This would be a group for ACE users
stringAceApproverGroup="7bdc4358-5206-419c-be77-88764674c567";//This is ACE approvers group, so it is higher level of access


boolAuthorizedACEUser=awaitIsMember(graphClient,userid,ACEGroupID);
//bool IsAuthorizedForVuln = await IsMember(graphClient, userid, VulnarabiltyGroupID);
Console.WriteLine("Is this user authorized to use ACE user search? They should be {0}",AuthorizedACEUser);

boolIsNOTAuthorizedForACE=awaitIsMember(graphClient,unauthorizeduser,ACEGroupID);
Console.WriteLine("Is this user authorized to use ACE user search? They should not be {0}",IsNOTAuthorizedForACE);

// TODO:
// retrieve the list of searches we have onboarded (all the customers in DSR so far) from the config. ACE, SAS, etc.
// This list has groups that we know have access to them
// instantiate a list of searches we will perform for the user (empty for now)
// for each cognitive search index we have onboarded
// check if user is in the group (or groups) that has access to index. If so, add that index to the list of searches we will perform for the user
// return the list of searches we will perform for the user to the orchestrator to perform and concatinate together

}

privatestaticasyncTask<bool>IsMember(GraphServiceClientgraphClient2,stringuserid,stringgroupid)
{
varrequestBody=newMicrosoft.Graph.DirectoryObjects.Item.CheckMemberGroups.CheckMemberGroupsPostRequestBody
{
GroupIds=newList<string>
{
groupid,
},
};
varresult=awaitgraphClient2.DirectoryObjects[userid].CheckMemberGroups.PostAsync(requestBody);
returnresult.Value.Contains(groupid);
}

privatestaticasyncTask<GraphServiceClient>InitializeGraphServiceClient(PublicClientApplicationOptionsappConfiguration,string[]scopes)
{
varclientId=appConfiguration.ClientId;
vartenantId=appConfiguration.TenantId;
varclientSecret="[Insert Secret Value For Test]";

// using Azure.Identity;
varoptions=newClientSecretCredentialOptions
{
AuthorityHost=AzureAuthorityHosts.AzurePublicCloud,
};

// https://learn.microsoft.com/dotnet/api/azure.identity.clientsecretcredential
varclientSecretCredential=newClientSecretCredential(
tenantId,clientId,clientSecret,options);

vargraphClient=newGraphServiceClient(clientSecretCredential,scopes);
returngraphClient;
}

privatestaticasyncTask<object>CallUsersAsync(GraphServiceClientgraphClient)
{
varres=awaitgraphClient.Users.GetAsync();
returnres;
}
}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
usingAzure.Identity;
usingMicrosoft.Extensions.Configuration;
usingMicrosoft.Graph;
usingMicrosoft.Graph.Models;
usingMicrosoft.Identity.Client;
usingSystem;
usingSystem.Collections.Generic;
usingSystem.Threading.Tasks;

namespaceConsole_Interactive_MultiTarget
{
internalclassProgram
{
privatestaticPublicClientApplicationOptionsappConfiguration=null;
privatestaticIConfigurationconfiguration;
privatestaticstringMSGraphURL;

// The MSAL Public client app
privatestaticIPublicClientApplicationapplication;

privatestaticasyncTaskMain(string[]args)
{
// Using appsettings.json for our configuration settings
varbuilder=newConfigurationBuilder()
.SetBasePath(System.IO.Directory.GetCurrentDirectory())
.AddJsonFile("appsettings.json");

configuration=builder.Build();

appConfiguration=configuration
.Get<PublicClientApplicationOptions>();

string[]scopes=new[]{"https://graph.microsoft.com/.default"};

GraphServiceClientgraphClient=awaitInitializeGraphServiceClient(appConfiguration,scopes);


//call different endpoint
UserCollectionResponseusers=(UserCollectionResponse)awaitCallUsersAsync(graphClient);
Console.WriteLine(users.Value);

stringuserid="281b2d29-d2b2-4431-be30-d51d4809ae42";//object id of rowol account, is in the group and is authorized
stringunauthorizeduser="91d3b422-2a90-433b-9fdd-f5009c1a9ae1";//object id of some other user account, is NOT in the group and is unauthorized

stringACEGroupID="7bdc4358-5206-419c-be77-88764674c567";//authorized group for ACE, retrieve from config

stringAceUserGroup="7bdc4358-5206-419c-be77-88764674c567";//This would be a group for ACE users
stringAceApproverGroup="7bdc4358-5206-419c-be77-88764674c567";//This is ACE approvers group, so it is higher level of access


boolAuthorizedACEUser=awaitIsMember(graphClient,userid,ACEGroupID);
//bool IsAuthorizedForVuln = await IsMember(graphClient, userid, VulnarabiltyGroupID);
Console.WriteLine("Is this user authorized to use ACE user search? They should be {0}",AuthorizedACEUser);

boolIsNOTAuthorizedForACE=awaitIsMember(graphClient,unauthorizeduser,ACEGroupID);
Console.WriteLine("Is this user authorized to use ACE user search? They should not be {0}",IsNOTAuthorizedForACE);

// TODO:
// retrieve the list of searches we have onboarded (all the customers in DSR so far) from the config. ACE, SAS, etc.
// This list has groups that we know have access to them
// instantiate a list of searches we will perform for the user (empty for now)
// for each cognitive search index we have onboarded
// check if user is in the group (or groups) that has access to index. If so, add that index to the list of searches we will perform for the user
// return the list of searches we will perform for the user to the orchestrator to perform and concatinate together

}

privatestaticasyncTask<bool>IsMember(GraphServiceClientgraphClient2,stringuserid,stringgroupid)
{
varrequestBody=newMicrosoft.Graph.DirectoryObjects.Item.CheckMemberGroups.CheckMemberGroupsPostRequestBody
{
GroupIds=newList<string>
{
groupid,
},
};
varresult=awaitgraphClient2.DirectoryObjects[userid].CheckMemberGroups.PostAsync(requestBody);
returnresult.Value.Contains(groupid);
}

privatestaticasyncTask<GraphServiceClient>InitializeGraphServiceClient(PublicClientApplicationOptionsappConfiguration,string[]scopes)
{
varclientId=appConfiguration.ClientId;
vartenantId=appConfiguration.TenantId;
varclientSecret="[Insert Secret Value For Test]";

// using Azure.Identity;
varoptions=newClientSecretCredentialOptions
{
AuthorityHost=AzureAuthorityHosts.AzurePublicCloud,
};

// https://learn.microsoft.com/dotnet/api/azure.identity.clientsecretcredential
varclientSecretCredential=newClientSecretCredential(
tenantId,clientId,clientSecret,options);

vargraphClient=newGraphServiceClient(clientSecretCredential,scopes);
returngraphClient;
}

privatestaticasyncTask<object>CallUsersAsync(GraphServiceClientgraphClient)
{
varres=awaitgraphClient.Users.GetAsync();
returnres;
}
}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
usingAzure.Identity;
usingMicrosoft.Extensions.Configuration;
usingMicrosoft.Graph;
usingMicrosoft.Graph.Models;
usingMicrosoft.Identity.Client;
usingSystem;
usingSystem.Collections.Generic;
usingSystem.Threading.Tasks;

namespaceConsole_Interactive_MultiTarget
{
internalclassProgram
{
privatestaticPublicClientApplicationOptionsappConfiguration=null;
privatestaticIConfigurationconfiguration;
privatestaticstringMSGraphURL;

// The MSAL Public client app
privatestaticIPublicClientApplicationapplication;

privatestaticasyncTaskMain(string[]args)
{
// Using appsettings.json for our configuration settings
varbuilder=newConfigurationBuilder()
.SetBasePath(System.IO.Directory.GetCurrentDirectory())
.AddJsonFile("appsettings.json");

configuration=builder.Build();

appConfiguration=configuration
.Get<PublicClientApplicationOptions>();

string[]scopes=new[]{"https://graph.microsoft.com/.default"};

GraphServiceClientgraphClient=awaitInitializeGraphServiceClient(appConfiguration,scopes);


//call different endpoint
UserCollectionResponseusers=(UserCollectionResponse)awaitCallUsersAsync(graphClient);
Console.WriteLine(users.Value);

stringuserid="281b2d29-d2b2-4431-be30-d51d4809ae42";//object id of rowol account, is in the group and is authorized
stringunauthorizeduser="91d3b422-2a90-433b-9fdd-f5009c1a9ae1";//object id of some other user account, is NOT in the group and is unauthorized

stringACEGroupID="7bdc4358-5206-419c-be77-88764674c567";//authorized group for ACE, retrieve from config

stringAceUserGroup="7bdc4358-5206-419c-be77-88764674c567";//This would be a group for ACE users
stringAceApproverGroup="7bdc4358-5206-419c-be77-88764674c567";//This is ACE approvers group, so it is higher level of access


boolAuthorizedACEUser=awaitIsMember(graphClient,userid,ACEGroupID);
//bool IsAuthorizedForVuln = await IsMember(graphClient, userid, VulnarabiltyGroupID);
Console.WriteLine("Is this user authorized to use ACE user search? They should be {0}",AuthorizedACEUser);

boolIsNOTAuthorizedForACE=awaitIsMember(graphClient,unauthorizeduser,ACEGroupID);
Console.WriteLine("Is this user authorized to use ACE user search? They should not be {0}",IsNOTAuthorizedForACE);

// TODO:
// retrieve the list of searches we have onboarded (all the customers in DSR so far) from the config. ACE, SAS, etc.
// This list has groups that we know have access to them
// instantiate a list of searches we will perform for the user (empty for now)
// for each cognitive search index we have onboarded
// check if user is in the group (or groups) that has access to index. If so, add that index to the list of searches we will perform for the user
// return the list of searches we will perform for the user to the orchestrator to perform and concatinate together

}

privatestaticasyncTask<bool>IsMember(GraphServiceClientgraphClient2,stringuserid,stringgroupid)
{
varrequestBody=newMicrosoft.Graph.DirectoryObjects.Item.CheckMemberGroups.CheckMemberGroupsPostRequestBody
{
GroupIds=newList<string>
{
groupid,
},
};
varresult=awaitgraphClient2.DirectoryObjects[userid].CheckMemberGroups.PostAsync(requestBody);
returnresult.Value.Contains(groupid);
}

privatestaticasyncTask<GraphServiceClient>InitializeGraphServiceClient(PublicClientApplicationOptionsappConfiguration,string[]scopes)
{
varclientId=appConfiguration.ClientId;
vartenantId=appConfiguration.TenantId;
varclientSecret="[Insert Secret Value For Test]";

// using Azure.Identity;
varoptions=newClientSecretCredentialOptions
{
AuthorityHost=AzureAuthorityHosts.AzurePublicCloud,
};

// https://learn.microsoft.com/dotnet/api/azure.identity.clientsecretcredential
varclientSecretCredential=newClientSecretCredential(
tenantId,clientId,clientSecret,options);

vargraphClient=newGraphServiceClient(clientSecretCredential,scopes);
returngraphClient;
}

privatestaticasyncTask<object>CallUsersAsync(GraphServiceClientgraphClient)
{
varres=awaitgraphClient.Users.GetAsync();
returnres;
}
}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
usingAzure.Identity;
usingMicrosoft.Extensions.Configuration;
usingMicrosoft.Graph;
usingMicrosoft.Graph.Models;
usingMicrosoft.Identity.Client;
usingSystem;
usingSystem.Collections.Generic;
usingSystem.Threading.Tasks;

namespaceConsole_Interactive_MultiTarget
{
internalclassProgram
{
privatestaticPublicClientApplicationOptionsappConfiguration=null;
privatestaticIConfigurationconfiguration;
privatestaticstringMSGraphURL;

// The MSAL Public client app
privatestaticIPublicClientApplicationapplication;

privatestaticasyncTaskMain(string[]args)
{
// Using appsettings.json for our configuration settings
varbuilder=newConfigurationBuilder()
.SetBasePath(System.IO.Directory.GetCurrentDirectory())
.AddJsonFile("appsettings.json");

configuration=builder.Build();

appConfiguration=configuration
.Get<PublicClientApplicationOptions>();

string[]scopes=new[]{"https://graph.microsoft.com/.default"};

GraphServiceClientgraphClient=awaitInitializeGraphServiceClient(appConfiguration,scopes);


//call different endpoint
UserCollectionResponseusers=(UserCollectionResponse)awaitCallUsersAsync(graphClient);
Console.WriteLine(users.Value);

stringuserid="281b2d29-d2b2-4431-be30-d51d4809ae42";//object id of rowol account, is in the group and is authorized
stringunauthorizeduser="91d3b422-2a90-433b-9fdd-f5009c1a9ae1";//object id of some other user account, is NOT in the group and is unauthorized

stringACEGroupID="7bdc4358-5206-419c-be77-88764674c567";//authorized group for ACE, retrieve from config

stringAceUserGroup="7bdc4358-5206-419c-be77-88764674c567";//This would be a group for ACE users
stringAceApproverGroup="7bdc4358-5206-419c-be77-88764674c567";//This is ACE approvers group, so it is higher level of access


boolAuthorizedACEUser=awaitIsMember(graphClient,userid,ACEGroupID);
//bool IsAuthorizedForVuln = await IsMember(graphClient, userid, VulnarabiltyGroupID);
Console.WriteLine("Is this user authorized to use ACE user search? They should be {0}",AuthorizedACEUser);

boolIsNOTAuthorizedForACE=awaitIsMember(graphClient,unauthorizeduser,ACEGroupID);
Console.WriteLine("Is this user authorized to use ACE user search? They should not be {0}",IsNOTAuthorizedForACE);

// TODO:
// retrieve the list of searches we have onboarded (all the customers in DSR so far) from the config. ACE, SAS, etc.
// This list has groups that we know have access to them
// instantiate a list of searches we will perform for the user (empty for now)
// for each cognitive search index we have onboarded
// check if user is in the group (or groups) that has access to index. If so, add that index to the list of searches we will perform for the user
// return the list of searches we will perform for the user to the orchestrator to perform and concatinate together

}

privatestaticasyncTask<bool>IsMember(GraphServiceClientgraphClient2,stringuserid,stringgroupid)
{
varrequestBody=newMicrosoft.Graph.DirectoryObjects.Item.CheckMemberGroups.CheckMemberGroupsPostRequestBody
{
GroupIds=newList<string>
{
groupid,
},
};
varresult=awaitgraphClient2.DirectoryObjects[userid].CheckMemberGroups.PostAsync(requestBody);
returnresult.Value.Contains(groupid);
}

privatestaticasyncTask<GraphServiceClient>InitializeGraphServiceClient(PublicClientApplicationOptionsappConfiguration,string[]scopes)
{
varclientId=appConfiguration.ClientId;
vartenantId=appConfiguration.TenantId;
varclientSecret="[Insert Secret Value For Test]";

// using Azure.Identity;
varoptions=newClientSecretCredentialOptions
{
AuthorityHost=AzureAuthorityHosts.AzurePublicCloud,
};

// https://learn.microsoft.com/dotnet/api/azure.identity.clientsecretcredential
varclientSecretCredential=newClientSecretCredential(
tenantId,clientId,clientSecret,options);

vargraphClient=newGraphServiceClient(clientSecretCredential,scopes);
returngraphClient;
}

privatestaticasyncTask<object>CallUsersAsync(GraphServiceClientgraphClient)
{
varres=awaitgraphClient.Users.GetAsync();
returnres;
}
}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
usingAzure.Identity;
usingMicrosoft.Extensions.Configuration;
usingMicrosoft.Graph;
usingMicrosoft.Graph.Models;
usingMicrosoft.Identity.Client;
usingSystem;
usingSystem.Collections.Generic;
usingSystem.Threading.Tasks;

namespaceConsole_Interactive_MultiTarget
{
internalclassProgram
{
privatestaticPublicClientApplicationOptionsappConfiguration=null;
privatestaticIConfigurationconfiguration;
privatestaticstringMSGraphURL;

// The MSAL Public client app
privatestaticIPublicClientApplicationapplication;

privatestaticasyncTaskMain(string[]args)
{
// Using appsettings.json for our configuration settings
varbuilder=newConfigurationBuilder()
.SetBasePath(System.IO.Directory.GetCurrentDirectory())
.AddJsonFile("appsettings.json");

configuration=builder.Build();

appConfiguration=configuration
.Get<PublicClientApplicationOptions>();

string[]scopes=new[]{"https://graph.microsoft.com/.default"};

GraphServiceClientgraphClient=awaitInitializeGraphServiceClient(appConfiguration,scopes);


//call different endpoint
UserCollectionResponseusers=(UserCollectionResponse)awaitCallUsersAsync(graphClient);
Console.WriteLine(users.Value);

stringuserid="281b2d29-d2b2-4431-be30-d51d4809ae42";//object id of rowol account, is in the group and is authorized
stringunauthorizeduser="91d3b422-2a90-433b-9fdd-f5009c1a9ae1";//object id of some other user account, is NOT in the group and is unauthorized

stringACEGroupID="7bdc4358-5206-419c-be77-88764674c567";//authorized group for ACE, retrieve from config

stringAceUserGroup="7bdc4358-5206-419c-be77-88764674c567";//This would be a group for ACE users
stringAceApproverGroup="7bdc4358-5206-419c-be77-88764674c567";//This is ACE approvers group, so it is higher level of access


boolAuthorizedACEUser=awaitIsMember(graphClient,userid,ACEGroupID);
//bool IsAuthorizedForVuln = await IsMember(graphClient, userid, VulnarabiltyGroupID);
Console.WriteLine("Is this user authorized to use ACE user search? They should be {0}",AuthorizedACEUser);

boolIsNOTAuthorizedForACE=awaitIsMember(graphClient,unauthorizeduser,ACEGroupID);
Console.WriteLine("Is this user authorized to use ACE user search? They should not be {0}",IsNOTAuthorizedForACE);

// TODO:
// retrieve the list of searches we have onboarded (all the customers in DSR so far) from the config. ACE, SAS, etc.
// This list has groups that we know have access to them
// instantiate a list of searches we will perform for the user (empty for now)
// for each cognitive search index we have onboarded
// check if user is in the group (or groups) that has access to index. If so, add that index to the list of searches we will perform for the user
// return the list of searches we will perform for the user to the orchestrator to perform and concatinate together

}

privatestaticasyncTask<bool>IsMember(GraphServiceClientgraphClient2,stringuserid,stringgroupid)
{
varrequestBody=newMicrosoft.Graph.DirectoryObjects.Item.CheckMemberGroups.CheckMemberGroupsPostRequestBody
{
GroupIds=newList<string>
{
groupid,
},
};
varresult=awaitgraphClient2.DirectoryObjects[userid].CheckMemberGroups.PostAsync(requestBody);
returnresult.Value.Contains(groupid);
}

privatestaticasyncTask<GraphServiceClient>InitializeGraphServiceClient(PublicClientApplicationOptionsappConfiguration,string[]scopes)
{
varclientId=appConfiguration.ClientId;
vartenantId=appConfiguration.TenantId;
varclientSecret="[Insert Secret Value For Test]";

// using Azure.Identity;
varoptions=newClientSecretCredentialOptions
{
AuthorityHost=AzureAuthorityHosts.AzurePublicCloud,
};

// https://learn.microsoft.com/dotnet/api/azure.identity.clientsecretcredential
varclientSecretCredential=newClientSecretCredential(
tenantId,clientId,clientSecret,options);

vargraphClient=newGraphServiceClient(clientSecretCredential,scopes);
returngraphClient;
}

privatestaticasyncTask<object>CallUsersAsync(GraphServiceClientgraphClient)
{
varres=awaitgraphClient.Users.GetAsync();
returnres;
}
}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
usingAzure.Identity;
usingMicrosoft.Extensions.Configuration;
usingMicrosoft.Graph;
usingMicrosoft.Graph.Models;
usingMicrosoft.Identity.Client;
usingSystem;
usingSystem.Collections.Generic;
usingSystem.Threading.Tasks;

namespaceConsole_Interactive_MultiTarget
{
internalclassProgram
{
privatestaticPublicClientApplicationOptionsappConfiguration=null;
privatestaticIConfigurationconfiguration;
privatestaticstringMSGraphURL;

// The MSAL Public client app
privatestaticIPublicClientApplicationapplication;

privatestaticasyncTaskMain(string[]args)
{
// Using appsettings.json for our configuration settings
varbuilder=newConfigurationBuilder()
.SetBasePath(System.IO.Directory.GetCurrentDirectory())
.AddJsonFile("appsettings.json");

configuration=builder.Build();

appConfiguration=configuration
.Get<PublicClientApplicationOptions>();

string[]scopes=new[]{"https://graph.microsoft.com/.default"};

GraphServiceClientgraphClient=awaitInitializeGraphServiceClient(appConfiguration,scopes);


//call different endpoint
UserCollectionResponseusers=(UserCollectionResponse)awaitCallUsersAsync(graphClient);
Console.WriteLine(users.Value);

stringuserid="281b2d29-d2b2-4431-be30-d51d4809ae42";//object id of rowol account, is in the group and is authorized
stringunauthorizeduser="91d3b422-2a90-433b-9fdd-f5009c1a9ae1";//object id of some other user account, is NOT in the group and is unauthorized

stringACEGroupID="7bdc4358-5206-419c-be77-88764674c567";//authorized group for ACE, retrieve from config

stringAceUserGroup="7bdc4358-5206-419c-be77-88764674c567";//This would be a group for ACE users
stringAceApproverGroup="7bdc4358-5206-419c-be77-88764674c567";//This is ACE approvers group, so it is higher level of access


boolAuthorizedACEUser=awaitIsMember(graphClient,userid,ACEGroupID);
//bool IsAuthorizedForVuln = await IsMember(graphClient, userid, VulnarabiltyGroupID);
Console.WriteLine("Is this user authorized to use ACE user search? They should be {0}",AuthorizedACEUser);

boolIsNOTAuthorizedForACE=awaitIsMember(graphClient,unauthorizeduser,ACEGroupID);
Console.WriteLine("Is this user authorized to use ACE user search? They should not be {0}",IsNOTAuthorizedForACE);

// TODO:
// retrieve the list of searches we have onboarded (all the customers in DSR so far) from the config. ACE, SAS, etc.
// This list has groups that we know have access to them
// instantiate a list of searches we will perform for the user (empty for now)
// for each cognitive search index we have onboarded
// check if user is in the group (or groups) that has access to index. If so, add that index to the list of searches we will perform for the user
// return the list of searches we will perform for the user to the orchestrator to perform and concatinate together

}

privatestaticasyncTask<bool>IsMember(GraphServiceClientgraphClient2,stringuserid,stringgroupid)
{
varrequestBody=newMicrosoft.Graph.DirectoryObjects.Item.CheckMemberGroups.CheckMemberGroupsPostRequestBody
{
GroupIds=newList<string>
{
groupid,
},
};
varresult=awaitgraphClient2.DirectoryObjects[userid].CheckMemberGroups.PostAsync(requestBody);
returnresult.Value.Contains(groupid);
}

privatestaticasyncTask<GraphServiceClient>InitializeGraphServiceClient(PublicClientApplicationOptionsappConfiguration,string[]scopes)
{
varclientId=appConfiguration.ClientId;
vartenantId=appConfiguration.TenantId;
varclientSecret="[Insert Secret Value For Test]";

// using Azure.Identity;
varoptions=newClientSecretCredentialOptions
{
AuthorityHost=AzureAuthorityHosts.AzurePublicCloud,
};

// https://learn.microsoft.com/dotnet/api/azure.identity.clientsecretcredential
varclientSecretCredential=newClientSecretCredential(
tenantId,clientId,clientSecret,options);

vargraphClient=newGraphServiceClient(clientSecretCredential,scopes);
returngraphClient;
}

privatestaticasyncTask<object>CallUsersAsync(GraphServiceClientgraphClient)
{
varres=awaitgraphClient.Users.GetAsync();
returnres;
}
}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
usingAzure.Identity;
usingMicrosoft.Extensions.Configuration;
usingMicrosoft.Graph;
usingMicrosoft.Graph.Models;
usingMicrosoft.Identity.Client;
usingSystem;
usingSystem.Collections.Generic;
usingSystem.Threading.Tasks;

namespaceConsole_Interactive_MultiTarget
{
internalclassProgram
{
privatestaticPublicClientApplicationOptionsappConfiguration=null;
privatestaticIConfigurationconfiguration;
privatestaticstringMSGraphURL;

// The MSAL Public client app
privatestaticIPublicClientApplicationapplication;

privatestaticasyncTaskMain(string[]args)
{
// Using appsettings.json for our configuration settings
varbuilder=newConfigurationBuilder()
.SetBasePath(System.IO.Directory.GetCurrentDirectory())
.AddJsonFile("appsettings.json");

configuration=builder.Build();

appConfiguration=configuration
.Get<PublicClientApplicationOptions>();

string[]scopes=new[]{"https://graph.microsoft.com/.default"};

GraphServiceClientgraphClient=awaitInitializeGraphServiceClient(appConfiguration,scopes);


//call different endpoint
UserCollectionResponseusers=(UserCollectionResponse)awaitCallUsersAsync(graphClient);
Console.WriteLine(users.Value);

stringuserid="281b2d29-d2b2-4431-be30-d51d4809ae42";//object id of rowol account, is in the group and is authorized
stringunauthorizeduser="91d3b422-2a90-433b-9fdd-f5009c1a9ae1";//object id of some other user account, is NOT in the group and is unauthorized

stringACEGroupID="7bdc4358-5206-419c-be77-88764674c567";//authorized group for ACE, retrieve from config

stringAceUserGroup="7bdc4358-5206-419c-be77-88764674c567";//This would be a group for ACE users
stringAceApproverGroup="7bdc4358-5206-419c-be77-88764674c567";//This is ACE approvers group, so it is higher level of access


boolAuthorizedACEUser=awaitIsMember(graphClient,userid,ACEGroupID);
//bool IsAuthorizedForVuln = await IsMember(graphClient, userid, VulnarabiltyGroupID);
Console.WriteLine("Is this user authorized to use ACE user search? They should be {0}",AuthorizedACEUser);

boolIsNOTAuthorizedForACE=awaitIsMember(graphClient,unauthorizeduser,ACEGroupID);
Console.WriteLine("Is this user authorized to use ACE user search? They should not be {0}",IsNOTAuthorizedForACE);

// TODO:
// retrieve the list of searches we have onboarded (all the customers in DSR so far) from the config. ACE, SAS, etc.
// This list has groups that we know have access to them
// instantiate a list of searches we will perform for the user (empty for now)
// for each cognitive search index we have onboarded
// check if user is in the group (or groups) that has access to index. If so, add that index to the list of searches we will perform for the user
// return the list of searches we will perform for the user to the orchestrator to perform and concatinate together

}

privatestaticasyncTask<bool>IsMember(GraphServiceClientgraphClient2,stringuserid,stringgroupid)
{
varrequestBody=newMicrosoft.Graph.DirectoryObjects.Item.CheckMemberGroups.CheckMemberGroupsPostRequestBody
{
GroupIds=newList<string>
{
groupid,
},
};
varresult=awaitgraphClient2.DirectoryObjects[userid].CheckMemberGroups.PostAsync(requestBody);
returnresult.Value.Contains(groupid);
}

privatestaticasyncTask<GraphServiceClient>InitializeGraphServiceClient(PublicClientApplicationOptionsappConfiguration,string[]scopes)
{
varclientId=appConfiguration.ClientId;
vartenantId=appConfiguration.TenantId;
varclientSecret="[Insert Secret Value For Test]";

// using Azure.Identity;
varoptions=newClientSecretCredentialOptions
{
AuthorityHost=AzureAuthorityHosts.AzurePublicCloud,
};

// https://learn.microsoft.com/dotnet/api/azure.identity.clientsecretcredential
varclientSecretCredential=newClientSecretCredential(
tenantId,clientId,clientSecret,options);

vargraphClient=newGraphServiceClient(clientSecretCredential,scopes);
returngraphClient;
}

privatestaticasyncTask<object>CallUsersAsync(GraphServiceClientgraphClient)
{
varres=awaitgraphClient.Users.GetAsync();
returnres;
}
}
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
usingAzure.Identity;
usingMicrosoft.Extensions.Configuration;
usingMicrosoft.Graph;
usingMicrosoft.Graph.Models;
usingMicrosoft.Identity.Client;
usingSystem;
usingSystem.Collections.Generic;
usingSystem.Threading.Tasks;

namespaceConsole_Interactive_MultiTarget
{
internalclassProgram
{
privatestaticPublicClientApplicationOptionsappConfiguration=null;
privatestaticIConfigurationconfiguration;
privatestaticstringMSGraphURL;

// The MSAL Public client app
privatestaticIPublicClientApplicationapplication;

privatestaticasyncTaskMain(string[]args)
{
// Using appsettings.json for our configuration settings
varbuilder=newConfigurationBuilder()
.SetBasePath(System.IO.Directory.GetCurrentDirectory())
.AddJsonFile("appsettings.json");

configuration=builder.Build();

appConfiguration=configuration
.Get<PublicClientApplicationOptions>();

string[]scopes=new[]{"https://graph.microsoft.com/.default"};

GraphServiceClientgraphClient=awaitInitializeGraphServiceClient(appConfiguration,scopes);


//call different endpoint
UserCollectionResponseusers=(UserCollectionResponse)awaitCallUsersAsync(graphClient);
Console.WriteLine(users.Value);

stringuserid="281b2d29-d2b2-4431-be30-d51d4809ae42";//object id of rowol account, is in the group and is authorized
stringunauthorizeduser="91d3b422-2a90-433b-9fdd-f5009c1a9ae1";//object id of some other user account, is NOT in the group and is unauthorized

stringACEGroupID="7bdc4358-5206-419c-be77-88764674c567";//authorized group for ACE, retrieve from config

stringAceUserGroup="7bdc4358-5206-419c-be77-88764674c567";//This would be a group for ACE users
stringAceApproverGroup="7bdc4358-5206-419c-be77-88764674c567";//This is ACE approvers group, so it is higher level of access


boolAuthorizedACEUser=awaitIsMember(graphClient,userid,ACEGroupID);
//bool IsAuthorizedForVuln = await IsMember(graphClient, userid, VulnarabiltyGroupID);
Console.WriteLine("Is this user authorized to use ACE user search? They should be {0}",AuthorizedACEUser);

boolIsNOTAuthorizedForACE=awaitIsMember(graphClient,unauthorizeduser,ACEGroupID);
Console.WriteLine("Is this user authorized to use ACE user search? They should not be {0}",IsNOTAuthorizedForACE);

// TODO:
// retrieve the list of searches we have onboarded (all the customers in DSR so far) from the config. ACE, SAS, etc.
// This list has groups that we know have access to them
// instantiate a list of searches we will perform for the user (empty for now)
// for each cognitive search index we have onboarded
// check if user is in the group (or groups) that has access to index. If so, add that index to the list of searches we will perform for the user
// return the list of searches we will perform for the user to the orchestrator to perform and concatinate together

}

privatestaticasyncTask<bool>IsMember(GraphServiceClientgraphClient2,stringuserid,stringgroupid)
{
varrequestBody=newMicrosoft.Graph.DirectoryObjects.Item.CheckMemberGroups.CheckMemberGroupsPostRequestBody
{
GroupIds=newList<string>
{
groupid,
},
};
varresult=awaitgraphClient2.DirectoryObjects[userid].CheckMemberGroups.PostAsync(requestBody);
returnresult.Value.Contains(groupid);
}

privatestaticasyncTask<GraphServiceClient>InitializeGraphServiceClient(PublicClientApplicationOptionsappConfiguration,string[]scopes)
{
varclientId=appConfiguration.ClientId;
vartenantId=appConfiguration.TenantId;
varclientSecret="[Insert Secret Value For Test]";

// using Azure.Identity;
varoptions=newClientSecretCredentialOptions
{
AuthorityHost=AzureAuthorityHosts.AzurePublicCloud,
};

// https://learn.microsoft.com/dotnet/api/azure.identity.clientsecretcredential
varclientSecretCredential=newClientSecretCredential(
tenantId,clientId,clientSecret,options);

vargraphClient=newGraphServiceClient(clientSecretCredential,scopes);
returngraphClient;
}

privatestaticasyncTask<object>CallUsersAsync(GraphServiceClientgraphClient)
{
varres=awaitgraphClient.Users.GetAsync();
returnres;
}
}
}