Merge pull request #992 from KelvinTegelaar/dev

[pull] dev from KelvinTegelaar:dev

Author: pull[bot]

Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1

@@ -136,6 +136,19 @@ function Test-CIPPAccess {
         $swUserBranch = [System.Diagnostics.Stopwatch]::StartNew()
         $User = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Request.Headers.'x-ms-client-principal')) | ConvertFrom-Json
 
+       if ($User.claims -and [string]::IsNullOrWhiteSpace($User.userDetails)) {
+            $Claims = @($User.claims)
+            $Upn = ($Claims | Where-Object { $_.typ -in @('preferred_username', 'upn', 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn', 'email', 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress') } | Select-Object -First 1).val
+            if ([string]::IsNullOrWhiteSpace($Upn)) { $Upn = $Request.Headers.'x-ms-client-principal-name' }
+            $Oid = ($Claims | Where-Object { $_.typ -in @('http://schemas.microsoft.com/identity/claims/objectidentifier', 'oid') } | Select-Object -First 1).val
+            $User = [pscustomobject]@{
+                identityProvider = 'aad'
+                userId           = $Oid
+                userDetails      = $Upn
+                userRoles        = @('authenticated', 'anonymous')
+            }
+        }
+
         # Check for roles granted via group membership
         if (($User.userRoles | Measure-Object).Count -eq 2 -and $User.userRoles -contains 'authenticated' -and $User.userRoles -contains 'anonymous') {
             $swResolveUserRoles = [System.Diagnostics.Stopwatch]::StartNew()
@@ -145,6 +158,9 @@ function Test-CIPPAccess {
         }
 
         $swIPCheck = [System.Diagnostics.Stopwatch]::StartNew()
+        if (-not $User.userRoles) {
+            throw 'Access denied: unable to resolve roles for the authenticated principal.'
+        }
         $AllowedIPRanges = Get-CIPPRoleIPRanges -Roles $User.userRoles
 
         if ($AllowedIPRanges -notcontains 'Any') {

Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1

@@ -43,6 +43,24 @@ function New-CippCoreRequest {
     $FunctionName = 'Invoke-{0}' -f $Request.Params.CIPPEndpoint
     Write-Information "API Endpoint: $($Request.Params.CIPPEndpoint) | Frontend Version: $($Request.Headers.'X-CIPP-Version' ?? 'Not specified')"
 
+    # For now, while we're in read-only we force the role of the MCP API cred.
+    # When we remove the feature flag, in NG, we move this to use the users role/ident.
+    if ($Request.Params.CIPPEndpoint -eq 'ExecMcp' -and
+        $Request.Headers.'x-ms-client-principal' -and
+        $Request.Headers.'x-ms-client-principal-name' -notmatch '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$') {
+        try {
+            $McpPrincipal = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Request.Headers.'x-ms-client-principal')) | ConvertFrom-Json
+            $McpAppId = ($McpPrincipal.claims | Where-Object { $_.typ -in @('azp', 'appid') } | Select-Object -First 1).val
+            if ($McpAppId -and (Get-CippApiClient -AppId $McpAppId)) {
+                $Request.Headers | Add-Member -NotePropertyName 'x-ms-client-principal-name' -NotePropertyValue $McpAppId -Force
+                $Request.Headers | Add-Member -NotePropertyName 'x-ms-client-principal-idp' -NotePropertyValue 'aad' -Force
+                Write-Information "MCP request mapped to API client $McpAppId (running at the app's CIPP role)"
+            }
+        } catch {
+            Write-Information "MCP principal app resolution failed: $($_.Exception.Message)"
+        }
+    }
+
     # Check if endpoint is disabled via feature flags
     $FeatureFlags = Get-CIPPFeatureFlag
     $DisabledEndpoint = $FeatureFlags | Where-Object {

Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1

@@ -27,12 +27,9 @@ function Invoke-ExecMcp {
             })
     }
 
-    # Per-client gate: the global 'MCPServer' feature flag lets this endpoint run at all (enforced
-    # upstream in New-CippCoreRequest); this narrows access to API clients explicitly flagged
-    # 'MCP Access Allowed'. A non-API-client caller, an unknown client, or one without the flag is denied.
     $CallerAppId = $Request.Headers.'x-ms-client-principal-name'
     $IsApiClient = $Request.Headers.'x-ms-client-principal-idp' -eq 'aad' -and $CallerAppId -match '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'
-    $McpAllowed = if ($IsApiClient) { [bool](Get-CippApiClient -AppId $CallerAppId).MCPAllowed } else { $false }
+    $McpAllowed = if ($IsApiClient) { [bool](Get-CippApiClient -AppId $CallerAppId).MCPAllowed } else { $true }
     if (-not $McpAllowed) {
         return ([HttpResponseContext]@{
                 StatusCode = [HttpStatusCode]::Forbidden