Merge pull request #984 from KelvinTegelaar/dev

pull[bot] · web-flow · commit ea06247e6e22 · 2026-06-01T06:41:08.000Z
[pull] dev from KelvinTegelaar:dev
diff --git a/Modules/CIPPCore/Public/Authentication/Get-CippApiAuth.ps1 b/Modules/CIPPCore/Public/Authentication/Get-CippApiAuth.ps1
@@ -4,53 +4,74 @@ function Get-CippApiAuth {
         [string]$FunctionAppName
     )
 
-    $AuthSettings = $null
+    if ($env:CIPPNG) {
+        $AuthSettings = $null
 
-    # When the auth config is available as an env var, use it directly (no ARM call needed)
-    if ($env:CIPPNG -and $env:WEBSITE_AUTH_V2_CONFIG_JSON) {
-        $AuthSettings = $env:WEBSITE_AUTH_V2_CONFIG_JSON | ConvertFrom-Json -ErrorAction SilentlyContinue
-    }
+        # When the auth config is available as an env var, use it directly (no ARM call needed)
+        if ($env:WEBSITE_AUTH_V2_CONFIG_JSON) {
+            $AuthSettings = $env:WEBSITE_AUTH_V2_CONFIG_JSON | ConvertFrom-Json -ErrorAction SilentlyContinue
+        }
+
+        # Fall back to reading via ARM REST
+        if (-not $AuthSettings) {
+            $SubscriptionId = Get-CIPPAzFunctionAppSubId
+            try {
+                $uri = "https://management.azure.com/subscriptions/$SubscriptionId/resourceGroups/$RGName/providers/Microsoft.Web/sites/$($FunctionAppName)/config/authsettingsV2/list?api-version=2020-06-01"
+                $response = New-CIPPAzRestRequest -Uri $uri -Method POST -ErrorAction Stop
+                $AuthSettings = $response.properties
+            } catch {
+                Write-Warning "Failed to get auth settings via REST: $($_.Exception.Message)"
+            }
+        }
+
+        if ($AuthSettings) {
+            $AAD = $AuthSettings.identityProviders.azureActiveDirectory
+            $Issuer = $AAD.registration.openIdIssuer ?? ''
+            $AllowedApps = @($AAD.validation.defaultAuthorizationPolicy.allowedApplications)
+
+            # When SSO EasyAuth is in use, filter out its clientId — the frontend only tracks API clients
+            $SSOClientId = $AAD.registration.clientId
+            if ($SSOClientId) {
+                $AllowedApps = @($AllowedApps | Where-Object { $_ -ne $SSOClientId })
+            }
 
-    # Fall back to reading via ARM REST
-    if (-not $AuthSettings) {
+            $ExtractedTenantId = $Issuer -replace 'https://sts.windows.net/', '' -replace 'https://login.microsoftonline.com/', '' -replace '/v2.0', ''
+            $TenantId = if ($ExtractedTenantId -eq 'common') { $env:TenantID } else { $ExtractedTenantId }
+
+            [PSCustomObject]@{
+                ApiUrl    = "https://$($env:WEBSITE_HOSTNAME)"
+                TenantID  = $TenantId
+                ClientIDs = $AllowedApps
+                Enabled   = $AAD.enabled
+            }
+        } else {
+            throw 'No auth settings found'
+        }
+    } else {
         $SubscriptionId = Get-CIPPAzFunctionAppSubId
+
         try {
+            # Get auth settings via REST
             $uri = "https://management.azure.com/subscriptions/$SubscriptionId/resourceGroups/$RGName/providers/Microsoft.Web/sites/$($FunctionAppName)/config/authsettingsV2/list?api-version=2020-06-01"
             $response = New-CIPPAzRestRequest -Uri $uri -Method POST -ErrorAction Stop
             $AuthSettings = $response.properties
         } catch {
             Write-Warning "Failed to get auth settings via REST: $($_.Exception.Message)"
         }
-    }
 
-    # Fallback to env var if ARM failed
-    if (-not $AuthSettings -and $env:WEBSITE_AUTH_V2_CONFIG_JSON) {
-        $AuthSettings = $env:WEBSITE_AUTH_V2_CONFIG_JSON | ConvertFrom-Json -ErrorAction SilentlyContinue
-    }
-
-    if ($AuthSettings) {
-        $AAD = $AuthSettings.identityProviders.azureActiveDirectory
-        $Issuer = $AAD.registration.openIdIssuer ?? ''
-        $AllowedApps = @($AAD.validation.defaultAuthorizationPolicy.allowedApplications)
-
-        # When SSO EasyAuth is in use, filter out its clientId — the frontend only tracks API clients
-        if ($env:CIPPNG) {
-            $SSOClientId = $AAD.registration.clientId
-            if ($SSOClientId) {
-                $AllowedApps = @($AllowedApps | Where-Object { $_ -ne $SSOClientId })
-            }
+        if (!$AuthSettings -and $env:WEBSITE_AUTH_V2_CONFIG_JSON) {
+            $AuthSettings = $env:WEBSITE_AUTH_V2_CONFIG_JSON | ConvertFrom-Json -ErrorAction SilentlyContinue
         }
 
-        $ExtractedTenantId = $Issuer -replace 'https://sts.windows.net/', '' -replace 'https://login.microsoftonline.com/', '' -replace '/v2.0', ''
-        $TenantId = if ($ExtractedTenantId -eq 'common') { $env:TenantID } else { $ExtractedTenantId }
-
-        [PSCustomObject]@{
-            ApiUrl    = "https://$($env:WEBSITE_HOSTNAME)"
-            TenantID  = $TenantId
-            ClientIDs = $AllowedApps
-            Enabled   = $AAD.enabled
+        if ($AuthSettings) {
+            [PSCustomObject]@{
+                ApiUrl    = "https://$($env:WEBSITE_HOSTNAME)"
+                TenantID  = $AuthSettings.identityProviders.azureActiveDirectory.registration.openIdIssuer -replace 'https://sts.windows.net/', '' -replace '/v2.0', ''
+                ClientIDs = $AuthSettings.identityProviders.azureActiveDirectory.validation.defaultAuthorizationPolicy.allowedApplications
+                Enabled   = $AuthSettings.identityProviders.azureActiveDirectory.enabled
+            }
+        } else {
+            throw 'No auth settings found'
         }
-    } else {
-        throw 'No auth settings found'
     }
 }
diff --git a/Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1 b/Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1
@@ -92,21 +92,30 @@ function Set-CippApiAuth {
             Write-Information '[ApiAuth] Updated EasyAuth successfully'
         }
     } else {
-        # Full overwrite path (no SSO EasyAuth config to preserve)
+        # Resolve subscription ID via helper (managed identity environment assumed for ARM).
         $SubscriptionId = Get-CIPPAzFunctionAppSubId
-        $BaseUri = "https://management.azure.com/subscriptions/$SubscriptionId/resourceGroups/$RGName/providers/Microsoft.Web/sites/$FunctionAppName"
 
-        $getUri = "$BaseUri/config/authsettingsV2/list?api-version=2020-06-01"
-        $AuthSettings = New-CIPPAzRestRequest -Uri $getUri -Method POST
+        # Get auth settings via ARM REST (managed identity)
+        $getUri = "https://management.azure.com/subscriptions/$SubscriptionId/resourceGroups/$RGName/providers/Microsoft.Web/sites/$($FunctionAppName)/config/authsettingsV2/list?api-version=2020-06-01"
+        $resp = New-CIPPAzRestRequest -Uri $getUri -Method 'GET'
+        $AuthSettings = $resp | Select-Object -ExpandProperty Content -ErrorAction SilentlyContinue
+        if ($AuthSettings -is [string]) { $AuthSettings = $AuthSettings | ConvertFrom-Json }
+        else { $AuthSettings = $resp }
 
         Write-Information "AuthSettings: $($AuthSettings | ConvertTo-Json -Depth 10)"
 
-        $AllowedAudiences = foreach ($ClientId in $ClientIds) { "api://$ClientId" }
+        # Set allowed audiences
+        $AllowedAudiences = foreach ($ClientId in $ClientIds) {
+            "api://$ClientId"
+        }
+
         if (!$AllowedAudiences) { $AllowedAudiences = @() }
         if (!$ClientIds) { $ClientIds = @() }
 
+        # Set auth settings
+
         if (($ClientIds | Measure-Object).Count -gt 0) {
-            $AuthSettings.properties.identityProviders | Add-Member -MemberType NoteProperty -Name 'azureActiveDirectory' -Value @{
+            $AuthSettings.properties.identityProviders.azureActiveDirectory = @{
                 enabled      = $true
                 registration = @{
                     clientId     = $ClientIds[0] ?? $ClientIds
@@ -118,30 +127,29 @@ function Set-CippApiAuth {
                         allowedApplications = @($ClientIds)
                     }
                 }
-            } -Force
+            }
         } else {
-            #Replaced with add-member -force
-            $AuthSettings.properties.identityProviders | Add-Member -MemberType NoteProperty -Name 'azureActiveDirectory' -Value @{
+            $AuthSettings.properties.identityProviders.azureActiveDirectory = @{
                 enabled      = $false
                 registration = @{}
                 validation   = @{}
-            } -Force
+            }
         }
 
-        $AuthSettings.properties | Add-Member -MemberType NoteProperty -Name 'globalValidation' -Value @{
+        $AuthSettings.properties.globalValidation = @{
             unauthenticatedClientAction = 'Return401'
-        } -Force
-        $AuthSettings.properties | Add-Member -MemberType NoteProperty -Name 'login' -Value @{
+        }
+        $AuthSettings.properties.login = @{
             tokenStore = @{
                 enabled                    = $true
                 tokenRefreshExtensionHours = 72
             }
-        } -Force
+        }
 
         if ($PSCmdlet.ShouldProcess('Update auth settings')) {
-            $putUri = "$BaseUri/config/authsettingsV2?api-version=2020-06-01"
-            $Body = $AuthSettings | ConvertTo-Json -Depth 20
-            $null = New-CIPPAzRestRequest -Uri $putUri -Method PUT -Body $Body -ContentType 'application/json'
+            # Update auth settings via ARM REST
+            $putUri = "https://management.azure.com/subscriptions/$SubscriptionId/resourceGroups/$RGName/providers/Microsoft.Web/sites/$($FunctionAppName)/config/authsettingsV2?api-version=2020-06-01"
+            $null = New-CIPPAzRestRequest -Uri $putUri -Method 'PUT' -Body $AuthSettings -ContentType 'application/json'
         }
 
         if ($PSCmdlet.ShouldProcess('Update allowed tenants')) {
