Merge pull request #991 from KelvinTegelaar/dev

pull[bot] · web-flow · commit f47875e1ab0b · 2026-06-03T18:41:09.000Z
[pull] dev from KelvinTegelaar:dev
diff --git a/Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1 b/Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1
@@ -0,0 +1,79 @@
+function Set-CIPPMCPClientApp {
+    <#
+    .SYNOPSIS
+        Configures an API client's app registration to act as the MCP OAuth resource.
+    .DESCRIPTION
+Sets a cipp API client.
+    .PARAMETER AppId
+        Application (client) ID of the API client to configure.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess)]
+    param(
+        [Parameter(Mandatory)]
+        [string]$AppId,
+        $Headers
+    )
+
+    $Hostname = $env:WEBSITE_HOSTNAME
+    if ([string]::IsNullOrWhiteSpace($Hostname)) {
+        throw 'WEBSITE_HOSTNAME is not set; cannot determine the MCP resource URL.'
+    }
+
+    $McpUris = @("https://$Hostname", "https://$Hostname/api/ExecMcp")
+
+    $App = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications(appId='$AppId')" -NoAuthCheck $true -AsApp $true
+    if (-not $App) {
+        throw "App registration with AppId '$AppId' was not found."
+    }
+
+    # Merge identifier URIs, preserving existing (e.g. api://<appId>)
+    $IdentifierUris = [System.Collections.Generic.List[string]]::new()
+    foreach ($Uri in @($App.identifierUris)) {
+        if (-not [string]::IsNullOrWhiteSpace($Uri) -and $IdentifierUris -notcontains $Uri) { $IdentifierUris.Add($Uri) }
+    }
+    foreach ($Uri in $McpUris) {
+        if ($IdentifierUris -notcontains $Uri) { $IdentifierUris.Add($Uri) }
+    }
+
+    # Preserve the existing api object; force v2 tokens; ensure a user_impersonation delegated scope
+    $Api = if ($App.api) { $App.api | ConvertTo-Json -Depth 10 | ConvertFrom-Json -AsHashtable } else { @{} }
+    $Api.requestedAccessTokenVersion = 2
+    $Scopes = [System.Collections.Generic.List[object]]::new()
+    if ($Api.oauth2PermissionScopes) {
+        foreach ($Scope in $Api.oauth2PermissionScopes) { $Scopes.Add($Scope) }
+    }
+    if (-not ($Scopes | Where-Object { $_.value -eq 'user_impersonation' })) {
+        $Scopes.Add(@{
+                adminConsentDescription = 'Allow the application to access CIPP-API on behalf of the signed-in user.'
+                adminConsentDisplayName = 'Access CIPP-API'
+                id                      = [guid]::NewGuid().ToString()
+                isEnabled               = $true
+                type                    = 'User'
+                userConsentDescription  = 'Allow the application to access CIPP-API on your behalf.'
+                userConsentDisplayName  = 'Access CIPP-API'
+                value                   = 'user_impersonation'
+            })
+    }
+    $Api.oauth2PermissionScopes = @($Scopes)
+
+    $PatchBody = @{
+        identifierUris = @($IdentifierUris)
+        api            = $Api
+    } | ConvertTo-Json -Depth 10 -Compress
+
+    if ($PSCmdlet.ShouldProcess($AppId, 'Configure app registration for MCP')) {
+        try {
+            $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/v1.0/applications/$($App.id)" -type PATCH -body $PatchBody -NoAuthCheck $true -asapp $true
+            Write-LogMessage -headers $Headers -API 'ExecApiClient' -message "Configured app registration $AppId as MCP resource (identifier URIs + v2 tokens)." -Sev 'Info'
+            return @{ Success = $true; IdentifierUris = @($IdentifierUris) }
+        } catch {
+            $ErrMsg = $_.Exception.Message
+            if ($ErrMsg -match 'identifierUri' -or $ErrMsg -match 'already exists' -or $ErrMsg -match 'in use') {
+                throw "The MCP resource URIs are already assigned to another application. Only one API client can be the MCP resource client. ($ErrMsg)"
+            }
+            throw
+        }
+    }
+}
diff --git a/Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1 b/Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1
@@ -4,7 +4,8 @@ function Set-CippApiAuth {
         [string]$RGName,
         [string]$FunctionAppName,
         [string]$TenantId,
-        [string[]]$ClientIds
+        [string[]]$ClientIds,
+        [string[]]$McpClientIds
     )
 
     if ($env:CIPPNG) {
@@ -18,6 +19,7 @@ function Set-CippApiAuth {
 
         Write-Information "[ApiAuth] SiteName=$SiteName, ResourceGroup=$ResourceGroup, SubscriptionId=$SubscriptionId"
         Write-Information "[ApiAuth] ClientIds to set: $($ClientIds -join ', ')"
+        Write-Information "[ApiAuth] MCP client IDs: $($McpClientIds -join ', ') | WEBSITE_HOSTNAME=$($env:WEBSITE_HOSTNAME)"
 
         if (-not $SiteName -or -not $ResourceGroup -or -not $SubscriptionId) {
             throw "[ApiAuth] Missing App Service env vars: WEBSITE_SITE_NAME=$SiteName, WEBSITE_RESOURCE_GROUP=$ResourceGroup, SubscriptionId=$SubscriptionId"
@@ -63,6 +65,16 @@ function Set-CippApiAuth {
             [void]$AllAudiences.Add("api://$id")
         }
 
+        # MCP resource clients also accept tokens whose audience is the host-based identifier URI or
+        # the bare appId (v2 tokens), so the Claude connector's token validates against EasyAuth.
+        if ($McpClientIds -and $env:WEBSITE_HOSTNAME) {
+            [void]$AllAudiences.Add("https://$($env:WEBSITE_HOSTNAME)")
+            [void]$AllAudiences.Add("https://$($env:WEBSITE_HOSTNAME)/api/ExecMcp")
+            foreach ($McpId in $McpClientIds) {
+                if (-not [string]::IsNullOrEmpty($McpId)) { [void]$AllAudiences.Add($McpId) }
+            }
+        }
+
         Write-Information "[ApiAuth] Merged allowedApplications: $($AllAppIds -join ', ')"
         Write-Information "[ApiAuth] Merged allowedAudiences: $($AllAudiences -join ', ')"
 
@@ -104,10 +116,19 @@ function Set-CippApiAuth {
 
         Write-Information "AuthSettings: $($AuthSettings | ConvertTo-Json -Depth 10)"
 
-        # Set allowed audiences
-        $AllowedAudiences = foreach ($ClientId in $ClientIds) {
-            "api://$ClientId"
+        # Set allowed audiences (api://{id} for each, plus MCP resource URIs + bare appId for MCP clients)
+        $AudienceList = [System.Collections.Generic.List[string]]::new()
+        foreach ($ClientId in $ClientIds) {
+            $AudienceList.Add("api://$ClientId")
+        }
+        if ($McpClientIds -and $env:WEBSITE_HOSTNAME) {
+            $AudienceList.Add("https://$($env:WEBSITE_HOSTNAME)")
+            $AudienceList.Add("https://$($env:WEBSITE_HOSTNAME)/api/ExecMcp")
+            foreach ($McpId in $McpClientIds) {
+                if (-not [string]::IsNullOrEmpty($McpId)) { $AudienceList.Add($McpId) }
+            }
         }
+        $AllowedAudiences = @($AudienceList)
 
         if (!$AllowedAudiences) { $AllowedAudiences = @() }
         if (!$ClientIds) { $ClientIds = @() }
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1
@@ -132,6 +132,20 @@ function Invoke-ExecApiClient {
                 }
 
                 Add-CIPPAzDataTableEntity @Table -Entity $Client -Force | Out-Null
+
+                # When this client is MCP-enabled, configure its app registration as the MCP OAuth
+                # resource (host identifier URIs + v2 tokens) so the Claude connector flow can resolve it.
+                if ([bool]($Request.Body.MCPAllowed ?? $false)) {
+                    try {
+                        $null = Set-CIPPMCPClientApp -AppId $ClientId -Headers $Request.Headers
+                        $Results.Add('MCP resource URIs and v2 tokens configured on the app registration. Run Save to Azure to apply the changes.')
+                    } catch {
+                        $Results.Add(@{
+                                resultText = "Client saved, but MCP app configuration failed: $($_.Exception.Message)"
+                                state      = 'warning'
+                            })
+                    }
+                }
             }
 
             if ($IPValidationErrors.Count -gt 0) {
@@ -193,8 +207,20 @@ function Invoke-ExecApiClient {
             $FunctionAppName = $env:WEBSITE_SITE_NAME
             $AllClients = Get-CIPPAzDataTableEntity @Table -Filter 'Enabled eq true' | Where-Object { ![string]::IsNullOrEmpty($_.RowKey) }
             $ClientIds = $AllClients.RowKey
+            # MCPAllowed can round-trip from table storage as a bool or a string; compare on string form.
+            $McpClientIds = @($AllClients | Where-Object { "$($_.MCPAllowed)" -eq 'True' } | ForEach-Object { $_.RowKey })
+            Write-Information "[ExecApiClient] MCP clients resolved for audiences/scope: $($McpClientIds -join ', ')"
             try {
-                Set-CippApiAuth -RGName $RGName -FunctionAppName $FunctionAppName -TenantId $TenantId -ClientIds $ClientIds
+                Set-CippApiAuth -RGName $RGName -FunctionAppName $FunctionAppName -TenantId $TenantId -ClientIds $ClientIds -McpClientIds $McpClientIds
+
+                # Advertise the MCP resource scope via App Service PRM so the Claude connector requests
+                # a scope that matches the resource app (clears AADSTS9010010). Cleared when no MCP clients.
+                if ($McpClientIds.Count -gt 0 -and $env:WEBSITE_HOSTNAME) {
+                    $null = Update-CIPPAzFunctionAppSetting -Name $FunctionAppName -ResourceGroupName $RGName -AppSetting @{ 'WEBSITE_AUTH_PRM_DEFAULT_WITH_SCOPES' = "https://$($env:WEBSITE_HOSTNAME)/user_impersonation" }
+                } else {
+                    $null = Update-CIPPAzFunctionAppSetting -Name $FunctionAppName -ResourceGroupName $RGName -AppSetting @{} -RemoveKeys @('WEBSITE_AUTH_PRM_DEFAULT_WITH_SCOPES')
+                }
+
                 $Body = @{ Results = 'API clients saved to Azure' }
                 Write-LogMessage -headers $Request.Headers -API 'ExecApiClient' -message 'Saved API clients to Azure' -Sev 'Info'
             } catch {
