Added Support for OnPremisesPublishing

Kajalp1079 · Oct 8, 2024 · efc4ac9 · efc4ac9
1 parent 47c5982
commit efc4ac9
Show file tree

Hide file tree

Showing 3 changed files with 252 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,7 @@
   * Initial release.
 * AADApplication
   * Fixed an issue trying to retrieve the beta instance.
+  * Added support for OnPremisesPublishing.
 * AADDeviceRegistrationPolicy
   * Initial release.
 * AADEntitlementManagementSettings

diff --git a/Modules/Microsoft365DSC/DSCResources/MSFT_AADApplication/MSFT_AADApplication.psm1 b/Modules/Microsoft365DSC/DSCResources/MSFT_AADApplication/MSFT_AADApplication.psm1
@@ -88,6 +88,10 @@ function Get-TargetResource
         [Microsoft.Management.Infrastructure.CimInstance[]]
         $Permissions,
 
+        [Parameter()]
+        [Microsoft.Management.Infrastructure.CimInstance]
+        $OnPremisesPublishing,
+
         [Parameter()]
         [ValidateSet('Present', 'Absent')]
         [System.String]
@@ -274,7 +278,6 @@ function Get-TargetResource
                 $complexApi = $null
             }
 
-
             $complexKeyCredentials = @()
             foreach ($currentkeyCredentials in $AADAppKeyCredentials.keyCredentials)
             {
@@ -379,6 +382,77 @@ function Get-TargetResource
                 $IsFallbackPublicClientValue = $AADApp.IsFallbackPublicClient
             }
 
+            #region OnPremisesPublishing
+            $onPremisesPublishingValue = @{}
+            $oppInfo = $null
+
+            try
+            {
+                $oppInfo = Invoke-MgGraphRequest -Method GET `
+                                                 -Uri "https://graph.microsoft.com/beta/applications/$($AADBetaApp.Id)/onPremisesPublishing" `
+                                                 -ErrorAction SilentlyContinue
+            }
+            catch
+            {
+                Write-Verbose -Message "On-premises publishing is not enabled for App {$($AADBetaApp.DisplayName)}"
+            }
+
+            if ($null -ne $oppInfo)
+            {
+                $onPremisesPublishingValue = @{
+                    alternateUrl                          = $oppInfo.alternateUrl
+                    applicationServerTimeout              = $oppInfo.applicationServerTimeout
+                    externalAuthenticationType            = $oppInfo.externalAuthenticationType
+                    externalUrl                           = $oppInfo.externalUrl
+                    internalUrl                           = $oppInfo.internalUrl
+                    isBackendCertificateValidationEnabled = $oppInfo.isBackendCertificateValidationEnabled
+                    isHttpOnlyCookieEnabled               = $oppInfo.isHttpOnlyCookieEnabled
+                    isPersistentCookieEnabled             = $oppInfo.isPersistentCookieEnabled
+                    isSecureCookieEnabled                 = $oppInfo.isSecureCookieEnabled
+                    isStateSessionEnabled                 = $oppInfo.isStateSessionEnabled
+                    isTranslateHostHeaderEnabled          = $oppInfo.isTranslateHostHeaderEnabled
+                    isTranslateLinksInBodyEnabled         = $oppInfo.isTranslateLinksInBodyEnabled
+                }
+
+                # onPremisesApplicationSegments
+                $segmentValues = @()
+                foreach ($segment in $oppInfo.onPremisesApplicationSegments)
+                {
+                    $entry = @{
+                        alternateUrl = $segment.AlternateUrl
+                        externalUrl  = $segment.externalUrl
+                        internalUrl  = $segment.internalUrl
+                    }
+
+                    $corsConfigurationValues = @()
+                    foreach ($cors in $segment.corsConfigurations)
+                    {
+                        $corsEntry = @{
+                            allowedHeaders  = [Array]($cors.allowedHeaders)
+                            allowedMethods  = [Array]($cors.allowedMethods)
+                            allowedOrigins  = [Array]($cors.allowedOrigins)
+                            maxAgeInSeconds = $cors.maxAgeInSeconds
+                            resource        = $cors.resource
+                        }
+                        $corsConfigurationValues += $corsEntry
+                    }
+                    $entry.Add('corsConfigurations', $corsConfigurationValues)
+                    $segmentValues += $entry
+                }
+                $onPremisesPublishingValue.Add('onPremisesApplicationSegments', $segmentValues)
+
+                # singleSignOnSettings
+                $singleSignOnValues = @{
+                    kerberosSignOnSettings = @{
+                        kerberosServicePrincipalName       = $oppInfo.singleSignOnSettings.kerberosSignOnSettings.kerberosServicePrincipalName
+                        kerberosSignOnMappingAttributeType = $oppInfo.singleSignOnSettings.kerberosSignOnSettings.kerberosSignOnMappingAttributeType
+                    }
+                    singleSignOnMode = $oppInfo.singleSignOnSettings.singleSignOnMode
+                }
+                $onPremisesPublishingValue.Add('singleSignOnSettings', $singleSignOnValues)
+            }
+            #endregion
+
             $result = @{
                 DisplayName             = $AADApp.DisplayName
                 AvailableToOtherTenants = $AvailableToOtherTenantsValue
@@ -401,6 +475,7 @@ function Get-TargetResource
                 PasswordCredentials     = $complexPasswordCredentials
                 AppRoles                = $complexAppRoles
                 Permissions             = $permissionsObj
+                OnPremisesPublishing   = $onPremisesPublishingValue
                 Ensure                  = 'Present'
                 Credential              = $Credential
                 ApplicationId           = $ApplicationId
@@ -522,6 +597,10 @@ function Set-TargetResource
         [Microsoft.Management.Infrastructure.CimInstance[]]
         $Permissions,
 
+        [Parameter()]
+        [Microsoft.Management.Infrastructure.CimInstance]
+        $OnPremisesPublishing,
+
         [Parameter()]
         [ValidateSet('Present', 'Absent')]
         [System.String]
@@ -678,6 +757,7 @@ function Set-TargetResource
     $currentParameters.Remove('ReplyURLs') | Out-Null
     $currentParameters.Remove('LogoutURL') | Out-Null
     $currentParameters.Remove('Homepage') | Out-Null
+    $currentParameters.Remove('OnPremisesPublishing') | Out-Null
 
 
     $keys = (([Hashtable]$currentParameters).clone()).Keys
@@ -944,6 +1024,74 @@ function Set-TargetResource
             Write-Warning -Message "KeyCredentials cannot be updated for AAD Applications with more than one KeyCredentials due to technical limitation of Update-MgApplication Cmdlet. Learn more at: https://learn.microsoft.com/en-us/graph/api/application-addkey"
         }
     }
+
+    #region OnPremisesPublishing
+    if ($null -ne $OnPremisesPublishing)
+    {
+        $oppInfo = $OnPremisesPublishing
+        $onPremisesPublishingValue = @{
+            alternateUrl                          = $oppInfo.alternateUrl
+            applicationServerTimeout              = $oppInfo.applicationServerTimeout
+            externalAuthenticationType            = $oppInfo.externalAuthenticationType
+            #externalUrl                           = $oppInfo.externalUrl
+            internalUrl                           = $oppInfo.internalUrl
+            isBackendCertificateValidationEnabled = $oppInfo.isBackendCertificateValidationEnabled
+            isHttpOnlyCookieEnabled               = $oppInfo.isHttpOnlyCookieEnabled
+            isPersistentCookieEnabled             = $oppInfo.isPersistentCookieEnabled
+            isSecureCookieEnabled                 = $oppInfo.isSecureCookieEnabled
+            isStateSessionEnabled                 = $oppInfo.isStateSessionEnabled
+            isTranslateHostHeaderEnabled          = $oppInfo.isTranslateHostHeaderEnabled
+            isTranslateLinksInBodyEnabled         = $oppInfo.isTranslateLinksInBodyEnabled
+        }
+
+        # onPremisesApplicationSegments
+        $segmentValues = @()
+        foreach ($segment in $oppInfo.onPremisesApplicationSegments)
+        {
+            $entry = @{
+                alternateUrl = $segment.AlternateUrl
+                externalUrl  = $segment.externalUrl
+                internalUrl  = $segment.internalUrl
+            }
+
+            $corsConfigurationValues = @()
+            foreach ($cors in $segment.corsConfigurations)
+            {
+                $corsEntry = @{
+                    allowedHeaders  = [Array]($cors.allowedHeaders)
+                    allowedMethods  = [Array]($cors.allowedMethods)
+                    allowedOrigins  = [Array]($cors.allowedOrigins)
+                    maxAgeInSeconds = $cors.maxAgeInSeconds
+                    resource        = $cors.resource
+                }
+                $corsConfigurationValues += $corsEntry
+            }
+            $entry.Add('corsConfigurations', $corsConfigurationValues)
+            $segmentValues += $entry
+        }
+        $onPremisesPublishingValue.Add('onPremisesApplicationSegments', $segmentValues)
+
+        # singleSignOnSettings
+        $singleSignOnValues = @{
+            kerberosSignOnSettings = @{
+                kerberosServicePrincipalName       = $oppInfo.singleSignOnSettings.kerberosSignOnSettings.kerberosServicePrincipalName
+                kerberosSignOnMappingAttributeType = $oppInfo.singleSignOnSettings.kerberosSignOnSettings.kerberosSignOnMappingAttributeType
+            }
+            singleSignOnMode = $oppInfo.singleSignOnSettings.singleSignOnMode
+        }
+        if ($null -eq $singleSignOnValues.kerberosSignOnSettings.kerberosServicePrincipalName)
+        {
+            $singleSignOnValues.Remove('kerberosSignOnSettings') | Out-Null
+        }
+
+        $onPremisesPublishingValue.Add('singleSignOnSettings', $singleSignOnValues)
+        $onPremisesPayload = ConvertTo-Json $onPremisesPublishingValue -Depth 10 -Compress
+        Write-Verbose -Message "Updating the OnPremisesPublishing settings for application {$($currentAADApp.DisplayName)} with payload: $onPremisesPayload"
+        Invoke-MgGraphRequest -Method 'PATCH' `
+                              -Uri "https://graph.microsoft.com/beta/applications/$($currentAADApp.Id)/onPremisesPublishing" `
+                              -Body $onPremisesPayload
+    }
+    #endregion
 }
 
 function Test-TargetResource
@@ -1036,6 +1184,10 @@ function Test-TargetResource
         [Microsoft.Management.Infrastructure.CimInstance[]]
         $Permissions,
 
+        [Parameter()]
+        [Microsoft.Management.Infrastructure.CimInstance]
+        $OnPremisesPublishing,
+
         [Parameter()]
         [ValidateSet('Present', 'Absent')]
         [System.String]
@@ -1309,6 +1461,47 @@ function Export-TargetResource
                         }
                     }
 
+                    if ($null -ne $Results.OnPremisesPublishing.singleSignOnSettings)
+                    {
+                        $complexMapping = @(
+                            @{
+                                Name = 'singleSignOnSettings'
+                                CimInstanceName = 'AADApplicationOnPremisesPublishingSingleSignOnSetting'
+                                IsRequired = $False
+                            },
+                            @{
+                                Name = 'onPremisesApplicationSegments'
+                                CimInstanceName = 'AADApplicationOnPremisesPublishingSegment'
+                                IsRequired = $False
+                            },
+                            @{
+                                Name = 'kerberosSignOnSettings'
+                                CimInstanceName = 'AADApplicationOnPremisesPublishingSingleSignOnSettingKerberos'
+                                IsRequired = $False
+                            },
+                            @{
+                                Name = 'corsConfigurations'
+                                CimInstanceName = 'AADApplicationOnPremisesPublishingSegmentCORS'
+                                IsRequired = $False
+                            }
+                        )
+                        $complexTypeStringResult = Get-M365DSCDRGComplexTypeToString `
+                            -ComplexObject $Results.OnPremisesPublishing `
+                            -CIMInstanceName 'AADApplicationOnPremisesPublishing' `
+                            -ComplexTypeMapping $complexMapping
+                        if (-not [String]::IsNullOrWhiteSpace($complexTypeStringResult))
+                        {
+                            $Results.OnPremisesPublishing = $complexTypeStringResult
+                        }
+                        else
+                        {
+                            $Results.Remove('OnPremisesPublishing') | Out-Null
+                        }
+                    }
+                    else
+                    {
+                        $Results.Remove('OnPremisesPublishing') | Out-Null
+                    }
 
                     if ($null -ne $Results.OptionalClaims)
                     {
@@ -1415,6 +1608,10 @@ function Export-TargetResource
                     {
                         $currentDSCBlock = Convert-DSCStringParamToVariable -DSCBlock $currentDSCBlock -ParameterName "OptionalClaims" -IsCIMArray:$False
                     }
+                    if ($Results.OnPremisesPublishing)
+                    {
+                        $currentDSCBlock = Convert-DSCStringParamToVariable -DSCBlock $currentDSCBlock -ParameterName "OnPremisesPublishing" -IsCIMArray:$False
+                    }
                     if ($Results.AuthenticationBehaviors)
                     {
                         $currentDSCBlock = Convert-DSCStringParamToVariable -DSCBlock $currentDSCBlock -ParameterName "AuthenticationBehaviors" -IsCIMArray:$False