|
| 1 | +#if !ONPREMISES |
| 2 | +using Microsoft.Online.SharePoint.TenantAdministration.Internal; |
| 3 | +using Microsoft.SharePoint.Client; |
| 4 | +using OfficeDevPnP.Core.ALM; |
| 5 | +using OfficeDevPnP.Core.Enums; |
| 6 | +using SharePointPnP.PowerShell.CmdletHelpAttributes; |
| 7 | +using SharePointPnP.PowerShell.Commands.Base; |
| 8 | +using SharePointPnP.PowerShell.Commands.Enums; |
| 9 | +using SharePointPnP.PowerShell.Commands.Model; |
| 10 | +using System.Linq; |
| 11 | +using System.Management.Automation; |
| 12 | + |
| 13 | +namespace SharePointPnP.PowerShell.Commands.Apps |
| 14 | +{ |
| 15 | + [Cmdlet(VerbsSecurity.Grant, "PnPTenantServicePrincipalPermission")] |
| 16 | + [CmdletHelp(@"Explicitely grants a specified permission to the ""SharePoint Online Client"" service principal", |
| 17 | + Category = CmdletHelpCategory.Apps, SupportedPlatform = CmdletSupportedPlatform.Online, |
| 18 | + OutputType = typeof(AppMetadata))] |
| 19 | + [CmdletExample( |
| 20 | + Code = @"PS:> Grant-PnPTenantServicePrincipalPermission -Scope ""Group.Read.All"" -Resource ""Microsoft Graph""", |
| 21 | + Remarks = @"This will explicitely grant the Group.Read.All permission on the Microsoft Graph resource", SortOrder = 1)] |
| 22 | + public class GrantTenantServicePrincipalPermission : PnPAdminCmdlet |
| 23 | + { |
| 24 | + [Parameter(Mandatory = true, HelpMessage = "The scope to grant the permission for")] |
| 25 | + public string Scope; |
| 26 | + |
| 27 | + [Parameter(Mandatory = true, HelpMessage = "The resource to grant the permission for")] |
| 28 | + public string Resource; |
| 29 | + |
| 30 | + protected override void ExecuteCmdlet() |
| 31 | + { |
| 32 | + var packageName = $"pnp-temporary-request-{System.Guid.NewGuid()}"; |
| 33 | + var appCatalog = Tenant.GetAppCatalog(); |
| 34 | + using (var appCatalogContext = ClientContext.Clone(appCatalog)) |
| 35 | + { |
| 36 | + var list = appCatalogContext.Web.Lists.GetByTitle("Web Api Permission Requests"); |
| 37 | + var itemCI = new ListItemCreationInformation(); |
| 38 | + var item = list.AddItem(itemCI); |
| 39 | + item["_ows_PackageName"] = packageName; |
| 40 | + item["_ows_PackageVersion"] = "0.0.0.0"; |
| 41 | + item["_ows_Scope"] = Scope; |
| 42 | + item["_ows_ResourceId"] = Resource; |
| 43 | + item.Update(); |
| 44 | + appCatalogContext.ExecuteQueryRetry(); |
| 45 | + } |
| 46 | + |
| 47 | + var servicePrincipal = new SPOWebAppServicePrincipal(ClientContext); |
| 48 | + var requests = ClientContext.LoadQuery(servicePrincipal.PermissionRequests.Where(r => r.PackageName == packageName)); |
| 49 | + ClientContext.ExecuteQueryRetry(); |
| 50 | + if (requests.Any()) |
| 51 | + { |
| 52 | + var newRequest = requests.First(); |
| 53 | + var request = servicePrincipal.PermissionRequests.GetById(newRequest.Id); |
| 54 | + var grant = request.Approve(); |
| 55 | + ClientContext.Load(grant); |
| 56 | + ClientContext.ExecuteQueryRetry(); |
| 57 | + WriteObject(new TenantServicePrincipalPermissionGrant(grant)); |
| 58 | + } |
| 59 | + } |
| 60 | + } |
| 61 | +} |
| 62 | +#endif |
0 commit comments