From f33925e973cfaa9be4d46abd81f63afe787c6607 Mon Sep 17 00:00:00 2001 From: Roy Ben Shabat Date: Tue, 22 Apr 2025 21:51:47 +0300 Subject: Prevent AD group check using AD Graph API. --- .../Eureka Installer-cache/cacheIndex.txt | Bin 52 -> 52 bytes .../Eureka Installer.aip | 231 ++++++++++++++++++++- .../PPC/Tango.PPC.UI/Properties/AssemblyInfo.cs | 2 +- .../Visual_Studio/PPC/Tango.PPC.UI/app.manifest | 2 +- .../ActiveDirectory/ActiveDirectoryManager.cs | 64 +++--- Software/Visual_Studio/Tango.Web/Tango.Web.csproj | 4 +- .../Controllers/AzureUtilsController.cs | 8 +- .../machineservice-gateway - Web Deploy.pubxml | 14 ++ .../Controllers/AccountController.cs | 8 +- .../Controllers/MachineStudioController.cs | 8 +- .../Controllers/PPCController.cs | 8 +- .../Tango.MachineService.csproj | 6 +- 12 files changed, 299 insertions(+), 56 deletions(-) (limited to 'Software/Visual_Studio') diff --git a/Software/Visual_Studio/Advanced Installer Projects/Eureka Installer-cache/cacheIndex.txt b/Software/Visual_Studio/Advanced Installer Projects/Eureka Installer-cache/cacheIndex.txt index a603ff06b..5fe5afe5a 100644 Binary files a/Software/Visual_Studio/Advanced Installer Projects/Eureka Installer-cache/cacheIndex.txt and b/Software/Visual_Studio/Advanced Installer Projects/Eureka Installer-cache/cacheIndex.txt differ diff --git a/Software/Visual_Studio/Advanced Installer Projects/Eureka Installer.aip b/Software/Visual_Studio/Advanced Installer Projects/Eureka Installer.aip index c1f86256a..431fb012e 100644 --- a/Software/Visual_Studio/Advanced Installer Projects/Eureka Installer.aip +++ b/Software/Visual_Studio/Advanced Installer Projects/Eureka Installer.aip @@ -15,10 +15,10 @@ - + - + @@ -38,8 +38,25 @@ + + + + + + + + + + + + + + + + + @@ -73,9 +90,17 @@ + + + + + + + + @@ -103,6 +128,7 @@ + @@ -125,13 +151,17 @@ + + + + @@ -140,6 +170,7 @@ + @@ -147,8 +178,11 @@ + + + @@ -161,13 +195,18 @@ + + + + + @@ -193,6 +232,7 @@ + @@ -209,15 +249,23 @@ + + + + + + + + @@ -225,19 +273,25 @@ + + + + + + @@ -297,9 +351,25 @@ + + + + + + + + + + + + + + + + @@ -310,6 +380,7 @@ + @@ -674,6 +745,106 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -682,7 +853,7 @@ - + @@ -1055,6 +1226,60 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/Software/Visual_Studio/PPC/Tango.PPC.UI/Properties/AssemblyInfo.cs b/Software/Visual_Studio/PPC/Tango.PPC.UI/Properties/AssemblyInfo.cs index 96e82e59b..bf0ac7b07 100644 --- a/Software/Visual_Studio/PPC/Tango.PPC.UI/Properties/AssemblyInfo.cs +++ b/Software/Visual_Studio/PPC/Tango.PPC.UI/Properties/AssemblyInfo.cs @@ -8,4 +8,4 @@ using System.Windows; // set of attributes. Change these attribute values to modify the information // associated with an assembly. [assembly: AssemblyTitle("Tango PPC Application")] -[assembly: AssemblyVersion("3.0.1.0")] +[assembly: AssemblyVersion("3.0.2.0")] diff --git a/Software/Visual_Studio/PPC/Tango.PPC.UI/app.manifest b/Software/Visual_Studio/PPC/Tango.PPC.UI/app.manifest index efc5f8179..d72e75011 100644 --- a/Software/Visual_Studio/PPC/Tango.PPC.UI/app.manifest +++ b/Software/Visual_Studio/PPC/Tango.PPC.UI/app.manifest @@ -16,7 +16,7 @@ Remove this element if your application requires this virtualization for backwards compatibility. --> - + diff --git a/Software/Visual_Studio/Tango.Web/ActiveDirectory/ActiveDirectoryManager.cs b/Software/Visual_Studio/Tango.Web/ActiveDirectory/ActiveDirectoryManager.cs index 0a0a1d476..b96241612 100644 --- a/Software/Visual_Studio/Tango.Web/ActiveDirectory/ActiveDirectoryManager.cs +++ b/Software/Visual_Studio/Tango.Web/ActiveDirectory/ActiveDirectoryManager.cs @@ -30,43 +30,43 @@ namespace Tango.Web.ActiveDirectory return authResult; } - public List GetUserGroups(String email) - { - var authResult = GetAppAuthenticationResult(); - ActiveDirectoryClient activeDirectoryClient = new ActiveDirectoryClient(new Uri($"https://graph.windows.net/{WebConfig.TENANT_ID}"), async () => await Task.FromResult(authResult.AccessToken)); - var user = activeDirectoryClient.Users.Where(x => x.UserPrincipalName == email).ExecuteSingleAsync().Result; + //public List GetUserGroups(String email) + //{ + // var authResult = GetAppAuthenticationResult(); + // ActiveDirectoryClient activeDirectoryClient = new ActiveDirectoryClient(new Uri($"https://graph.windows.net/{WebConfig.TENANT_ID}"), async () => await Task.FromResult(authResult.AccessToken)); + // var user = activeDirectoryClient.Users.Where(x => x.UserPrincipalName == email).ExecuteSingleAsync().Result; - var userFetcher = (IUserFetcher)user; + // var userFetcher = (IUserFetcher)user; - List groups = new List(); + // List groups = new List(); - IPagedCollection pagedCollection = userFetcher.MemberOf.ExecuteAsync().Result; - do - { - List directoryObjects = pagedCollection.CurrentPage.ToList(); - foreach (IDirectoryObject directoryObject in directoryObjects) - { - if (directoryObject is Group) - { - var group = directoryObject as Group; - groups.Add(group); - } - } - pagedCollection = pagedCollection.GetNextPageAsync().Result; - } while (pagedCollection != null); + // IPagedCollection pagedCollection = userFetcher.MemberOf.ExecuteAsync().Result; + // do + // { + // List directoryObjects = pagedCollection.CurrentPage.ToList(); + // foreach (IDirectoryObject directoryObject in directoryObjects) + // { + // if (directoryObject is Group) + // { + // var group = directoryObject as Group; + // groups.Add(group); + // } + // } + // pagedCollection = pagedCollection.GetNextPageAsync().Result; + // } while (pagedCollection != null); - return groups; - } + // return groups; + //} - public bool IsUserMemberOf(String group, String email) - { - return GetUserGroups(email).Exists(x => x.DisplayName == group); - } + //public bool IsUserMemberOf(String group, String email) + //{ + // return GetUserGroups(email).Exists(x => x.DisplayName == group); + //} - public bool CanUserAccessCurrentEnvironment(String email) - { - var groups = GetUserGroups(email); - return groups.Exists(x => x.DisplayName == WebConfig.ENVIRONMENT_GROUP); - } + //public bool CanUserAccessCurrentEnvironment(String email) + //{ + // var groups = GetUserGroups(email); + // return groups.Exists(x => x.DisplayName == WebConfig.ENVIRONMENT_GROUP); + //} } } diff --git a/Software/Visual_Studio/Tango.Web/Tango.Web.csproj b/Software/Visual_Studio/Tango.Web/Tango.Web.csproj index 0e729fbd2..cc348f764 100644 --- a/Software/Visual_Studio/Tango.Web/Tango.Web.csproj +++ b/Software/Visual_Studio/Tango.Web/Tango.Web.csproj @@ -188,7 +188,9 @@ ..\packages\Microsoft.Web.Infrastructure.1.0.0.0\lib\net40\Microsoft.Web.Infrastructure.dll - + + False + ..\packages\Newtonsoft.Json.9.0.1\lib\net45\Newtonsoft.Json.dll diff --git a/Software/Visual_Studio/Web/Tango.MachineService.Gateway/Controllers/AzureUtilsController.cs b/Software/Visual_Studio/Web/Tango.MachineService.Gateway/Controllers/AzureUtilsController.cs index ae5aa4543..8dee1bdad 100644 --- a/Software/Visual_Studio/Web/Tango.MachineService.Gateway/Controllers/AzureUtilsController.cs +++ b/Software/Visual_Studio/Web/Tango.MachineService.Gateway/Controllers/AzureUtilsController.cs @@ -36,10 +36,10 @@ namespace Tango.MachineService.Gateway.Controllers throw new AuthenticationException("The specified email or password is incorrect.", ex); } - if (!adManager.IsUserMemberOf(GatewayConfig.AZURE_UTILS_GROUP, request.Email)) - { - throw new AuthenticationException("The specified user is not authorized to access the resource."); - } + //if (!adManager.IsUserMemberOf(GatewayConfig.AZURE_UTILS_GROUP, request.Email)) + //{ + // throw new AuthenticationException("The specified user is not authorized to access the resource."); + //} return new LoginResponse() { diff --git a/Software/Visual_Studio/Web/Tango.MachineService.Gateway/Properties/PublishProfiles/machineservice-gateway - Web Deploy.pubxml b/Software/Visual_Studio/Web/Tango.MachineService.Gateway/Properties/PublishProfiles/machineservice-gateway - Web Deploy.pubxml index 8af9f7fc8..bd195918c 100644 --- a/Software/Visual_Studio/Web/Tango.MachineService.Gateway/Properties/PublishProfiles/machineservice-gateway - Web Deploy.pubxml +++ b/Software/Visual_Studio/Web/Tango.MachineService.Gateway/Properties/PublishProfiles/machineservice-gateway - Web Deploy.pubxml @@ -24,5 +24,19 @@ by editing this MSBuild file. In order to learn more about this please visit htt $machineservice-gateway <_SavePWD>True <_DestinationType>AzureWebSite + + + + + + + + + + + + + + \ No newline at end of file diff --git a/Software/Visual_Studio/Web/Tango.MachineService/Controllers/AccountController.cs b/Software/Visual_Studio/Web/Tango.MachineService/Controllers/AccountController.cs index 0a395b00e..44f3ea445 100644 --- a/Software/Visual_Studio/Web/Tango.MachineService/Controllers/AccountController.cs +++ b/Software/Visual_Studio/Web/Tango.MachineService/Controllers/AccountController.cs @@ -37,10 +37,10 @@ namespace Tango.MachineService.Controllers { var authResult = _ad_manager.ValidateUserCredentials(request.Email, request.Password); - if (!_ad_manager.CanUserAccessCurrentEnvironment(request.Email)) - { - throw new AuthenticationException($"You do not have permissions to access the {MachineServiceConfig.DEPLOYMENT_SLOT.ToDescription()} environment."); - } + //if (!_ad_manager.CanUserAccessCurrentEnvironment(request.Email)) + //{ + // throw new AuthenticationException($"You do not have permissions to access the {MachineServiceConfig.DEPLOYMENT_SLOT.ToDescription()} environment."); + //} FormsAuthentication.SetAuthCookie(request.Email, true); diff --git a/Software/Visual_Studio/Web/Tango.MachineService/Controllers/MachineStudioController.cs b/Software/Visual_Studio/Web/Tango.MachineService/Controllers/MachineStudioController.cs index 7eda111d0..23e7e5ce6 100644 --- a/Software/Visual_Studio/Web/Tango.MachineService/Controllers/MachineStudioController.cs +++ b/Software/Visual_Studio/Web/Tango.MachineService/Controllers/MachineStudioController.cs @@ -312,10 +312,10 @@ namespace Tango.MachineService.Controllers throw new AuthenticationException(ex.FlattenMessage()); } - if (!_ad_manager.CanUserAccessCurrentEnvironment(request.Email)) - { - throw new AuthenticationException($"You do not have permissions to access the {MachineServiceConfig.DEPLOYMENT_SLOT.ToDescription()} environment."); - } + //if (!_ad_manager.CanUserAccessCurrentEnvironment(request.Email)) + //{ + // throw new AuthenticationException($"You do not have permissions to access the {MachineServiceConfig.DEPLOYMENT_SLOT.ToDescription()} environment."); + //} using (ObservablesContext db = ObservablesWebContext.CreateContext()) { diff --git a/Software/Visual_Studio/Web/Tango.MachineService/Controllers/PPCController.cs b/Software/Visual_Studio/Web/Tango.MachineService/Controllers/PPCController.cs index 17f6ba324..b60bc77c0 100644 --- a/Software/Visual_Studio/Web/Tango.MachineService/Controllers/PPCController.cs +++ b/Software/Visual_Studio/Web/Tango.MachineService/Controllers/PPCController.cs @@ -1072,10 +1072,10 @@ namespace Tango.MachineService.Controllers { var authResult = _ad_manager.ValidateUserCredentials(request.Email, request.Password); - if (!_ad_manager.CanUserAccessCurrentEnvironment(request.Email)) - { - throw new AuthenticationException($"You do not have permissions to access the {MachineServiceConfig.DEPLOYMENT_SLOT.ToDescription()} environment."); - } + //if (!_ad_manager.CanUserAccessCurrentEnvironment(request.Email)) + //{ + // throw new AuthenticationException($"You do not have permissions to access the {MachineServiceConfig.DEPLOYMENT_SLOT.ToDescription()} environment."); + //} BasicHashGenerator hash = new BasicHashGenerator(); String pass = hash.Encrypt(request.Password); diff --git a/Software/Visual_Studio/Web/Tango.MachineService/Tango.MachineService.csproj b/Software/Visual_Studio/Web/Tango.MachineService/Tango.MachineService.csproj index a027b9f53..9f8889d60 100644 --- a/Software/Visual_Studio/Web/Tango.MachineService/Tango.MachineService.csproj +++ b/Software/Visual_Studio/Web/Tango.MachineService/Tango.MachineService.csproj @@ -181,7 +181,9 @@ ..\..\packages\Microsoft.SqlServer.SqlManagementObjects.140.17283.0\lib\net40\Microsoft.SqlServer.WmiEnum.dll - + + False + ..\..\packages\Newtonsoft.Json.13.0.1\lib\net45\Newtonsoft.Json.dll @@ -506,7 +508,7 @@ False - + -- cgit v1.3.1