-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathlifecycle-policy.xml
More file actions
120 lines (113 loc) · 9.05 KB
/
Copy pathlifecycle-policy.xml
File metadata and controls
120 lines (113 loc) · 9.05 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
<!--
Disclaimer
The sample scripts are not supported under any Microsoft standard support program or service. The sample scripts are provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample scripts and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation, even if Microsoft has been advised of the possibility of such damages.
-->
<policies>
<inbound>
<base />
<choose>
<!-- Gestione dell'evento "reauthorizationRequired" -->
<when condition="@(context.Request.Body.As<JObject>(preserveContent: true)?["value"]?[0]?["lifecycleEvent"]?.ToString() == "reauthorizationRequired")">
<!-- 1. Parametrizzazione di client_id e client_secret -->
<set-variable name="tenantId" value="{{GraphAPI-TenantId}}" />
<set-variable name="clientId" value="{{GraphAPI-ClientId}}" />
<set-variable name="clientCertificate" value="{{GraphAPI-Certificate}}" />
<!-- 2. Richiesta di un token di accesso tramite client credentials -->
<send-request ignore-error="true" timeout="20" response-variable-name="bearerToken" mode="new">
<set-url>https://login.microsoftonline.com/{{GraphAPI-TenantId}}/oauth2/v2.0/token</set-url>
<set-method>POST</set-method>
<set-header name="Content-Type" exists-action="override">
<value>application/x-www-form-urlencoded</value>
</set-header>
<set-body><![CDATA[@{
var clientCertificate = new X509Certificate2(Convert.FromBase64String(context.Variables.GetValueOrDefault<string>("clientCertificate")));
var jwt_h = new JObject(
new JProperty("alg", "RS256"),
new JProperty("typ", "JWT"),
new JProperty("x5t#S256", Convert.ToBase64String(clientCertificate.GetCertHash(HashAlgorithmName.SHA256)).Replace("+", "-").Replace("/", "_").Replace("=", ""))
);
var jwt_claims = new JObject(
new JProperty("iss", context.Variables.GetValueOrDefault<string>("clientId")),
new JProperty("aud", "https://login.microsoftonline.com/" + context.Variables.GetValueOrDefault<string>("tenantId") + "/oauth2/v2.0/token"),
new JProperty("nbt", DateTimeOffset.UtcNow.ToUnixTimeSeconds()),
new JProperty("exp", DateTimeOffset.UtcNow.ToUnixTimeSeconds() + 300),
new JProperty("jti", Guid.NewGuid().ToString()),
new JProperty("sub", context.Variables.GetValueOrDefault<string>("clientId")),
new JProperty("iat", DateTimeOffset.UtcNow.ToUnixTimeSeconds())
);
var jwt_h_b64url = Convert.ToBase64String(Encoding.UTF8.GetBytes(jwt_h.ToString(NewtonSoft.Json.Formatting.None))).Replace("+", "-").Replace("/", "_").Replace("=", "");
var jwt_claims_b64url = Convert.ToBase64String(Encoding.UTF8.GetBytes(jwt_claims.ToString(NewtonSoft.Json.Formatting.None))).Replace("+", "-").Replace("/", "_").Replace("=", "");
var toSign = Encoding.UTF8.GetBytes(jwt_h_b64url + "." + jwt_claims_b64url);
var rsa = clientCertificate.GetRSAPrivateKey();
var signature = rsa.SignData(toSign, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
var signature_b64url = Convert.ToBase64String(signature).Replace("+", "-").Replace("/", "_").Replace("=", "");
var clientAssertion = jwt_h_b64url + "." + jwt_claims_b64url + "." + signature_b64url;
return string.Format(
"client_id={0}&scope=https://graph.microsoft.com/.default&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&client_assertion={1}&grant_type=client_credentials",
context.Variables.GetValueOrDefault<string>("clientId"),
clientAssertion
);
}]]></set-body>
</send-request>
<!-- 3. Gestione errori nella chiamata per ottenere il token -->
<choose>
<when condition="@(context.Variables.GetValueOrDefault<IResponse>("bearerToken")?.StatusCode != 200)">
<return-response>
<set-status code="500" reason="Internal Server Error" />
<set-body>@("Error fetching token: " + context.Variables.GetValueOrDefault<IResponse>("bearerToken")?.Body.As<string>())</set-body>
</return-response>
</when>
</choose>
<!-- 4. Estrai subscriptionId e calcola la nuova data di scadenza -->
<set-variable name="subscriptionId" value="@((string)context.Request.Body.As<JObject>(preserveContent: true)["value"][0]["subscriptionId"])" />
<set-variable name="newExpirationDate" value="@(DateTime.UtcNow.AddMinutes(59).ToString("yyyy-MM-ddTHH:mm:ss.fffZ"))" />
<set-variable name="subscriptionUrlPrefix" value="https://graph.microsoft.com/v1.0/subscriptions/" />
<set-variable name="patchUrl" value="@(context.Variables.GetValueOrDefault<string>("subscriptionUrlPrefix","") + context.Variables.GetValueOrDefault<string>("subscriptionId",""))" />
<!-- 5. Invia la richiesta PATCH per rinnovare la subscription -->
<send-request mode="new" response-variable-name="patchResponse">
<set-url>@(context.Variables.GetValueOrDefault<string>("patchUrl"))</set-url>
<set-method>PATCH</set-method>
<set-header name="Authorization" exists-action="override">
<value>@("Bearer " + (String)((IResponse)context.Variables["bearerToken"]).Body.As<JObject>()["access_token"])</value>
</set-header>
<set-header name="Content-Type" exists-action="override">
<value>application/json</value>
</set-header>
<set-body>@(new JObject(new JProperty("expirationDateTime", context.Variables.GetValueOrDefault<string>("newExpirationDate"))).ToString(Newtonsoft.Json.Formatting.None))</set-body>
</send-request>
<!-- 6. Gestione della risposta della chiamata PATCH -->
<choose>
<when condition="@(context.Variables.GetValueOrDefault<IResponse>("patchResponse")?.StatusCode != 200)">
<return-response>
<set-status code="500" reason="Internal Server Error" />
<set-body>@("Error renewing subscription: " + context.Variables.GetValueOrDefault<IResponse>("patchResponse")?.Body.As<string>())</set-body>
</return-response>
</when>
<otherwise>
<return-response>
<set-status code="202" reason="Accepted" />
<set-body>@(context.Variables.GetValueOrDefault<IResponse>("patchResponse")?.Body.As<string>())</set-body>
</return-response>
</otherwise>
</choose>
</when>
<!-- Caso alternativo: evento diverso da "reauthorizationRequired" -->
<when condition="@(context.Request.Body.As<JObject>(preserveContent: true)?["value"]?[0]?["lifecycleEvent"]?.ToString() != "reauthorizationRequired")">
<set-status code="202" reason="Accepted" />
</when>
</choose>
</inbound>
<outbound>
<base />
</outbound>
<!-- Gestione errori generici -->
<on-error>
<return-response>
<set-status code="500" reason="Internal Server Error" />
<set-body>@("An unexpected error occurred.")</set-body>
</return-response>
</on-error>
<backend>
<base />
</backend>
</policies>