221 lines
8.7 KiB
PowerShell
221 lines
8.7 KiB
PowerShell
#requires -Version 7.0
|
||
<#
|
||
.SYNOPSIS
|
||
Affiche les rôles par UTILISATEUR (hors "Tanium Internal*") et/ou par GROUPE,
|
||
avec filtres -User et -Group. Sections affichées selon les filtres.
|
||
#>
|
||
|
||
[CmdletBinding()]
|
||
param(
|
||
[string[]]$User, # filtre sur display name / username (substring ou wildcard)
|
||
[string[]]$Group # filtre sur nom du groupe (substring ou wildcard)
|
||
)
|
||
|
||
$ErrorActionPreference = 'Stop'
|
||
try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}
|
||
|
||
# --- Auth depuis config.json ---
|
||
$ConfigPath = Join-Path $PSScriptRoot 'config.json'
|
||
if (-not (Test-Path $ConfigPath -PathType Leaf)) {
|
||
throw "Config introuvable: $ConfigPath (attendu: { `"TaniumUrl`", `"TaniumApiToken`" })"
|
||
}
|
||
$cfg = Get-Content -Path $ConfigPath -Raw | ConvertFrom-Json
|
||
$baseUrl = ($cfg.TaniumUrl -replace '/+$',''); if ($baseUrl -notmatch '^https?://') { $baseUrl = "https://$baseUrl" }
|
||
|
||
$headers = @{
|
||
'Accept' = 'application/json'
|
||
'Content-Type' = 'application/json'
|
||
}
|
||
if ($cfg.TaniumApiToken) {
|
||
$headers['X-Api-Token'] = $cfg.TaniumApiToken
|
||
$headers['session'] = $cfg.TaniumApiToken
|
||
}
|
||
|
||
function Invoke-TaniumApi {
|
||
param(
|
||
[Parameter(Mandatory)][ValidateSet('GET','POST','PATCH','PUT','DELETE')] [string]$Method,
|
||
[Parameter(Mandatory)][string]$Path,
|
||
[hashtable]$Query,
|
||
[object]$Body
|
||
)
|
||
$b = [System.UriBuilder]("$baseUrl$Path")
|
||
if ($Query) {
|
||
$nv = [System.Web.HttpUtility]::ParseQueryString([string]::Empty)
|
||
foreach ($k in $Query.Keys) { $nv[$k] = [string]$Query[$k] }
|
||
$b.Query = $nv.ToString()
|
||
}
|
||
$uri = $b.Uri.AbsoluteUri
|
||
if ($PSBoundParameters.ContainsKey('Body')) { Invoke-RestMethod -Method $Method -Uri $uri -Headers $headers -Body ($Body | ConvertTo-Json -Depth 20) }
|
||
else { Invoke-RestMethod -Method $Method -Uri $uri -Headers $headers }
|
||
}
|
||
|
||
function Get-TaniumItems {
|
||
param([Parameter(Mandatory)][object]$Response)
|
||
if ($Response.items) { ,@($Response.items) }
|
||
elseif ($Response.data) { ,@($Response.data) }
|
||
elseif ($Response.users) { ,@($Response.users) }
|
||
elseif ($Response.user_groups) { ,@($Response.user_groups) }
|
||
else { ,@($Response) }
|
||
}
|
||
|
||
# helper: match substring/wildcard, case-insensitive
|
||
function Test-Match {
|
||
param([string]$Text, [string[]]$Patterns)
|
||
if (-not $Patterns -or $Patterns.Count -eq 0) { return $true }
|
||
foreach ($p in $Patterns) {
|
||
if ([string]::IsNullOrWhiteSpace($p)) { continue }
|
||
$pat = $p
|
||
if ($pat -notmatch '[\*\?\[\]]') { $pat = "*$pat*" } # ajoute wildcards si absent
|
||
if ($Text -like $pat -or $Text -like $pat.ToLower() -or $Text -like $pat.ToUpper()) { return $true }
|
||
}
|
||
return $false
|
||
}
|
||
|
||
# Déterminer quelles sections afficher
|
||
$hasUserFilter = $PSBoundParameters.ContainsKey('User') -and $User -and $User.Count -gt 0
|
||
$hasGroupFilter = $PSBoundParameters.ContainsKey('Group') -and $Group -and $Group.Count -gt 0
|
||
if ($hasUserFilter -and -not $hasGroupFilter) { $showUsers = $true; $showGroups = $false }
|
||
elseif ($hasGroupFilter -and -not $hasUserFilter) { $showUsers = $false; $showGroups = $true }
|
||
else { $showUsers = $true; $showGroups = $true } # aucun filtre OU les deux => montrer les deux
|
||
|
||
# --- Rôles (nécessaire pour libellés) ---
|
||
Write-Host ">> Récupère la liste des rôles..." -ForegroundColor Cyan
|
||
$rolesAll = Get-TaniumItems (Invoke-TaniumApi -Method GET -Path '/api/v2/content_set_roles' -Query @{ limit = 5000 })
|
||
$roleIndex = @{}; foreach ($r in $rolesAll) { if ($null -ne $r.id) { $roleIndex[[int]$r.id] = [string]$r.name } }
|
||
|
||
function Format-RoleLabel {
|
||
param([int]$Id, [string]$Name)
|
||
if ([string]::IsNullOrWhiteSpace($Name)) { $Name = $roleIndex[$Id] }
|
||
if ([string]::IsNullOrWhiteSpace($Name)) { "RoleID:$Id" } else { "RoleID:$Id ($Name)" }
|
||
}
|
||
|
||
# --- Utilisateurs (+ memberships) --------------------------------------------
|
||
$usersWithRoles = @()
|
||
if ($showUsers) {
|
||
Write-Host ">> Récupère les utilisateurs..." -ForegroundColor Cyan
|
||
$usersAll = Get-TaniumItems (Invoke-TaniumApi -Method GET -Path '/api/v2/users' -Query @{ limit = 5000 })
|
||
|
||
$users = $usersAll | Where-Object {
|
||
$disp = $_.display_name ?? $_.displayName ?? $_.name ?? $_.username
|
||
-not ($disp -like 'Tanium Internal*') -and (
|
||
(Test-Match -Text $disp -Patterns $User) -or (Test-Match -Text $_.username -Patterns $User)
|
||
)
|
||
}
|
||
|
||
Write-Host ">> Récupère les memberships (User<->Role)..." -ForegroundColor Cyan
|
||
$userRoleMships = Get-TaniumItems (Invoke-TaniumApi -Method GET -Path '/api/v2/content_set_role_memberships' -Query @{ limit = 50000 })
|
||
|
||
# Index users
|
||
$userIndex = @{}
|
||
foreach ($u in $users) {
|
||
$userIndex[[int]$u.id] = [pscustomobject]@{
|
||
ID = [int]$u.id
|
||
Name = $u.display_name ?? $u.displayName ?? $u.name ?? $u.username
|
||
Username = $u.username
|
||
Email = $u.email
|
||
}
|
||
}
|
||
|
||
# Rôles par user
|
||
$rolesByUser = @{}
|
||
foreach ($m in $userRoleMships) {
|
||
if ($null -eq $m.user -or $null -eq $m.content_set_role) { continue }
|
||
$uid = [int]$m.user.id
|
||
if (-not $userIndex.ContainsKey($uid)) { continue } # filtré/exclu
|
||
$rid = [int]$m.content_set_role.id
|
||
$rname = [string]$m.content_set_role.name
|
||
$label = Format-RoleLabel -Id $rid -Name $rname
|
||
if (-not $rolesByUser.ContainsKey($uid)) { $rolesByUser[$uid] = @() }
|
||
$rolesByUser[$uid] += $label
|
||
}
|
||
|
||
$usersWithRoles = $userIndex.GetEnumerator() |
|
||
ForEach-Object {
|
||
$uid = $_.Key
|
||
$info = $_.Value
|
||
$roles = @()
|
||
if ($rolesByUser.ContainsKey($uid)) {
|
||
$roles = $rolesByUser[$uid] | Where-Object { $_ } | Sort-Object -Unique
|
||
}
|
||
[pscustomobject]@{
|
||
ID = $info.ID
|
||
Nom = $info.Name
|
||
Username = $info.Username
|
||
RolesCount = $roles.Count
|
||
Roles = ($roles -join ', ')
|
||
}
|
||
} |
|
||
Sort-Object -Property Nom
|
||
}
|
||
|
||
# --- Groupes (+ memberships) --------------------------------------------------
|
||
$groupsWithRoles = @()
|
||
if ($showGroups) {
|
||
Write-Host ">> Récupère les groupes..." -ForegroundColor Cyan
|
||
$groupsAll = Get-TaniumItems (Invoke-TaniumApi -Method GET -Path '/api/v2/user_groups' -Query @{ limit = 5000 })
|
||
$groups = $groupsAll | Where-Object {
|
||
$gname = $_.name ?? $_.display_name ?? $_.displayName
|
||
Test-Match -Text $gname -Patterns $Group
|
||
}
|
||
|
||
Write-Host ">> Récupère les memberships (Group<->Role)..." -ForegroundColor Cyan
|
||
$groupRoleMships = Get-TaniumItems (Invoke-TaniumApi -Method GET -Path '/api/v2/content_set_user_group_role_memberships' -Query @{ limit = 50000 })
|
||
|
||
# Index groupes
|
||
$groupIndex = @{}
|
||
foreach ($g in $groups) {
|
||
$groupIndex[[int]$g.id] = [pscustomobject]@{
|
||
ID = [int]$g.id
|
||
Name = $g.name ?? $g.display_name ?? $g.displayName
|
||
}
|
||
}
|
||
|
||
# Rôles par groupe
|
||
$rolesByGroup = @{}
|
||
foreach ($m in $groupRoleMships) {
|
||
if ($null -eq $m.user_group -or $null -eq $m.content_set_role) { continue }
|
||
$gid = [int]$m.user_group.id
|
||
if (-not $groupIndex.ContainsKey($gid)) { continue } # filtré/exclu
|
||
$rid = [int]$m.content_set_role.id
|
||
$rname = [string]$m.content_set_role.name
|
||
$label = Format-RoleLabel -Id $rid -Name $rname
|
||
if (-not $rolesByGroup.ContainsKey($gid)) { $rolesByGroup[$gid] = @() }
|
||
$rolesByGroup[$gid] += $label
|
||
}
|
||
|
||
$groupsWithRoles = $groupIndex.GetEnumerator() |
|
||
ForEach-Object {
|
||
$gid = $_.Key
|
||
$g = $_.Value
|
||
$roles = @()
|
||
if ($rolesByGroup.ContainsKey($gid)) {
|
||
$roles = $rolesByGroup[$gid] | Where-Object { $_ } | Sort-Object -Unique
|
||
}
|
||
[pscustomobject]@{
|
||
ID = $g.ID
|
||
Groupe = $g.Name
|
||
RolesCount = $roles.Count
|
||
Roles = ($roles -join ', ')
|
||
}
|
||
} |
|
||
Sort-Object -Property Groupe
|
||
}
|
||
|
||
# --- Affichage conditionnel ---
|
||
if ($showUsers) {
|
||
Write-Host ""
|
||
Write-Host "=== ROLES PAR UTILISATEUR (hors 'Tanium Internal*') ===" -ForegroundColor Green
|
||
$usersWithRoles | Format-Table -Property ID,Nom,Username,RolesCount,Roles -AutoSize
|
||
}
|
||
if ($showGroups) {
|
||
Write-Host ""
|
||
Write-Host "=== ROLES PAR GROUPE ===" -ForegroundColor Green
|
||
$groupsWithRoles | Format-Table -Property ID,Groupe,RolesCount,Roles -AutoSize
|
||
}
|
||
|
||
# --- Sortie exploitable (ne s’affiche que si tu ne l’assignes pas) ---
|
||
[pscustomobject]@{
|
||
UsersWithRoles = $usersWithRoles
|
||
GroupsWithRoles = $groupsWithRoles
|
||
}
|