Microsoft Graph API: “Insufficient privileges to …” DELETE a Group

Recently, had a task to DELETE an Azure AD Group by using application client credentials.

  1. Custom application were registered in Azure AD.
  2. All possible permission were assigned to the application
  3. But the DELETE https://graph.microsoft.io/en-us/docs/api-reference/v1.0/api/group_delete request failed anyway with the error below
{ 
  "error": { 
    "code": "Authorization_RequestDenied",
    "message": "Insufficient privileges to complete the operation.",
    "innerError": {
      "request-id": "fa1a14bf-6168-0000-b247-5ed17dafd08e",
      "date": "2016-12-22T19:53:59"
    }
  }
}

It turned out that you have to assign application principal object id to a “Company Administrator” role. Right now this is possible to do only trough PowerShell CMDlet https://docs.microsoft.com/en-us/powershell/msonline/v1/add-msolrolemember

Below is the the PowerShell script:

$tenantGuid = '4e4628a1-EXAM-PLE0-9064-44c1ab290b7f'
$user = 'admin@b940edadEXAMPLE093.onmicrosoft.com'
$password = 'YOUR PASSWORD'
$appID = '0bb0bda3-19b0-EXAM-PLE0-29d10a8cbecd'

$Creds = New-Object System.Management.Automation.PsCredential($user, (ConvertTo-SecureString $password -AsPlainText -Force))

Connect-MSOLSERVICE -Credential $Creds
$msSP = Get-MsolServicePrincipal -AppPrincipalId $appID -TenantID $tenantGuid

#ID of the Application's object (not the same as Application Id defined above)
$objectId = $msSP.ObjectId
Add-MsolRoleMember -RoleName "Company Administrator" -RoleMemberType ServicePrincipal -RoleMemberObjectId $objectId

 

Wait 3-5 minutes… It should work now.

Silent IIS UrlRewrite, ARR and FARM provisioning by #PowerShell

Recently, I had the task to run several fitnesse instances in on the single AWS EC2 instance. The requirement was what each fitnesse instance should be accessible trough port 80 (HTTP). IIS as reverse proxy came to the rescue. But there were one more requirement – IIS Reverse Proxy configuration should be automated.

Here >> konstantinvlasenko/IIS Reverse Proxy << you can find a complete PowerShell script how to install IIS and configure it as reverse proxy.

Silent install IIS UrlRewrite and ARR by #PowerShell

Create-Item c:/msi -Type Directory
Invoke-WebRequest 'http://download.microsoft.com/download/C/F/F/CFF3A0B8-99D4-41A2-AE1A-496C08BEB904/WebPlatformInstaller_amd64_en-US.msi' -OutFile c:/msi/WebPlatformInstaller_amd64_en-US.msi
Start-Process 'c:/msi/WebPlatformInstaller_amd64_en-US.msi' '/qn' -PassThru | Wait-Process
cd 'C:/Program Files/Microsoft/Web Platform Installer'; .\WebpiCmd.exe /Install /Products:'UrlRewrite2,ARRv3_0' /AcceptEULA /Log:c:/msi/WebpiCmd.log

Prepare your Amazon Linux for Sencha ExtJS 6.0 development

  1. install unzip
  2. install java
  3. download ExtJS 6.0 GPL
  4. download SenchaCMD 6.0
  5. unzip SenchaCMD
  6. unzip ExtJS 6.0
  7. install SenchaCMD
  8. logout/login
sudo yum install unzip
sudo yum install java-1.7.0-openjdk 
curl http://cdn.sencha.com/ext/gpl/ext-6.0.0-gpl.zip -o ext-6.0.0-gpl.zip
curl http://cdn.sencha.com/cmd/6.0.0.202/no-jre/SenchaCmd-6.0.0.202-linux-amd64.sh.zip -o SenchaCmd-6.0.0.202-linux-amd64.sh.zip
unzip SenchaCmd-6.0.0.202-linux-amd64.sh.zip
unzip ext-6.0.0-gpl.zip
./SenchaCmd-6.0.0.202-linux-amd64.sh

Apache proxy for sencha app watch

  1. sudo yum -y install httpd
  2. sudo service httpd start
  3. sudo vi /etc/httpd/conf/httpd.conf
  4. <VirtualHost *:80>
      ProxyPass / http://localhost:1841/
      ProxyPassReverse / http://localhost:1841/
    </VirtualHost>
  5. now you can access your server trough port 80

Howto register AWS SAML metadata in SimpleSAMLphp

  1. There is the page Configuring a Relying Party and Adding Claims. It explains how to get AWS metadata https://signin.aws.amazon.com/static/saml-metadata.xml
  2. Go to you SimpleSAMLphp Federation tab
  3. Click on XML to simpleSAMLphp metadata converter link
    XMLtoMetadata
  4. Copy content of https://signin.aws.amazon.com/static/saml-metadata.xml
  5. Paste it into Metadata parser window. Click Parse button.
  6. Copy Converted metadata content
  7. Paste into Noteapd
  8. Add Auth Procc Filter (mentioned at https://groups.google.com/forum/#!topic/simplesamlphp/AgHEy-5vHdA)

    ‘authproc’ => array(
    10 => array(
    ‘class’ => ‘core:AttributeAdd’,
    https://aws.amazon.com/SAML/Attributes/Role‘ => array(‘arn:aws:iam::<account_number_without_spaces>:role/<role_name>,arn:aws:iam::<account_number_without_spaces>:saml-provider/<’saml_provider_name)
    ),
    20 => array(
    ‘class’ => ‘core:AttributeAdd’,
    https://aws.amazon.com/SAML/Attributes/RoleSessionName‘ => array(‘uid’)
    ),
    ),

  9. Open /var/simplesamlphp/metadata/saml20-sp-remote.php file
  10. Replace its content by content from Notepad