migrate to msgraph

docs/webhook_events.md

@@ -1004,7 +1004,8 @@ Each event will be submitted via HTTP POST to the user provided URL.
                 469,
                 470,
                 471,
-                472
+                472,
+                473
             ],
             "title": "ErrorCode"
         },
@@ -1615,7 +1616,8 @@ Each event will be submitted via HTTP POST to the user provided URL.
                 469,
                 470,
                 471,
-                472
+                472,
+                473
             ],
             "title": "ErrorCode"
         }
@@ -2501,7 +2503,8 @@ Each event will be submitted via HTTP POST to the user provided URL.
                 469,
                 470,
                 471,
-                472
+                472,
+                473
             ],
             "title": "ErrorCode"
         }
@@ -3190,7 +3193,8 @@ Each event will be submitted via HTTP POST to the user provided URL.
                 469,
                 470,
                 471,
-                472
+                472,
+                473
             ],
             "title": "ErrorCode"
         },
@@ -5123,7 +5127,8 @@ Each event will be submitted via HTTP POST to the user provided URL.
                 469,
                 470,
                 471,
-                472
+                472,
+                473
             ],
             "title": "ErrorCode"
         },

src/api-service/__app__/onefuzzlib/azure/creds.py

@@ -6,12 +6,12 @@
 import functools
 import logging
 import os
-from typing import Any, Callable, List, TypeVar, cast
+import urllib.parse
+from typing import Any, Callable, Dict, List, Optional, TypeVar, cast
 from uuid import UUID
 
+import requests
 from azure.core.exceptions import ClientAuthenticationError
-from azure.graphrbac import GraphRbacManagementClient
-from azure.graphrbac.models import CheckGroupMembershipParameters
 from azure.identity import DefaultAzureCredential
 from azure.keyvault.secrets import SecretClient
 from azure.mgmt.resource import ResourceManagementClient
@@ -23,6 +23,10 @@
 
 from .monkeypatch import allow_more_workers, reduce_logging
 
+# https://docs.microsoft.com/en-us/graph/api/overview?view=graph-rest-1.0
+GRAPH_RESOURCE = "https://graph.microsoft.com"
+GRAPH_RESOURCE_ENDPOINT = "https://graph.microsoft.com/v1.0"
+
 
 @cached
 def get_msi() -> MSIAuthentication:
@@ -99,18 +103,77 @@ def get_regions() -> List[Region]:
     return sorted([Region(x.name) for x in locations])
 
 
-@cached
-def get_graph_client() -> GraphRbacManagementClient:
-    return GraphRbacManagementClient(get_msi(), get_subscription())
+class GraphQueryError(Exception):
+    def __init__(self, message: str, status_code: Optional[int]) -> None:
+        super(GraphQueryError, self).__init__(message)
+        self.message = message
+        self.status_code = status_code
+
+
+def query_microsoft_graph(
+    method: str,
+    resource: str,
+    params: Optional[Dict] = None,
+    body: Optional[Dict] = None,
+) -> Dict:
+    cred = get_identity()
+    access_token = cred.get_token(f"{GRAPH_RESOURCE}/.default")
+
+    url = urllib.parse.urljoin(f"{GRAPH_RESOURCE_ENDPOINT}/", resource)
+    headers = {
+        "Authorization": "Bearer %s" % access_token.token,
+        "Content-Type": "application/json",
+    }
+    response = requests.request(
+        method=method, url=url, headers=headers, params=params, json=body
+    )
+
+    if 200 <= response.status_code < 300:
+        if response.content and response.content.strip():
+            json = response.json()
+            if isinstance(json, Dict):
+                return json
+            else:
+                raise GraphQueryError(
+                    "invalid data expected a json object: HTTP"
+                    f" {response.status_code} - {json}",
+                    response.status_code,
+                )
+        else:
+            return {}
+    else:
+        error_text = str(response.content, encoding="utf-8", errors="backslashreplace")
+        raise GraphQueryError(
+            f"request did not succeed: HTTP {response.status_code} - {error_text}",
+            response.status_code,
+        )
+
+
+def query_microsoft_graph_list(
+    method: str,
+    resource: str,
+    params: Optional[Dict] = None,
+    body: Optional[Dict] = None,
+) -> List[Any]:
+    result = query_microsoft_graph(
+        method,
+        resource,
+        params,
+        body,
+    )
+    value = result.get("value")
+    if isinstance(value, list):
+        return value
+    else:
+        raise GraphQueryError("Expected data containing a list of values", None)
 
 
 def is_member_of(group_id: str, member_id: str) -> bool:
-    client = get_graph_client()
-    return bool(
-        client.groups.is_member_of(
-            CheckGroupMembershipParameters(group_id=group_id, member_id=member_id)
-        ).value
+    body = {"groupIds": [group_id]}
+    response = query_microsoft_graph_list(
+        method="POST", resource=f"users/{member_id}/checkMemberGroups", body=body
     )
+    return group_id in response
 
 
 @cached

src/api-service/__app__/onefuzzlib/request.py

@@ -10,13 +10,11 @@
 from uuid import UUID
 
 from azure.functions import HttpRequest, HttpResponse
-from azure.graphrbac.models import GraphErrorException
 from onefuzztypes.enums import ErrorCode
 from onefuzztypes.models import Error
 from onefuzztypes.responses import BaseResponse
 from pydantic import ValidationError
 
-from .azure.creds import is_member_of
 from .orm import ModelMixin
 
 # We don't actually use these types at runtime at this time.  Rather,
@@ -28,25 +26,15 @@
 
 
 def check_access(req: HttpRequest) -> Optional[Error]:
-    if "ONEFUZZ_AAD_GROUP_ID" not in os.environ:
-        return None
-
-    group_id = os.environ["ONEFUZZ_AAD_GROUP_ID"]
-    member_id = req.headers["x-ms-client-principal-id"]
-    try:
-        result = is_member_of(group_id, member_id)
-    except GraphErrorException:
-        return Error(
-            code=ErrorCode.UNAUTHORIZED, errors=["unable to interact with graph"]
-        )
-    if not result:
-        logging.error("unauthorized access: %s is not in %s", member_id, group_id)
+    if "ONEFUZZ_AAD_GROUP_ID" in os.environ:
+        message = "ONEFUZZ_AAD_GROUP_ID configuration not supported"
+        logging.error(message)
         return Error(
-            code=ErrorCode.UNAUTHORIZED,
-            errors=["not approved to use this instance of onefuzz"],
+            code=ErrorCode.INVALID_CONFIGURATION,
+            errors=[message],
         )
-
-    return None
+    else:
+        return None
 
 
 def ok(

src/api-service/__app__/requirements.txt

@@ -4,7 +4,6 @@ azure-cosmosdb-nspkg==2.0.2
 azure-cosmosdb-table==1.0.6
 azure-devops==6.0.0b4
 azure-functions==1.7.2
-azure-graphrbac~=0.61.1
 azure-identity==1.6.1
 azure-keyvault-secrets~=4.3.0
 azure-mgmt-compute==22.0

src/cli/requirements.txt

@@ -23,4 +23,4 @@ cryptography<3.4,>=3.2
 # PyJWT needs to be pinned to the version used by azure-cli-core
 PyJWT>=2.1.0
 # onefuzztypes version is set during build
-onefuzztypes==0.0.0
+onefuzztypes==0.0.0

src/deployment/azuredeploy.json

@@ -899,6 +899,6 @@
         "tenant_id": {
             "type": "string",
             "value": "[subscription().tenantId]"
-        }
+       }
     }
 }