diff --git a/website/api/controllers/microsoft-proxy/create-compliance-partner-tenant.js b/website/api/controllers/microsoft-proxy/create-compliance-partner-tenant.js index 42d11cec09..1ec058d873 100644 --- a/website/api/controllers/microsoft-proxy/create-compliance-partner-tenant.js +++ b/website/api/controllers/microsoft-proxy/create-compliance-partner-tenant.js @@ -16,7 +16,7 @@ module.exports = { exits: { - success: { description: 'Details about a new Microsoft complaince tsenant have been returned to a Fleet isntance' }, + success: { description: 'Details about a new Microsoft compliance tenant have been returned to a Fleet instance' }, connectionAlreadyExists: {description: 'A Microsoft compliance tenant already exists for the provided entra tenant id.', statusCode: 409}, missingOriginHeader: { description: 'No Origin header set', responseType: 'badRequest'}, }, @@ -29,8 +29,8 @@ module.exports = { throw 'missingOriginHeader'; } - // Look for an existing microsoftComplianceTenant record using the requesting Fleet instances URL. - let existingComplianceTenant = await MicrosoftComplianceTenant.findOne({fleetInstanceUrl: this.req.get('origin')}); + // Look for an existing microsoftComplianceTenant record using the provided entraTenantId. + let existingComplianceTenant = await MicrosoftComplianceTenant.findOne({entraTenantId}); if(existingComplianceTenant) { // If we found one with the provided tenant ID, and setup was not completed, delete the incomplete compliance tenant and create a new one. if(!existingComplianceTenant.setupCompleted) { diff --git a/website/api/models/MicrosoftComplianceTenant.js b/website/api/models/MicrosoftComplianceTenant.js index db6ea69753..872ea5d3c4 100644 --- a/website/api/models/MicrosoftComplianceTenant.js +++ b/website/api/models/MicrosoftComplianceTenant.js @@ -28,7 +28,6 @@ module.exports = { fleetInstanceUrl: { type: 'string', description: 'The url of the connected Fleet instance.', - unique: true, required: true, }, diff --git a/website/api/policies/is-cloud-customer.js b/website/api/policies/is-cloud-customer.js deleted file mode 100644 index 8888def5de..0000000000 --- a/website/api/policies/is-cloud-customer.js +++ /dev/null @@ -1,24 +0,0 @@ -/** - * is-cloud-customer - * - * A simple policy that allows requests to microsoft proxy endpoints from a cloud customer. - * - * For more about how to use policies, see: - * https://sailsjs.com/config/policies - * https://sailsjs.com/docs/concepts/policies - * https://sailsjs.com/docs/concepts/policies/access-control-and-permissions - */ -module.exports = async function (req, res, proceed) { - - // If an MS API KEY header was provided, check to see if it matches the entraSharedSecret. - if (req.get('MS-API-KEY')) { - if([sails.config.custom.cloudCustomerCompliancePartnerSharedSecret, sails.config.custom.alternateCompliancePartnerSharedSecret].includes(req.get('MS-API-KEY'))){ - return proceed(); - } - } - - //--• - // Otherwise, this request did not come from a cloud customer. - return res.unauthorized(); - -}; diff --git a/website/config/custom.js b/website/config/custom.js index cb5ab3abcb..dd339af160 100644 --- a/website/config/custom.js +++ b/website/config/custom.js @@ -515,8 +515,6 @@ module.exports.custom = { // Microsoft compliance proxy // compliancePartnerClientId: '…', // compliancePartnerClientSecret: '…', - // cloudCustomerCompliancePartnerSharedSecret: '…', - // alternateCompliancePartnerSharedSecret: '…', // Android proxy diff --git a/website/config/policies.js b/website/config/policies.js index b08291ebec..1b1d0e4ce0 100644 --- a/website/config/policies.js +++ b/website/config/policies.js @@ -13,7 +13,7 @@ module.exports.policies = { '*': 'is-logged-in', 'admin/*': 'is-super-admin', 'query-generator/*': 'has-query-generator-access', - 'microsoft-proxy/*': 'is-cloud-customer', + 'microsoft-proxy/*': true, // Bypass the `is-logged-in` policy for: 'entrance/*': true,