Install-SecureMfaThreatDetectionModule.ps1
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 |
<#
.SYNOPSIS Installs SecureMFA.com Threat Detection Module for ADFS. .DESCRIPTION Deployment must be done from elevated PowerShell command window If you are using federation server farm that uses Windows Internal Database, you must start installation using the primary federation server of the farm as a MAIN node. Installation needs to be executed on ADFS farm server (not web application proxy servers). Dependencies: * System which executes a script must run ADFS service on Windows 2019 with Microsoft Framework 4.7.2 and above installed. * SecureMfaThreatDetectionModule.dll file must be present in script directory. * SecureMfaThreatDetectionModule.json configuration file must be present in script directory. Bellow is a sample of valid Json config file with minimal configuration required for installation: { "company": "MyCompany", "serialkey": "m00000000", "subscriptionid": "1000000000000000000000001", "user_risk_assessment_enable": "false", "user_risk_assessment_mode": "AzureIdentityProtection", "az_tenantname": "709755e6-234c-470c-9993-xxxxxxxxxxxx", "az_app_clientid": "b5ee9d27-fba1-46f0-a337-xxxxxxxxxxxx", "az_app_clientsecret": "-wmQrk~UJrZ_BLD~7XU~09y0MQ4OGdcS2o", "az_block_risklevel_high": "true", "az_block_risklevel_medium": "false", "az_block_risklevel_low": "false", "az_block_risklevel_notevaluated": "false", "blockip_extranet_enable": "false", "blockip_extranet_mode": "deny", "blockip_extranet_networks": "105.201.220.1/105.201.220.120;184.200.20.12/184.200.20.12;", "blockip_intranet_enable": "false", "blockip_intranet_mode": "allow", "blockip_intranet_networks": "10.0.0.0/10.255.255.255;172.16.0.0/172.16.255.255;192.168.0.0/192.168.255.255;ee80:e1::/ee80:e1::ffff", "api_timeout": "5000", "api_on_error_continue": "true", "proxy_enable": "false", "proxy_server": "proxy.adatum.labnet", "proxy_port": "8080", "verboselog": "false" } .PARAMETER NotMainNode NotMainNode parameter is required when you do installation on multiple ADFS nodes (not web application proxy servers). This needs to be executed on other adfs servers when installation of a provider is done on the MAIN(First) ADFS node. .NOTES Version: 2.0.0.4 Author: SecureMfa.com Creation Date: 02/08/2021 Purpose/Change: Incorporated into PS module. .EXAMPLE C:\PS> Install-SecureMfaThreatDetectionModule This command will install OTP authentication provider on the MAIN ADFS node. .EXAMPLE C:\PS> Install-SecureMfaThreatDetectionModule -NotMainNode This command will install OTP authentication provider on OTHER ADFS node(s). #> $dllpath = (Join-Path -Path $PSScriptRoot -ChildPath SecureMfaThreatDetectionModule.dll) $dllversion = [System.Diagnostics.FileVersionInfo]::GetVersionInfo("$dllpath").FileVersion $configpath = (Join-Path -Path $PSScriptRoot -ChildPath SecureMfaThreatDetectionModule.json) Write-Host "File: $dllpath" Write-Host "Version: $dllversion" Write-Host "Configuration: $configpath" #Check if windows events source for application log exist, if not create one. if ([System.Diagnostics.EventLog]::SourceExists("Secure MFA TDM") -eq $False) {New-EventLog -LogName "Application" -Source "Secure MFA TDM" ; Write-Host "Secure MFA TDM Log Source Created."} #Check if ADFS service is available if((Get-Service adfssrv -ErrorAction SilentlyContinue).Status -eq "Stopped") {Start-Service adfssrv ; write-host "Starting ADFS Service on $env:COMPUTERNAME" -ForegroundColor Yellow;} #Load GAC Assembly Set-location $PSScriptRoot [System.Reflection.Assembly]::Load("System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a") $publish = New-Object System.EnterpriseServices.Internal.Publish Function Install-SecureMfaThreatDetectionModule { Param ( [Parameter(Mandatory=$false, ParameterSetName="Default")] [Switch]$NotMainNode ) #OTHER nodes install if ($NotMainNode) { try { $Error.Clear() if (!(Test-Path $dllpath -Type Leaf) ) { throw "The assembly $dllpath does not exist" } write-host "Installing SecureMfaThreatDetectionModule on the OTHER node" -ForegroundColor Cyan #Remove SecureMfaThreatDetectionModule DLL from GAC assembly $publish.GacRemove($dllpath) #Add SecureMfaThreatDetectionModule DLL to GAC assembly $publish.GacInstall($dllpath) #Restart ADFS service write-host "Restarting adfssrv service." -ForegroundColor Green Stop-Service adfssrv Start-Service adfssrv } catch { Write-Host "$($MyInvocation.InvocationName): $_" -ForegroundColor red } } #MAIN nodes install else { try { $Error.Clear() if (!(Test-Path $dllpath -Type Leaf) ) { throw "The assembly $dllpath does not exist" } write-host "Installing SecureMfaThreatDetectionModule on the MAIN node using configuration $configpath" -ForegroundColor Cyan #Unregister SecureMfaThreatDetectionModule from ADFS server write-host "Removing SecureMFA Threat Detection Module." -ForegroundColor Green UnRegister-AdfsThreatDetectionModule -Name "SecureMfaThreatDetectionModule" #Restart ADFS service write-host "Restarting adfssrv service." -ForegroundColor Green Stop-Service adfssrv Start-Service adfssrv write-host "Installing SecureMfaThreatDetectionModule..." -ForegroundColor Green #Remove SecureMfaThreatDetectionModule DLL from GAC assembly Write-Host "Removing SecureMfaThreatDetectionModule $dllpath" -ForegroundColor yellow; $publish.GacRemove($dllpath) #Add SecureMfaThreatDetectionModule DLL to GAC assembly Write-Host "Adding SecureMfaThreatDetectionModule $dllpath" -ForegroundColor Green; $publish.GacInstall($dllpath) #Register SecureMfaThreatDetectionModule addapter $typeName = �SecureMfaThreatDetectionModule.UserRiskAnalyzer, SecureMfaThreatDetectionModule, Version=$dllversion, Culture=neutral, PublicKeyToken=0471e941c843bbd6, processorArchitecture=MSIL� Register-AdfsThreatDetectionModule -Name "SecureMfaThreatDetectionModule" -TypeName $typeName -ConfigurationFilePath $configpath #Restart ADFS service write-host "`r`nRestarting adfssrv service." -ForegroundColor Green Stop-Service adfssrv Start-Service adfssrv } catch { Write-Host "$($MyInvocation.InvocationName): $_" -ForegroundColor red } } #List all Threat Detection Modules Get-AdfsThreatDetectionModule | fl } |