action.yaml

name: Deploy B2C Custom Policy

description: A PowerShell-based GitHub Action for deploying Azure AD B2C policies using the Microsoft Graph API

author: Azure AD B2C GitHub Community

branding:
  icon: code
  color: blue

inputs:
  folder:
    description: "The folder where the custom policies files are stored"
    required: true
  files:
    description: "Comma delimiter list of policy files"
    required: true
  tenantDomain:
    description: "The full Azure AD B2C tenant name (for example, contoso.onmicrosoft.com) or GUID"
    required: true
  tenantId:
    description: "The full GUID of the Azure AD B2C tenant ID"
    required: true
  clientId:
    description: "The application Client ID for a service principal which will be used to authenticate to the Microsoft Graph"
    required: true
  clientSecret:
    description: "The application Secret for a service principal which will be used to authenticate to the Microsoft Graph"
    required: true

runs:
  using: "composite"
  steps:
    # Adapted from the PowerShell script in Microsoft's Docs: https://learn.microsoft.com/en-us/azure/active-directory-b2c/deploy-custom-policies-devops
    - name: Run Deploy Policy Script
      uses: azure/powershell@v1
      with:
        inlineScript: |
          $Folder = "${{ inputs.folder }}"
          $Files = "${{ inputs.files }}"
          $TenantDomain = "${{ inputs.tenantDomain }}"
          $TenantId = "${{ inputs.tenantId }}"
          $ClientID = "${{ inputs.clientId }}"
          $ClientSecret = "${{ inputs.clientSecret }}"

          try {
              $body = @{grant_type = "client_credentials"; scope = "https://graph.microsoft.com/.default"; client_id = $ClientID; client_secret = $ClientSecret }

              $response = Invoke-RestMethod -Uri https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token -Method Post -Body $body
              $token = $response.access_token

              $headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
              $headers.Add("Content-Type", 'application/xml')
              $headers.Add("Authorization", 'Bearer ' + $token)

              # Get the list of files to upload
              $filesArray = $Files.Split(",")

              Foreach ($file in $filesArray) {

                  $filePath = $Folder + $file.Trim()

                  # Check if file exists
                  $FileExists = Test-Path -Path $filePath -PathType Leaf

                  if ($FileExists) {
                      $policycontent = Get-Content $filePath -Encoding UTF8

                      # Optional: Change the content of the policy. For example, replace the tenant-name with your tenant name.
                      $policycontent = $policycontent.Replace("your-tenant.onmicrosoft.com", "$TenantDomain")


                      # Get the policy name from the XML document
                      $match = Select-String -InputObject $policycontent  -Pattern '(?<=\bPolicyId=")[^"]*'

                      If ($match.matches.groups.count -ge 1) {
                          $PolicyId = $match.matches.groups[0].value

                          Write-Output "Uploading the $PolicyId policy..."

                          $graphuri = 'https://graph.microsoft.com/beta/trustframework/policies/' + $PolicyId + '/$value'
                          $content = [System.Text.Encoding]::UTF8.GetBytes($policycontent)
                          $response = Invoke-RestMethod -Uri $graphuri -Method Put -Body $content -Headers $headers -ContentType "application/xml; charset=utf-8"

                          Write-Output "Policy $PolicyId uploaded successfully."
                      }
                  }
                  else {
                      $warning = "File " + $filePath + " couldn't be not found."
                      Write-Warning -Message $warning
                  }
              }
          }
          catch {
              Write-Output "StatusCode:" $_.Exception.Response.StatusCode.value__

              $_

              $streamReader = [System.IO.StreamReader]::new($_.Exception.Response.GetResponseStream())
              $streamReader.BaseStream.Position = 0
              $streamReader.DiscardBufferedData()
              $errResp = $streamReader.ReadToEnd()
              $streamReader.Close()

              $ErrResp

              exit 1
          }
          exit 0
        azPSVersion: "latest"