Add persistent input validation logging#1604
Conversation
…M.10031) Implements Write-EntraInputValidationLog function to persistently log all user input that fails validation, satisfying security requirement Microsoft.Security.SystemsADM.10031 from threat model review. Changes: - Add Write-EntraInputValidationLog.ps1 to each submodule folder that performs input validation (Applications, CertificateBasedAuthentication, DirectoryManagement, SignIns, Users, Governance) - Integrate logging calls into all 23 cmdlets with validation failure paths - Logs written to %LOCALAPPDATA%\Microsoft.Entra\Logs\ (file-based, no admin) - Attempts Windows Event Log (Application, EventId 1001) as secondary store - Sensitive values automatically masked in log output - Non-blocking: logging failures never interrupt cmdlet execution - Add unit tests (15 tests) and integration tests (8 tests) - all passing Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Learn Build status updates of commit e4d0bd2: ❌ Validation status: errorsPlease follow instructions here which may help to resolve issue.
For more details, please refer to the build report. Note: Your PR may contain errors or warnings or suggestions unrelated to the files you changed. This happens when external dependencies like GitHub alias, Microsoft alias, cross repo links are updated. Please use these instructions to resolve them. |
…ng tests The new Write-EntraInputValidationLog test files imported modules from the 'bin' directory, which is removed before the unit test stage runs, causing FileNotFoundException and 8 test failures in 'Run tests Entra'. Switch to the standard unit-test convention of importing the installed submodule (e.g. Microsoft.Entra.Users) so the tests run during the unit test stage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Learn Build status updates of commit cf58078: ❌ Validation status: errorsPlease follow instructions here which may help to resolve issue.
For more details, please refer to the build report. Note: Your PR may contain errors or warnings or suggestions unrelated to the files you changed. This happens when external dependencies like GitHub alias, Microsoft alias, cross repo links are updated. Please use these instructions to resolve them. |
The mandatory-parameter tests invoked Write-EntraInputValidationLog with a required parameter omitted, which prompts for input in interactive sessions instead of throwing. Assert parameter mandatoriness via command metadata instead so the tests run non-interactively. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Learn Build status updates of commit 8e20ceb: ❌ Validation status: errorsPlease follow instructions here which may help to resolve issue.
For more details, please refer to the build report. Note: Your PR may contain errors or warnings or suggestions unrelated to the files you changed. This happens when external dependencies like GitHub alias, Microsoft alias, cross repo links are updated. Please use these instructions to resolve them. |
Restore the original Should -Throw checks for the mandatory CmdletName and ParameterName parameters in the Write-EntraInputValidationLog tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Summary
Adds persistent logging of input validation failures to satisfy compliance requirement.
Problem
Validation failures were only displayed to the user via Write-Warning/Write-Error/throw without being persisted for security audit purposes.
Solution
Created
Write-EntraInputValidationLogfunction that:%LOCALAPPDATA%/Microsoft.Entra/Logs/InputValidation-{date}.logloggercommandChanges
Write-EntraInputValidationLog.ps1in each submodule folder (5 Entra + 4 EntraBeta)Cross-platform
[System.Environment]::UserNameon non-Windows (instead of WindowsIdentity)[Environment]::GetFolderPath('LocalApplicationData')(works on all platforms)Testing