OAuth Example One - Azure AD Integration

maltego-trx start azure_oauth_project 

This will create a folder azure_oauth_project  with the example project.

4.3 Adding a Transform

Add a new Transform by creating a new Python file titled Azure.py in the "transforms" folder. Any Python file in the "transforms" folder whose class name matches the filename from which the class inherits from Transform will automatically be discovered and added to your Transform server.

import json
from pathlib import Path
 
import requests
from maltego_trx.entities import Phrase
from maltego_trx.maltego import UIM_TYPES
from maltego_trx.oauth import MaltegoOauth
from maltego_trx.transform import DiscoverableTransform
 
 
class Azure(DiscoverableTransform):
    """
    Uses Oauth token from the Microsoft Graph and Returns the current Loggedin person's contacts
    """
 
    @classmethod
    def create_entities(cls, request, response):
        try:
            cipher_token = request.getTransformSetting('maltego.web.api.key.azure')
            private_key_path = Path("private_key.pem").resolve()
            token_fields = MaltegoOauth.decrypt_secrets(private_key_path, cipher_token)
 
            api_url = "https://graph.microsoft.com/v1.0/me/contacts"
            headers = {'Authorization': 'Bearer {}'.format(token_fields['token'])}
            result = requests.get(api_url, headers=headers)
            content = json.loads(result.content)
            for value in content['value']:
                for entry in value['emailAddresses']:
                    response.addEntity('maltego.EmailAddress', entry['address'])
                    response.addEntity("maltego.Person", entry['name'])
            ciphertext = response.addEntity(Phrase, cipher_token)
            ciphertext.setNote("ciphertext")
            token = response.addEntity(Phrase, token_fields['token'])
            token.setNote("token")
        except Exception as e:
            response.addUIMessage("Error: " + str(e), UIM_TYPES["partial"])

    4.5.1 Create file : azure_oauth_project /private key.pem

    Add the contents of the private key to this pem file. It is possible to simply upload/save the actual pem file to this location

    if you have it as a PEM file.

4.6 Navigate to azure_oauth_project /

4.7 Run the trx project using (oauth-venv)python3 -b project.py runserver

Should all have gone successfully you should see something like this:

4.8 Deploy the entire project folder / azure_oauth_project to a remote VPS/VM/Dockerized environment. More details on how to deploy for production can be found here for standard web deployment and here for Docker containerized deployment. The simplest method for this tutorial is to upload the folder to a remote server through Git or FTP.

4.9 Navigating to your VPS IP http://<ip-address>/run/azure in a browser you should the following output. If it doesn’t work check that you have opened port on the firewall.

5. Configure Seed and Pair with Transform

Now that we have our Transform up and running we need to create a Seed to distribute the Transform. The TDS will generate a random alphanumeric Seed name for you, but you can also use one of your own choosing.

5.1 Add Transform and OAuth Settings to Seed

Next, we need to add the Transform, so we add the OAuth setting and the Input Entity and Seed.

5.2 Install Seed in the Maltego Client

After we are done adding the Transform, we can now install our Seed in Maltego.

5.3 Verify the OAuth Settings in the Service Manager

We can view the OAuth Authenticator settings in the Service Manager by selecting the Manage Service options under the Transforms menu. Cross check that the protocol set in step 2.3 are the same as here. The settings the Service Manager correspond with should correspond to the callback URL set in the provider Application.

5.4 Run the Transform

Drag a Person Entity on an empty graph and then right click and run Person to Emails [Signed in User].

Upon running the Transform, a prompt will appear asking you to sign in to authorize the Transform. Click Sign In. A browser page will be opened with the URL https://127.0.0.1:63141/signin and we are redirected to the Azure login page, please note you might observe a warning sign in the browser, ignore it and proceed.

After redirecting we are now able to sign into the application and grant the permissions which we set when we were setting up out OAuth settings.

The application we created will accept logins from any Microsoft public email account. In an organizational setup the privileges will be set by the admin.

After successful login a user can now make a query and return the contacts for the logged in user. The same authentication flow can be used in Maltego to authenticate users and return JWT access or id tokens.

You can view a video of the Transform in Action here. 

Note: To shorten authorization urls and to reference the returned token, Maltego uses configuration placeholders as follows:

For OAuth 2, "apiKey" and "callback" can be used as replacement variables in the authorization URL, e.g. http://example.com/oauth2/authorize?client_id={apiKey}&redirect_uri={callback}.

For OAuth 1.0a, only "token" can be used as a replacement variable, e.g. http://example.com/oauth1/authorize?oauth_token={token}.

For further explanation regarding OAuth endpoint configuration, please read more here.