<#
    .Synopsis 
        Retrieve SPOIDCR cookie for SharePoint Online.
    .Description
        Authenticates to the sts and retrieves the SPOIDCR cookie for SharePoint Online.
        Will use the custom IDP if one has been setup.
        Optionally, can use integrated credentials (when integrated is set to true) with ADFS using the windowsmixed endpoint.
        Results are formattable as XML, JSON, KEYVALUE, and by line.
        
        Makes global variables avaiable at the end of the run.
        $spoidcrl contains the SPOIDCRL cookie

    .Example 
        The following returns the SPOIDCRL cookie value provided a username and password.

        PS> .\spoidcrl.ps1 -url https://contoso.sharepoint.com -username user@contoso.com -password ABCDEFG
    .Example 
        The following returns the SPOIDCRL cookie value using integrated windows credentials. Applies only to ADFS.

        PS> .\spoidcrl.ps1 -url https://contoso.sharepoint.com/sites/site1 -integrated

	.Example 
        The following saves the SPOIDCRL cookie value using integrated windows credentials. Applies only to ADFS.

        PS> .\spoidcrl.ps1 -url https://contoso.sharepoint.com/sites/site1 -integrated -format "XML" | Out-File "c:\temp\spoidcr.txt"

    .PARAMETER url 
        Tenant url (e.g. contoso.sharepoint.com)
    .PARAMETER username
        The username to login with. (e.g. user@contoso.com or user@contoso.onmicrosoft.com)		
    .PARAMETER password
      The password to login with.
    .PARAMETER integrated
      Whether to use integrated credentials (user running PowerShell) instead of explicit credentials.
      Needs to be supported by ADFS.
    .PARAMETER format
      How to format the output. Options include: XML, JSON, KEYVALUE

#>
[CmdletBinding()]
Param(
[Parameter(Mandatory=$true)]
[string]$url,
[Parameter(Mandatory=$false)]
[string]$username,
[Parameter(Mandatory=$false)]
[string]$password,
[Parameter(Mandatory=$false)]
[switch]$integrated = $false,
[Parameter(Mandatory=$false)]
[string]$format
)

$statusText = New-Object System.Text.StringBuilder

function log($info)
{
    if([string]::IsNullOrEmpty($info))
    {
        $info = ""
    }

    [void]$statusText.AppendLine($info)
}

try
{
    if (![uri]::IsWellFormedUriString($url, [UriKind]::Absolute))
    {
        throw "Parameter 'url' is not a valid URI."
    }
    else
    {
        $uri = [uri]::new($url)
        $tenant = $uri.Authority
    }

    if ($tenant.EndsWith("sharepoint.com", [System.StringComparison]::OrdinalIgnoreCase))
    {
        $msoDomain = "sharepoint.com"
    }
    else
    {
        $msoDomain = $tenant
    }

    if ($integrated.ToBool())
    {
        [System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices") | out-null
        [System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices.AccountManagement") | out-null
        $username = [System.DirectoryServices.AccountManagement.UserPrincipal]::Current.UserPrincipalName
    }
    elseif ([string]::IsNullOrWhiteSpace($username) -or [string]::IsNullOrWhiteSpace($password))
    {
        $credential = Get-Credential -UserName $username -Message "Enter credentials"
        $username = $credential.UserName
        $password = $credential.GetNetworkCredential().Password
    }

    $contextInfoUrl = $url.TrimEnd('/') + "/_api/contextinfo"
    $getRealmUrl = "https://login.microsoftonline.com/GetUserRealm.srf"
    $realm = "urn:federation:MicrosoftOnline"
    $msoStsAuthUrl = "https://login.microsoftonline.com/rst2.srf"
    $idcrlEndpoint = "https://$tenant/_vti_bin/idcrl.svc/"
    $username = [System.Security.SecurityElement]::Escape($username)
    $password = [System.Security.SecurityElement]::Escape($password)

    # Custom STS integrated authentication envelope format index info
    # 0: message id - unique guid
    # 1: custom STS auth url
    # 2: realm
    $customStsSamlIntegratedRequestFormat = "<?xml version=`"1.0`" encoding=`"UTF-8`"?><s:Envelope xmlns:s=`"http://www.w3.org/2003/05/soap-envelope`" xmlns:a=`"http://www.w3.org/2005/08/addressing`"><s:Header><a:Action s:mustUnderstand=`"1`">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue</a:Action><a:MessageID>urn:uuid:{0}</a:MessageID><a:ReplyTo><a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address></a:ReplyTo><a:To s:mustUnderstand=`"1`">{1}</a:To></s:Header><s:Body><t:RequestSecurityToken xmlns:t=`"http://schemas.xmlsoap.org/ws/2005/02/trust`"><wsp:AppliesTo xmlns:wsp=`"http://schemas.xmlsoap.org/ws/2004/09/policy`"><wsa:EndpointReference xmlns:wsa=`"http://www.w3.org/2005/08/addressing`"><wsa:Address>{2}</wsa:Address></wsa:EndpointReference></wsp:AppliesTo><t:KeyType>http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey</t:KeyType><t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType></t:RequestSecurityToken></s:Body></s:Envelope>";


    # custom STS envelope format index info
    # {0}: ADFS url, such as https://corp.sts.contoso.com/adfs/services/trust/2005/usernamemixed, its value comes from the response in GetUserRealm request.
    # {1}: MessageId, it could be an arbitrary guid
    # {2}: UserLogin, such as someone@contoso.com
    # {3}: Password
    # {4}: Created datetime in UTC, such as 2012-11-16T23:24:52Z
    # {5}: Expires datetime in UTC, such as 2012-11-16T23:34:52Z
    # {6}: tokenIssuerUri, such as urn:federation:MicrosoftOnline, or urn:federation:MicrosoftOnline-int
    $customStsSamlRequestFormat = "<?xml version=`"1.0`" encoding=`"UTF-8`"?><s:Envelope xmlns:s=`"http://www.w3.org/2003/05/soap-envelope`" xmlns:wsse=`"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd`" xmlns:saml=`"urn:oasis:names:tc:SAML:1.0:assertion`" xmlns:wsp=`"http://schemas.xmlsoap.org/ws/2004/09/policy`" xmlns:wsu=`"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd`" xmlns:wsa=`"http://www.w3.org/2005/08/addressing`" xmlns:wssc=`"http://schemas.xmlsoap.org/ws/2005/02/sc`" xmlns:wst=`"http://schemas.xmlsoap.org/ws/2005/02/trust`"><s:Header><wsa:Action s:mustUnderstand=`"1`">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue</wsa:Action><wsa:To s:mustUnderstand=`"1`">{0}</wsa:To><wsa:MessageID>{1}</wsa:MessageID><ps:AuthInfo xmlns:ps=`"http://schemas.microsoft.com/Passport/SoapServices/PPCRL`" Id=`"PPAuthInfo`"><ps:HostingApp>Managed IDCRL</ps:HostingApp><ps:BinaryVersion>6</ps:BinaryVersion><ps:UIVersion>1</ps:UIVersion><ps:Cookies></ps:Cookies><ps:RequestParams>AQAAAAIAAABsYwQAAAAxMDMz</ps:RequestParams></ps:AuthInfo><wsse:Security><wsse:UsernameToken wsu:Id=`"user`"><wsse:Username>{2}</wsse:Username><wsse:Password>{3}</wsse:Password></wsse:UsernameToken><wsu:Timestamp Id=`"Timestamp`"><wsu:Created>{4}</wsu:Created><wsu:Expires>{5}</wsu:Expires></wsu:Timestamp></wsse:Security></s:Header><s:Body><wst:RequestSecurityToken Id=`"RST0`"><wst:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</wst:RequestType><wsp:AppliesTo><wsa:EndpointReference>  <wsa:Address>{6}</wsa:Address></wsa:EndpointReference></wsp:AppliesTo><wst:KeyType>http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey</wst:KeyType></wst:RequestSecurityToken></s:Body></s:Envelope>"

    # mso envelope format index info (Used for custom STS + MSO authentication)
    # 0: custom STS assertion
    # 1: mso endpoint
    $msoSamlRequestFormat = "<?xml version=`"1.0`" encoding=`"UTF-8`"?><S:Envelope xmlns:S=`"http://www.w3.org/2003/05/soap-envelope`" xmlns:wsse=`"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd`" xmlns:wsp=`"http://schemas.xmlsoap.org/ws/2004/09/policy`" xmlns:wsu=`"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd`" xmlns:wsa=`"http://www.w3.org/2005/08/addressing`" xmlns:wst=`"http://schemas.xmlsoap.org/ws/2005/02/trust`"><S:Header><wsa:Action S:mustUnderstand=`"1`">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue</wsa:Action><wsa:To S:mustUnderstand=`"1`">https://login.microsoftonline.com/rst2.srf</wsa:To><ps:AuthInfo xmlns:ps=`"http://schemas.microsoft.com/LiveID/SoapServices/v1`" Id=`"PPAuthInfo`"><ps:BinaryVersion>5</ps:BinaryVersion><ps:HostingApp>Managed IDCRL</ps:HostingApp></ps:AuthInfo><wsse:Security>{0}</wsse:Security></S:Header><S:Body><wst:RequestSecurityToken xmlns:wst=`"http://schemas.xmlsoap.org/ws/2005/02/trust`" Id=`"RST0`"><wst:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</wst:RequestType><wsp:AppliesTo><wsa:EndpointReference><wsa:Address>{1}</wsa:Address></wsa:EndpointReference></wsp:AppliesTo><wsp:PolicyReference URI=`"MBI`"></wsp:PolicyReference></wst:RequestSecurityToken></S:Body></S:Envelope>"

    # mso envelope format index info (Used for MSO-only authentication)
    # 0: mso endpoint
    # 1: username
    # 2: password
    $msoSamlRequestFormat2 = "<?xml version=`"1.0`" encoding=`"UTF-8`"?><S:Envelope xmlns:S=`"http://www.w3.org/2003/05/soap-envelope`" xmlns:wsse=`"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd`" xmlns:wsp=`"http://schemas.xmlsoap.org/ws/2004/09/policy`" xmlns:wsu=`"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd`" xmlns:wsa=`"http://www.w3.org/2005/08/addressing`" xmlns:wst=`"http://schemas.xmlsoap.org/ws/2005/02/trust`"><S:Header><wsa:Action S:mustUnderstand=`"1`">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue</wsa:Action><wsa:To S:mustUnderstand=`"1`">{0}</wsa:To><ps:AuthInfo xmlns:ps=`"http://schemas.microsoft.com/LiveID/SoapServices/v1`" Id=`"PPAuthInfo`"><ps:BinaryVersion>5</ps:BinaryVersion><ps:HostingApp>Managed IDCRL</ps:HostingApp></ps:AuthInfo><wsse:Security><wsse:UsernameToken wsu:Id=`"user`"><wsse:Username>{1}</wsse:Username><wsse:Password>{2}</wsse:Password></wsse:UsernameToken></wsse:Security></S:Header><S:Body><wst:RequestSecurityToken xmlns:wst=`"http://schemas.xmlsoap.org/ws/2005/02/trust`" Id=`"RST0`"><wst:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</wst:RequestType><wsp:AppliesTo><wsa:EndpointReference><wsa:Address>sharepoint.com</wsa:Address></wsa:EndpointReference></wsp:AppliesTo><wsp:PolicyReference URI=`"MBI`"></wsp:PolicyReference></wst:RequestSecurityToken></S:Body></S:Envelope>"


    function Invoke-HttpPost($endpoint, $body, $headers, $session)
    {
        log
        log "Invoke-HttpPost"
        log "url: $endpoint"
        log "post body: $body"

        $params = @{}
        $params.Headers = $headers
        $params.uri = $endpoint
        $params.Body = $body
        $params.Method = "POST"
        $params.WebSession = $session

        $response = Invoke-WebRequest @params -ContentType "application/soap+xml; charset=utf-8" -UseDefaultCredentials -UserAgent ([string]::Empty)
        $content = $response.Content

        return $content
    }

    # Get saml Assertion value from the custom STS
    function Get-AssertionCustomSts($customStsAuthUrl)
    {
        log
        log "Get-AssertionCustomSts"

        $messageId = [guid]::NewGuid()
        $created = [datetime]::UtcNow.ToString("o", [System.Globalization.CultureInfo]::InvariantCulture)
        $expires = [datetime]::UtcNow.AddMinutes(10).ToString("o", [System.Globalization.CultureInfo]::InvariantCulture)

        if ($integrated.ToBool())
        {
            log "integrated"

            $customStsAuthUrl = $customStsAuthUrl.ToLowerInvariant().Replace("/usernamemixed","/windowstransport")
            log $customStsAuthUrl

            $requestSecurityToken = [string]::Format($customStsSamlIntegratedRequestFormat, $messageId, $customStsAuthUrl, $realm)
            log $requestSecurityToken

        }
        else
        {
            log "not integrated"

            $requestSecurityToken = [string]::Format($customStsSamlRequestFormat, $customStsAuthUrl, $messageId, $username, $password, $created, $expires, $realm)
            log $requestSecurityToken

        }

        [xml]$customStsXml = Invoke-HttpPost $customStsAuthUrl $requestSecurityToken

        return $customStsXml.Envelope.Body.RequestSecurityTokenResponse.RequestedSecurityToken.Assertion.OuterXml
    }

    function Get-BinarySecurityToken($customStsAssertion, $msoSamlRequestFormatTemp)
    {
        log
        log "Get-BinarySecurityToken"

        if ([string]::IsNullOrWhiteSpace($customStsAssertion))
        {
            log "using username and password"
            $msoPostEnvelope = [string]::Format($msoSamlRequestFormatTemp, $msoDomain, $username, $password)
        }
        else
        {
            log "using custom sts assertion"
            $msoPostEnvelope = [string]::Format($msoSamlRequestFormatTemp, $customStsAssertion, $msoDomain)
        }

        $msoContent = Invoke-HttpPost $msoStsAuthUrl $msoPostEnvelope

        # Get binary security token using regex instead of [xml]
        # Using regex to workaround PowerShell [xml] bug where hidden characters cause failure
        [regex]$regex = "BinarySecurityToken Id=.*>([^<]+)<"
        $match = $regex.Match($msoContent).Groups[1]

        return $match.Value
    }

    function Get-SPOIDCRLCookie($msoBinarySecurityToken)
    {
        log
        log "Get-SPOIDCRLCookie"
        log
        log "BinarySecurityToken: $msoBinarySecurityToken"

        $binarySecurityTokenHeader = [string]::Format("BPOSIDCRL {0}", $msoBinarySecurityToken)
        $params = @{uri=$idcrlEndpoint
                    Method="GET"
                    Headers = @{}
                   }
        $params.Headers["Authorization"] = $binarySecurityTokenHeader
        $params.Headers["X-IDCRL_ACCEPTED"] = "t"

        $resonse = Invoke-WebRequest @params -UserAgent ([string]::Empty)
        $cookie = $resonse.BaseResponse.Cookies["SPOIDCRL"]

        return $cookie
    }

    # Retrieve the configured STS Auth Url (ADFS, PING, etc.)
    function Get-UserRealmUrl($getRealmUrl, $username)
    {
        log
        log "Get-UserRealmUrl"
        log "url: $getRealmUrl"
        log "username: $username"

        $body = "login=$username&xml=1"
        $response = Invoke-WebRequest -Uri $getRealmUrl -Method POST -Body $body -UserAgent ([string]::Empty)

        return ([xml]$response.Content).RealmInfo.STSAuthURL
    }

    [System.Net.ServicePointManager]::Expect100Continue = $true

    #1 Get custom STS auth url
    $customStsAuthUrl = Get-UserRealmUrl $getRealmUrl $username

    if ($customStsAuthUrl -eq $null)
    {
        #2 Get binary security token from the MSO STS by passing the SAML <Assertion> xml
        $customStsAssertion = $null
        $msoBinarySecurityToken = Get-BinarySecurityToken $customStsAssertion $msoSamlRequestFormat2
    }
    else
    {
        #2 Get SAML <Assertion> xml from custom STS
        $customStsAssertion = Get-AssertionCustomSts $customStsAuthUrl

        #3 Get binary security token from the MSO STS by passing the SAML <Assertion> xml
        $msoBinarySecurityToken = Get-BinarySecurityToken $customStsAssertion $msoSamlRequestFormat
    }

    #3/4 Get SPOIDRCL cookie from SharePoint site by passing the binary security token
    #  Save cookie and reuse with multiple requests
    $idcrl = $null
    $idcrl = Get-SPOIDCRLCookie $msoBinarySecurityToken

    if ([string]::IsNullOrEmpty($format))
    {
        $format = [string]::Empty
    }
    else
    {
        $format = $format.Trim().ToUpperInvariant()
    }

    $Global:spoidcrl = $idcrl

    if ($format -eq "XML")
    {
        Write-Output ([string]::Format("<SPOIDCRL>{0}</SPOIDCRL>", $idcrl.Value))
    }
    elseif ($format -eq "JSON")
    {
        Write-Output ([string]::Format("{{`"SPOIDCRL`":`"{0}`"}}", $idcrl.Value))
    }
    elseif ($format.StartsWith("KEYVALUE") -or $format.StartsWith("NAMEVALUE"))
    {
        Write-Output ("SPOIDCRL:" + $idcrl.Value)
    }
    else
    {
        Write-Output $idcrl.Value
    }

}
catch
{
    log $error[0]
    "ERROR:" + $statusText.ToString()
}

<#
    .Synopsis
        Get access token for AAD web app.

    .Description
        Authorizes AAD app and retrieves access token using OAuth 2.0 and endpoints.
        Refreshes the token if within 5 minutes of expiration or, optionally forces refresh.
        Sets global variable ($Global:accessTokenResult) that can be used after the script runs.

    .Todo
        Add ability to handle refresh token input and access token retrieval without re-authorization.

    .Example 
        The following returns the access token result from AAD with admin consent authorization and caches the result.

        PS> .\aad_web.ps1 -Clientid "" -Clientsecret "" -Resource "https://TENANT.sharepoint.com" -Redirecturi "https://localhost:44385" -Scope "" -AdminConsent -Cache
    
    .Example 
        The following returns the access token result from AAD with admin consent authorization or refreshes the token.

        PS> .\aad_web.ps1 -Clientid "" -Clientsecret "" -Resource "https://TENANT.sharepoint.com" -Redirecturi "https://localhost:44385" -Scope "" -AdminConsent
    
    .Example 
        The following returns the access token result from AAD or from cache, forces refresh so the token is good for an hour and outputs to a file

        PS> .\aad_web.ps1 -Clientid "" -Clientsecret "" -Resource "https://TENANT.sharepoint.com" -Redirecturi "https://localhost:44385" -Scope "" -Refresh Force | Out-File c:\temp\token.txt

    .PARAMETER ClientId 
        The AAD App client id.
    .PARAMETER ClientSecret
        The AAD App client secret.	
    .PARAMETER RedirectUri
        The redirect uri configured for that app.
    .PARAMETER Resource
        The resource the app is attempting to access (i.e. https://TENANT.sharepoint.com)
    .PARAMETER Scope
        Permission scopes for the app (optional).
    .PARAMETER AdminConsent
        Will perform admin consent (optional).
    .PARAMETER Cache
        Cache the access token in the temp directory for subsequent retrieval (optional).
    .PARAMETER Refresh
        Options (Yes, No, Force). Will automatically enabling caching if "Yes" or "Force" are used.
        Yes: Refresh token if within 5 minutes of expiration if cached token found.
        No: Do not refresh and re-authorize.
        Force: Forfce a refresh if cached token found.

#>
[CmdletBinding()]
Param(
[Parameter(Mandatory=$true)]
[string]$ClientId,
[Parameter(Mandatory=$true)]
[string]$ClientSecret,
[Parameter(Mandatory=$true)]
[string]$RedirectUri,
[Parameter(Mandatory=$true)]
[string]$Resource,
[Parameter(Mandatory=$false)]
[string]$Scope,
[Parameter(Mandatory=$false)]
[switch]$AdminConsent,
[Parameter(Mandatory=$false)]
[switch]$Cache,
[Parameter(Mandatory=$false)]
[ValidateSet("Yes","No","Force")]
[ValidateNotNullOrEmpty()]
[string]$Refresh = "Yes"
)

Add-Type -AssemblyName System.Windows.Forms
Add-Type -AssemblyName System.Web

$isCache = $Cache.IsPresent
$isRefresh = (($Refresh -eq "Yes") -or ($Refresh -eq "Force"))
$refreshForce = $Refresh -eq "Force"

if ($isRefresh)
{
    $isCache = $true
}

# Don't edit variables below (unless there's a bug)
$clientSecretEncoded = [uri]::EscapeDataString($clientSecret)
$redirectUriEncoded = [uri]::EscapeDataString($redirectUri)
$resourceEncoded = [uri]::EscapeDataString($resource)
$accessTokenUrl = "https://login.microsoftonline.com/common/oauth2/token"
$cacheFilePath = [System.IO.Path]::Combine($env:TEMP, "aad_web_cache_$clientId.json")

$accessTokenResult = $null
$adminConsentText =""
if ($adminConsent)
{
    $adminConsentText = "&prompt=admin_consent"
}

$authorizationUrl = "https://login.microsoftonline.com/common/oauth2/authorize?resource=$resourceEncoded&client_id=$clientId&scope=$scope&redirect_uri=$redirectUriEncoded&response_type=code$adminConsentText"

function Invoke-OAuth()
{
    $Global:authorizationCode = $null

    $form = New-Object Windows.Forms.Form
    $form.FormBorderStyle = [Windows.Forms.FormBorderStyle]::FixedSingle
    $form.Width = 640
    $form.Height = 480
    $form.MaximizeBox = $false
    $form.MinimizeBox = $false

    $web = New-Object Windows.Forms.WebBrowser
    $form.Controls.Add($web)

    $web.Size = $form.ClientSize
    $web.DocumentText = "<html><body style='text-align:center;overflow:hidden;background-image:url(https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6856.20/content/images/backgrounds/0.jpg?x=f5a9a9531b8f4bcc86eabb19472d15d5)'><h3 id='title'>Continue with current user or logout?</h3><div><input id='cancel' type='button' value='Continue' /></div><br /><div><input id='logout' type='button' value='Logout' /></div><h5 id='loading' style='display:none'>Working on it...</h5><script type='text/javascript'>var logout = document.getElementById('logout');var cancel = document.getElementById('cancel');function click(element){document.getElementById('title').style.display='none';document.getElementById('loading').style.display='block';logout.style.display='none';cancel.style.display='none';if (this.id === 'logout'){window.location = 'https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=' + encodeURIComponent('$authorizationUrl');}else{window.location = '$authorizationUrl';}}logout.onclick = click;cancel.onclick = click;</script></body></html>"

    $web.add_DocumentCompleted(
    {
        $uri = [uri]$redirectUri
        $queryString = [System.Web.HttpUtility]::ParseQueryString($_.url.Query)

        if($_.url.authority -eq $uri.authority)
        {
            $authorizationCode = $queryString["code"]

            if (![string]::IsNullOrEmpty($authorizationCode))
            {
                $form.DialogResult = "OK"
                $Global:authorizationCode = $authorizationCode
                $Global:authorizationCodeTime = [datetime]::Now
            }

            $form.close()
        }
    })

    $dialogResult = $form.ShowDialog()

    if($dialogResult -eq "OK")
    {
        $authorizationCode = $Global:authorizationCode
        $headers = @{"Accept" = "application/json;odata=verbose"}
        $body = "client_id=$clientId&client_secret=$clientSecretEncoded&redirect_uri=$redirectUriEncoded&grant_type=authorization_code&code=$authorizationCode"

        $accessTokenResult = Invoke-RestMethod -Uri $accessTokenUrl -Method POST -Body $body -Headers $headers
        $Global:accessTokenResult = $accessTokenResult
        $Global:accessTokenResultTime = [datetime]::Now
        $accessTokenResultText = (ConvertTo-Json $accessTokenResult)

        if ($isCache -and ![string]::IsNullOrEmpty($accessTokenResultText))
        {
            [void](Set-Content -Path $cacheFilePath -Value $accessTokenResultText)
        }

        Write-Output (ConvertTo-Json $accessTokenResultText)
    }

    $web.Dispose()
    $form.Dispose()
}

function Get-CachedAccessTokenResult()
{
    if ($isCache -and [System.IO.File]::Exists($cacheFilePath))
    {
        $accessTokenResultText = Get-Content -Raw $cacheFilePath
        if (![string]::IsNullOrEmpty($accessTokenResultText))
        {
            $accessTokenResult  = (ConvertFrom-Json $accessTokenResultText)
            if (![string]::IsNullOrEmpty($accessTokenResult.access_token))
            {
                $Global:accessTokenResult = $accessTokenResult

                return $accessTokenResult
            }
        }
    }

    return $null
}

function Invoke-Refresh()
{
    $refreshToken = $accessTokenResult.refresh_token
    $headers = @{"Accept" = "application/json;odata=verbose"}
    $body = "client_id=$clientId&client_secret=$clientSecretEncoded&resource=$resourceEncoded&grant_type=refresh_token&refresh_token=$refreshToken"
    $accessTokenResult2 = Invoke-RestMethod -Uri $accessTokenUrl -Method POST -Body $body -Headers $headers

    $accessTokenResult.scope = $accessTokenResult2.scope
    $accessTokenResult.expires_in = $accessTokenResult2.expires_in
    $accessTokenResult.ext_expires_in = $accessTokenResult2.ext_expires_in
    $accessTokenResult.expires_on = $accessTokenResult2.expires_on
    $accessTokenResult.not_before = $accessTokenResult2.not_before
    $accessTokenResult.resource = $accessTokenResult2.resource
    $accessTokenResult.access_token = $accessTokenResult2.access_token
    $accessTokenResult.refresh_token = $accessTokenResult2.refresh_token

    $Global:accessTokenResult = $accessTokenResult
    $Global:accessTokenResultTime = [datetime]::Now
    $accessTokenResultText = (ConvertTo-Json $accessTokenResult)

    if (![string]::IsNullOrEmpty($accessTokenResultText))
    {
        [void](Set-Content -Path $cacheFilePath -Value $accessTokenResultText)
    }

    Write-Output (ConvertTo-Json $accessTokenResultText)
}

$accessTokenResult = Get-CachedAccessTokenResult
if ($accessTokenResult -eq $null)
{
    Invoke-OAuth
}
elseif ($refreshForce -or (([datetime]::Parse("1/1/1970")).AddSeconds([int]$accessTokenResult.expires_on).ToLocalTime() -lt ([datetime]::Now).AddMinutes(5)))
{
    if ($isRefresh)
    {
        Invoke-Refresh
    }
    else
    {
        Invoke-OAuth
    }
}
else
{
    Write-Output (ConvertTo-Json $Global:accessTokenResult)
}

{
   "debugMode": true,
   "elmType": "span",
   "txtContent": "@currentField",
   "style": {
      "width":"100%",
      "height": "80px",
      "overflow":"visible",
      "vertical-align": "top",
      "padding": "4px",
      "word-wrap": "break-word",
      "overflow-wrap": "break-word",
      "word-break": "break-all",
      "white-space":"normal"
    }
}

$Username = "garthf@spo.onmicrosoft.com"
$Password = ConvertTo-SecureString 'password' -AsPlainText -Force
$LiveCred = New-Object System.Management.Automation.PSCredential $Username, $Password
 
$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $LiveCred -Authentication Basic -AllowRedirection

Import-PSSession $session

Connect-MsolService -Credential $LiveCred
 
$Users = Get-MsolUser | Where-Object {$_.UserPrincipalName -notlike "*#EXT#*" }
 
$Users | ForEach {
        
$OutputFile = "C:\SomeFolder\Usage-" + $_.DisplayName + ".csv"

$auditEventsForUser = Search-UnifiedAuditLog -EndDate $((Get-Date)) -StartDate $((Get-Date).AddDays(-7)) -UserIds $_.UserPrincipalName -RecordType SharePoint -Operations FileAccessed,PageViewed,PageViewedExtended


Write-Host "Events for" $_.DisplayName "created at" $_.WhenCreated
 
$ConvertedOutput = $auditEventsForUser | Select-Object -ExpandProperty AuditData | ConvertFrom-Json

$ConvertedOutput | Select-Object CreationTime,UserId,Operation,Workload,ObjectID,SiteUrl,SourceFileName,ClientIP,UserAgent | Export-Csv $OutputFile -NoTypeInformation -Append
}
 
Remove-PSSession $session 

function fixWebParts(){
		
	var docSetID = "0x0120D5"; // all document sets content types will start with this id
	var listName = "DocSet3"; // update list name 

	var clientContext = SP.ClientContext.get_current();

	var oWeb =	clientContext.get_web();
	var oList = oWeb.get_lists().getByTitle(listName);
	var contentTypes = oList.get_contentTypes();
	
		
	clientContext.load(oList, 'RootFolder');
	clientContext.load(contentTypes );
	clientContext.executeQueryAsync(onSuccess, onFail);
	
	function onSuccess() {
	  var rootFolder = oList.get_rootFolder();
	  var listURL = rootFolder.get_serverRelativeUrl(); // URL of the list
	  console.log(listURL)
	  
	  var count = contentTypes.get_count();
	  
	  for(var i=0; i < count; i++)
	  {
	  	var id = contentTypes.itemAt(i).get_id().toString();
	  	var name = contentTypes.itemAt(i).get_name();
	  	
	  	if (id.startsWith(docSetID)) // this is a document set type
	  	{
	  		AddWebParts(listURL , name );
	  	}
	  }	  
	}

	function onFail(sender, args) {
	  console.log('Request Failed: ' + args.get_message() + '\n' + args.get_stackTrace());
	}	
}



function AddWebParts(listRootFolderUrl,contentTypeName){

	var pageUrl = listRootFolderUrl + "/forms/" + contentTypeName + "/docsethomepage.aspx";
	
	
	AddImageWebPart(pageUrl);
	AddDocumentSetContentWebPart(pageUrl);
	AddDocumentSetPropertiesWebPart(pageUrl);

}


function AddImageWebPart(pageUrl)
{
	var webPartXml = '<WebPart xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/WebPart/v2">' +
  '<Title>Image</Title>' +
  '<FrameType>Default</FrameType>' +
  '<Description>Use to display pictures and photos.</Description>' +
  '<IsIncluded>true</IsIncluded>' +
  '<ZoneID>WebPartZone_TopLeft</ZoneID>' +
  '<PartOrder>0</PartOrder>' +
  '<FrameState>Normal</FrameState>' +
  '<Height />' +
  '<Width />' +
  '<AllowRemove>true</AllowRemove>' +
  '<AllowZoneChange>true</AllowZoneChange>' +
  '<AllowMinimize>true</AllowMinimize>' +
  '<AllowConnect>true</AllowConnect>' +
  '<AllowEdit>true</AllowEdit>' +
  '<AllowHide>true</AllowHide>' +
  '<IsVisible>true</IsVisible>' +
  '<DetailLink />' +
  '<HelpLink />' +
  '<HelpMode>Modeless</HelpMode>' +
  '<Dir>Default</Dir>' +
  '<PartImageSmall />' +
  '<MissingAssembly>Cannot import this Web Part.</MissingAssembly>' +
  '<PartImageLarge />' +
  '<IsIncludedFilter />' +
  '<Assembly>Microsoft.SharePoint, Version=16.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c</Assembly>' +
  '<TypeName>Microsoft.SharePoint.WebPartPages.ImageWebPart</TypeName>' +
  '<ImageLink xmlns="http://schemas.microsoft.com/WebPart/v2/Image">/_layouts/images/docset_welcomepage_big.png</ImageLink>' +
  '<AlternativeText xmlns="http://schemas.microsoft.com/WebPart/v2/Image" />' +
  '<VerticalAlignment xmlns="http://schemas.microsoft.com/WebPart/v2/Image">Middle</VerticalAlignment>' +
  '<HorizontalAlignment xmlns="http://schemas.microsoft.com/WebPart/v2/Image">Center</HorizontalAlignment>' +
  '<BackgroundColor xmlns="http://schemas.microsoft.com/WebPart/v2/Image">transparent</BackgroundColor>' +
'</WebPart>';


AddWebPart(pageUrl,"WebPartZone_TopLeft","0",webPartXml );

}


function AddDocumentSetPropertiesWebPart(pageUrl)
{
	var webPartXml = '<WebPart xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/WebPart/v2">' +
  '<Title>Document Set Properties</Title>' +
  '<FrameType>Default</FrameType>' +
  '<Description>Displays the properties of the Document Set.</Description>' +
  '<IsIncluded>true</IsIncluded>' +
  '<ZoneID>WebPartZone_Top</ZoneID>' +
  '<PartOrder>0</PartOrder>' +
  '<FrameState>Normal</FrameState>' +
  '<Height />' +
  '<Width />' +
  '<AllowRemove>true</AllowRemove>' +
  '<AllowZoneChange>true</AllowZoneChange>' +
  '<AllowMinimize>true</AllowMinimize>' +
  '<AllowConnect>true</AllowConnect>' +
  '<AllowEdit>true</AllowEdit>' +
  '<AllowHide>true</AllowHide>' +
  '<IsVisible>true</IsVisible>' +
  '<DetailLink />' +
  '<HelpLink />' +
  '<HelpMode>Modeless</HelpMode>' +
  '<Dir>Default</Dir>' +
  '<PartImageSmall />' +
  '<MissingAssembly>Cannot import this Web Part.</MissingAssembly>' +
  '<PartImageLarge>/_layouts/15/images/msimagel.gif</PartImageLarge>' +
  '<IsIncludedFilter />' +
  '<DisplayText>' +
  '</DisplayText>' +
  '<Assembly>Microsoft.Office.DocumentManagement, Version=16.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c</Assembly>' +
  '<TypeName>Microsoft.Office.Server.WebControls.DocumentSetPropertiesWebPart</TypeName>' +
'</WebPart>';


AddWebPart(pageUrl,"WebPartZone_Top","0",webPartXml );

}


function AddDocumentSetContentWebPart(pageUrl)
{
	var webPartXml = '<WebPart xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/WebPart/v2">' +
  '<Title>Document Set Contents</Title>' +
  '<FrameType>Default</FrameType>' +
  '<Description>Displays the contents of the Document Set.</Description>' +
  '<IsIncluded>true</IsIncluded>' +
  '<ZoneID>WebPartZone_CenterMain</ZoneID>' +
  '<PartOrder>0</PartOrder>' +
  '<FrameState>Normal</FrameState>' +
  '<Height />' +
  '<Width />' +
  '<AllowRemove>true</AllowRemove>' +
  '<AllowZoneChange>true</AllowZoneChange>' +
  '<AllowMinimize>true</AllowMinimize>' +
  '<AllowConnect>true</AllowConnect>' +
  '<AllowEdit>true</AllowEdit>' +
  '<AllowHide>true</AllowHide>' +
  '<IsVisible>true</IsVisible>' +
  '<DetailLink />' +
  '<HelpLink />' +
  '<HelpMode>Modeless</HelpMode>' +
  '<Dir>Default</Dir>' +
  '<PartImageSmall />' +
  '<MissingAssembly>Cannot import this Web Part.</MissingAssembly>' +
  '<PartImageLarge>/_layouts/15/images/msimagel.gif</PartImageLarge>' +
  '<IsIncludedFilter />' +
  '<DisplayText>' +
  '</DisplayText>' +
  '<Assembly>Microsoft.Office.DocumentManagement, Version=16.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c</Assembly>' +
  '<TypeName>Microsoft.Office.Server.WebControls.DocumentSetContentsWebPart</TypeName>' +
'</WebPart>';


AddWebPart(pageUrl,"WebPartZone_CenterMai","0",webPartXml );

}



function AddWebPart(pageUrl,zoneId,zoneIndex, webPartXml){
	
	var clientContext = SP.ClientContext.get_current();
    var oFile = clientContext.get_web().getFileByServerRelativeUrl(pageUrl);

    var limitedWebPartManager = oFile.getLimitedWebPartManager(SP.WebParts.PersonalizationScope.shared);
    
   
	var oWebPartDefinition = limitedWebPartManager.importWebPart(webPartXml);
    this.oWebPart = oWebPartDefinition.get_webPart(); 
    
   limitedWebPartManager.addWebPart(oWebPart,zoneId, zoneIndex);

    clientContext.load(oWebPart);

    clientContext.executeQueryAsync(Function.createDelegate(this, this.onQuerySucceeded), Function.createDelegate(this, this.onQueryFailed));
}


function onQuerySucceeded()
{
	console.log("success");
}


function onQueryFailed(e1,e2,e3)
{
	console.log("error");
	console.log(e1);
	console.log(e2);
	console.log(e3);
		
}

<link href="//amp.azure.net/libs/amp/2.1.3/skins/amp-default/azuremediaplayer.min.css" rel="stylesheet"> 
<script src="//amp.azure.net/libs/amp/2.1.3/azuremediaplayer.min.js"></script>
<video id="azuremediaplayer" class="azuremediaplayer amp-default-skin amp-big-play-centered" tabindex="0"></video>
<script type="text/javascript">
var myOptions = {
 "nativeControlsForTouch": false,
 controls: true,
 autoplay: true,
 width: "640",
 height: "400",
 }

myPlayer = amp("azuremediaplayer", myOptions);
myPlayer.src([
{
 "src": "https://sccpssvideo.streaming.mediaservices.windows.net/ab838cb0-befe-40bd-b873-f9793e86255d/Capital Improvements Committee M.ism/manifest",
 "type": "application/vnd.ms-sstr+xml"
 }
]);
</script>

<iframe width="500" height="280" align="center" src="https://aka.ms/ampembed?url=https://sccpssvideo.streaming.mediaservices.windows.net/ab838cb0-befe-40bd-b873-f9793e86255d/Capital%20Improvements%20Committee%20M.ism/manifest&autoplay=false" frameborder="no"></iframe>

'use strict'; 
ExecuteOrDelayUntilScriptLoaded(initializePage, "sp.js"); 
function initializePage()
{
    var context = SP.ClientContext.get_current();
    var user = context.get_web().get_currentUser();
    var hostWebUrl;
    var appWebUrl;
    var listName = "testList";  
    var ctx;
    var appCtxSite;
    var oList;
    var web;
    var collListItem;	 
    // This code runs when the DOM is ready and creates a context object which is needed to use the SharePoint object model
    $(document).ready(function () {         
        hostWebUrl = decodeURIComponent(getQueryStringParameter('SPHostUrl'));
        appWebUrl = decodeURIComponent(getQueryStringParameter('SPAppWebUrl'));
        getListItemFromHostWeb(); 
    }); 
    //get the list data from host web  
    function getListItemFromHostWeb() {
        debugger;
        ctx = new SP.ClientContext(appWebUrl);
        appCtxSite = new SP.AppContextSite(ctx, hostWebUrl);
        oList = appCtxSite.get_web().get_lists().getByTitle(listName); 
        ctx.load(oList);
        ctx.executeQueryAsync(oListExist, OnGetListItemFailure);
    } 
    //check whether list is exist or not  
    function oListExist(sender, args) {        
        alert('Got List Title - ' + oList.get_title());
        var camlQuery = new SP.CamlQuery();
        camlQuery.set_viewXml('<View><Query><Where><Geq><FieldRef Name=\'ID\'/>' +
            '<Value Type=\'Number\'>1</Value></Geq></Where></Query><RowLimit>10</RowLimit></View>');
        collListItem = oList.getItems(camlQuery);        
        ctx.load(collListItem);
        ctx.executeQueryAsync(onGetListItemSucceeded, OnGetListItemFailure);     
    }
 
    function onGetListItemSucceeded(sender, args) {        
        var listItemInfo = '<p>';
        var listItemEnumerator = collListItem.getEnumerator();
        if (collListItem.get_count() > 0) {
            while (listItemEnumerator.moveNext()) {
                var oListItem = listItemEnumerator.get_current();
                listItemInfo += oListItem.get_id() + ',Title: ' + oListItem.get_item('Title');
            }
            listItemInfo += '</p>';            
            document.getElementById('Label1').innerHTML = listItemInfo.toString();
        }
    }    
 
    function OnGetListItemFailure(sender, args) {
        alert('Failed to get target List. Error:' + args.get_message());
    } 
    //This function is used to get the hostweb url  
    function getQueryStringParameter(paramToRetrieve)   
    {  
        var params =  
        document.URL.split("?")[1].split("&");  
        var strParams = "";  
        for (var i = 0; i < params.length; i = i + 1)  
        {  
            var singleParam = params[i].split("=");  
            if (singleParam[0] == paramToRetrieve)   
               { return singleParam[1]; }  
        }  
    }       
}

../gulp trust-dev-cert
 
Error: Cannot find module '@microsoft/sp-build-web'
    at Function.Module._resolveFilename (module.js:527:15)
    at Function.Module._load (module.js:476:23)
    at Module.require (module.js:568:17)
    at require (internal/module.js:11:18)
    at Object.<anonymous> (D:\bin\helloworld-webpart\gulpfile.js:4:15)
    at Module._compile (module.js:624:30)
    at Object.Module._extensions..js (module.js:635:10)
    at Module.load (module.js:545:32)
    at tryModuleLoad (module.js:508:12)
    at Function.Module._load (module.js:500:3)

npm config set proxy http://proxyaddress.com:8080
npm config set https-proxy http://proxyaddress.com:8080

<?xml version="1.0" encoding="utf-16"?>
<Model xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" Name="BDCMetadata_AdventureWorks" xmlns="http://schemas.microsoft.com/windows/2007/BusinessDataCatalog">
<LobSystems>
<LobSystem Name="adventureworks" Type="OData">
<Properties>
<Property Name="ODataServiceMetadataUrl" Type="System.String">http://adventureworks.contoso.com/WcfODataService_AdventureWorks.svc/$metadata</Property>
<Property Name="ODataServiceMetadataAuthenticationMode" Type="System.String">WindowsCredentials</Property>
<Property Name="ODataServicesVersion" Type="System.String">2.0</Property>
<Property Name="SsoApplicationId" Type="System.String">SecureStoreTargentApplicationName</Property>
<Property Name="SsoProviderImplementation" Type="System.String">Microsoft.Office.SecureStoreService.Server.SecureStoreProvider, Microsoft.Office.SecureStoreService, Version=16.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c</Property>
</Properties>
…
<LobSystemInstances>
<LobSystemInstance Name="adventureworks">
<Properties>
<Property Name="ODataServiceUrl" Type="System.String">http://adventureworks.contoso.com/WcfODataService_AdventureWorks.svc</Property>
<Property Name="ODataServiceAuthenticationMode" Type="System.String">WindowsCredentials</Property>
<Property Name="ODataFormat" Type="System.String">application/atom+xml</Property>
<Property Name="HttpHeaderSetAcceptLanguage" Type="System.Boolean">true</Property>
<Property Name="SsoApplicationId" Type="System.String"> SecureStoreTargentApplicationName</Property>
<Property Name="SsoProviderImplementation" Type="System.String">Microsoft.Office.SecureStoreService.Server.SecureStoreProvider, Microsoft.Office.SecureStoreService, Version=16.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c</Property>
</Properties>
</LobSystemInstance>
</LobSystemInstances>

var termStore = termStores.getByName("Taxonomy_Dmxzz8tIBzk8wNVKQpJ+xA==");

TaxonomySession.GetDefaultSiteCollectionTermStore
TaxonomySession.GetDefaultKeywordsTermStore

getDefaultSiteCollectionTermStore
getDefaultKeywordsTermStore

$webApp = Get-SPWebApplication "https://sp"
$webApp.AllowSilverlightPrompt = $false
$webApp.Update()

Type.registerNamespace('SSPXTesting')
SSPXTesting.Disp = SSPXTesting.Disp || {};
SSPXTesting.Disp.Templates = SSPXTesting.Disp.Templates || {};
SSPXTesting.Disp.Functions = SSPXTesting.Disp.Functions || {};
var currentUser = null;    

function getCurrentUser(siteurl)
{	    
    $.ajax({
        async: false,
        headers: { "accept": "application/json; odata=verbose" },
        method: "GET",
        url: siteurl + "/_api/web/CurrentUser",
        success: function (data) { 
            currentUser = data.d;
        },
		error: function (error) {
			console.log('some error');
			//alert("error:" +error);
		}
    });    
}

renderListItemTemplate = function (renderCtx) {		
		var	workbookname = "";			
		//File_x0020_Type	"xlsm" or "xlsx"
		var filetype = renderCtx.CurrentItem["File_x0020_Type"];
		var fileAuthor = renderCtx.CurrentItem.Author;	
        if(filetype == "xlsm" || filetype == "xlsx") 
        {
			if(!currentUser)
			{
				getCurrentUser(renderCtx.HttpRoot)
			}			
			if(fileAuthor[0].email == currentUser.Email)
			{
				return RenderItemTemplate(renderCtx);
			}
			else
			{
				//return empty string
				return '';
			}
        }
		else
		{
			// return emtpy string
			return '';  
		}        
}	

SSPXTesting.Disp.Templates.Item = renderListItemTemplate

SSPXTesting.Disp.Functions.RegisterField = function () {
    SPClientTemplates.TemplateManager.RegisterTemplateOverrides(SSPXTesting.Disp)
}

SSPXTesting.Disp.Functions.MdsRegisterField = function () {
    var thisUrl = _spPageContextInfo.siteServerRelativeUrl + "/SiteAssets/POC_ListItemFiltering.js";
    SSPXTesting.Disp.Functions.RegisterField();
    RegisterModuleInit(thisUrl, SSPXTesting.Disp.Functions.RegisterField)
};


if (typeof _spPageContextInfo != "undefined" && _spPageContextInfo != null) {
    SSPXTesting.Disp.Functions.MdsRegisterField();
}
else {
    SSPXTesting.Disp.Functions.RegisterField();
}

Get-SPOSite -Template "SPSPERS"

using System;
using System.Collections.Generic;
using System.Security;
using Microsoft.SharePoint.Client;
using Microsoft.Online.SharePoint.TenantAdministration;

namespace GetAllSitesWithFilter
{
    class Program
    {
        static string TENANT = "mytenant";
        static string ADMINURL = "https://" + TENANT + "-admin.sharepoint.com";

        static void Main(string[] args)
        {
            //Specify tenant admin and site URL
            string adminUser = "admin@" + TENANT + ".onmicrosoft.com";
            SecureString password = "adminpassword".ConvertToSecureString();
            SharePointOnlineCredentials adminCred = new SharePointOnlineCredentials(adminUser, password);

            List<SiteProperties> list = new List<SiteProperties>();

            SPOSitePropertiesEnumerable ssp = null;

            using (ClientContext cc = new ClientContext(ADMINURL))
            {
                cc.Credentials = adminCred;

                String nextIndex = null;
                Tenant tenant = new Tenant(cc);

                SPOSitePropertiesEnumerableFilter sspFilter = new SPOSitePropertiesEnumerableFilter()
                {
                    // get personal sites
                    IncludePersonalSite = PersonalSiteFilter.Include,  // needed to for personal sites
                    IncludeDetail = true,
                    Template = "SPSPERS"

                    // get classic team sites
                    //IncludeDetail = true,
                    //Template = "STS"

                    // get modern sites
                    //IncludeDetail = true,
                    //Template = "GROUP"

                    // get communication sites
                    //IncludeDetail = true,
                    //Template = "SITEPAGEPUBLISHING"
                };

                do
                {
                    sspFilter.StartIndex = nextIndex;
                    ssp = tenant.GetSitePropertiesFromSharePointByFilters(sspFilter);

                    cc.Load(ssp);
                    cc.ExecuteQuery();

                    list.AddRange(ssp);
                    nextIndex = ssp.NextStartIndexFromSharePoint;
                } while (nextIndex != null);
            }

            foreach(SiteProperties siteProp in list)
            {
                Console.WriteLine(string.Format("Site Url: {0} - Template: {1}", siteProp.Url, siteProp.Template));
            }

        }
    }

    static class StringExtension
    {
        public static SecureString ConvertToSecureString(this string item)
        {
            if (!string.IsNullOrEmpty(item))
            {
                var secureString = new SecureString();
                foreach (var c in item)
                {
                    secureString.AppendChar(c);
                }
                return secureString;
            }
            return null;
        }
    }
}

SPOSitePropertiesEnumerableFilter sspFilter = new SPOSitePropertiesEnumerableFilter()
{
  IncludePersonalSite = PersonalSiteFilter.Include,
  IncludeDetail = true,
  Template = "SPSPERS" // template name for personal site
};

SPOSitePropertiesEnumerableFilter sspFilter = new SPOSitePropertiesEnumerableFilter()
{
  IncludeDetail = true,
  Template = "STS"
};

SPOSitePropertiesEnumerableFilter sspFilter = new SPOSitePropertiesEnumerableFilter()
{
  IncludeDetail = true,
  Template = "GROUP"
};

SPOSitePropertiesEnumerableFilter sspFilter = new SPOSitePropertiesEnumerableFilter()
{
  IncludeDetail = true,
  Template = "SITEPAGEPUBLISHING"
};

GET /drive/items/{item-id}/content?format={format}
GET /drive/root:/{path and filename}:/content?format={format}

using Microsoft.IdentityModel.Clients.ActiveDirectory;
using Newtonsoft.Json;

using Microsoft.IdentityModel.Clients.ActiveDirectory;
using Newtonsoft.Json;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading.Tasks;
using System.Net;
using System.Security.Claims;
using System.IO;
using Microsoft.SharePoint.Client;
using System.Security;


namespace ConsoleApp1
{
    public static class StreamExtensions
    {
        public static byte[] ReadAllBytes(this Stream instream)
        {
            if (instream is MemoryStream)
                return ((MemoryStream)instream).ToArray();

            using (var memoryStream = new MemoryStream())
            {
                instream.CopyTo(memoryStream);
                return memoryStream.ToArray();
            }
        }
    }
    class Program
    {
        private static string TENANT_NAME = "mycompany.onmicrosoft.com";
        private static string resource = "https://graph.microsoft.com";
        private static string loginname = "user@mycompany.onmicrosoft.com";
        private static string loginpassword = "*********";
        private static string AzureTenantID = "********-f247-4d48-a45d-************";
        private static string spositeUrl = "https://mycompany.sharepoint.com/*********";
        private static string destinationDocumentLibrary = "dl1"; 

        static void Main(string[] args)
        {
            //USER TOKEN - THIS WORKS!!!!!!!!!!!!
            UserPasswordCredential userPasswordCredential = new UserPasswordCredential(loginname, loginpassword);
            var graphauthority = "https://login.microsoftonline.com/" + AzureTenantID;
            AuthenticationContext authContext = new AuthenticationContext(graphauthority);
            var token = authContext.AcquireTokenAsync(resource, "94b1544c-35e8-4d45-a941-c3dbaab283dc", userPasswordCredential).Result.AccessToken;

            // Create a new HttpWebRequest Object to the mentioned URL.
HttpWebRequest myHttpWebRequest = (HttpWebRequest)WebRequest.Create("https://graph.microsoft.com/v1.0/me/drive/root:/orange.docx:/content?format=pdf");
            //HttpWebRequest myHttpWebRequest = (HttpWebRequest)WebRequest.Create("https://graph.microsoft.com/v1.0/drives/b!zMNDej1sNEG0SanRDltXfAVTYcdt1pdIggMBPYZYp9Wgdi3ir9sFQJXof6j8GNUD/root:/Repro.docx:/content?format=pdf");
            myHttpWebRequest.AllowAutoRedirect = false;
            myHttpWebRequest.Headers.Set("Authorization", ("Bearer " + token));
            HttpWebResponse myHttpWebResponse = (HttpWebResponse)myHttpWebRequest.GetResponse();
            string downloadPath = myHttpWebResponse.GetResponseHeader("Location");
            Console.WriteLine("Download PDF file from here:\n " + downloadPath);

            //Get the file Stream with Location Url
            HttpWebRequest HttpWebRequest_download = (HttpWebRequest)WebRequest.Create(downloadPath);
            HttpWebRequest_download.Accept = "blob";

            var response = (HttpWebResponse)HttpWebRequest_download.GetResponse();
            Stream myStream = response.GetResponseStream();
            FileStream targetFile = new FileStream("C:\\temp\\orange_converted_localcopy.pdf", FileMode.Create);
            myStream.CopyTo(targetFile);
            myStream.Close();                   
            response.Close();

//You can continue to use Graph API to upload document back to OneDrive or other SPO site
//since we used loginname/password above already, we will use simple CSOM to upload file to another SPO site as quick demo
            using (var clientContext = new ClientContext(spositeUrl))
            {
                SecureString passWord = new SecureString();
                foreach (char c in loginpassword.ToCharArray()) passWord.AppendChar(c);

                clientContext.Credentials = new SharePointOnlineCredentials(loginname, passWord);
                var web = clientContext.Web;
                clientContext.Load(web);
                clientContext.ExecuteQuery();

                List dl = web.Lists.GetByTitle(destinationDocumentLibrary);
                clientContext.Load(dl);
                clientContext.ExecuteQuery();

                //Upload the converted file to SPO site
                targetFile.Position = 0;               
                    var fci = new FileCreationInformation
                    {
                        Url = "orange_converted_spocopy.pdf",
                        ContentStream = targetFile,
                        Overwrite = true
                    };
                    Folder folder = dl.RootFolder;
                    FileCollection files = folder.Files;
                    Microsoft.SharePoint.Client.File file = files.Add(fci);
                    clientContext.Load(files);
                    clientContext.Load(file);
                    clientContext.ExecuteQuery();

                    targetFile.Close();
                    response.Close();            

                Console.WriteLine("Converted file is uploaded to SPO site - orange_converted_spocopy.pdf");
                Console.ReadKey();
            }
        }
       
    }
    }

{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#drives/$entity",
    "createdDateTime": "2017-12-04T19:48:25Z",
    "description": "This system library was created by the Publishing feature to store documents that are used on pages in this site.",
    "id": "b!zMNDej1sNEG0SanRDltXfAVTYcdt1pdIggMBPYZYp9Wgdi3ir9sFQJXof6j8GNUD",
    "lastModifiedDateTime": "2018-10-11T04:08:37Z",
    "name": "Documents",
    "webUrl": "https://mycompany.sharepoint.com/sites/****/Documents",
    "driveType": "documentLibrary",
    "createdBy": {
        "user": {
            "displayName": "System Account"
        }
  }
}

<S:Fault>
<S:Code>
<S:Value>S:Sender</S:Value>
<S:Subcode>
<S:Value>wst:FailedAuthentication</S:Value>
</S:Subcode>
</S:Code>
<S:Reason>
<S:Text xml:lang="en-US">Authentication Failure</S:Text>
</S:Reason>
<S:Detail>
<psf:error xmlns:psf="http://schemas.microsoft.com/Passport/SoapServices/SOAPFault">
<psf:value>0x80048823</psf:value><psf:internalerror>
<psf:code>0x80048823</psf:code>
<psf:text>AADSTS53003: Blocked by conditional access.</psf:text>
</psf:internalerror></psf:error>
</S:Detail>
</S:Fault>

import-module microsoft.online.sharepoint.powershell
#download https://www.nuget.org/packages/Microsoft.SharePointOnline.CSOM/16.1.7723.1200
[System.Reflection.Assembly]::LoadFile("C:\TEMP\microsoft.sharepointonline.csom.16.1.7723.1200\lib\net45\Microsoft.SharePoint.Client.dll")
[System.Reflection.Assembly]::LoadFile("C:\TEMP\microsoft.sharepointonline.csom.16.1.7723.1200\lib\net45\Microsoft.SharePoint.Client.Runtime.dll")
[System.Reflection.Assembly]::LoadFile("C:\TEMP\microsoft.sharepointonline.csom.16.1.7723.1200\lib\net45\Microsoft.SharePoint.Client.Taxonomy.dll")
#download https://www.nuget.org/packages/Microsoft.IdentityModel.Clients.ActiveDirectory/2.29.0
[System.Reflection.Assembly]::LoadFile("C:\TEMP\microsoft.identitymodel.clients.activedirectory\lib\net45\Microsoft.IdentityModel.Clients.ActiveDirectory.dll")
#download https://www.nuget.org/packages/SharePointPnPCoreOnline/2.26.1805.1
[System.Reflection.Assembly]::LoadFile("C:\TEMP\sharepointpnpcoreonline.2.26.1805.1\lib\net45\OfficeDevPnP.Core.dll")
$adminUrl = "https://<<tenant>>-admin.sharepoint.com"
$siteUrl=https://<<tenant>>.sharepoint.com
Connect-SPOService -Url $adminUrl
$authManager = new-object OfficeDevPnP.Core.AuthenticationManager;
$clientContext = $authManager.GetWebLoginClientContext($siteUrl);
#testing CSOM calls
$clientContext.Load($clientContext.Web)
$clientContext.ExecuteQuery();
Write-Host $clientContext.Web.Title

private static string AcsHostUrl = "accesscontrol.windows.net";

private static string AcsHostUrl = "login.microsoftonline.us";

private static string GetAcsGlobalEndpointUrl()
{
    return String.Format(CultureInfo.InvariantCulture, "https://{0}/", AcsHostUrl);
}