# OAuth Certificate Flow:
# 1. Client requests access token from Exchange
# 2. Exchange signs token with OAuth certificate private key
# 3. Receiving server validates signature with public key
# 4. If valid, request is authenticated

# Key components:
# - AuthConfig: Stores OAuth certificate thumbprint
# - Certificate Store: Holds the actual certificate
# - AuthServer: Defines trusted token issuers
# - PartnerApplication: Defines trusted applications

# Check AuthConfig for current certificate
Get-AuthConfig | Select-Object CurrentCertificateThumbprint, PreviousCertificateThumbprint, ServiceName

# Check if the certificate exists in store
$authConfig = Get-AuthConfig
if ($authConfig.CurrentCertificateThumbprint) {
    $cert = Get-ExchangeCertificate -Thumbprint $authConfig.CurrentCertificateThumbprint -ErrorAction SilentlyContinue
    if ($cert) {
        Write-Host "OAuth certificate found:" -ForegroundColor Green
        $cert | Select-Object Subject, Thumbprint, NotAfter, Services
    } else {
        Write-Host "ERROR: OAuth certificate thumbprint configured but certificate not found!" -ForegroundColor Red
    }
} else {
    Write-Host "ERROR: No OAuth certificate configured in AuthConfig!" -ForegroundColor Red
}

# Get complete auth configuration
Get-AuthConfig | Format-List *

# Expected output should show:
# CurrentCertificateThumbprint : ABC123... (valid thumbprint)
# ServiceName                  : 00000002-0000-0ff1-ce00-000000000000-0000-0ff1-ce00-000000000000

# If CurrentCertificateThumbprint is empty = certificate not configured
# If thumbprint exists but cert not found = certificate deleted/corrupted

# Look for auth certificates in store
Get-ExchangeCertificate | Where-Object {
    $_.Subject -like "*Microsoft Exchange Server Auth*" -or
    $_.Subject -like "*Auth Certificate*"
} | Select-Object Subject, Thumbprint, NotBefore, NotAfter, Services

# Check Windows certificate store directly
Get-ChildItem Cert:\LocalMachine\My | Where-Object {
    $_.Subject -like "*Exchange*Auth*"
} | Select-Object Subject, Thumbprint, NotAfter

# Test OAuth with Microsoft 365 (if hybrid)
Test-OAuthConnectivity -Service EWS -TargetUri https://outlook.office365.com/ews/exchange.asmx -Mailbox admin@domain.com

# Test internal OAuth
$testMailbox = (Get-Mailbox | Select-Object -First 1).PrimarySmtpAddress
Test-OAuthConnectivity -Service EWS -TargetUri https://mail.domain.com/ews/exchange.asmx -Mailbox $testMailbox

# Step 1: Create new OAuth certificate
$newCert = New-ExchangeCertificate -KeySize 2048 -PrivateKeyExportable $true -SubjectName "cn=Microsoft Exchange Server Auth Certificate" -Services SMTP -FriendlyName "Microsoft Exchange Server Auth Certificate"

Write-Host "New certificate created: $($newCert.Thumbprint)"

# Step 2: Configure AuthConfig with new certificate
Set-AuthConfig -NewCertificateThumbprint $newCert.Thumbprint -NewCertificateEffectiveDate (Get-Date)

# Step 3: Publish the certificate
Set-AuthConfig -PublishCertificate

# Step 4: Clear previous certificate (optional, after verification)
# Set-AuthConfig -ClearPreviousCertificate-ClearPreviousCertificate

# Step 5: Restart IIS
iisreset /noforce

Write-Host "OAuth certificate configured successfully!"

# For on-premises Exchange without hybrid
# Step 1: Create the certificate
$authCert = New-ExchangeCertificate -KeySize 2048 -PrivateKeyExportable $true -SubjectName "cn=Microsoft Exchange Server Auth Certificate" -Services SMTP -FriendlyName "Microsoft Exchange Server Auth Certificate" -DomainName $env:USERDNSDOMAIN

Write-Host "Certificate Thumbprint: $($authCert.Thumbprint)"
Write-Host "Certificate Expires: $($authCert.NotAfter)"

# Step 2: Configure as auth certificate
Set-AuthConfig -NewCertificateThumbprint $authCert.Thumbprint -NewCertificateEffectiveDate (Get-Date)

# Step 3: Publish to partner applications
Set-AuthConfig -PublishCertificate

# Step 4: Verify configuration
$authConfig = Get-AuthConfig
Write-Host "Current Certificate: $($authConfig.CurrentCertificateThumbprint)"

# Step 5: Restart services
Restart-Service MSExchangeOWAAppPool -Force
Restart-Service MSExchangeServiceHost -Force
iisreset /noforce

# Step 6: Test
Write-Host "Testing OAuth..."
Start-Sleep -Seconds 10
$testMailbox = (Get-Mailbox | Select-Object -First 1).PrimarySmtpAddress
Test-OAuthConnectivity -Service EWS -TargetUri "https://$($env:COMPUTERNAME)/ews/exchange.asmx" -Mailbox $testMailbox

# If you have a backup of the original certificate
$pfxPath = "C:\Backup\OAuthCert.pfx"
$pfxPassword = Read-Host "Enter PFX password" -AsSecureString

# Import the certificate
Import-ExchangeCertificate -FileName $pfxPath -Password $pfxPassword -PrivateKeyExportable:$true

# Get the imported certificate thumbprint
$importedCert = Get-ExchangeCertificate | Where-Object { $_.FriendlyName -like "*Auth*" } | Select-Object -First 1

# Configure as auth certificate
Set-AuthConfig -NewCertificateThumbprint $importedCert.Thumbprint -NewCertificateEffectiveDate (Get-Date)
Set-AuthConfig -PublishCertificate

# Restart services
iisreset /noforce

# After creating new OAuth certificate in hybrid environment

# Step 1: Export new certificate public key for M365
$authConfig = Get-AuthConfig
$cert = Get-ExchangeCertificate -Thumbprint $authConfig.CurrentCertificateThumbprint
Export-ExchangeCertificate -Thumbprint $cert.Thumbprint -FileName "C:\Temp\OAuth_PublicKey.cer" -BinaryEncoded

Write-Host "Certificate exported. Upload to Microsoft 365 or re-run HCW."-run HCW."

# Step 2: Re-run Hybrid Configuration Wizard-run Hybrid Configuration Wizard
# Download latest HCW from: https://aka.ms/HybridWizard
Write-Host "Download and run the Hybrid Configuration Wizard"
Write-Host "The wizard will automatically update Microsoft 365 with the new certificate"

# Step 3: After HCW completes, test hybrid connectivity
Test-OAuthConnectivity -Service EWS -TargetUri https://outlook.office365.com/ews/exchange.asmx -Mailbox admin@domain.com

# Step 4: Test free/busy
Get-AvailabilityConfig | Format-List

# Export certificate from source server
$authConfig = Get-AuthConfig
$thumbprint = $authConfig.CurrentCertificateThumbprint
$pfxPassword = Read-Host "Enter export password" -AsSecureString

Export-ExchangeCertificate -Thumbprint $thumbprint -FileName "C:\Temp\OAuthCert.pfx" -Password $pfxPassword -BinaryEncoded

# Copy PFX to each Exchange server and import
$exchangeServers = Get-ExchangeServer | Where-Object { $_.ServerRole -match "Mailbox" }

foreach ($server in $exchangeServers) {
    Write-Host "Processing $($server.Name)..."

    # Import on remote server (run from each server or use remoting)
    Invoke-Command -ComputerName $server.Name -ScriptBlock {
        param($pfxPath, $password)
        Add-ExchangeSnapin *Exchange* -ErrorAction SilentlyContinue
        Import-ExchangeCertificate -FileName $pfxPath -Password $password -PrivateKeyExportable:$true
    } -ArgumentList "C:\Temp\OAuthCert.pfx", $pfxPassword
}

Write-Host "Certificate deployed to all servers. Verify with:"
Write-Host "Get-ExchangeServer | ForEach-Object { Get-ExchangeCertificate -Server $_.Name | Where-Object { $_.Thumbprint -eq '$thumbprint' } }"-Object { Get-ExchangeCertificate -Server $_.Name | Where-Object { $_.Thumbprint -eq '$thumbprint' } }"

# Verify AuthConfig
Write-Host "=== AuthConfig ===" -ForegroundColor Cyan
Get-AuthConfig | Select-Object CurrentCertificateThumbprint, ServiceName | Format-List

# Verify certificate exists and is valid
Write-Host "=== Certificate Status ===" -ForegroundColor Cyan
$authConfig = Get-AuthConfig
$cert = Get-ExchangeCertificate -Thumbprint $authConfig.CurrentCertificateThumbprint
$cert | Select-Object Subject, NotBefore, NotAfter, Services | Format-List

# Check certificate is not expired
if ($cert.NotAfter -lt (Get-Date)) {
    Write-Host "WARNING: Certificate is expired!" -ForegroundColor Red
} else {
    Write-Host "Certificate valid until: $($cert.NotAfter)" -ForegroundColor Green
}

# Test OAuth connectivity
Write-Host "=== OAuth Test ===" -ForegroundColor Cyan
$testMailbox = (Get-Mailbox | Select-Object -First 1).PrimarySmtpAddress
$oauthTest = Test-OAuthConnectivity -Service EWS -TargetUri "https://$env:COMPUTERNAME/ews/exchange.asmx" -Mailbox $testMailbox
$oauthTest | Select-Object ResultType, ResultDescription

# Check for errors in event log
Write-Host "=== Recent OAuth Errors ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{
    LogName = 'Application'
    ProviderName = 'MSExchange*'
    Level = 2
    StartTime = (Get-Date).AddHours(-1)
} -MaxEvents 5 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -like "*OAuth*" -or $_.Message -like "*Auth*" } |
    Select-Object TimeCreated, Message

# Add to scheduled monitoring
$authConfig = Get-AuthConfig
$cert = Get-ExchangeCertificate -Thumbprint $authConfig.CurrentCertificateThumbprint -ErrorAction SilentlyContinue

if (-not $cert) {
    Write-Host "CRITICAL: OAuth certificate missing!" -ForegroundColor Red
    # Send alert
} elseif ($cert.NotAfter -lt (Get-Date).AddDays(90)) {
    Write-Host "WARNING: OAuth certificate expires in less than 90 days!" -ForegroundColor Yellow
    Write-Host "Expiration: $($cert.NotAfter)"
    # Send warning
} else {
    Write-Host "OK: OAuth certificate valid until $($cert.NotAfter)" -ForegroundColor Green
}