SWIS authentication

rderrington

We have recently upgraded from an older version of Orion to 2020.02.0896 and SWIS authentication no longer works in the existing scripts.

The error returned is "Get-SwisData : Invalid username or password."

This is the original code.

$swis = Connect-Swis -Hostname Server -Credential $DomainCredential

Get-SwisData $swis -Query 'SELECT TOP 1000 ObjectName,AlertMessage,TriggerTimeStamp, AcknowledgedBy, Notes FROM Orion.AlertStatus' -Parameters @{}

$DomainCredential is generated by the following

$Global:DomainCredential = New-Object -typename System.Management.Automation.PSCredential -ArgumentList $env:USERNAME,(Get-Content $PasswordPath | ConvertTo-SecureString)

To rule out any issues with the above I also tried.

$swis = Connect-Swis -Hostname Server -UserName "Username" -Password "Password"

Get-SwisData $swis -Query 'SELECT TOP 1000 ObjectName,AlertMessage,TriggerTimeStamp, AcknowledgedBy, Notes FROM Orion.AlertStatus' -Parameters @{}

Username was tried in the format DOMAIN\Username and also just Username

This also does not work.

$swis = Connect-Swis -Hostname Server -Credential (Get-Credential)

Get-SwisData $swis -Query 'SELECT TOP 1000 ObjectName,AlertMessage,TriggerTimeStamp, AcknowledgedBy, Notes FROM Orion.AlertStatus' -Parameters @{}

This does work on our test servers but not in production due to security settings

$swis = Connect-Swis -Hostname Server -Trusted

Get-SwisData $swis -Query 'SELECT TOP 1000 ObjectName,AlertMessage,TriggerTimeStamp, AcknowledgedBy, Notes FROM Orion.AlertStatus' -Parameters @{}

KMSigma.SWI

The -Trusted parameter implies that you want to pass the current Windows credentials through to Orion and is one of the best ways to do the authentication is you have Windows/AD Logins enabled.

The -Credential parameter is for use with Orion local accounts and not AD creds.

Why doesn't -Trusted work in your production environment?