Passing ${CREDENTIAL} in a PowerShell without using -Credential

There is an out-of-the-box template for Groupwise performance metrics that a client is trying to use in their environment. They use local authentication for the target webpage but, try as I might, I've been unable to figure out how to pass the variable ${credential} into the Net-Object System.Net.WebClient object. (See lines 18-20 below)

I tried inserting the following on line 19 but that fails with 'The user name or password is incorrect.'

$webClient.Credentials = new-object System.Management.Automation.PSCredential(${CREDENTIAL});

As per the script body of Windows PowerShell monitor the ${CREDENTIAL} variable will pass the username and the component will prompt for the password at run time, which SAM will then pass from the SAM credential store.

I got the option for line 19 (as above) from How to make an authenticated web request in Powershell? - Stack Overflow.

Tagging mrxinu on this one for some help!

$Error.Clear();
$server = $args[0];
$port = $args[1];
if ( !$server )
 {
 Write-Host "Message: Can't find ""server"" argument. Check documentation.";
 exit 1;
 }
if ( !$port )
 {
 Write-Host "Message: Can't find ""port"" argument. Check documentation.";
 exit 1;
 }
$tempvar = (Get-Childitem env:temp).value;
$tempfile = $tempvar + '\APM-GW-POA1' + $server + '.txt';
$downloadstring = 'http://'; + $server + ':' + $port + '/';
try {
  $webClient = New-Object System.Net.WebClient;
  
  $content = $webClient.DownloadString("$downloadstring") | out-file $tempfile;
  }
catch {
  Write-Host "Message: Connection error: $($Error[0])";
  exit 1;
  }
function getstat2([string] $path, [string] $pattern) {
 $i = (get-content $path | select-string $pattern | Select-Object LineNumber | select -first 1).LineNumber;
 if ($i -eq $null)
  {
  return -1;
  }
 else
  {
  $out = get-content $path;
  $i=$i+1;
  $t=$out[$i].Split("<*>");
  return $t[2];
  }
 }
function getstat1([string] $path, [string] $pattern) {
 $i = (get-content $path | select-string $pattern | Select-Object LineNumber | select -first 1).LineNumber;
 if ($i -eq $null)
  {
  return -1;
  }
 else
  {
  $out = get-content $path;
  $t=$out[$i].Split("<*>");
  return $t[4];
  }
 }
$stat1 = getstat1 $tempfile "C/S Users";
$stat2 = getstat2 $tempfile "Application Connections";
$stat3 = getstat2 $tempfile "Physical Connections";
$stat4 = getstat2 $tempfile "Priority Queues";
$stat5 = getstat2 $tempfile "Normal Queues";
$stat6 = getstat1 $tempfile "C/S Requests";
$stat7 = getstat1 $tempfile "C/S Requests Pending";
$stat8 = getstat1 $tempfile "Users Timed Out";
$stat9 = getstat2 $tempfile "Rules Executed";
Write-Host "Statistic.Users: $stat1";
Write-Host "Statistic.Application_Connections: $stat2";
Write-Host "Statistic.Physical_Connections: $stat3";
Write-Host "Statistic.Priority_Queues: $stat4";
Write-Host "Statistic.Normal_Queues: $stat5";
Write-Host "Statistic.Requests: $stat6";
Write-Host "Statistic.Requests_Pending: $stat7";
Write-Host "Statistic.Users_Timed_Out: $stat8";
Write-Host "Statistic.Rules_Executed: $stat9";
exit 0;

Find more posts tagged with

powershell monitor

PowerShell

credentials

Accepted answers

jbiggley

Gah! Foiled by the Advanced > Preferred Polling Method ... AGAIN!

I changed the preferred polling method to Agentless after writing out the $downloadstring in the error message and discovering that the $downloadstring (the URL:port combo) was returning http://127.0.0.1:7181 instead of the target IP address. That change, coupled with setting the components to run in local execution mode without impersonation (vs Remote mode w/ impersonation) worked. Oddly enough, I still couldn't test successfully while editing the script itself, but the component tested fine.

This is what the script looks like now (without the functions -- I didn't change that part because it matches what was out of the box from the SAM team).

Basically, I leveraged the collection of the stored SAM creds and parsed them out into the username/password, ensuring that I converted to decoded password back into a secure string, and then updated the $webclient variable to use the new username and password strings.

Thanks to KMSigma, mrxinu, and chad.every for their helpful questions and feedback.

$Error.Clear();
$server = $args[0];
$port = $args[1];
$c = Get-Credential -credential ${CREDENTIAL}

Function SecureStringToString($value)
{
    [System.IntPtr] $bstr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($value);
    try
    {
        [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($bstr);
    }
    finally
    {
        [System.Runtime.InteropServices.Marshal]::FreeBSTR($bstr);
    }
}

[string] $username = $c.Username
[string] $password = SecureStringToString $c.Password
$securepass = $password | ConvertTo-SecureString -AsPlainText -Force

if ( !$server )
{
Write-Host "Message: Can't find ""server"" argument. Check documentation.";
exit 1;
}
if ( !$port )
{
Write-Host "Message: Can't find ""port"" argument. Check documentation.";
exit 1;
}
$tempvar = (Get-Childitem env:temp).value;
$tempfile = $tempvar + '\APM-GW-POA1' + $server + '.txt';
$downloadstring = 'http://'; + $server + ':' + $port + '/';

try {
  $webClient = New-Object System.Net.WebClient;
  $webClient.Credentials = new-object System.Management.Automation.PSCredential($username, $securepass);
  $content = $webClient.DownloadString("$downloadstring") | out-file $tempfile;
  }
catch {
  Write-Host "Message: Connection error: $($Error[0]) on $downloadstring";
  exit 1;
  }

All comments

jbiggley

Fiddling with Re: Powershell Monitor / Basic Authentications / Credentials now to see if this works. Apparently you can break ${CREDENTIAL} into the username/password variables for use in PoSH cmdlets where you can't pass the -Credentials.

EDIT:

I've figured out how to get it to work from PowerShell ISE on the polling engine but I'm getting a "the username and password are incorrect" when executing via component test. Here's what I did to get to this point.

I inserted the following after the declaration of the variables (line 3 above). I got this from the URL at the top of this comment but you'll note that I converted the deciphered password back into a secure password. (This may be my folly! -- testing continues) This allows the script to extract the username and password from the ${credentials} variable.

$c = Get-Credential 

Function SecureStringToString($value)
{
    [System.IntPtr] $bstr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($value);
    try
    {
        [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($bstr);
    }
    finally
    {
        [System.Runtime.InteropServices.Marshal]::FreeBSTR($bstr);
    }
}

[string] $username = $c.Username
[string] $password = SecureStringToString $c.Password
$securepass = $password | ConvertTo-SecureString -AsPlainText -Force

With the assigned credentials stored in variables, I updated the try{ } as follows:

try {
  $webClient = New-Object System.Net.WebClient;
  $webClient.Credentials = new-object System.Management.Automation.PSCredential($username, $securepass);
  $content = $webClient.DownloadString("$downloadstring") | out-file $tempfile;
  }

This passes the username and the secure password.

Again, I know that this works locally from ISE as I am able to pass in the $server and $port parameters as well as enter the username/password that via $c = Get-Credential and get back the metrics I'm after.

Any thoughts on why I am getting a username/password error when trying execute when testing the SAM component?

damien.solodow

In the credential store do you have it as DOMAIN\USERNAME?

KMSigma.SWI

Can't you use:

$Creds = Get-Credential ${CREDENTIAL}

Then do whatever you like with the $Creds variable?

yellowtj

Are you using the same user account to run the ISE that SAM is running under?

jbiggley

It is a local user, no domain.

jbiggley

Re: Passing ${CREDENTIAL} in a PowerShell without using -Credential

That was what I did. It works locally on the polling engine but does not work via SAM

jbiggley

No, that's why I am passing the credentials to the Net-Object cmdlet. I want to use the credentials that SAM has stored to execute the test on the polling engine.

KMSigma.SWI

If it's running under the context of that user, can't you do a "-Trusted" connection to the resource?

Sidebar: Who even uses Groupwise anymore?

chad.every

This is what i use to extract creds in SAM

I need to get it into a json request at the end so i'm piping to ConvertTo-Json but the concept is the same. And you should be able to use ${credential} or ${creds} as a SAM variable

    $creds = Get-Credential ${creds}
    $CredUser=$creds.GetNetworkCredential().UserName
    $CredPass=$creds.GetNetworkCredential().Password
    $creds = $( @{ username=$CredUser; password=$CredPass } | ConvertTo-Json )

Shout out to hussod for helping me with this originally.

mrxinu

This was going to be my suggestion as well. Can we see the entire script with this laid in?

jbiggley

It will probably be tomorrow morning before I can get to this, but I will make the updates and post here.

jbiggley

Gah! Foiled by the Advanced > Preferred Polling Method ... AGAIN!

This is what the script looks like now (without the functions -- I didn't change that part because it matches what was out of the box from the SAM team).

Thanks to KMSigma, mrxinu, and chad.every for their helpful questions and feedback.

$Error.Clear();
$server = $args[0];
$port = $args[1];
$c = Get-Credential -credential ${CREDENTIAL}

Function SecureStringToString($value)
{
    [System.IntPtr] $bstr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($value);
    try
    {
        [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($bstr);
    }
    finally
    {
        [System.Runtime.InteropServices.Marshal]::FreeBSTR($bstr);
    }
}

[string] $username = $c.Username
[string] $password = SecureStringToString $c.Password
$securepass = $password | ConvertTo-SecureString -AsPlainText -Force

if ( !$server )
{
Write-Host "Message: Can't find ""server"" argument. Check documentation.";
exit 1;
}
if ( !$port )
{
Write-Host "Message: Can't find ""port"" argument. Check documentation.";
exit 1;
}
$tempvar = (Get-Childitem env:temp).value;
$tempfile = $tempvar + '\APM-GW-POA1' + $server + '.txt';
$downloadstring = 'http://'; + $server + ':' + $port + '/';

try {
  $webClient = New-Object System.Net.WebClient;
  $webClient.Credentials = new-object System.Management.Automation.PSCredential($username, $securepass);
  $content = $webClient.DownloadString("$downloadstring") | out-file $tempfile;
  }
catch {
  Write-Host "Message: Connection error: $($Error[0]) on $downloadstring";
  exit 1;
  }

KMSigma.SWI

Glad you figured it out and you aren't the only one (looking in a mirror) who has been burned by this in the past.

Maybe we should all come up with an "Application Component Script Component Best Practices."