SAM credential - use only password not username

Having worked on this a while today...  Solarwinds documentation says there are two macros that represent various parts of the SAM credential used in script monitors - ${USER} and ${PASSWORD}.

Working with this and trying to replace the loooooooong token in the header >> authorization part of the script monitor I have no luck with authenticating to my web site.

Digging deeper and using some diagnostic write-host messages I find that the ${USER} variable expands into my dummy user name, but the ${PASSWORD} variable does not.  Used as a script argument I get literally "${PASSWORD}"; used in the body of the script I get nothing.  Blank. 

I tried replacing the password in the SAM credential with something simple, like 'password123' just in case my long token contains some character that the monitor can't handle.  Results are the same: password variable does not expand in my script monitor.

I saw a thread from a couple years ago where another community member was unable to get anything from the ${PASSWORD} macro in a script monitor - similar results to my experience.  I'm using SW version 2023.x of pretty recent vintage.  Wondering if the ${PASSWORD} macro was somehow removed in a recent product update.

Please let me know if anyone has had any luck using the ${PASSWORD} macro in script monitors, especially PowerShell script monitors.

Thanks.

Jbiggley had a response in this thread:  Passing ${CREDENTIAL} in a PowerShell without using -Credential - Forum - Server & Application Monitor (SAM) - THWACK (solarwinds.com), which I believe would accomplish what you are looking for.  It takes the "Credential for Monitoring" variable (${Credential}) then decrypts the password.  So in theory someone could still potentially hijack the password, but at least you wouldn't be storing the password as plain text within the monitor itself.  My recommendation would be the backend account tied to the oauth token to have very limited access.

Simply supply the code below in the top of your script, and $password would be your unecrypted password/api key from the credential set.

$c = Get-Credential 

Function SecureStringToString($value)
{
    [System.IntPtr] $bstr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($value);
    try
    {
        [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($bstr);
    }
    finally
    {
        [System.Runtime.InteropServices.Marshal]::FreeBSTR($bstr);
    }
}

[string] $username = $c.Username
[string] $password = SecureStringToString $c.Password
$securepass = $password | ConvertTo-SecureString -AsPlainText -Force

Thank you! Reading through the thread it sounds like this will provide the needed result.

One question.  I assume then...

1. I will add ${CREDENTIAL} as a script argument in the component monitor.
2. the '$c = Get-Credential' as the first line of the component script is smart enough to know that the credential was passed from ${CREDENTIAL}.  I don't have to worry about assigning the $arg[0] to a separate variable. 

Please let me know if either of these assumptions are not correct, or if more clarification is needed.  Thanks for your help.

With some effort and troubleshooting got this working.

Using Get-Credential something else was needed to make this work.  Assign a variable to the ${creds} macro with the -credential switch, as below:

You should be able to use:

$c = Get-Credential ${Credential}

inside of the script itself instead of setting credential into the argument.