diff --git a/PAM Export to User Vault/PAM Export to User Vault.json b/PAM Export to User Vault/PAM Export to User Vault.json new file mode 100644 index 0000000..9ed39eb --- /dev/null +++ b/PAM Export to User Vault/PAM Export to User Vault.json @@ -0,0 +1,27 @@ +{ + "Connections": [{ + "ConnectionType": 30, + "ID": "39ad70e5-6547-494c-a045-b784e0405c10", + "Name": "PAM Export to User Vault", + "OpenEmbedded": true, + "PowerShell": { + "Arguments": "-PAMVaultName '{1}'", + "CustomParameters": { + "ExtraParametersData": [], + "Parameter1DataType": 1, + "Parameter1Label": "PAMVaultName", + "SafeParam1Default": "Uk0aCB/IFBo8hdcDFk1rZQ==" + }, + "EmbeddedScriptCompressed": "rVXRbtowFH0GiX+waKSGB6P9AA+s6bZIhUZNoQ9VtZnkMjyZmNoOHer677t2QkhKijqtEVTEzj33nHOP04gptiZ+r9u5j+xPMKD8CctSZqTakRHxblUOgwf7wJwJjuswlWaaC3GtLtcbs/OLzdgonv188KLxZM5yYaaI1esOet1e10s1AvlfwdCbYBIww2KZqwTIH3K3AgX0evELEkOeve/D290GCIVHco6Pxucvg/tPCO/lSiBEDUE7hEjJDSizI7SGatvRaicGtQWFEDFozWWGMFN4okG8v6efmYaZ4sQ1oTMN1+PcrLAiAqVlxkTE1k7SXkQQVyuvFRCUYJUPb+WVfEIrB4SumUlWpGFMbbtUGC6Jf9Rw8IzO1lfHSSLzzFg7KyLVGh1rlMKTMFtKhU2tuDaHga2/SJGCCgPn9FHbYRi8uMaKb3HcdhCFV/u+uFLuVSaGWSLyFOJ8UWDrY2t8bH4hswzvsOQw6AsFKWSGM3GObmH0iierVV37fagKNhr5YoWlioKBocloYWUI4VlD2t4nZ2rnDDGRP8FxK7J1s8QOmHhuSCbx5jfXptcl5WXHQ3HdbzPlrRCU7lath1dsAQInXlDo3ClugH6T2rQ81eeaLACPFEkc09Tqwa6kJFBj3ndonm4E/ECQUEfmuAV1bh7MLWDKqlMDGFX2v10SRHFx9Ow7JICtFLkdu57dXJ0sQlRUNtmVVGMwBk2wyfMMvolO1DpGhxVM96ghOgwO87TX3rCTKM660bF5jkfcehaqQVAFSwV6Regc1EJqR97GtXMpNLwnA0wIHH66K+KoT0agTZpj/v+BbYKf7f8PFKxsRIujY49uvnE7fEkUPOYcfXQy7fnx32W4fSllzbSGwYD8aHKwF5UKD/y7h/ga1WlzR/E1sL1qc+nPrKZKZr8tDG0QH5PSD0prG+S/x7de7YJs/+AXP73uXw==", + "IsEmbeddedScript": true, + "LoadRDMCmdLet": true, + "Version": 3 + }, + "Tools": { + "ConnectionType": 7 + } + } + ], + "DatabaseID": "1c25577d-e924-40b2-80cd-d9c64e9c0ef4", + "Version": 2 +} diff --git a/PAM Export to User Vault/PAM Export to User Vault.ps1 b/PAM Export to User Vault/PAM Export to User Vault.ps1 new file mode 100644 index 0000000..3942563 --- /dev/null +++ b/PAM Export to User Vault/PAM Export to User Vault.ps1 @@ -0,0 +1,40 @@ +Param ( + [Parameter(Mandatory = $True)] + [ValidateNotNullOrEmpty()] + [String]$PAMVaultName +) + +$ds = (Get-RDMDataSource | Where-Object {$_.Type -eq 'RDMS'})[0] +$url = Get-RDMDatasourceProperty -DataSource $ds -Property Server +$Session = New-DSSession -BaseUri $url -UseOAuth +$PersonalPamVault = (Get-DSPamVault | Where-Object { $_.Name.ToLower() -match $PAMVaultName.ToLower() })[0] +If ($PersonalPamVault){ + $PersonalPamAccounts = Get-DSPamAccounts -AsBasicInformation | Where-Object {$_.TeamFolderID -eq $PersonalPamVault.ID} + $PrivateRDMSessions = Get-RDMPrivateSession -IncludeSubFolders | Where-Object { ($_.ConnectionType -eq 'Credential') -and ($_.Credentials.CredentialType -eq 'DpsPam') } + foreach ($PamAccount in $PersonalPamAccounts){ + #Create User vault entry it not exist + If (-not($PrivateRDMSessions | Where-Object { $_.Name -eq $PamAccount.Label })){ + Write-Host $PamAccount.Label "is being created in RDM Private User vault" + $session = New-RDMSession -Name $PamAccount.Label -Type Credential + $Session.Credentials.CredentialType = 'DpsPam' + $Session.Credentials.DPSServer = $url + $Session.Credentials.DPSPamUseMyAccountSettings = $true + $Session.Credentials.DpsPamCredentialID = $PamAccount.ID + $session.Credentials.DpsPamCredentialName = $PamAccount.Label + Set-RDMPrivateSession $session -refresh -Verbose + } + Else{ + Write-Host $PamAccount.Label "allready exists in RDM Private User vault" + $session = $PrivateRDMSessions | Where-Object { $_.Name -eq $PamAccount.Label } + #Validate existing entry and update if required + If (($session.Credentials.DpsPamCredentialID -ne $PamAccount.ID) ` + -or ($session.Credentials.DpsPamCredentialName -ne $PamAccount.Label)){ + Write-Host "Updating entry" $PamAccount.Label + $Session.Credentials.DpsPamCredentialID = $PamAccount.ID + $session.Credentials.DpsPamCredentialName = $PamAccount.Label + Set-RDMPrivateSession $session -refresh -Verbose + } + } + } +} + diff --git a/PAM Export to User Vault/README.md b/PAM Export to User Vault/README.md new file mode 100644 index 0000000..25a8c60 --- /dev/null +++ b/PAM Export to User Vault/README.md @@ -0,0 +1,9 @@ +# Introduction +Creates linked credential entries in Private User vault corresponding to a PAM vault +For example, if personal credentials are stored in a PAM vault named 'Personal_UserName', then all entries within that PAM vault will be created in Private User Vault +These PAM credentails can then be retrieved when other RDM entries are configured to 'Find by name (uservault)' for their credential + +# Getting Started +Import the json file into RDM datasource +Open the imported entry, and set the PAM Vault Name parameter +Open/Launch the entry