Locked out?

[rkeithhill]

What have I done to myself here?

🔥09-18 16:32:39 20> Set-SecretStoreConfiguration -DoNotPrompt -Force

      Scope PasswordRequired PasswordTimeout DoNotPrompt
      ----- ---------------- --------------- -----------
CurrentUser             True             900        True

C:\Users\Keith>
🔥0x8A150014 09-18 16:33:45 22> Get-Secret -Name SomePassword -AsPlainText
Get-Secret: A valid password is required to access the Microsoft.PowerShell.SecretStore vault.
Get-Secret: The secret SomePassword was not found.

C:\Users\Keith>
09-18 17:27:06 24> Set-SecretStoreConfiguration -PasswordRequired:$false

Confirm
Are you sure you want to perform this action?
Performing the operation "Changes local store configuration" on target "SecretStore module local store".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): Y
Set-SecretStoreConfiguration: A valid password is required to access the Microsoft.PowerShell.SecretStore vault.

C:\Users\Keith>
🔥09-18 17:27:16 25> Get-SecretStoreConfiguration
Get-SecretStoreConfiguration: A valid password is required to access the Microsoft.PowerShell.SecretStore vault.

If we are actually supposed to be able to disable the password requirement, then this syntax is not great -PasswordRequired:$false. Might be better to have -EnablePasswordRequired and DisablePasswordRequired.

[PaulHigin]

The above is by design. You need to unlock the store before you can change the configuration password setting with 'Unlock-SecretStore', since prompting is turned off. But maybe a prompt should always occur in this case, or a better error message.

We want to be secure by default, and decided to use -PasswordRequired and make it a little bit difficult to turn it off since no password use is much less secure.

But I am open to changes as long as default always goes to 'most secure'.

[rkeithhill]

You need to unlock the store before you can change the configuration ...

That makes sense but why is Get-SecretStoreConfiguration failing? Seems like that should not fail in this case i.e. does the display of the store config need to be password protected?

a better error message.

Yeah, maybe something indicating that the vault is locked, and since password prompting is disabled, it needs to be unlocked via Unlock-SecretStore.

[ThomasNieto]

If PasswordRequired is set to false I would expect SecretStore (Get-SecretStoreConfiguration) cmdlets to implicitly unlock the store without needing to explicitly unlocking the store with Unlock-SecretStore.

[PaulHigin]

Yes, it works that way now. The above repro started with a required password, turned off prompting and then tried to access the store, and failed because the store was locked. In this case a password is required to access the store or change the password configuration and is by design. However, better error reporting or always allow prompting in this case may be a better experience.

[PaulHigin]

Closing as 'answered'.