Skip to content

Release v1.0.27

Latest
Latest

Choose a tag to compare

View all tags
@jullienl jullienl released this 04 Nov 08:46
v1.0.27
d4ef71e

🎯 What's New in v1.0.27

⭐ Headline Feature — OpenID Connect (OIDC) Single Sign-On

Connect-HPEGL now signs in to HPE GreenLake workspaces and organizations federated with OpenID Connect (OIDC), in addition to SAML 2.0, for Okta, Microsoft Entra ID and PingIdentity.

Until now, the library only supported SAML 2.0 federation. Any workspace whose single sign-on was configured with OIDC, the modern federation option offered by HPE GreenLake, could not be used from PowerShell at all: Connect-HPEGL stopped with an error saying the sign-in flow had changed, and the only way around it was to fall back to a separate HPE account. With v1.0.27, OIDC-federated workspaces work exactly like SAML ones, with the same cmdlet, the same parameters, and no script changes.

Why this matters

  • OIDC is simpler to set up than SAML: an identity provider application with a client ID and secret, with no SAML metadata or signing certificates to exchange and maintain.
  • One script for every workspace: the federation protocol is detected automatically, so the same Connect-HPEGL call works whether a workspace uses SAML or OIDC.
  • No more fallback accounts: teams that moved to OIDC no longer need a separate HPE account just to run their automation.

Supported identity providers and sign-in modes

Identity provider SAML 2.0 OIDC (new) Passwordless (-PasswordlessSSOEmail) Password-based (-Credential)
Okta (Identity Engine) ✅ ✅ Okta Verify push or TOTP Password only, or password + Okta Verify
Microsoft Entra ID ✅ ✅ Microsoft Authenticator push (number matching) Password only, or password + Authenticator push or TOTP
PingIdentity (PingOne SSO) ✅ ✅ PingID push or OTP Password only, or password + PingID

OIDC sign-in has been tested end to end with all three providers, in both passwordless and password-based modes, including a clear error message for a wrong password.

# Passwordless: approve the push notification on your phone
Connect-HPEGL -PasswordlessSSOEmail "user@company.com" -Workspace "Production"

# Password-based: password, then MFA step-up if your identity provider requires it
$cred = Get-Credential -UserName "user@company.com"
Connect-HPEGL -Credential $cred -Workspace "Production"

PingIdentity OIDC setup tip: set the PingOne application's Token Endpoint Authentication Method to Client Secret Post. With another method, HPE GreenLake can reject the sign-in with error HPE_GL_IDENTITY_OIDC_REQUEST_INVALID_4606, even in a browser.

Under the hood: OIDC is not a variation of the SAML sign-in, it is a different conversation. Each identity provider hands control back to HPE GreenLake in its own way after the user is authenticated, and none of these exchanges is documented for use without a browser. Each provider's OIDC sign-in had to be traced, reproduced and fitted into the existing password, push, TOTP and step-up handling, so that one Connect-HPEGL call keeps "just working" whatever protocol and provider a workspace uses.

✨ Also in this release

  • 👥 Group-based user onboarding: create users whose permissions come entirely from user groups, and manage group membership reliably again (see Bug Fixes).
  • 🔐 Safer sign-in logs: -Verbose output now masks email addresses, sign-in tokens, authorization codes and cookie values, so a log can be shared for support as is.
  • 🎯 Targeted Secure Gateway discovery: discover iLOs at specific addresses or ranges instead of scanning a whole subnet.
  • 🛠️ Many sign-in and user-management fixes, detailed below.

Bug Fixes

  • Connect-HPEGL: Fixed -PasswordlessSSOEmail failing for accounts whose email domain is a subdomain of hpe.com but is not @hpe.com itself (for example @labs.example.hpe.com). These accounts were treated as HPE internal accounts and stopped with a misleading message asking to use -PasswordlessSSOEmail, the parameter already in use. They now sign in through their organization's single sign-on.

  • New-HPEGLUser: Users can now be created with membership in one or more user groups and no direct role assignment, so their permissions come entirely from the roles assigned to those groups. Previously -RoleName was mandatory, which prevented group-based onboarding. Specifying at least one role or one user group is still required. Group membership failures are now reported: if the user is created but cannot be added to a group, the result shows Failed with the reason, instead of reporting success. Running the command again for a user that was created earlier without workspace access now completes the missing group membership instead of failing with a conflict error.

    'user1@company.com', 'user2@company.com' | New-HPEGLUser -UserGroupName 'Engineering Team'

  • Add-HPEGLUserToUserGroup, Remove-HPEGLUserFromUserGroup, Get-HPEGLUserGroup, Get-HPEGLUserGroupMembership: Fixed adding and removing group members failing with "Not Found", group memberships failing to load, and member lists (-ShowUsers) and member counts coming back empty, because these cmdlets used an HPE GreenLake group API version that is no longer available. They now use the current version, the same one the HPE GreenLake web console uses. In addition, users are now found when they have no access to the current workspace yet, for example users created without direct role assignments, so they can be added to a group and receive their permissions from it.

  • Remove-HPEGLUser: Fixed the cmdlet not recognizing that the connected workspace belongs to an organization. It always behaved as if the workspace were standalone and only removed the user from the workspace instead of deleting the account from the organization as documented. It also could not find users that have no access to the current workspace, such as users created without direct roles, and reported them as not found. In an organization, the default now deletes the user account from the organization and finds users regardless of their workspace access. Use -FromWorkspaceOnly to remove a user from the current workspace only. Run with -WhatIf first to review the request before deleting accounts.

    Remove-HPEGLUser -Email user@company.com -WhatIf
Remove-HPEGLUser -Email user@company.com -FromWorkspaceOnly

  • New-HPEGLUserGroup: Fixed group creation reporting success without assigning the role supplied with -RoleName and -ScopeName. The requested role is now assigned when the group is created, and invalid roles or scopes are detected before creation. If the group is created but role assignment fails, the result reports Failed and retains the group's ID so you can retry the assignment without recreating the group. With -WhatIf, no changes are made.

  • Connect-HPEGL: Fixed a sign-in failure affecting accounts whose email domain is configured for single sign-on in HPE GreenLake, but whose identity is a local HPE account rather than an account in the corporate identity provider. This typically applies to users who were created in HPE GreenLake before their domain was set up for SSO. Signing in with -Credential failed with a misleading message stating that the account did not exist in the identity provider, even though the credentials were correct and signing in through the web console worked. These accounts now sign in successfully.

    Connect-HPEGL -Credential $cred -Workspace "MyWorkspace"

  • Remove-HPEGLWorkspace: Fixed incomplete session cleanup after deleting a workspace. Previously, leftover session data (workspace list, credentials, region and time-zone information) remained in the PowerShell session, which could cause confusion or stale results. The workspace is now fully disconnected and all session data is cleared after a successful deletion, just like Disconnect-HPEGL.

  • Connect-HPEGL (Entra ID passwordless sign-in): Fixed a sign-in failure that could occur with Microsoft Entra ID accounts using Microsoft Authenticator when a push approval had not been pre-armed by Entra. In these cases the sign-in now automatically requests the Authenticator approval so it can complete successfully. When Microsoft has temporarily blocked push notifications for the account (for example after a recently denied request, a "Report suspicious activity" tap, or rate limiting), Connect-HPEGL now returns a clear, specific message explaining the block and how to resolve it, instead of a confusing error. A related issue that displayed raw internal text in the error output has also been corrected.

  • Connect-HPEGLDeviceComputeiLOtoCOM, New-HPEGLWorkspaceSAMLSSODomain, Set-HPEGLWorkspaceSAMLSSODomain, Remove-HPEGLWorkspaceSAMLSSODomain: Fixed a failure when these cmdlets run in a session without a console window, such as ForEach-Object -Parallel or thread jobs (Start-ThreadJob). The cmdlets previously stopped with the error "times ('-1') must be a non-negative value". They now run normally in these sessions.

    $iLOIPs | ForEach-Object -Parallel { Connect-HPEGLDeviceComputeiLOtoCOM -IloIP $_ -IloCredential $using:iLO_credential }

Improvements

  • Connect-HPEGL: Email addresses are now masked in the verbose output. Sign-in diagnostics are often captured to a file and shared when reporting an issue, and the account name previously appeared throughout the log in several forms, including inside web addresses and server responses. Only the first character of the name and the top-level domain are kept, so different accounts can still be told apart in a log while the address itself is no longer readable. The temporary sign-in values exchanged with the identity provider (session tokens, SAML messages, authorization codes) and browser cookie values are now masked as well, so a shared log no longer contains any part of a live sign-in session. Passwords were never written to the verbose output. Messages displayed directly to you, and the request previews shown by -WhatIf, continue to show the real address.

    Connect-HPEGL -Credential $cred -Workspace "MyWorkspace" -Verbose *> signin-log.txt

  • Invoke-HPECOMSecureGatewayServerDiscovery: Added a new manual (targeted) discovery mode. In addition to the existing automatic subnet scan, you can now discover HPE iLO devices at specific addresses using the new -IPAddress and -IPRange parameters. This probes only the addresses you provide instead of scanning the entire subnet behind the Secure Gateway, making discovery faster and more precise when you already know the iLO addresses. Individual addresses and ranges can be combined, and duplicate addresses are removed automatically. The results returned by a manual discovery contain only the servers matching the addresses you probed.

    # Discover specific iLO addresses
Invoke-HPECOMSecureGatewayServerDiscovery -Region eu-central -SecureGateway "sg01.lj.lab" -IPAddress '192.168.1.45','192.168.1.56'

# Discover a range of addresses
Invoke-HPECOMSecureGatewayServerDiscovery -Region eu-central -SecureGateway "sg01.lj.lab" -IPRange '192.168.1.10-192.168.1.60'

Installation

Install-Module -Name HPECOMCmdlets -RequiredVersion 1.0.27

Or update from a previous version:

Update-Module -Name HPECOMCmdlets
Assets 2
Loading