ISPSS New-PASSession returns a session but none of the cmdlets work #465

walidhammad · 2023-04-03T13:52:27Z

Describe the issue
While the new module update to include ISPSS seems to connect, I cannot access any of the cmdlets results.

To Reproduce
Installing the module
Connecting to ISPSS using service account
Running cmdlets

Expected behavior
I expect to be able to get results for any of the cmdlets of this module.

$ get-module pspas -ListAvailable

$ install-module pspas -RequiredVersion 5.5.110

$ get-module pspas -ListAvailable

    Directory: xxxxxxx

ModuleType Version    PreRelease Name                                PSEdition ExportedCommands
---------- -------    ---------- ----                                --------- ----------------
Script     5.5.110               psPAS                               Desk      {New-PASSession, Close-PASSession, Add-PASPublicSSHKey, Get-PASPublicSSHKey…}


$ $pcloudlogin = Get-Credential -UserName xxxxx@xxxxxxxxx

PowerShell credential request
Enter your credentials.
Password for user xxxxx@xxxxxxxxx: ****************************************


$ New-PASSession -TenantSubdomain xxxxxxx -Credential $pcloudlogin -Verbose
VERBOSE: Performing the operation "Logon" on target "https://xxxxxxx.id.cyberark.cloud/oauth2/platformtoken".
VERBOSE: HTTP/1.1 POST with 141-byte payload
VERBOSE: received 2120-byte response of content type application/json
VERBOSE: HTTP/1.1 GET with 0-byte payload

$ Get-PASSession

User BaseURI                                                     ExternalVersion WebSession
---- -------                                                     --------------- ----------
     https://xxxxxxx.privilegecloud.cyberark.cloud/PasswordVault 0.0             Microsoft.PowerShell.Commands.WebRequestSession

$ Get-PASServer
Invoke-PASRestMethod:
Line |
  14 |  …   $result = Invoke-PASRestMethod -Uri $URI -Method GET -WebSession $S …
     |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | No such host is known.

$ Get-PASLoggedOnUser
Invoke-PASRestMethod:
Line |
  16 |  …   $result = Invoke-PASRestMethod -Uri $URI -Method GET -WebSession $S …
     |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | No such host is known.

$ Get-PASSafe
Invoke-PASRestMethod:
Line |
 230 |  …   $result = Invoke-PASRestMethod -Uri $URI -Method GET -WebSession $S …
     |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | No such host is known.

$ Get-PASComponentSummary
Invoke-PASRestMethod:
Line |
  18 |  …   $result = Invoke-PASRestMethod -Uri $URI -Method GET -WebSession $S …
     |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | No such host is known.

$ Get-PASAccount
Invoke-PASRestMethod:
Line |
 197 |  …   $result = Invoke-PASRestMethod -Uri $URI -Method GET -WebSession $S …
     |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | No such host is known.

Your Environment
Windows:
Name Value

PSVersion 7.3.3
PSEdition Core
GitCommitId 7.3.3
OS Microsoft Windows 10.0.22621
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0

Mac:
Name Value

PSVersion 7.3.3
PSEdition Core
GitCommitId 7.3.3
OS Darwin 22.3.0 Darwin Kernel Version 22.3.0: Mon Jan 30 20:38:37 PST 2023; root:xnu-8792.81.3~2/RELEASE_ARM64_T60…
Platform Unix
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0

PowerShell Version: 7.3.3
psPAS Version: 5.5.110
CyberArk Version: ISPSS 13.0

Additional context
Add any other context about the problem here.

walidhammad · 2023-04-03T13:57:07Z

I can still connect with older module + issue#402 work around and do everything I need

$ Get-PASSession

User                     BaseURI                                                       ExternalVersion WebSession
----                     -------                                                       --------------- ----------
xxxxx@xxxxxxxxx https://xxxxxxxx.privilegecloud.cyberark.cloud/PasswordVault 13.0.0          Microsoft.PowerShell.Commands.WebRequestSession

$ Get-PASServer 

ExternalVersion InternalVersion ServerName
--------------- --------------- ----------
13.0.0          13.0.0.9        Vault

$ Get-PASLoggedOnUser

AgentUser    : False
Disabled     : False
Email        : 
Expired      : False
ExpiryDate   : 
FirstName    : Privilege
LastName     : user
Location     : \
Source       : Internal
Suspended    : False
UserName     : xxxxx@xxxxxxxxx
UserTypeName : EPVUser

pspete · 2023-04-03T19:47:40Z

It would be expected for both a username & the version information to be included in the get-passession output...

If the "WebSession" object is examined, does it include a bearer token?

PS C:\Users\petem> Get-PASSession | Select -ExpandProperty WebSession | select -ExpandProperty Headers

Key           Value                                                                                                                                                                                                    
---           -----                                                                                                                                                                                                    
Authorization Bearer SomeLongStringSomeLongStringSomeLongStringSomeLongStringSomeLongString...

walidhammad · 2023-04-04T14:57:30Z

Yes

Get-PASSession | Select -ExpandProperty WebSession | select -ExpandProperty Headers

Key           Value
---           -----
Authorization Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjRBOTJBRkUxRjIxMkZCQTJEN0M2MDg4NjE3N0ZGRTMxNEZCMkE1QTgiLCJ4NXQiOiJTcEt2NGZJUy…

pspete · 2023-04-04T22:03:45Z

is the https://xxxxxxx.privilegecloud.cyberark.cloud/PasswordVault value from Get-PASSession as expected?

does it match the value you see when using the issue #402 workaround?

pspete · 2023-04-04T22:06:28Z

Yes

Get-PASSession | Select -ExpandProperty WebSession | select -ExpandProperty Headers

Key           Value
---           -----
Authorization Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjRBOTJBRkUxRjIxMkZCQTJEN0M2MDg4NjE3N0ZGRTMxNEZCMkE1QTgiLCJ4NXQiOiJTcEt2NGZJUy…

Can you see if the Bearer token is able to be used outside of the module?
Like described here: #464 (comment)

walidhammad · 2023-04-04T22:14:48Z

is the https://xxxxxxx.privilegecloud.cyberark.cloud/PasswordVault value from Get-PASSession as expected?

does it match the value you see when using the issue #402 workaround?

No, the xxxxxxx returned is the identity tenant, which is in https://xxxxxxx.id.cyberark.cloud/oauth2/platformtoken instead of the privilege cloud pvwa name https://xyz.privilegecloud.cyberark.cloud/PasswordVault

walidhammad · 2023-04-04T22:25:14Z

Yes

Get-PASSession | Select -ExpandProperty WebSession | select -ExpandProperty Headers

Key           Value
---           -----
Authorization Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjRBOTJBRkUxRjIxMkZCQTJEN0M2MDg4NjE3N0ZGRTMxNEZCMkE1QTgiLCJ4NXQiOiJTcEt2NGZJUy…

Can you see if the Bearer token is able to be used outside of the module? Like described here: #464 (comment)

I can by replacing baseurl with https://xyz.privilegecloud.cyberark.cloud/PasswordVault instead of https://xxxxxxx.privilegecloud.cyberark.cloud/PasswordVault and it returns users.

pspete · 2023-04-11T20:30:18Z

OK, so your scenario is that the Identity & Privilege Cloud subtenant names are different?
Will investigate how to cater for this.

bab29 · 2023-07-17T15:11:50Z

@pspete The URL that is used for "Identity" (Authentication, user updates, etc) operations will always go to a URL that uses "????.my.idaptive.app" (???? Assigned by CyberArk) while any operation that goes to a "PCloud" (Accounts, Safes, Ownership, etc) will go to the "{subdomain}.id.cyberark.cloud" (Subdomain chosen by the tenant)

This line is using a incorrect URL
New-PASSession.ps1
$LogonRequest['Uri'] = "https://${TenantSubdomain}.id.cyberark.cloud/oauth2/platformtoken"

This line needs to be updated to use the "Identity" tenant then the code should work.

Suggestion:

New-PASSession.ps1
[Parameter(Mandatory = $true, ValueFromPipeline = $false, ValueFromPipelinebyPropertyName = $true, ParameterSetName = 'SharedServices')] [string]$IdentityID,

$LogonRequest['Uri'] = "https://${IdentityID}.id.cyberark.cloud/oauth2/platformtoken"

Note that $Uri being set is correct and should use the TenantSubdomain, it is just the oauth token request that needs to go to the "Identity" Uri

New-PASSession.ps1
$Uri = "https://${TenantSubdomain}.privilegecloud.cyberark.cloud/$PVWAAppName"

pspete · 2023-07-19T00:26:48Z

1st generation URLs (like ????.my.idaptive.app) are not yet catered for in the module, we currently assume the URL for current day systems.
{subdomain} can be configured as a tenant URL for the Identity portal, which should allow authentication to proceed.

Nevertheless, will work to add some additional logic into the module to cater for different configurations.

pspete · 2023-07-31T10:45:45Z

It si expected that most Shared Services implementations will be configured so that Identity and Privileged Cloud portal addresses share a common subdomain.

Where this is not the case, and Identity and Privilege Cloud portals do not share an identical subdomain, in the latest psPAS release 5.6.135, subdomain values or portal URL values can be specified independently: https://pspas.pspete.dev/docs/authentication/#shared-services-authentication

walidhammad · 2023-08-13T20:36:52Z

1st generation URLs (like ????.my.idaptive.app) are not yet catered for in the module, we currently assume the URL for current day systems. {subdomain} can be configured as a tenant URL for the Identity portal, which should allow authentication to proceed.

Nevertheless, will work to add some additional logic into the module to cater for different configurations.

Thank you! The last release works by giving me the options to specify identitysubdomain and tenantsubdomain.

The reason we cannot have them be the same is due to it being Identity Security Platform tenant which makes identitysubdomain a pre generated string

pspete · 2023-08-14T09:43:35Z

Great it works for you.
I Don't think a custom domain/ vanity URL is the same thing as a Tenant subdomain.

The process for adding a custom domain is a lot more involved than adding a subdomain.

walidhammad · 2023-08-14T11:13:51Z

I Don't think a custom domain/ vanity URL is the same thing as a Tenant subdomain.

It is

https://docs.cyberark.com/Idaptive/Latest/en/Content/GetStarted/CustomDomain.htm

pspete mentioned this issue Jul 12, 2023

Pspas module problem with pcloud #472

Closed

pspete mentioned this issue Jul 30, 2023

UPDATE ISPSS Authentication #476

Merged

17 tasks

pspete closed this as completed Jul 31, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ISPSS New-PASSession returns a session but none of the cmdlets work #465

ISPSS New-PASSession returns a session but none of the cmdlets work #465

walidhammad commented Apr 3, 2023 •

edited

Loading

walidhammad commented Apr 3, 2023 •

edited

Loading

pspete commented Apr 3, 2023

walidhammad commented Apr 4, 2023

pspete commented Apr 4, 2023

pspete commented Apr 4, 2023

walidhammad commented Apr 4, 2023 •

edited

Loading

walidhammad commented Apr 4, 2023

pspete commented Apr 11, 2023

bab29 commented Jul 17, 2023 •

edited

Loading

pspete commented Jul 19, 2023

pspete commented Jul 31, 2023

walidhammad commented Aug 13, 2023 •

edited

Loading

pspete commented Aug 14, 2023

walidhammad commented Aug 14, 2023

ISPSS New-PASSession returns a session but none of the cmdlets work #465

ISPSS New-PASSession returns a session but none of the cmdlets work #465

Comments

walidhammad commented Apr 3, 2023 • edited Loading

walidhammad commented Apr 3, 2023 • edited Loading

pspete commented Apr 3, 2023

walidhammad commented Apr 4, 2023

pspete commented Apr 4, 2023

pspete commented Apr 4, 2023

walidhammad commented Apr 4, 2023 • edited Loading

walidhammad commented Apr 4, 2023

pspete commented Apr 11, 2023

bab29 commented Jul 17, 2023 • edited Loading

pspete commented Jul 19, 2023

pspete commented Jul 31, 2023

walidhammad commented Aug 13, 2023 • edited Loading

pspete commented Aug 14, 2023

walidhammad commented Aug 14, 2023

walidhammad commented Apr 3, 2023 •

edited

Loading

walidhammad commented Apr 3, 2023 •

edited

Loading

walidhammad commented Apr 4, 2023 •

edited

Loading

bab29 commented Jul 17, 2023 •

edited

Loading

walidhammad commented Aug 13, 2023 •

edited

Loading