public/New-VPASPSMSession.ps1
|
<#
.Synopsis CONNECT WITH PSM CREATED BY: Vadim Melamed, EMAIL: vpasmodule@gmail.com .DESCRIPTION USE THIS FUNCTION TO MAKE A CONNECTION VIA PSM .LINK https://vpasmodule.com/commands/New-VPASPSMSession .PARAMETER token HashTable of data containing various pieces of login information (PVWA, LoginToken, HeaderType, etc). If -token is not passed, function will use last known hashtable generated by New-VPASToken .PARAMETER safe Safe name that will be used to query for the target account if no AcctID is passed .PARAMETER username Username that will be used to query for the target account if no AcctID is passed .PARAMETER platform PlatformID that will be used to query for the target account if no AcctID is passed .PARAMETER address Address that will be used to query for the target account if no AcctID is passed .PARAMETER AcctID Unique ID that maps to a single account, passing this variable will skip any query functions .PARAMETER OpenRDPFile Trigger the RDPFile to open by default, rather then just display the RDPFile contents .PARAMETER ConnectionComponent Define which connection component will be used via ConnectionComponentID ConnectionComponentID is the ID given to the Connection Component (for example PSM-RDP for RDP, and PSM-SSH for SSH) .PARAMETER TargetServer Define the target server if the connection component prompts for a server Commonly used for domain accounts connecting via PSM-RDP .PARAMETER Reason Define a reason for connecting for audit purposes .PARAMETER InputParameters HashTable of values containing the parameters required to make the API call .EXAMPLE $ConnectWithPSMRDPFile = New-VPASPSMSession -safe {SAFE VALUE} -username {USERNAME VALUE} -address {ADDRESS VALUE} -ConnectionComponent {CONNECTION COMPONENT VALUE} .EXAMPLE $ConnectWithPSMRDPFile = New-VPASPSMSession -AcctID {ACCTID VALUE} -ConnectionComponent {CONNECTION COMPONENT VALUE} .EXAMPLE $InputParameters = @{ safe = "TargetSafeName" platform = "TargetPlatformID" username = TargetUsername" address = "targetAddress" OpenRDPFile = $true|$false ConnectionComponent = "PSM-RDP" TargetServer = "Targetserver01.vman.com" Reason = "ritm12345" } $ConnectWithPSMRDPFile = New-VPASPSMSession -InputParameters $InputParameters .EXAMPLE $InputParameters = @{ AcctID = "22_123" OpenRDPFile = $true|$false ConnectionComponent = "PSM-RDP" TargetServer = "Targetserver01.vman.com" Reason = "ritm12345" } $ConnectWithPSMRDPFile = New-VPASPSMSession -InputParameters $InputParameters .OUTPUTS If successful: An RDP file containing the following example full address:s:1.2.3.4 server port:i:3389 username:s:localhost\PSM@1df467e5-de84-424f-8527-d88a423577fc alternate shell:s:PSM@1df467e5-de84-424f-8527-d88a423577fc desktopwidth:i:768 desktopheight:i:1024 screen mode id:i:2 redirectdrives:i:0 drivestoredirect:s: redirectsmartcards:i:0 EnableCredSspSupport:i:0 redirectcomports:i:0 remoteapplicationmode:i:0 use multimon:i:0 span monitors:i:0 smart sizing:i:1 --- $false if failed #> function New-VPASPSMSession{ [OutputType('System.Object',[bool])] [CmdletBinding(DefaultParameterSetName='Set1')] Param( [Parameter(Mandatory=$false,ParameterSetName='Set1',ValueFromPipelineByPropertyName=$true)] [String]$safe, [Parameter(Mandatory=$false,ParameterSetName='Set1',ValueFromPipelineByPropertyName=$true)] [String]$platform, [Parameter(Mandatory=$false,ParameterSetName='Set1',ValueFromPipelineByPropertyName=$true)] [String]$username, [Parameter(Mandatory=$false,ParameterSetName='Set1',ValueFromPipelineByPropertyName=$true)] [String]$address, [Parameter(Mandatory=$true,ParameterSetName='Set2',ValueFromPipelineByPropertyName=$true,HelpMessage="Unique AccountID of the target account (for example: 22_123)")] [String]$AcctID, [Parameter(Mandatory=$false,ParameterSetName='Set1',ValueFromPipelineByPropertyName=$true)] [Parameter(Mandatory=$false,ParameterSetName='Set2',ValueFromPipelineByPropertyName=$true)] [Switch]$OpenRDPFile, [Parameter(Mandatory=$true,ParameterSetName='Set1',ValueFromPipelineByPropertyName=$true,HelpMessage="Enter target ConnectionComponent (for example: PSM-RDP)")] [Parameter(Mandatory=$true,ParameterSetName='Set2',ValueFromPipelineByPropertyName=$true,HelpMessage="Enter target ConnectionComponent (for example: PSM-RDP)")] [String]$ConnectionComponent, [Parameter(Mandatory=$false,ParameterSetName='Set1',ValueFromPipelineByPropertyName=$true)] [Parameter(Mandatory=$false,ParameterSetName='Set2',ValueFromPipelineByPropertyName=$true)] [String]$TargetServer, [Parameter(Mandatory=$false,ParameterSetName='Set1',ValueFromPipelineByPropertyName=$true)] [Parameter(Mandatory=$false,ParameterSetName='Set2',ValueFromPipelineByPropertyName=$true)] [String]$Reason, [Parameter(Mandatory=$true,ParameterSetName='InputParameters',ValueFromPipelineByPropertyName=$true,HelpMessage="Hashtable of parameters required to make API call, refer to get-help -examples for valid inputs")] [hashtable]$InputParameters, [Parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true)] [hashtable]$token ) Begin{ $tokenval,$sessionval,$PVWA,$Header,$ISPSS,$IdentityURL,$EnableTextRecorder,$AuditTimeStamp,$NoSSL,$VaultVersion,$HideWarnings,$AuthenticatedAs,$SubDomain,$EnableTroubleshooting = Get-VPASSession -token $token $CommandName = $MyInvocation.MyCommand.Name $log = Write-VPASTextRecorder -inputval $CommandName -token $token -LogType COMMAND } Process{ try{ if($PSCmdlet.ParameterSetName -eq "InputParameters"){ $KeyHash = @{ set1 = @{ AcceptableKeys = @("safe","platform","username","address","OpenRDPFile","ConnectionComponent","TargetServer","Reason") MandatoryKeys = @("ConnectionComponent") } set2 = @{ AcceptableKeys = @("AcctID","OpenRDPFile","ConnectionComponent","TargetServer","Reason") MandatoryKeys = @("AcctID","ConnectionComponent") } } $CheckSet = Test-VPASHashtableKeysHelper -InputHash $InputParameters -KeyHash $KeyHash if(!$CheckSet){ $log = Write-VPASTextRecorder -inputval "FAILED TO FIND TARGET PARAMETER SET" -token $token -LogType MISC Write-Verbose "FAILED TO FIND TARGET PARAMETER SET" Write-VPASOutput -str "FAILED TO FIND TARGET PARAMETER SET...VIEW EXAMPLES BELOW:" -type E $examples = Write-VPASExampleHelper -CommandName $CommandName return $false } else{ foreach($key in $InputParameters.Keys){ Set-Variable -Name $key -Value $InputParameters.$key } } } }catch{ $log = Write-VPASTextRecorder -inputval $_ -token $token -LogType ERROR $log = Write-VPASTextRecorder -inputval "REST API COMMAND RETURNED: FALSE" -token $token -LogType MISC Write-Verbose "FAILED TO INITIATE PSM SESSION" Write-VPASOutput -str $_ -type E return $false } try{ if([String]::IsNullOrEmpty($AcctID)){ Write-Verbose "NO ACCOUNT ID PROVIDED...INVOKING HELPER FUNCTION TO RETRIEVE UNIQUE ACCOUNT ID BASED ON SPECIFIED PARAMETERS" $AcctID = Get-VPASAccountIDHelper -token $token -safe $safe -platform $platform -username $username -address $address Write-Verbose "RETURNING ACCOUNT ID" } else{ Write-Verbose "ACCOUNT ID SUPPLIED, SKIPPING HELPER FUNCTION" } write-verbose "INITIALIZING BODY PARAMETERS" $params = @{ Reason = $Reason ConnectionComponent = $ConnectionComponent ConnectionParams = @{ PSMRemoteMachine = @{ value = $TargetServer } } } $log = Write-VPASTextRecorder -inputval $params -token $token -LogType PARAMS $params = $params | ConvertTo-Json if($NoSSL){ Write-Verbose "NO SSL ENABLED, USING HTTP INSTEAD OF HTTPS" $uri = "http://$PVWA/PasswordVault/API/Accounts/$AcctID/PSMConnect/" } else{ Write-Verbose "SSL ENABLED BY DEFAULT, USING HTTPS" $uri = "https://$PVWA/PasswordVault/API/Accounts/$AcctID/PSMConnect/" } $log = Write-VPASTextRecorder -inputval $uri -token $token -LogType URI $log = Write-VPASTextRecorder -inputval "POST" -token $token -LogType METHOD write-verbose "MAKING API CALL TO CYBERARK" if($sessionval){ $response = Invoke-RestMethod -Headers @{"Authorization"=$Header} -Uri $uri -Method POST -Body $params -ContentType "application/json" -WebSession $sessionval } else{ $response = Invoke-RestMethod -Headers @{"Authorization"=$Header} -Uri $uri -Method POST -Body $params -ContentType "application/json" } Write-Verbose "CONSTRUCTING FILENAME" $tempResponse = $response -split "`r`n" $GUID = $tempResponse[2] -split ":" $tempName = $GUID[2] + "Vpas.rdp" $tempName = $tempName -replace "\\","_" Write-Verbose "CREATING RDP FILE" $curUser = $env:UserName $outputPath = "C:\Users\$curUser\Downloads\$tempName" write-output $response | Set-Content $outputPath Write-Verbose "RDP FILE CREATED: $outputPath" if($OpenRDPFile){ write-verbose "OPENING RDP FILE" #Invoke-Expression "mstsc.exe '$outputPath'" Start-Process "$env:windir\system32\mstsc.exe" -ArgumentList "$outputPath" } else{ Write-VPASOutput -str "RDP FILE CREATED: $outputPath" -type M Write-VPASOutput -str "PLEASE NOTE THIS FILE IS VALID FOR ~15 SECONDS ONLY" -type M } $outputlog = $response $log = Write-VPASTextRecorder -inputval "REST API COMMAND RETURNED: $outputlog" -token $token -LogType MISC Write-Verbose "RETURNING RDP FILE CONTENT" return $response }catch{ $log = Write-VPASTextRecorder -inputval $_ -token $token -LogType ERROR $log = Write-VPASTextRecorder -inputval "REST API COMMAND RETURNED: FALSE" -token $token -LogType MISC Write-Verbose "UNABLE TO CONNECT TO PSM SESSION" Write-VPASOutput -str $_ -type E return $false } } End{ $log = Write-VPASTextRecorder -inputval $CommandName -token $token -LogType DIVIDER } } |