With the new powershell module SecretsManagement it is possible to add plugins. The new module is used to get\/add\/remove credentials. I created a plugin for secretserver to this module.<\/p>\n
To get started you will have to install secretsmanagement:
\nInstall-Module -Name Microsoft.Powershell.SecretsManagement -AllowPrerelease
\nIf -AllowPrerelase is not an option you would have to update PowershellGet first. ( install-script powershellget )<\/p>\n
After SecretManagement has been installed you can run : <\/p>\n
add-secret -Name "Test" -secret (get-credential) -vault -builtinlocalvault <\/pre>\n, followed by <\/p>\n
get-secret Test <\/pre>\n.<\/p>\n
But I would like to have a uniform cmdlet for all my credentials. So I used Secrets Management Module Vault Extensions<\/a> to get me started.<\/p>\n
If you would like to install my module from powershell gallery run : <\/p>\n
install-module -name secretsmanagement.secretserver<\/pre>\nA bit more info for those interested<\/p>\n
First created a new folder structure below C:\\Program Files\\WindowsPowerShell\\Modules\\
\nSecretsmanagement\\0.0.3\\SecretsManagementExtension
\nIn the version folder “0.0.3” i added 2 files : Readme.txt (How to register vault) and SecretsManagement.SecretServer.psd1 ( Datafile for the module)<\/p>\n\r\n# Module manifest for module 'SecretsManagement.SecretServer'\r\n# Generated by: Atle Vatland\r\n# Generated on: 2\/12\/2020\r\n@{\r\n# Script module or binary module file associated with this manifest.\r\n# RootModule = ''\r\n# Version number of this module.\r\nModuleVersion = '0.0.3'\r\n# Supported PSEditions\r\nCompatiblePSEditions = @('Desktop')\r\n# ID used to uniquely identify this module\r\nGUID = 'e25aacec-637f-4935-bbd9-463a75ba46ea'\r\n# Author of this module\r\nAuthor = 'Atle Vatland'\r\n# Copyright statement for this module\r\nCopyright = '(c) 2020 Atle Vatland. All rights reserved.'\r\n# Description of the functionality provided by this module\r\nDescription = 'Proof of concept for Secretserver( by Thycotic ) vault extension for powershell. Remove-secret is not implemented in this test.'\r\n# Modules that must be imported into the global environment prior to importing this module\r\nPowershellVersion = '5.1'\r\n}\r\n<\/pre>\nThe subfolder has to be named “SecretsManagementExtension” also the scripts has to be named SecretsManagementExtension.psm1 and .psd1
\nWhat gave me some hassle was that the add-secret cmdlet actually calls set-secret in the extension.<\/p>\nSecretsManagementExtension.psd1:<\/p>\n
\r\n@{\r\n ModuleVersion = '1.0' \r\n RootModule = '.\\SecretsManagementExtension.psm1'\r\n PowershellVersion = '5.1'\r\n FunctionsToExport = @('Get-Secret','Set-Secret','Remove-Secret','Get-SecretInfo')\r\n PrivateData = @{\r\n PSData = @{\r\n # A URL to the license for this module.\r\n LicenseUri = 'https:\/\/opensource.org\/licenses\/MIT'\r\n } # End of PSData hashtable\r\n } # End of PrivateData hashtable\r\n}\r\n<\/pre>\nHave not implemented remove-secret as we do not want to to delete any secrets.
\nSecretsManagementExtension.psm1:<\/p>\n\r\n# Licensed under the MIT License.\r\n\r\nfunction Get-Secret\r\n{\r\n param (\r\n [string]$Name,\r\n [hashtable]$AdditionalParameters\r\n )\r\n $where = $AdditionalParameters.secretserveruri\r\n $ws = New-WebServiceProxy -uri $where -Credential $AdditionalParameters.secretservercredential #-ErrorAction SilentlyContinue\r\n $wsResult = $ws.GetSecret([int]$name, $false, $null)\r\n [PSCredential]::new($wsResult.Secret.Items[1].value.ToString(), ($wsResult.Secret.Items[2].value.ToString()|ConvertTo-SecureString -AsPlainText -Force)) \r\n}\r\n\r\nfunction set-secret\r\n{\r\n param (\r\n [string] $Name,\r\n [object] $Secret,\r\n [hashtable] $AdditionalParameters\r\n )\r\n \r\n $where = $AdditionalParameters.secretserveruri\r\n $cred= $AdditionalParameters.secretservercredential\r\n $secretserverfolder=$AdditionalParameters.secretserverfolderid \r\n if($secretserverfolder -eq $null){\r\n $secretserverfolder=44\r\n }\r\n $domain=$Name\r\n $templatename=$AdditionalParameters.secretservertemplate\r\n if($templatename -eq $null){\r\n $templatename= "Windows Account"\r\n }\r\n if($Secret -eq $null){\r\n throw "Secret can not be null."\r\n }\r\n elseif($secret -is [string]){\r\n throw "String is currently not supported"\r\n }\r\n elseif($secret -is [hashtable]){\r\n throw "String is currently not supported"\r\n }\r\n elseif ($secret -is [PSCredential]){\r\n $username = $Secret.username\r\n $password = $secret.GetNetworkCredential().password\r\n } \r\n $ws = New-WebServiceProxy -uri $where -Credential $cred \r\n # Get Template\r\n $template = $ws.GetSecretTemplates().SecretTemplates | Where {$_.Name -eq $templateName}\r\n # Set fields info\r\n $secretName = $domain + "-" + $UserName\r\n $secretItemFields = (($template.Fields | Where {$_.DisplayName -eq "Machine"}).Id, ($template.Fields | Where {$_.DisplayName -eq "Username"}).Id, ($template.Fields | Where {$_.DisplayName -eq "Password"}).Id, ($template.Fields | Where {$_.DisplayName -eq "Notes"}).Id)\r\n $secretItemValues=($domain,$UserName,$password, "")\r\n $folderId = $secretserverfolder\r\n # Add secret to secretserver.\r\n $addResult = $ws.AddSecret($template.Id, $secretName, $secretItemFields, $secretItemValues, $folderId)\r\n if($addResult.Errors.Count -gt 0){\r\n return $false\r\n }else{\r\n return $true\r\n }\r\n}\r\n\r\nfunction Remove-Secret\r\n{\r\n param (\r\n [string] $Name,\r\n [hashtable] $AdditionalParameters\r\n )\r\n throw "Not implemented"\r\n}\r\n\r\nfunction Get-SecretInfo\r\n{\r\n param(\r\n [string] $filter,\r\n [hashtable] $AdditionalParameters\r\n )\r\n if ([string]::IsNullOrEmpty($filter)) { $filter = "*" }\r\n $where = $AdditionalParameters.secretserveruri\r\n $ws = New-WebServiceProxy -uri $where -Credential $AdditionalParameters.secretservercredential # -ErrorAction SilentlyContinue\r\n $hits=$ws.SearchSecrets($filter,$null,$null)\r\n $result=@()\r\n foreach($hit in $hits.SecretSummaries){\r\n $result+= ([pscustomobject] @{\r\n Name = $($hit.secretid.tostring()) \r\n Value = $($hit.secretName.ToString())\r\n })\r\n }\r\n $result\r\n}\r\n<\/pre>\nTo register this extension for module for SecretsManagement there are some required parameters.
\nCredentials used to access secretserver, secretserver web service url, default template and default folder.
\nCredential and parameters are stored encrypted in Credential Manager.<\/p>\n\r\n[pscredential]$c=Get-Credential # Secretserver credential\r\n \r\n Register-SecretsVault -Name "VaultName" -ModuleName secretsmanagement.secretserver -VaultParameters @{\r\n secretservercredential=$c # Account used to connect to secret server.\r\n secretserveruri="https:\/\/secretserver.domain.local\/secretserver\/winauthwebservices\/sswinauthwebservice.asmx" # Webservice uri\r\n secretserverfolderid="44" # New secrets are stored in this folder. Folder id -1 is default if not specified.\r\n secretservertemplate="Windows Account" # Template used when creating new secrets. "Windows Account" is default if not specified.\r\n }\r\n <\/pre>\n","protected":false},"excerpt":{"rendered":"With the new powershell module SecretsManagement it is possible to add plugins. The new module is used to get\/add\/remove credentials. I created a plugin for secretserver to this module. To get started you will have to install secretsmanagement: Install-Module -Name Microsoft.Powershell.SecretsManagement -AllowPrerelease If -AllowPrerelase is not an option you would have to update PowershellGet first. … Continue reading SecretServer(Thycotic) plugin for powershell SecretsManagement module.<\/span>