search

Keeper-Security / keeper-sdk-dotnet

.Net and PowerShell version of Keeper Commander, a CLI and SDK interface for the Keeper Security platform.
https://docs.keeper.io/secrets-manager/commander-cli/using-commander/dotnet-powershell
MIT License
29 stars 20 forks source link

Add MasterPassword paramater #111

Closed lim3ra closed 8 months ago

lim3ra commented 8 months ago

MasterPassword paramater added so you can establish connection without user prompt. Useful for Powershell automation scripts where you cannot prompt the value.

sk-keeper commented 8 months ago

MasterPassword paramater added so you can establish connection without user prompt. Useful for Powershell automation scripts where you cannot prompt the value.

Do you have SSO account and want to login with a password? Connect-Keeper has SsoPassword parameter that forces master password flow for SSO accounts.

$password='<Password>'
Connect-Keeper -Password=$password -SsoPassword <account_email>
lim3ra commented 8 months ago

MasterPassword paramater added so you can establish connection without user prompt. Useful for Powershell automation scripts where you cannot prompt the value.

Do you have SSO account and want to login with a password?

Connect-Keeper has SsoPassword parameter that forces master password flow for SSO accounts.


$password='<Password>'

Connect-Keeper -Password=$password -SsoPassword <account_email>

Hi, yes it has.

But when you put -SsoPassword, it will generate you a Write-Host prompt so you can write your password and accept with "Enter". (See that -SsoPassword is type "switch")

In my case I need to have fully automated solution, and I would like to pass MasterPassword as a variable without user interaction.

sk-keeper commented 8 months ago

It is a bug if -SsoPassword parameter does not work with -Password one for SSO accounts. It will be fixed soon.

lim3ra commented 8 months ago

It is a bug if -SsoPassword parameter does not work with -Password one for SSO accounts. It will be fixed soon.

It's not a bug, please see line 338 in PowerCommander/AuthCommands.ps1:

[Parameter(ParameterSetName = 'sso_password')][switch] $SsoPassword,

when you run: kc -Username $username -Password $pass -SsoPassword it will trigger ask user to choose between SSO token and master password, then it will trigger Write-Host command at some point and it will wait for user interaction to type master password in the popup window.

When you want to use this tool in automation, you cannot have Write-Window because you won't be able to type password manually, you have to pass the password as variable. In current version of the module you cannot do something like that:

kc -Username $username -Password $pass -SsoPassword $masterpassword <- that line won't work because -SsoPassword can be only true or false

That's why new parameter is needed (to keep backward compatibility) for example -MasterPassword so you can pass variable to it and connect without additional manual prompt: kc -Username $username -Password $pass -MasterPassword $masterpassword

sk-keeper commented 8 months ago

-SsoPassword is a switch/flag that forces password flow for SSO accounts. It does not accept any value. -Password parameter is used for passing both regular and SSO users password.

sk-keeper commented 8 months ago

The latest version works as expected.

$password= Read-Host -AsSecureString ...
Connect-Keeper -Password=$password -SsoPassword <account_email>

does not show any input.

lim3ra commented 8 months ago

Ok, I can confirm

kc -Password $masterpassword -SsoPassword $username works if you want to connect using master password

It would be great if we could mention that in the official powershell docs for this module.

Thank you for your help, @sk-keeper !