search

cyberark / epv-api-scripts

These API scripts enable CyberArk users to automate privileged account management task like account creation, user management, and more.
https://www.cyberark.com/best
Apache License 2.0
197 stars 176 forks source link

Code bug - incorrect type usage #295

Closed Ross-Y closed 10 months ago

Ross-Y commented 1 year ago

In line 1146 and 1148, the variable $logonBody gets a powershell custom object converted into type json. That's why it will never work in line 1151, when you call a property of an object $logonBody.password - since it is no longer an object, but a json text.

A simple workaround would be to have some temporary object to convert from json, change the password and convert to json again:

$objLogonBody = $logonBody | convertfrom-json
$objLogonBody.Password += "$RadiusOTP"
$logonBody = $objLogonBody | ConvertTo-Json -Compress

https://github.com/cyberark/epv-api-scripts/blob/afafeb0af114330a822f2a7c045263b63f441294/Account%20Onboard%20Utility/Accounts_Onboard_Utility.ps1#L1145-L1152

Ross-Y commented 1 year ago

Also a coma should be removed in line 1151, as if your password is Password01 and your OTP code is 987654, the password field should look as follows: Password01987654. With the coma it looks like Password01,987654 and obviously authentication fails. I haven't seen any RADIUS authentication systems which would use a delimiter between a password and an OTP code. It doesn't mean they don't exist - but I guess it's just another bug.