Alternate authentication for APIs

[adamdriscoll]

Summary of the new feature / enhancement

A user is requesting the ability to have basic authentication for API endpoints and Windows authentication for the rest of the platform.

Proposed technical implementation details (optional)

No response

[rstolpe]

Sure but you have the token?

Why not auth with the same Creds and collect the token in variable or similar to pass in to the API request?

Here is a example for vSphere that I have done.

Function Connect-RSvi {
    [CmdletBinding()]
    Param(
        [Parameter(Mandatory = $true, HelpMessage = "Your username and password for vSphere")]
        [PSCredential]$Credential,
        [Parameter(Mandatory = $true, HelpMessage = "Full FQDN for the vSphere, example vs1.company.com")]
        [string]$vURI
    )

    $ConvertAuth = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($Credential.UserName + ':' + $Credential.GetNetworkCredential().Password))
    $Head = @{
        'Authorization' = "Basic $($ConvertAuth)"
    }

    $Connection = Invoke-WebRequest -Uri "https://$($vURI)/api/session" -Method Post -Headers $Head -ContentType "application/json"
    switch ($Connection.StatusCode) {
        201 {
            [PSCustomObject]@{
                SessionID = @{ "vmware-api-session-id" = $Connection.Content.Replace('"', "") }
                vURI      = $vURI
            }
        }
    }
}

Then just do something like this

$API = Connect-RSvi (fill out all needed Params)

$API | get-mypsustuff

It would be perfect if the API key /session key that's generated has a time limit for like 30min or similar. And that the post returns the end time so you know when you need to regenerate it

[RockoTheeHut]

This would be fantastic. We have legacy systems that require the use of basic auth. We are migrating everything to PSU but we can't fully transition until we figure out the basic auth issue..

To be clear i'm talking Headers @{ Authorization = "Basic [base64 user:pass]"}