pspete / psPAS

PowerShell module for CyberArk Privileged Access Security REST API
https://pspas.pspete.dev
MIT License
286 stars 90 forks source link

get-pasaccount able to search "name" #454

Closed ELANDJEA closed 1 year ago

ELANDJEA commented 1 year ago

at this moment, when I search using the exact name of an object, it does not return results. for instance, the name of an object is "username1-servernameA", with address=servernameA and username=username1

get-pasaccount -safename testsafe -search "username1-servernameA" does return empty while get-pasaccount -safename testsafe -search "username1 servernameA" does return at least one entry....but could also return multiple entries when I have more objects with identical username and adress properties

it would be nice if can directly search on the objectname also to get a single result (yes I can make an additional filter also, but if this function also takes care of objectname searching it would be even better)

pspete commented 1 year ago

Can you do that successfully in pvwa already?

ELANDJEA commented 1 year ago

ouch.....forgot that my demo environment did not have "accountwidesearch" enabled.....after enabling that, the get-pasaccount -safename testsafe -search "username1-servernameA" does indeed return 1 unique entry.

taking into account above, I still think it must be relatively easy to filter in your module, as it already also returns the "name" property. The only difference is that with "accountwidesearch" you let EPV give the final result (some more EPV load because of this settinge).....in in the later case you make the query unique locally in the module processing.

pspete commented 1 year ago

likewise, it would be simple to filter the results returned from Get-PASAccount in your code...

Querying all accounts to find specific single accounts by name creates more vault activity than filtering a single set of results held locally.

We try mostly adhere to native API capabilities with minimal processing in the module other than some formatting and value conversions where required. As API (& psPAS Get-PASAccount) search operates as the target PVWA configuration dictates, WideAccountsSearch is an already available solution here.

A companion, or helper function to achieve the goal could be worked on if there is more appetite for something like this, but such an update to Get-PASAccount is unlikely.

Closing, but if there is wider need for this, comment below.