Page Comparison

Granting permanent elevated privileges to your admins represents an open security vulnerability. You can avoid this by using vaulted admin credentials in EmpowerID so that usernames and passwords are stored in a secure, encrypted password vault. When your system admins require elevated privileges for use in a PowerShell script, the EmpowerID system retrieves the credentials and generates a PSCredential object for them to use.

...

In order to implement this, you need to create an OAuth application in EmpowerID for PowerShell. This allows you to control who has access to the script. Once you create the application, you can test the script. 

...

Create an OAuth client application (one time setup)

...

1. On the

...

1. navbar, expand 

...

1. Single Sign-On > SSO Connections, and

...

1. select OAuth / OpenID Connect.

...

1. Select the

...

1. OAuth Client Apps tab

...

1. and then click the Add button above the grid.
   

...

1. 
   
   
   

2. In the OAuth Provider Application Details page that appears, enter information in the fields about the application for which you want to share credentials to use in your PowerShell script. 
   
   Image Modified

...

1. 
   
   

   
   

2. Scroll to the bottom and click Save. When it finishes, click the Find Apps link in the breadcrumbs to return to the list of OAuth Client Apps.
   
   Image Modified
   
   
3. Find your app in the list and click the Name value to open the OAuth Provider Application Details page.
4. The Connection Details section contains the values that you can copy for use in the PowerShell script:
   
   Image Modified
   
   
   • Client ID (Key) – copy this value to use for the $ClientID 
   • Client Secret  – copy this value to use for the $ClientSecret 
   • API Key – copy this value to use for the $APIKey

To create a PowerShell script to retrieve the credentials

1. In Windows PowerShell ISE (or any text editor), paste the following script:

   Code Block
   language powershell

   
   

2. Replace the following values in the script: 

   • $ClientID – replace the xxx with the GUID value from the Client ID (Key) of your OAuth application

   • $ClientSecret – replace the xxx with the GUID value from the Client Secret of your OAuth application

   • $APIKey – replace the xxx with the GUID value from the API Key of your OAuth application

   • $RedirectURL – replace sso.empoweriam.com with the FQDN of your server
   • $TokenURL – replace sso.empoweriam.com with the FQDN of your server
   • $CheckoutURL – replace sso.empoweriam.com with the FQDN of your server
   • $GetCredentialURL – replace sso.empoweriam.com with the FQDN of your server
   • $SearchURL – replace sso.empoweriam.com with the FQDN of your server
     
     
3. Save the file as GetCredentials.ps1.

To run the PowerShell file

1. In File Explorer, right-click the saved file and select Run with PowerShell. 
2. PowerShell opens and prompts you for several values. Answer each and press Enter. The script retrieves the OAuth token.
   
   Image Modified
   
   
3. Once the token is retrieved, you are asked whether you have the GUID of the credential. If you respond yes, you must provide the GUID, otherwise, you are prompted to search for the credential. Here we respond yes.
   
   Image Modified
   
   
4. To copy the GUID for the credential:
   1. In the Navigation Sidebar, expand Privileged Access and click Shared Credentials.
   2. Click the Credentials I Manage tab, and then click the display name of the credential we created above.
   3. In the Credential Details page, expand the Advanced section and copy the ExternalCredentialGUID value.
      
      Image Modified
      
      

5. Paste this value at the PowerShell prompt and press Enter. PowerShell proceeds to check out the credentials.
   
   Image Modified
   

...

1. 
   

   If your PowerShell instance disappears instead of checking out the credentials, your server may not be set to allow you to execute scripts.

   See About Execution Policies in the Microsoft PowerShell documentation to learn how to change your execution policy.

   
   

2. The retrieved credentials are stored in a global variable: $credentialsfromREST. 
3. In EmpowerID, you can verify that the credentials are checked out on the Shared Credentials page, Credentials I Manage tab.
   
   Image Modified

...

...