Powershell: How do I pass secure credentials to 'test-adauthentication'?

Question

Powershell: How do I pass secure credentials to 'test-adauthentication'?

Kelly Sparks 121

I have a valid set of credentials stored in $Cred.

$Cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $UserName, $Password

Clearly they work like this:
PS C:\> $login=Test-ADAuthentication -username $Cred.UserName -password $Cred.GetNetworkCredential().Password
PS C:\> echo $login
True

However, I would like to pass them using only the $Cred variable if possible.
I have tried both of these, but neither work.

PS C:\> $login=Test-ADAuthentication -credential $Cred
PS C:\> echo $login
False
PS C:\> $login=Test-ADAuthentication -PSCredential $Cred
PS C:\> echo $login
False

Any help on this one?

Note: the only tag I found that was close to my question, was azure-ad-authentication-protocols... which isn't actually about my question, but I couldn;t submit the question without a tag.. so..

Accepted answer

2 additional answers

Your answer

Answer 1

Kelly Sparks 121

I ultimately figured this out... the Get-ADUser function has an option to pass $Cred, and if $Cred is wrong, it fails.

try
{
$login=Get-ADUser -Identity $User -Credential $Cred -Server $Domain
}
catch
{
$login=$false
Write-Host("Login failed!")
}

Rich Matheisen 47,901 Reputation points

2021-07-15T14:51:08.773+00:00
Any cmdlet that uses the -Credential parameter will fail if the credential is invalid. However, your code won't work the way you expect it to. You need to set the ErrorAction to STOP to throw the exception.

try { $login=Get-ADUser -Identity $User -Credential $Cred -Server $Domain -ErrorAction STOP } catch{ $login=$false Write-Host("Login failed!") }

Answer 2

Rich Matheisen 47,901

"Test-ADAuthentication" is a function that either you or someone else wrote. Is that correct? If so, see this: add-credentials-to-powershell-functions. The "Adding a Credential Parameter" section should help.

You can also pass the user-id as a string and the password as a secure string, and then create the credential in the function.

Kelly Sparks 121 Reputation points

2021-07-15T15:07:49.893+00:00

Hi Rich:
So the Test-ADAuthentication is a function that appears to be available with: Import-Module ActiveDirectory
That's the only think I did and the function worked. But in my last version, I'm not using Test-ADAuthentication any more.

We are passing the ID and PWD from a JAVA Application, then we simply want to check if they are valid. I believe I am passing the password as a secure string correctly.

Here is the full script:

$UserName = [ID@keyman .com PASSED FROM JAVA APP]
$Password = ConvertTo-SecureString [PWD VAR Passed from JAVA APP] -AsPlainText -Force
$Domain = $UserName -replace ".@"
$User=$UserName -replace "@."
$Cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $UserName, $Password
try
{
$login=Get-ADUser -Identity $User -Credential $Cred -Server $Domain
}
catch
{
$login=$false
Write-Host("Login failed!")
}
echo $login

Rich Matheisen 47,901

Sorry, but Test-ADAuthentication isn't a Microsoft cmdlet:

PS C:\Users\Administrator> get-command test-* | Select Name

Name
----
Test-DnsServer
Test-DnsServerDnsSecZoneSetting
Test-Dtc
Test-NetConnection
Test-NfsMappingStore
Test-RDOUAccess
Test-RDVirtualDesktopADMachineAccountReuse
Test-ScriptFileInfo
Test-ADDSDomainControllerInstallation
Test-ADDSDomainControllerUninstallation
Test-ADDSDomainInstallation
Test-ADDSForestInstallation
Test-ADDSReadOnlyDomainControllerAccountCreation
Test-ADServiceAccount
Test-AppLockerPolicy
Test-Certificate
Test-ComputerSecureChannel
Test-Connection
Test-DscConfiguration
Test-FileCatalog
Test-KdsRootKey
Test-ModuleManifest
Test-NfsMappedIdentity
Test-Path
Test-PSSessionConfigurationFile
Test-UevTemplate
Test-WSMan

Rich Matheisen 47,901 Reputation points

2021-07-15T18:34:12.43+00:00
The first lines of that script don't do what you think they do. Replace the two regular expressions with:

$Domain = $UserName -replace "^.+@", "" $User=$UserName -replace "@.+$", ""

and, unless the name of your domain controller is the same as your domain, this won't work either:

$login=Get-ADUser -Identity $User -Credential $Cred -Server $Domain

The "-Server" parameter should take the machine name of a Domain Controller (or a Global Catalog) server.

If the user name that's passed from your Java app is the form of a UPN (User Principal Name) there's no need to separate the "user" from the "domain".

The conversion of the password string to a secure string looks okay.

Answer 3

Anonymous

Hi

What is Test-ADAuthentication? If it's a function, you can replace the parameters $username and $password with $credential, then add the below lines to the function.

$username = $credential.UserName  
$password = $credential.GetNetworkCredential().Password

Best Regards,
Ian Xue

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Bill Stewart 186 Reputation points

2021-07-19T22:22:00.317+00:00

There should be a security disclaimer here: In general, it isn't recommended to decrypt a credential password to plain-text.

Share via

Powershell: How do I pass secure credentials to 'test-adauthentication'?

2 additional answers

Your answer