Powershell: How do I pass secure credentials to 'test-adauthentication'?

Kelly Sparks 121

I have a valid set of credentials stored in $Cred.

$Cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $UserName, $Password

Clearly they work like this:
PS C:\> $login=Test-ADAuthentication -username $Cred.UserName -password $Cred.GetNetworkCredential().Password
PS C:\> echo $login
True

However, I would like to pass them using only the $Cred variable if possible.
I have tried both of these, but neither work.

PS C:\> $login=Test-ADAuthentication -credential $Cred
PS C:\> echo $login
False
PS C:\> $login=Test-ADAuthentication -PSCredential $Cred
PS C:\> echo $login
False

Any help on this one?

Note: the only tag I found that was close to my question, was azure-ad-authentication-protocols... which isn't actually about my question, but I couldn;t submit the question without a tag.. so..

Accepted answer

Kelly Sparks 121 Reputation points

2021-07-15T11:22:52.957+00:00

I ultimately figured this out... the Get-ADUser function has an option to pass $Cred, and if $Cred is wrong, it fails.

try
{
$login=Get-ADUser -Identity $User -Credential $Cred -Server $Domain
}
catch
{
$login=$false
Write-Host("Login failed!")
}
Please sign in to rate this answer.
Rich Matheisen 46,711 Reputation points

2021-07-15T14:51:08.773+00:00

Any cmdlet that uses the -Credential parameter will fail if the credential is invalid. However, your code won't work the way you expect it to. You need to set the ErrorAction to STOP to throw the exception.

try { $login=Get-ADUser -Identity $User -Credential $Cred -Server $Domain -ErrorAction STOP } catch{ $login=$false Write-Host("Login failed!") }
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

2 additional answers

Rich Matheisen 46,711 Reputation points

2021-07-15T02:23:02.593+00:00

"Test-ADAuthentication" is a function that either you or someone else wrote. Is that correct? If so, see this: add-credentials-to-powershell-functions. The "Adding a Credential Parameter" section should help.

You can also pass the user-id as a string and the password as a secure string, and then create the credential in the function.
Please sign in to rate this answer.
Kelly Sparks 121 Reputation points

2021-07-15T15:07:49.893+00:00

Hi Rich:
So the Test-ADAuthentication is a function that appears to be available with: Import-Module ActiveDirectory
That's the only think I did and the function worked. But in my last version, I'm not using Test-ADAuthentication any more.

We are passing the ID and PWD from a JAVA Application, then we simply want to check if they are valid. I believe I am passing the password as a secure string correctly.

Here is the full script:

$UserName = [ID@keyman .com PASSED FROM JAVA APP]
$Password = ConvertTo-SecureString [PWD VAR Passed from JAVA APP] -AsPlainText -Force
$Domain = $UserName -replace ".@"
$User=$UserName -replace "@."
$Cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $UserName, $Password
try
{
$login=Get-ADUser -Identity $User -Credential $Cred -Server $Domain
}
catch
{
$login=$false
Write-Host("Login failed!")
}
echo $login

Rich Matheisen 46,711 Reputation points

2021-07-15T18:17:12.693+00:00

Sorry, but Test-ADAuthentication isn't a Microsoft cmdlet:

PS C:\Users\Administrator> get-command test-* | Select Name Name ---- Test-DnsServer Test-DnsServerDnsSecZoneSetting Test-Dtc Test-NetConnection Test-NfsMappingStore Test-RDOUAccess Test-RDVirtualDesktopADMachineAccountReuse Test-ScriptFileInfo Test-ADDSDomainControllerInstallation Test-ADDSDomainControllerUninstallation Test-ADDSDomainInstallation Test-ADDSForestInstallation Test-ADDSReadOnlyDomainControllerAccountCreation Test-ADServiceAccount Test-AppLockerPolicy Test-Certificate Test-ComputerSecureChannel Test-Connection Test-DscConfiguration Test-FileCatalog Test-KdsRootKey Test-ModuleManifest Test-NfsMappedIdentity Test-Path Test-PSSessionConfigurationFile Test-UevTemplate Test-WSMan

Rich Matheisen 46,711 Reputation points

2021-07-15T18:34:12.43+00:00

The first lines of that script don't do what you think they do. Replace the two regular expressions with:

$Domain = $UserName -replace "^.+@", "" $User=$UserName -replace "@.+$", ""

and, unless the name of your domain controller is the same as your domain, this won't work either:

$login=Get-ADUser -Identity $User -Credential $Cred -Server $Domain

The "-Server" parameter should take the machine name of a Domain Controller (or a Global Catalog) server.

If the user name that's passed from your Java app is the form of a UPN (User Principal Name) there's no need to separate the "user" from the "domain".

The conversion of the password string to a secure string looks okay.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Ian Xue 36,936 Reputation points Microsoft Vendor

2021-07-15T05:49:33.1+00:00
Hi

What is Test-ADAuthentication? If it's a function, you can replace the parameters $username and $password with $credential, then add the below lines to the function.

$username = $credential.UserName $password = $credential.GetNetworkCredential().Password

Best Regards,
Ian Xue

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Bill Stewart 181 Reputation points

2021-07-19T22:22:00.317+00:00

There should be a security disclaimer here: In general, it isn't recommended to decrypt a credential password to plain-text.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Powershell: How do I pass secure credentials to 'test-adauthentication'?

2 additional answers

Your answer