Actually I don't have any trouble getting the idSource when needed but here, I get the error on a function that doesn't ask for the idSource.
You can copy/paste this code into connect_rsaapi.ps1 (it complies with my company's coding rules) :
function rsa_set_globals(
[string]$rsa_server = "<your RSA AM server>",
[string]$admin_login = '<your login>',
[SecureString]$admin_password, # can be passed through : $admin_password = read-host -AsSecureString
[string]$api_login = "CmdClient_********",
[string]$api_password = "******************************"
) {
write-host "Récup WSDL et creation namespace rsaapi" -ForegroundColor DarkCyan
$secpass=ConvertTo-SecureString $api_password -AsPlainText -Force
$cred=New-Object System.Management.Automation.PSCredential($api_login, $secpass)
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
$securIDWebWervice = New-WebServiceProxy -Uri "https://${rsa_server}:7002/ims-ws/services/CommandServer?wsdl" -Namespace rsaapi -Credential $cred
write-host "Créer le server de commandes" -ForegroundColor DarkCyan
$Global:CommandServer = New-Object rsaapi.CommandServerService
$Global:CommandServer.Credentials=$cred
$Global:CommandServer.Url="https://${rsa_server}:7002/ims-ws/services/CommandServer"
write-host "Mise en forme des identifiants de $admin_login" -ForegroundColor DarkCyan
$userNameParam=New-Object rsaapi.FieldParameterDTO
$userNameParam.promptKey="AUTHENTICATIONSERVICE_PRINCIPALID"
$userNameParam.value = $admin_login
$userPasswordParam=New-Object rsaapi.FieldParameterDTO
$userPasswordParam.promptKey = "PASSWORD_CREDENTIAL"
$userPasswordParam.value = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($admin_password))
[rsaapi.AbstractParameterDTO[]]$paramsArray=@($userNameParam,$userPasswordParam)
write-host "Connexion de $admin_login" -ForegroundColor DarkCyan
$Global:loginCommand = New-Object rsaapi.LoginCommand
$Global:loginCommand.authenticationMethodId="LDAP_Password"
$Global:loginCommand.parameters=$paramsArray
$Global:loginCommand=$Global:CommandServer.executeCommand([System.Management.Automation.Language.NullString]::Value , $loginCommand)
if (! $loginCommand.authenticationState.Equals("authenticated")) {
write-host "Login et/ou mot de passe incorrects" -ForegroundColor Red
throw "Login et/ou mot de passe incorrects"
}
}
function rsa_get_idsource (
[string]$nom = "<Your Id source Name (Active directory domain for me)>"
) {
$query = New-Object rsaapi.GetIdentitySourcesCommand
$result = $CommandServer.executeCommand($loginCommand.sessionId, $query)
return ($result.identitySources | where {$_.name -like $nom})
}
function rsa_get_user(
[Parameter(Mandatory=$True)][string]$login,
[int]$min = 1,
[int]$max = 1,
[int]$search_limit = 5000 # I used the dirty way here...I know...
) {
$query = New-Object rsaapi.SearchPrincipalsCommand
$query.identitySourceGuid = (rsa_get_idsource).guid
$query.limit = $search_limit # I used the dirty way here...I know...
try {
$result = $CommandServer.executeCommand($loginCommand.sessionId, $query)
} catch {
Write-host "Impossible de retrouver l'utilisateur $Login :" $Error[0].Exception.Message -ForegroundColor Red
throw $Error[0]
}
$principals = $result.principals | where {$_.userID -like $login}
if ($principals.count -lt $min) {
Write-Host "On n'a pas trouvé assez d'utilisateurs avec" $login ":" $principals.count "au lieu de minimum" $min -ForegroundColor Red
throw "Pas assez d'utilisateurs trouvés"
} elseif ($principals.count -gt $max) {
Write-Host "On a trouvé trop d'utilisateurs avec" $login ":" $principals.count "au lieu de maximum" $max -ForegroundColor Red
throw "Trop d'utilisateurs trouvés"
}
return $principals
}
function rsa_get_token (
[Parameter(Mandatory=$True)][long]$serialNumber
) {
$query = New-Object rsaapi.LookupTokenCommand
$query.serialNumber = "{0:D12}" -f $serialNumber
try {
$result = $CommandServer.executeCommand($loginCommand.sessionId, $query)
} catch {
Write-host "Impossible de trouver le token $Token_number :" $Error[0].Exception.Message -ForegroundColor Red
throw $Error[0]
}
return $result.token
}
function rsa_link_token_to_user (
[Parameter(Mandatory=$True)][rsaapi.PrincipalDTO]$user,
[Parameter(Mandatory=$True)][rsaapi.TokenDTO]$token
) {
$query = New-Object rsaapi.LinkTokensWithPrincipalCommand
$query.principalGuid = $user.guid
$query.tokenGuids = $token.id
try {
$result = $CommandServer.executeCommand($loginCommand.sessionId, $query)
} catch {
Write-host "Impossible de d'associer le token" $Token.serialNumber "Ã " $User.userID ":" $Error[0].Exception.Message -ForegroundColor Red
throw $Error[0]
}
}
function rsa_get_user_tokens (
[Parameter(Mandatory=$True)][rsaapi.PrincipalDTO]$user
) {
$query = New-Object rsaapi.ListTokensByPrincipalCommand
$query.principalId = $user.guid
$result = $CommandServer.executeCommand($loginCommand.sessionId, $query)
return $result.tokenDTOs
}
function rsa_unassign_token (
[Parameter(Mandatory=$True)][rsaapi.TokenDTO]$token
) {
$query = New-Object rsaapi.UnlinkTokensFromPrincipalsCommand
$query.tokenGuids = $token.id
try {
$result = $CommandServer.executeCommand($loginCommand.sessionId, $query)
} catch {
Write-host "Impossible de libérer le token" $Token.serialNumber "associé à '" $token.assignedUserId "' :" $Error[0].Exception.Message -ForegroundColor Red
throw $Error[0]
}
}
Add-Type -TypeDefinition @"
public enum EA_mode
{
DISABLE_EA_ON_AUTH=1,
DISABLE_EA_ON_EXPIRE=2,
DISABLE_EA_NEVER=3
}
"@
function rsa_emergency_code (
[Parameter(Mandatory=$True)][rsaapi.TokenDTO]$token,
[Parameter(Mandatory=$True)][EA_mode]$mode,
[Parameter(Mandatory=$True)][DateTime]$expiration
) {
# Générer un code
$query = New-Object rsaapi.GenerateEmergencyAccessCodeCommand
$query.tokenGuid = $token.id
try {
$result = $CommandServer.executeCommand($loginCommand.sessionId, $query)
} catch {
Write-host "Impossible de générer un code d'accès pour le token" $token.serialNumber ":" $Error[0].Exception.Message -ForegroundColor Red
throw $Error[0]
}
$code = $result.emergencyAccessCode # the try clause has never wroked so I'm not sure this is the correct property name
# Récupérer l'emergency access du token
$query = New-Object rsaapi.LookupTokenEmergencyAccessCommand
$query.Guid = $token.id
try {
$result = $CommandServer.executeCommand($loginCommand.sessionId, $query)
} catch {
Write-host "Impossible de trouver l'accès d'urgence du token" $token.serialNumber ":" $Error[0].Exception.Message -ForegroundColor Red
throw $Error[0]
}
$tokenEA = $result.tokenEmergencyAccess # the try clause has never wroked so I'm not sure this is the correct property name
# Envoyer le code générer pour l'emergency access du token
$tokenEA.tokenLost = $true
$tokenEA.lostMode = [int]$mode
$tokenEA.eaMode = 1 # Fixed token code
$tokenEA.eaExpiration = Get-Date $a -Format 'MM/dd/yyyy'
$tokenEA.temporaryFixedTokencode = $code
$query = New-Object rsaapi.UpdateTokenEmergencyAccessCommand
$query.tokenEmergencyAccessDTO = $tokenEA
try {
$result = $CommandServer.executeCommand($loginCommand.sessionId, $query)
} catch {
Write-host "Impossible de pousser le code" $code "pour le token" $token.serialNumber ":" $Error[0].Exception.Message -ForegroundColor Red
throw $Error[0]
}
}
Then, you can run in a powerhsell console :
$Token_number = '12345678' # of an attributed token, of course
$days = 7 # days to enable EA code, starting today
$admin_login = $env:USERNAME # or login of the adminitrator connectong to the AM
$admin_password = read-host -AsSecureString # password of this token administrator
$ErrorActionPreference = "Stop"
#Chargement modules
Write-Host "Chargement console RSA" -ForegroundColor Cyan
. connect_rsaapi.ps1
rsa_set_globals -admin_login $admin_login -admin_password $admin_password
$token = rsa_get_token -serialNumber $Token_number
rsa_emergency_code -token $token -mode DISABLE_EA_ON_AUTH -expiration (Get-Date).AddDays($jours)
