AnsweredAssumed Answered

RSA Console tasks with Powershell

Question asked by R1BAFz6UN2sKqYJB9dDguc8PVGHv5xcB8kuEENvKWHQ= on Nov 2, 2016
Latest reply on Jan 30, 2020 by Miroslaw Czaplinski

Like • Show 0 Likes0
Comment • 9

Hello,

I am new on this forum and I have a question. We use in the Netherlands RSA Security tokens for our customers. They can choose for a Hardware or Software token. The most of them are using software tokens. We have many calls that the token is locked out and every day we must unlock the token from the RSA Security Console. I will use Powershell for this basic administrative tasks.

My question: is it possible to use Powershell to access the RSA Console to unlock tokens? I want to use Powershell because I will make a script that list a view user information about a particular user, like:

- what kind of token is used (software or hardware)

- is the token locked or unlocked

- and other information from Active Directory like: is the account locked, password expires and so on ...

From the script I will control basic tasks like I sad above

To list information with Powershell from Active Directory is not the issue, but to access RSA Console is for my the problem, so... Please help

3 people also have this question

Outcomes

9 Replies

Erica Chalfin Feb 22, 2017 12:02 PM
Mark Correct
Correct Answer
Khalid Othman,

My apologies for taking so long to reply to your question. I've moved it from the RSA Access Manager space to the RSA SecurID Suite since it is about performing Authentication Manager tasks through PowerShell.

Please let me know if you still have questions on this that we can help you answer.

Regards,
Erica
Like • Show 0 Likes0
Actions
Matthew Bond Mar 29, 2017 5:35 PM
Mark Correct
Correct Answer
You can do this. RSA Authentication Manager has a web-services interface documented in the Administration SDK and Powershell is able to use this interface through the New-WebServiceProxy.
1 person found this helpful
Like • Show 1 Like1
Actions
- Ray Gaudreau @ Matthew Bond on Apr 7, 2017 11:29 AM
  Mark Correct
  Correct Answer
  I'm looking into tackling this as well. Does anybody have any starter code they can share for using PowerShell to do some basic administrative tasks?
  Like • Show 0 Likes0
  Actions
  - Erica Chalfin @ Ray Gaudreau on Apr 7, 2017 12:53 PM
    Mark Correct
    Correct Answer
    Ray Gaudreau,
    
    Please download the RSA Authentication Manager SDK that is part of the am-extras-8.2.0.0.0.zip, using the instructions in the article entitled 000034558 - How to download RSA Authentication Manager 8.x full kits from RSA Link. Inside the zip file is the webservices directory to which Matthew Bond was referring.
    
    Regards,
    Erica
    Like • Show 0 Likes0
    Actions
  - Matthew Bond @ Ray Gaudreau on Apr 9, 2017 7:53 PM
    Mark Correct
    Correct Answer
    It is important to be familiar with the methodology of the RSA Authentication Manager API and although you do not need any libraries from the SDK it contains documentation and examples and although is Java centric does have a few .NET and Web-Services demonstrations which are closer to PowerShell usage than anything else. All of the reference material describing available commands is in Javadoc format but is applicable to any language.
    Here is a working example that I manually typed into PowerShell ISE. The only thing you do not see here is that I have already installed my RSA Authentication Manager root certificate in my local store. For delivery to my customers here in Australia I have been building PowerShell modules to encapsulate most of the core functionality including loading the certificate (see the bottom of this article for a demonstration) - however here is a raw example which will does the following:-
    Dynamically query the RSA Authentication Manager for its WSDL and generate a web-services proxy
    Create an API connector
    Perform an administrator logon (this could actually be a SecurID passcode but I have kept it simple)
    Do a simple API command of querying configured realms (on version 8 you actually only ever have one)
    # Dynamically query the RSA Authentication Manager for its WSDL
    $secpass=ConvertTo-SecureString "stMvEU4ulePJ9Vah9rrqr7W5hZgTBH" -AsPlainText -Force
    $cred=New-Object System.Management.Automation.PSCredential("CmdClient_h3wyuftq",$secpass)
    $securIDWebWervice=New-WebServiceProxy -Uri https://pearl.hawaii.local:7002/ims-ws/services/CommandServer?wsdl -Namespace mjb -Credential $cred
    
    # Generate a web-services proxy command service
    $CommandServer = New-Object mjb.CommandServerService
    $CommandServer.Credentials=$cred
    $CommandServer.Url="https://pearl.hawaii.local:7002/ims-ws/services/CommandServer"
    
    # Create a username Data Transfer Object
    $userNameParam=New-Object mjb.FieldParameterDTO
    $userNameParam.promptKey="AUTHENTICATIONSERVICE_PRINCIPALID"
    $userNameParam.value="scadmin"
    
    # Create a password Data Transfer Object
    $userPasswordParam=New-Object mjb.FieldParameterDTO
    $userPasswordParam.promptKey = "PASSWORD_CREDENTIAL"
    $userPasswordParam.value="Qwerty001."
    
    # Create an array of the authenticaton DTOs
    [mjb.AbstractParameterDTO[]]$paramsArray=@($userNameParam,$userPasswordParam)
    
    # Perform an administrator logon
    $loginCommand = New-Object mjb.LoginCommand
    $loginCommand.authenticationMethodId="RSA_Password"
    $loginCommand.parameters=$paramsArray
    $loginCommand=$CommandServer.executeCommand([System.Management.Automation.Language.NullString]::Value,$loginCommand)
    
    # Do a simple API command of querying configured realms
    $searchRealms=New-Object mjb.SearchRealmsCommand
    $searchRealms=$CommandServer.executeCommand($loginCommand.sessionId,$searchRealms)
    $searchRealms.realms[0].topLevelSecurityDomain.name
    
    If I put this into a PowerShell script file and run it then my result is:
    PS C:\users\Matthew> C:\Users\Matthew\MJBExample1.ps1
    SystemDomain
    PS C:\users\Matthew>
    As an example of what you can achieve, here is an example of what it can look like encapsulated within a module (or two)
    PS C:\users\Matthew> Import-Module .\AuthenticationManager.psm1
    PS C:\users\Matthew> Import-Module .\Reports.psm1
    PS C:\users\Matthew> $pearlServer = Get-SDTICommandServer -remoteServer pearl.hawaii.local -remotePort 7002 -httpuser CmdClient_h3wyuftq -httppass stMvEU4ulePJ9Vah9rrqr7W5hZgTBH -AuthMgrRootCertFile .\pearl-ca.crt
    PS C:\users\Matthew> $sess = Get-SDTISessionID -CommandServer $pearlServer -Username scadmin -Password Qwerty001.
    PS C:\users\Matthew> Get-ReportList -CommandServer $pearlServer -AdminSession $sess
    Registered users_admin_040717_1506PM_AEST
    Registered users_admin_040717_1454PM_AEST
    Registered users_admin_040717_1506PM_AEST
    PS C:\users\Matthew> Send-Report -CommandServer $pearlServer -AdminSession $sess -ReportName "Registered users_admin_040717_1506PM_AEST" -Recipient mjbond@tpg.com.au –Format HTML
    PS C:\users\Matthew>
    1 person found this helpful
    Like • Show 1 Like1
    Actions
    - Ray Gaudreau @ Matthew Bond on Apr 10, 2017 11:22 AM
      Mark Correct
      Correct Answer
      Thank you so much for sharing your code. Are you able to share any of your modules? Also, from the documentation I was looking through it seemed you needed to use the Command API Client User ID / Password to interact with the API, but your comment made it sound like this isn't the only option. Is it possible to use an AD user / passcode combo?
      Again, thank you for sharing what you have already. That in itself is very helpful.
      Like • Show 0 Likes0
      Actions
    - Miroslaw Czaplinski @ Matthew Bond on Feb 3, 2020 8:52 AM
      Mark Correct
      Correct Answer
      Indeed, thank you very much for sharing the code.
      
      I managed to successfully connect to our RSA environment and issue simple API commands, but unfortunately I got stuck on trying to issue more advanced commands that use filters (eg. SearchPrincipalsCommand - search for a particular userid). The C# code example available in the documentation looks simple enough, but I struggle to port it to use WSDL instead.
      
      private PrincipalDTO lookupUser(String userId)
      {
         SearchPrincipalsCommand cmd = new SearchPrincipalsCommand(); // create a filter with the login UID equal condition
         cmd.filter = (Filter.equal(PrincipalDTO.LOGINUID, userId));
         cmd.systemFilter = (Filter.empty());
         cmd.limit = (1);
         cmd.identitySourceGuid = (idSource.guid);
         cmd.securityDomainGuid = (domain.guid);
         cmd.groupGuid = (null);
         cmd.onlyRegistered = (true);
         cmd.searchSubDomains = (true);
         cmd.execute();      // we asked for 1 and we got here without exception
      
         return cmd.principals[0];
      }
      Could you please point me in the right direction - I have no idea how to specify such a filter to be provided to the WSDL connector.
      
      *EDIT*
      After browsing the documentation thoroughly, I found the answer. In order to use filters via the WSDL API, the filter has to be built using Simple objects, that store the actual filter syntax. Example below:
      
      $simple = New-Object mjb.Simple
      $simple.type= New-Object mjb.Equal
      $simple.core="True"
      $simple.value="my_email_address@domain.com"
      $simple.attr="email"
      
      $filter = New-Object mjb.Filter
      $filter.comp=$simple
      
      The human-friendly version of that filter would be "Filter results for those which have the email == my_email_address@domain.com"
      
      Best regards,
      Miroslaw
      Like • Show 0 Likes0
      Actions
- Erica Chalfin @ Matthew Bond on Apr 7, 2017 12:27 PM
  Mark Correct
  Correct Answer
  Matthew Bond,
  
  Thanks for jumping in to help out!
  
  Regards,
  Erica
  Like • Show 0 Likes0
  Actions
Cedric Salson Nov 27, 2017 5:49 AM
Mark Correct
Correct Answer
Interesting powershell example.
But I have an issue, I have tested it and I have an error when I perform the administrator logon

$loginCommand=$CommandServer.executeCommand([System.Management.Automation.Language.NullString]::Value,$loginCommand)

I receive this error message:
Exception calling "executeCommand" with "2" argument(s): "com.rsa.common.SystemException: Unexpected exception from SOA
P call: java.lang.IllegalArgumentException: getCacheEntry called with an empty or null key
    Caused by: java.lang.IllegalArgumentException: getCacheEntry called with an empty or null key"
At line:1 char:44
+ $loginCommand=$CommandServer.executeCommand <<<< ([System.Management.Automation.Language.NullString]::Value,$loginCom
mand)
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DotNetMethodException

Does someone can help me to debug?
Like • Show 0 Likes0
Actions

RSA Console tasks with Powershell

Outcomes

Related Content

Recommended Content