2017-09-21 13:32:15 +02:00
|
|
|
function Set-CredentialStoreItem {
|
|
|
|
<#
|
|
|
|
.SYNOPSIS
|
|
|
|
Changes the credentials for the given remote host in the store.
|
|
|
|
|
|
|
|
.DESCRIPTION
|
2019-04-29 16:05:43 +02:00
|
|
|
Use this function to update your already stored RemoteHost items.
|
2017-09-21 13:32:15 +02:00
|
|
|
|
|
|
|
.PARAMETER Path
|
|
|
|
Define the store in which your given host entry already exists.
|
|
|
|
|
|
|
|
.PARAMETER RemoteHost
|
|
|
|
Specify the host you for which you would like to change the credentials.
|
|
|
|
|
|
|
|
.PARAMETER Identifier
|
2022-10-10 10:05:08 +02:00
|
|
|
Defaults to ''. Specify a string, which separates two CredentialStoreItems for the
|
2017-09-21 13:32:15 +02:00
|
|
|
same hostname.
|
|
|
|
|
|
|
|
.PARAMETER Shared
|
|
|
|
Switch to shared mode with this param. This enforces the command to work with a shared CredentialStore which
|
|
|
|
can be decrypted across systems.
|
|
|
|
|
2019-04-29 16:05:43 +02:00
|
|
|
.PARAMETER Credential
|
|
|
|
Provided the new credentials you want to update inside the RemoteHost item.
|
|
|
|
|
2017-09-21 13:32:15 +02:00
|
|
|
.INPUTS
|
|
|
|
[None]
|
|
|
|
|
|
|
|
.OUTPUTS
|
|
|
|
[None]
|
|
|
|
|
|
|
|
.EXAMPLE
|
2022-10-10 10:05:08 +02:00
|
|
|
Set-CredentialStoreItem -Path 'C:\TMP\mystore.json' -RemoteHost 'esx01.myside.local'
|
2019-04-29 16:05:43 +02:00
|
|
|
|
|
|
|
.EXAMPLE
|
2022-10-10 10:05:08 +02:00
|
|
|
Set-CredentialStoreItem -Path 'C:\TMP\mystore.json' -RemoteHost 'esx01.myside.local' -Identifier svc
|
2017-09-21 13:32:15 +02:00
|
|
|
#>
|
|
|
|
|
2022-06-28 08:56:33 +02:00
|
|
|
[CmdletBinding(DefaultParameterSetName = 'Private')]
|
2022-07-15 10:59:56 +02:00
|
|
|
[Diagnostics.CodeAnalysis.SuppressMessageAttribute(
|
|
|
|
'PSUseShouldProcessForStateChangingFunctions',
|
|
|
|
'',
|
|
|
|
Justification = 'Updates existing credential object.'
|
|
|
|
)]
|
2022-06-28 08:56:33 +02:00
|
|
|
param (
|
|
|
|
[Parameter(Mandatory = $true, ParameterSetName = 'Private')]
|
|
|
|
[Parameter(Mandatory = $true, ParameterSetName = 'Shared')]
|
2017-09-21 13:32:15 +02:00
|
|
|
[string]$RemoteHost,
|
|
|
|
|
2022-06-28 08:56:33 +02:00
|
|
|
[Parameter(Mandatory = $false, ParameterSetName = 'Private')]
|
|
|
|
[Parameter(Mandatory = $false, ParameterSetName = 'Shared')]
|
2017-09-21 13:32:15 +02:00
|
|
|
[string]$Identifier,
|
|
|
|
|
2018-03-21 14:32:32 +01:00
|
|
|
[Parameter(Mandatory = $false, ValueFromPipeline = $true)]
|
|
|
|
[ValidateNotNullOrEmpty()]
|
|
|
|
[PSCredential]$Credential,
|
|
|
|
|
2022-06-28 08:56:33 +02:00
|
|
|
[Parameter(Mandatory = $true, ParameterSetName = 'Shared')]
|
2019-01-16 12:55:29 +01:00
|
|
|
[switch]$Shared,
|
|
|
|
|
2022-06-28 08:56:33 +02:00
|
|
|
[Parameter(Mandatory = $false, ParameterSetName = 'Shared')]
|
2019-01-16 12:55:29 +01:00
|
|
|
[ValidateNotNullOrEmpty()]
|
|
|
|
[string]$Path
|
2017-09-21 13:32:15 +02:00
|
|
|
)
|
|
|
|
|
2019-01-16 12:55:29 +01:00
|
|
|
begin {
|
|
|
|
# Set the CredentialStore for private, shared or custom mode.
|
2022-10-10 10:05:08 +02:00
|
|
|
Write-Debug ('ParameterSetName: {0}' -f $PSCmdlet.ParameterSetName)
|
2022-06-28 08:56:33 +02:00
|
|
|
if ($PSCmdlet.ParameterSetName -eq 'Private') {
|
2019-01-16 12:55:29 +01:00
|
|
|
$Path = Get-DefaultCredentialStorePath
|
|
|
|
}
|
2022-06-28 08:56:33 +02:00
|
|
|
elseif ($PSCmdlet.ParameterSetName -eq 'Shared') {
|
2019-01-16 12:55:29 +01:00
|
|
|
if (!($PSBoundParameters.ContainsKey('Path'))) {
|
|
|
|
$Path = Get-DefaultCredentialStorePath -Shared
|
|
|
|
}
|
2017-09-21 13:32:15 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-01-16 12:55:29 +01:00
|
|
|
process {
|
2022-10-10 10:05:08 +02:00
|
|
|
# Define the default splatting.
|
|
|
|
$DefaultSplatting = @{
|
|
|
|
Path = $Path
|
|
|
|
}
|
|
|
|
|
|
|
|
# Check if the user passed -Shared. If he added -Shared, we'll pass it into the splatting
|
|
|
|
if ($PSBoundParameters.ContainsKey('Shared')) {
|
|
|
|
$DefaultSplatting.Add('Shared', $true)
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
$DefaultSplatting.Add('Shared', $false)
|
|
|
|
}
|
|
|
|
|
|
|
|
# Now lets check the given CredentialStore.
|
|
|
|
if (-not(Test-CredentialStore @DefaultSplatting)) {
|
2019-01-16 12:55:29 +01:00
|
|
|
$MessageParams = @{
|
2022-10-10 10:05:08 +02:00
|
|
|
Message = ('The given CredentialStore ({0}) does no exist.' -f $Path)
|
2022-06-28 08:56:33 +02:00
|
|
|
ErrorAction = 'Stop'
|
2019-01-16 12:55:29 +01:00
|
|
|
}
|
|
|
|
Write-Error @MessageParams
|
|
|
|
}
|
2017-09-21 13:32:15 +02:00
|
|
|
|
2019-01-16 12:55:29 +01:00
|
|
|
# Read the file content based on the given ParameterSetName
|
2022-10-10 10:05:08 +02:00
|
|
|
$CSContent = Get-CredentialStore @DefaultSplatting
|
2017-09-21 13:32:15 +02:00
|
|
|
|
2022-10-10 10:05:08 +02:00
|
|
|
# Get a formatted current date for the last update time of the Item.
|
2022-06-28 08:56:33 +02:00
|
|
|
$CurrentDate = Get-Date -Format 'u'
|
2017-09-21 13:32:15 +02:00
|
|
|
|
2022-10-10 10:05:08 +02:00
|
|
|
# Check if the user supplied an identifier. If so, we need to mangle the CredentialName, as that's where
|
|
|
|
# the identifier is actually added.
|
|
|
|
if ($Identifier -ne '') {
|
|
|
|
$CredentialName = $RemoteHost = '{0}/{1}' -f $Identifier, $RemoteHost
|
2017-09-21 13:32:15 +02:00
|
|
|
}
|
|
|
|
else {
|
2019-01-16 12:55:29 +01:00
|
|
|
$CredentialName = $RemoteHost
|
2017-09-21 13:32:15 +02:00
|
|
|
}
|
2019-01-16 12:55:29 +01:00
|
|
|
|
2022-10-10 10:05:08 +02:00
|
|
|
# If the user didn't supply a CredentialObject, we need to prompt for it.
|
2019-01-16 12:55:29 +01:00
|
|
|
if (-not($Credential)) {
|
|
|
|
$Credential = Get-Credential -Message $CredentialName
|
2017-09-21 13:32:15 +02:00
|
|
|
}
|
2019-01-16 12:55:29 +01:00
|
|
|
|
2022-10-10 10:05:08 +02:00
|
|
|
# If the username isn't empty, we ca go ahead and update the entry.
|
|
|
|
if ($null -ne $Credential.UserName -and -not [string]::IsNullOrWhiteSpace($Credential.UserName)) {
|
|
|
|
# Check if the path to the PfxCertificate is stored in the CredentialStore. If so load the certificate.
|
|
|
|
# If not, load try loading the certificate from the Filepath of the CredentialStore.
|
2019-04-29 16:05:43 +02:00
|
|
|
if ($null -eq $CSContent.PfxCertificate) {
|
|
|
|
$Cert = Get-CSCertificate -Type $CSContent.Type -Thumbprint $CSContent.Thumbprint
|
2019-01-16 12:55:29 +01:00
|
|
|
}
|
2019-04-29 16:05:43 +02:00
|
|
|
else {
|
|
|
|
$Cert = Get-PfxCertificate -FilePath $CSContent.PfxCertificate -ErrorAction Stop
|
2019-01-16 12:55:29 +01:00
|
|
|
}
|
|
|
|
|
2022-10-10 10:05:08 +02:00
|
|
|
# Now locate the Item.
|
2022-07-15 10:59:56 +02:00
|
|
|
if (Get-Member -InputObject $CSContent -Name $CredentialName -MemberType Properties) {
|
2022-10-10 10:05:08 +02:00
|
|
|
# Get a random AES key for the entry.
|
2019-01-16 12:55:29 +01:00
|
|
|
$RSAKey = Get-RandomAESKey
|
|
|
|
$CSContent.$CredentialName.User = $Credential.UserName
|
2022-07-15 10:59:56 +02:00
|
|
|
$ConvertParams = @{
|
|
|
|
SecureString = $Credential.Password
|
|
|
|
Key = $RSAKey
|
|
|
|
}
|
2022-10-10 10:05:08 +02:00
|
|
|
|
|
|
|
# Now create a updated item containing the updated credentials.
|
2022-07-15 10:59:56 +02:00
|
|
|
$CSContent.$CredentialName.Password = ConvertFrom-SecureString @ConvertParams
|
2019-01-16 12:55:29 +01:00
|
|
|
$CSContent.$CredentialName.LastChange = $CurrentDate
|
|
|
|
$CSContent.$CredentialName.EncryptedKey = [Convert]::ToBase64String(
|
|
|
|
$Cert.PublicKey.Key.Encrypt(
|
|
|
|
$RSAKey,
|
|
|
|
[System.Security.Cryptography.RSAEncryptionPadding]::Pkcs1
|
|
|
|
)
|
|
|
|
)
|
2022-10-10 10:05:08 +02:00
|
|
|
|
|
|
|
# Convert the CredentialStore back into JSON and save it to the file.
|
2019-01-16 12:55:29 +01:00
|
|
|
ConvertTo-Json -InputObject $CSContent -Depth 5 | Out-File -FilePath $Path -Encoding utf8
|
|
|
|
}
|
2022-10-10 10:05:08 +02:00
|
|
|
else {
|
|
|
|
Write-Warning -Message ('Unable to locate CredentialStoreItem for {0}' -f $CredentialName)
|
|
|
|
}
|
2019-01-16 12:55:29 +01:00
|
|
|
}
|
2022-10-10 10:05:08 +02:00
|
|
|
else {
|
2017-09-21 13:32:15 +02:00
|
|
|
$MessageParams = @{
|
2022-06-28 08:56:33 +02:00
|
|
|
Message = 'Please Provide at least a valid user!'
|
|
|
|
ErrorAction = 'Stop'
|
2017-09-21 13:32:15 +02:00
|
|
|
}
|
2019-01-16 12:55:29 +01:00
|
|
|
Write-Error @MessageParams
|
2017-09-21 13:32:15 +02:00
|
|
|
}
|
|
|
|
}
|
2019-01-16 12:55:29 +01:00
|
|
|
|
|
|
|
end {
|
|
|
|
|
2017-09-21 13:32:15 +02:00
|
|
|
}
|
|
|
|
}
|