Hello @MattB.
Below is how we are able to use a REST connector and configure IIS to use basic authentication to secure the setup and restrict any user from being able to run PS scripts directly on the Windows server...
1) Change IIS authentication configurations from anonymous/passthrough to basic authentication
2) Configure a REST connector instead of a Win-PS connector to achieve the use-case
3) In the connection JSON of the REST connector, we need to provide 2 sets of credentials
3a) Credentials of IIS(Windows box) application: Using these creds, the REST connector will generate a token and use the token to authenticate against IIS(Windows box). Please refer to the 'properties' attribute within the sample connection JSON below. The token generated using these credentials is sore in the 'accessToken' variable which is then referenced in the createAccountJSON as "${access_token}".
3b) Credentials of target application: This is to avoid passing the credentials of the target application such as exchange mailbox etc. in plain text within the PS scrips within the create/update account JSON attributes of the REST connector. Instead, we are able to define these parameters within the connection JSON, securely store them, and reference them in the JSONs such as create/update account JSON. Please refer to 'pass' attribute within the connection JSON which is later referenced as '${connection.pass}' in the createAccountJSON. Similarly, you can define the username of the target application as well...
Below is a sample of the connection as well as createAccountJSON...
Connection JSON
{
"authentications": {
"acctAuth": {
"authType": "Basic",
"url": "",
"properties": {
"userName": "UserName",
"password": "XXXXXXXX"
},
"pass": "TargetAppPssword",
"authError": [
"InvalidAuthenticationToken",
"AuthenticationFailed"
],
"errorPath": "error",
"maxRefreshTryCount": 5,
"testConnectionParams": {
"http": {
"url": "https://XXXXXXXXXXXX:8088/FIMDemo/PS/ExecutePSScript",
"httpContentType": "application/json",
"httpMethod": "POST",
"httpParams": "{\"script\":\"Test-NetConnection localhost\"}",
"httpHeaders": {
"Authorization": "${access_token}"
}
},
"successResponses": {
"response[0].PingSucceeded": [
"True"
]
}
},
"accessToken": "Basic XXXXXXXXXXXX"
}
}
}
Create Account JSON
{
"accountIdPath": "accountName",
"responseColsToPropsMap": {},
"call": [
{
"name": "call1",
"connection": "acctAuth",
"url": "https://XXXXXXXXXXXX:8088/FIMDemo/PS/ExecutePSScript",
"httpMethod": "POST",
"httpParams": "{\"Script\":\"\\$pw = convertto-securestring '${connection.pass}' -asplaintext -force;\\$mycred = new-object -typename System.Management.Automation.PSCredential -argumentlist '<Target_App_Username>',\\$pw;Invoke-Command -ComputerName 'localhost' -Credential \\$mycred -ScriptBlock {C:/Scripts/CreateADUser.ps1 '${user.username}' '${user.firstname}' '${user.lastname}'}\"}",
"httpHeaders": {
"Authorization": "${access_token}"
},
"httpContentType": "application/x-www-form-urlencoded",
"successResponses": {
"response[0].Enabled": [
"True"
]
}
}
]
}
Note: As for achieving the same via Win-PS connection, we are working on an improvement and the same can be tracked via the idea: EIC-I-4499.
Please let me know if you have any additional questions.
