Delinea integration - use current credentials

[StephanGa]

We are using the integration to Delinea. Is there a possibility to use "-usedefaultcredentials" instead of saving the creds to a RoyalTS file? This would be a great enhancement.
We tried our luck but failed.

[eiabea]

Thank you for reaching out. Could you please provide what you tried so get a starting point?

[StephanGa]

Well, to be honest, we just got the code inside of MS Copilot and asked to rewrite it with "usedefaultcreds".
We exchanged all commands that were related to "tokens".

What we want to achieve:
Share a file with all devices and a dynamic folder.
The dynamic folder authenticates with the current (admin) creds against Delinea
All passwords can be linked to the entries

At the moment each engineer is using a file of his own with the dynamic folder and we use "specify cred name" to make sharing possible.

[eiabea]

I checked the sample script "Thycotic Secret Server (PowerShell).rdfx" and it uses the $EffectiveUsername$ and $EffectivePassword$ magic values to login at the Delinea Secret Server.

These magic variables are getting replaced with the values configured in the dynamic folder. It is possible to use "Credentials from the parent folder" (Dynamic Folder Settings - Common - Credentials - Use credentials from parent folder).

I hope I understood your usecase correctly, but creating a parent folder for each engineer with their credentials and then importing the Dynamic Folder with the sample "Thycotic Secret Server (PowerShell).rdfx" script and setting this Dynamic Folder to use the credentials from the parent folder (where the engineer set the private credentials)

Please let me know if this did the trick!

[StephanGa]

But then all engineers' passwords would be saved in one file. Using the current credential would solve this problem.
Thats why each engineer is using an own file at the moment.

[eiabea]

I try to set the stage how I understood the problem:

Assumption

• Delinea Server holds all the conntections + credentials
  • Server1:
    • User: serv1User
    • Password: serv1Password
    • Host: server1.example.com
  • Server2:
    • User: serv2User
    • Password: serv2Password
    • Host: server2.example.com
  • ...
• Each engineer has his/her own credentials to log in to the Delinea Server

Proposed solution

• Create parent folder with engineer's credentlias
• Add Dynamic Folder into the folder from above
• Set "Use credentials from parent folder" in the dynamic folder

engineer1 # <- Holds credential of engineer
├─ Dynamic Folder (Delinea) # <- Loads all the items from Delinea with the credentials of engineer1

[StephanGa]

@eiabea
In your proposed solution the passwords of each engineer would be saved in the RoyalTS file which would be a violation of our policies.
Because each engineer would have the possibility to view the passwords of the other engineers.

[eiabea]

I was thinking in a complete different direction, please excuse.

If I'm on the correct path now, you are trying to use the -UseDefaultCredentials parameter of the Invoke-Webrequest in order to login to the Delinea Server with the current logged in Windows user?

I looked into it and came up with this proof of concept for the Get-Entries function of the script. Please note, that this changes are untested due to the fact that I don't have access to a Delinea Server instance

(original on the left, updated script on the right)

    $api = "$url/api/v1"				      |	    # The "winauthwebservices" part can be hardcoded here, or
    $tokenRoute = "$url/oauth2/token";			      |	    $api = "$url/winauthwebservices/api/v1"

    $tokenParams = @{					      |	    # The whole "Getting the Bearer Token part" can be omitte
        grant_type = "password";			      <
        username = $username;				      <
        password = $password;				      <
    }							      <
							      <
    $headers = $null					      <
							      <
    If ($requiresMFA) {					      <
        $headers = @{					      <
            "OTP" = Show-Prompt -prompt "Enter your OTP for M <
        }						      <
    }							      <
							      <
    $tokenJSON = Invoke-WebRequest -SkipCertificateCheck -Uri <
    $token = (ConvertFrom-Json $tokenJSON.Content).access_tok <
							      <
    $headers = @{					      <
        "Authorization" = "Bearer $token"		      <
    }							      <

    $foldersRequestBody = @{					    $foldersRequestBody = @{
        "paging.take" = 1000;					        "paging.take" = 1000;
    }								    }

    $foldersJSON = Invoke-WebRequest -SkipCertificateCheck -U |	    $foldersJSON = Invoke-WebRequest -UseDefaultCredentials -
    $folders = (ConvertFrom-Json $foldersJSON.Content)		    $folders = (ConvertFrom-Json $foldersJSON.Content)

I hope I finally understood your request correctly, please let me know if this is helping you out :)

[StephanGa]

Yes you perfectly understood!
I was short on work time :)

I tried it but i am getting an error because of invalid credentials. "You do not have access to this directory".
I configured this: https://docs.delinea.com/online-help/secret-server/authentication/iwa-webservices/webservice-iwa-powershell/index.htm
But .. after i configured it - no one could access Delinea anymore. So i have to dig a bit deeper and set it up in a Lab to test it.

[StephanGa]

I have rebuilt in the installation in SureBackup and configured it like the documents said.
I am getting 404s although i configured it in IIS to allow Windows Auth for this specific folder

Even this is not working
https://docs.delinea.com/online-help/secret-server/authentication/iwa-webservices/webservice-iwa-powershell/index.htm#:~:text=REST%20web%20service%20references%20the%20same