Cannot use Set-SecretStoreConfiguration from a Script #46

Activity

1. Entech-Ramon commented on Jan 28, 2021

   

   Entech-Ramon

   on Jan 28, 2021

   More actions

   Same issue for me. I'm trying to use it in a container to store a ephemeral copy of secrets and can't configure anything.

   Set-SecretStoreConfiguration: /data/startup.ps1:8
   Line |
   8 | … try {Set-SecretStoreConfiguration -Authentication None -Intera …
   | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   | A command that prompts the user failed because the host program or the command type does not support user interaction. Try a host program that supports user interaction, such as the PowerShell Console, and remove prompt-related commands from command types that do not support user interaction.
2. Paul Higinbotham (PaulHigin)

   added

   enhancementNew feature or requestNew feature or request

   on Mar 8, 2021
3. PaulHigin commented on Mar 8, 2021

   

   Paul Higinbotham (PaulHigin)

   on Mar 8, 2021

   Contributor

   More actions

   I agree that it makes sense to have non-interactive parameter set.

   👍React with 👍1Reacted by Nate Scherer
4. Sydney Smith (SydneyhSmith)

   added this to the 1.0 - GA milestone on Mar 8, 2021
5. JustinGrote commented on Mar 9, 2021

   

   Justin Grote (JustinGrote)

   on Mar 9, 2021

   Last edited by JustinGrote

   More actions

   Just remember to include guidance to store the password somewhere safe, since it is a noninteractive scenario. Storing the password in plaintext in a script just to unlock the secretstore kinda defeats the whole purpose :)

   I will not be adding this support to KeePass for example, justification here: JustinGrote/SecretManagement.KeePass#35 (comment)

   👍React with 👍1Reacted by Paul Higinbotham
6. PaulHigin commented on Mar 15, 2021

   

   Paul Higinbotham (PaulHigin)

   on Mar 15, 2021

   Contributor

   More actions

   Ok, I have added a -Password parameter to the Set-SecretStoreConfiguration cmdlet for the RC3 release.
   https://www.powershellgallery.com/packages/Microsoft.PowerShell.SecretStore/0.9.2

   Note that also the -Force parameter was removed, since best practice is now to use Confirm:$false to prevent PowerShell from prompting for confirmation.

   The -Password parameter will be used when changing the SecretStore Authentication configuration.
   When switching from Password to None configuration, the -Password argument is the current password needed to authorize the configuration authentication change.
   When switching from None to Password configuration , the -Password argument is the new password for the SecretStore to use.

   Note that you cannot change/update the SecretStore password using the Set-SecretStoreConfiguration cmdlet. For that you need to use the Set-SecretStorePassword cmdlet.

   For automation I believe the script will create the initial SecretStore configuration on the image, and would be something like:

   Install-Module -Name Microsoft.PowerShell.SecretManagement -Repository PSGallery -Force
   
   Install-Module -Name Microsoft.PowerShell.SecretStore -Repository PSGallery -Force
   # Get password to use securely.  This uses Windows (only) CredMan to retrieve the secretstore password encrypted on file.
   $password = Import-CliXml -Path $secretStorePasswordPath
   # This configures the SecretStore to use a password and never prompt, without prompting the user for confirmation.
   Set-SecretStoreConfiguration -Authentication Password -PasswordTimeout 3600 -Interaction None -Password $password -Confirm:$false
   
   Register-SecretVault -Name SecretStore -ModuleName Microsoft.PowerShell.SecretStore -DefaultVault
   Unlock-SecretStore -Password $password
   ...

   Nate Scherer (@natescherer), Entech-Ramon Can you take a look and provide feedback?
7. OneUser1 commented on Mar 17, 2021

   

   OneUser1

   on Mar 17, 2021

   More actions

   I tried your steps above, Paul Higinbotham (@PaulHigin). Thanks for the update! For me the changes work fine in case I have a SecretStore which is already in use.

   How should I non-interactively set a password for a SecretStore on a client on which I just have installed SecretManagement and SecretStore modules for the first time? It seems like the default configuration expects a password I have never set. How should I do this? I do the following:

   • Install Microsoft.PowerShell.SecretManagement + Microsoft.PowerShell.SecretStore modules
   • Set-SecretStorePassword requires an "old" password
   • Problem: I have never added a password
     • Get-SecretStoreConfiguration returns a prompt to enter a password saying "Creating a new Microsoft.PowerShell.SecretStore vault. A password is required by the current store configuration."
     • Set-SecretStoreConfiguration -Authentication Password -PasswordTimeout 300 -Interaction (Prompt | None) -Password $(Read-Host -Prompt "Enter pwd" -AsSecureString) returns an error "The Microsoft.PowerShell.SecretStore is already configured to require a password, and a new password cannot be added."
     • Unlock-SecretStore also requires a password because set in SecretStore config
     • Seems like the only option is to use Reset-SecretStore using the -Password parameter
   • What I can do is: Set-SecretStoreConfiguration -Authentication None -Interaction (Prompt | None) -Password $(Read-Host -Prompt "Enter pwd" -AsSecureString) which seems to accept ANY value (though I never set a password before, it accepted what I typed). After that I can use the just implemented Set-SecretStoreConfiguration -Authentication Password -Password myPass to set a password for the first time (of course, I would automate setting a password and not using Read-Host).

   Am I missing something? Is there a way to set the password of the very first SecretStore config? Any help is appreciated.

   👍React with 👍4Reacted by robinmalik, fatherofinvention, wisemoth and Nicholas Morris
8. PaulHigin commented on Mar 17, 2021

   

   Paul Higinbotham (PaulHigin)

   on Mar 17, 2021

   Last edited by PaulHigin

   Contributor

   More actions

   OneUser1

   If you are setting the configuration for the first time, you don't need an 'oldPassword' and can simply use Set-SecretStoreConfiguration.

   Set-SecretStoreConfiguration -Authentication Password -PasswordTimeout 3600 -Interaction None -Password $newPassword -Confirm:$false

   For example right after you installed the Microsoft.PowerShell.SecretStore module and before using the SecretStore. For dev ops automation, this shouldn't be too difficult as it would probably be part of the set up script for the image (as shown in my example above).
   But if you first ran SecretStore interactively and provided a password (which is the only other way to provide a password with the default 'password required' configuration), then the password is already set and you don't need to set configuration authentication again. But you can set other configuration options:

   Set-SecretStoreConfiguration -PasswordTimeout 3600 -Interaction None -Password $currentPassword -Confirm:$false

   Set-SecretStorePassword is only used to change an existing password, and so you need to provide the old and the new passwords.

   Another option that can be used for automation is to use the Reset-SecretStore command. This allows you to reset the store and configuration, but it will also delete any existing secrets in the store.

   Reset-SecretStore -Authentication Password -Password $newPassword -PasswordTimeout 3600 -Interaction None -Force
   WARNING: !!This operation will completely remove all SecretStore module secrets and reset configuration settings to new values!!

   The tricky part of non-interactive use is passing in the password value securely. In my example above I use Import-CliXml to import a SecureString password from file. But this only works safely on Windows platforms with DataProtection APIs.
   In general, I believe most dev ops systems have ways to pass readonly variables in a relatively secure way and I imagine that is how most systems would work.
9. OneUser1 commented on Mar 18, 2021

   

   OneUser1

   on Mar 18, 2021

   More actions

   Hello Paul Higinbotham (@PaulHigin), thanks for your helpful answer!

   As you said using Set-SecretStoreConfiguration directly after installing SecretStore module works fine. Thanks for clarifying! I tested it today again with a slightly altered command line to the one yesterday (see my post above) and it still worked.
   As I am using Windows Import-CliXml is working fine.

   Thanks for your fast help!

   👍React with 👍1Reacted by Paul Higinbotham
10. Paul Higinbotham (PaulHigin)

    added

    Resolution-Answered

    on Mar 24, 2021
11. PaulHigin commented on Mar 26, 2021

    

    Paul Higinbotham (PaulHigin)

    on Mar 26, 2021

    Contributor

    More actions

    Implemented in GA

    🎉React with 🎉1Reacted by Nate Scherer
12. Paul Higinbotham (PaulHigin)

    closed this as completedon Mar 26, 2021