document.write('\
\ "); document.write('
  1. # Author:       Hal Rottenberg <hal@halr9000.com>
    2. \
  2. # Url:          http://halr9000.com/article/tag/lib-authentication.ps1
    3. \
  3. # Purpose:      These functions allow one to easily save network credentials to disk in a relatively
    4. \
  4. #                       secure manner.  The resulting on-disk credential file can only [1] be decrypted
    5. \
  5. #                       by the same user account which performed the encryption.  For more details, see
    6. \
  6. #                       the help files for ConvertFrom-SecureString and ConvertTo-SecureString as well as
    7. \
  7. #                       MSDN pages about Windows Data Protection API.
    8. \
  8. #                       [1]: So far as I know today.  Next week I\'m sure a script kiddie will break it.
    9. \
  9. #
    10. \
  10. # Usage:        Export-PSCredential [-Credential <PSCredential object>] [-Path <file to export>]
    11. \
  11. #                       Export-PSCredential [-Credential <username>] [-Path <file to export>]
    12. \
  12. #                       If Credential is not specififed, user is prompted by Get-Credential cmdlet.
    13. \
  13. #                       If a username is specified, then Get-Credential will prompt for password.
    14. \
  14. #                       If the Path is not specififed, it will default to "./credentials.enc.xml".
    15. \
  15. #                       Output: FileInfo object referring to saved credentials
    16. \
  16. #
    17. \
  17. #                       Import-PSCredential [-Path <file to import>]
    18. \
  18. #
    19. \
  19. #                       If not specififed, Path is "./credentials.enc.xml".
    20. \
  20. #                       Output: PSCredential object
    21. \
  21.  
    22. \
  22. function Export-PSCredential {
    23. \
  23.         param ( $Credential = (Get-Credential), $Path = "credentials.enc.xml" )
    24. \
  24.  
    25. \
  25.         # Look at the object type of the $Credential parameter to determine how to handle it
    26. \
  26.         switch ( $Credential.GetType().Name ) {
    27. \
  27.                 # It is a credential, so continue
    28. \
  28.                 PSCredential            { continue }
    29. \
  29.                 # It is a string, so use that as the username and prompt for the password
    30. \
  30.                 String                          { $Credential = Get-Credential -credential $Credential }
    31. \
  31.                 # In all other caess, throw an error and exit
    32. \
  32.                 default                         { Throw "You must specify a credential object to export to disk." }
    33. \
  33.         }
    34. \
  34.        
    35. \
  35.         # Create temporary object to be serialized to disk
    36. \
  36.         $export = "" | Select-Object Username, EncryptedPassword
    37. \
  37.        
    38. \
  38.         # Give object a type name which can be identified later
    39. \
  39.         $export.PSObject.TypeNames.Insert(0,’ExportedPSCredential’)
    40. \
  40.        
    41. \
  41.         $export.Username = $Credential.Username
    42. \
  42.  
    43. \
  43.         # Encrypt SecureString password using Data Protection API
    44. \
  44.         # Only the current user account can decrypt this cipher
    45. \
  45.         $export.EncryptedPassword = $Credential.Password | ConvertFrom-SecureString
    46. \
  46.  
    47. \
  47.         # Export using the Export-Clixml cmdlet
    48. \
  48.         $export | Export-Clixml $Path
    49. \
  49.         Write-Host -foregroundcolor Green "Credentials saved to: " -noNewLine
    50. \
  50.  
    51. \
  51.         # Return FileInfo object referring to saved credentials
    52. \
  52.         Get-Item $Path
    53. \
  53. }
    54. \
  54.  
    55. \
  55. function Import-PSCredential {
    56. \
  56.         param ( $Path = "credentials.enc.xml" )
    57. \
  57.  
    58. \
  58.         # Import credential file
    59. \
  59.         $import = Import-Clixml $Path
    60. \
  60.        
    61. \
  61.         # Test for valid import
    62. \
  62.         if ( !$import.UserName -or !$import.EncryptedPassword ) {
    63. \
  63.                 Throw "Input is not a valid ExportedPSCredential object, exiting."
    64. \
  64.         }
    65. \
  65.         $Username = $import.Username
    66. \
  66.        
    67. \
  67.         # Decrypt the password and store as a SecureString object for safekeeping
    68. \
  68.         $SecurePass = $import.EncryptedPassword | ConvertTo-SecureString
    69. \
  69.        
    70. \
  70.         # Build the new credential object
    71. \
  71.         $Credential = New-Object System.Management.Automation.PSCredential $Username, $SecurePass
    72. \
  72.         Write-Output $Credential
    73. \
  73. }
    74. \
');document.write('
downloadThis Script brought to you by PoshCode\
\
\
');