ADFS : PowerShell cmdlet - parameter PolicyMetadata

Another question on the forum around the format of PowerShell parameters.

This one was around PolicyMetadata.

Get-AdfsAccessControlPolicy -Name "Demo"

Name           : Demo
Identifier     : Demo
IsBuiltIn      : False
RpUsageCount   : 0
LastUpdateTime : 10/10/2017 7:22:00 PM
Description    :
PolicyMetadata : RequireFreshAuthentication:False
                 IssuanceAuthorizationRules:
                 {
                   Permit everyone
                 }
AssignedTo     : {} 

Now if you copy / paste the metadata into a file and then run:

New-AdfsAccessControlPolicy -Name "DemoOne" -PolicyMetadataFile c:\Filename

you get all kinds of errors.

Looking at the errors e.g. "Root error" made me think that the format wasn't JSON, rather XML.

Which means that it is almost impossible to guess the element names etc.

So Mr. Google to the rescue and a long time later, I came across:

(Get-AdfsAccessControlPolicy -Name "Permit everyone").PolicyMetadata | fl *

which displays:

IsParameterized : False
Serialized      : <PolicyMetadata xmlns:i="http://www.w3.org/2001/XMLSchema-instance"
                  xmlns="http://schemas.datacontract.org/2012/04/ADFS">
                    <RequireFreshAuthentication>false</RequireFreshAuthentication>
                    <IssuanceAuthorizationRules>
                      <Rule>
                        <Conditions>
                          <Condition i:type="AlwaysCondition">
                            <Operator>IsPresent</Operator>
                            <Values />
                          </Condition>
                        </Conditions>
                      </Rule>
                    </IssuanceAuthorizationRules>
                  </PolicyMetadata>
Summary         : RequireFreshAuthentication:False
                  IssuanceAuthorizationRules:
                  {
                    Permit everyone
                  }
ExtensionData   : System.Runtime.Serialization.ExtensionDataObject

Putting that into a file e.g.

<?xml version="1.0" encoding="UTF-8"?>
<PolicyMetadata xmlns:i="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://schemas.datacontract.org/2012/04/ADFS">
    <RequireFreshAuthentication>false</RequireFreshAuthentication>
        <IssuanceAuthorizationRules>
            <Rule>
                <Conditions>
                    <Condition i:type="AlwaysCondition">
                        <Operator>IsPresent</Operator>
                        <Values />
                    </Condition>
                </Conditions>
            </Rule>
        </IssuanceAuthorizationRules>
</PolicyMetadata>

and then running the command works!

I suggest running:

Get-AdfsAccessControlPolicy  

which displays them all and then look at the XML formats to get some hints as to the XML format.

Enjoy!



ADFS : PowerShell cmdlet - parameter is an array

Over on the forum, there was a question around a parameter in the cmdlet that accepts multiple options as an array i.e.

"-RedirectUriSpecifies an array of redirection URIs for the OAuth 2.0 client to register with AD FS".

The question was around the format of the array since that is not specified.

Looking at another example:

Set-AdfsRelyingPartyTrust -TargetName claimapp -ClaimsProviderName @("Fabrikam","Active Directory")

the array is of the form:

@("Fabrikam","Active Directory")

Enjoy!



ADFS : Claims rules and regex

I answer a lot of claims rules questions over on the forum:

Claims based access platform (CBA), code-named Geneva

and a lot of them concern regex.

One of the recent ones concerned:

"This works fine. I want to filter groups that are included in outgoing claim to just groups which start with string "SG". So I wrote custom ADFS rule:

c:[Type == "http://schemas.xmlsoap.org/claims/Group", Value =~
"(?i) ^SG*"]
=> issue(claim = c);"

There's a number of tools to check the regex. I tend to use Expresso.

But then I came across an article which showed an easy way to check this in PowerShell.

PS C:\> "SG1234" -match '(?i)^SG*'
True
PS C:\> "abcSG1234" -match '(?i)^SG*'
False
PS C:\> "SG1234" -match '(?i)^SG.'
True
PS C:\> "SG" -match '(?i)^SG.'
False
PS C:\> "SG" -match '(?i)^SG'
True


 ... and you can see some of the other strings I played around with.

Neat!

Enjoy!

Powershell : Setting credentials for a web request

Trying to get through a proxy and getting the dreaded “407 – Proxy Authentication Required.
The solution is to use:

$wcl = New-Object Net.Webclient
$wcl.Credentials = new-object Net.NetworkCredential("login", "password", "domain")
$wcl.Proxy.Credentials = new-object Net.NetworkCredential(("login", "password", "domain"); 

And suddenly we’re through the proxy and all is good!

Enjoy!

PowerShell : Using an IDE

 

PowerShell is command line which means that you lose out on all the benefits that an IDE brings.

There is an in-built PowerShell IDE:

Just type “ise” from the command line

but it’s pretty basic.

Then I came across PowerGui.

It has two parts viz. an administrative console that allows you to run a collection of PowerShell scripts and a script editor that allows you to enter and run scripts. It has intellisense and a set of built in snippets. It has a debug function where you can step through the script and examine all the variables.

Very neat – and BTW it’s free.

Enjoy!

PowerShell : Survival Guide

Take a look at Windows PowerShell Survival Guide.

Everything you wanted to ask about PowerShell and were afraid to ask!

See the cheat sheets:

Windows PowerShell Refcard

Windows PowerShell Quick Reference: A two-page "cheat sheet."

Enjoy!

Powershell : Getting a list of commands

Powershell is a useful tool if you like a command line interface.

Although it has a pretty comprehensive list of help commands, quite often you can't remember the exact command.

e.g. you remember that the command had the word "item" in it.

So use:

get-command *item*

which gives you a list of all commands that contain the phrase "item".

Enjoy!