From cfdedca91dfcbcecf39401b15e894a8c98e5501d Mon Sep 17 00:00:00 2001 From: "mroberts@prod.quest.corp" Date: Tue, 7 Jun 2022 17:56:14 +0000 Subject: [PATCH 1/2] Updates for safeguard 7.0.0 --- cmdlet-tests-certificates.ps1 | 30 ---------------- cmdlet-tests-obsolete-commands.ps1 | 26 ++++++++++++-- cmdlet-tests-settings.ps1 | 7 +++- cmdlet-tests-starling.ps1 | 10 ------ harness-data.ps1 | 58 +++++++++++++++++------------- license-123-456-000.dlv | 13 ------- license-7-0.dlv | 12 +++++++ 7 files changed, 75 insertions(+), 81 deletions(-) delete mode 100644 license-123-456-000.dlv create mode 100644 license-7-0.dlv diff --git a/cmdlet-tests-certificates.ps1 b/cmdlet-tests-certificates.ps1 index bf2bffe..e9345d2 100644 --- a/cmdlet-tests-certificates.ps1 +++ b/cmdlet-tests-certificates.ps1 @@ -32,36 +32,6 @@ $blockInfo = testBlockHeader $TestBlockName # try { - Get-SafeguardAccessCertificationAccount -Identifier $DATA.appliance -StdOut - goodResult "Get-SafeguardAccessCertificationAccount" "Successfully called" - - # NOTE - # these require that ActiveDirectory modules be installed. See "Install Instructions" here - # https://www.microsoft.com/en-us/download/details.aspx?id=45520 - # - # Install these - # RSAT: Server Manager - # RSAT: Active Directory Domain Services and Lightweight Directory Services Tools - try { - Get-SafeguardAccessCertificationAll -Identifier $DATA.appliance -OutputDirectory $DATA.outputPaths.certificates -DomainName $DATA.domainName -Credential $DATA.domainCredential - goodResult "Get-SafeguardAccessCertificationAll" "Successfully called. Check CSV files for output." - - Get-ADAccessCertificationIdentity -StdOut -DomainName $DATA.domainName -Credential $DATA.domainCredential - goodResult "Get-ADAccessCertificationIdentity" "Successfully called" - } catch { - badResult "Access Certification" "Error accessing domain $($DATA.domainName) for Access Certification Info" $_ - } - - Get-SafeguardAccessCertificationGroup -Identifier $DATA.appliance -StdOut - goodResult "Get-SafeguardAccessCertificationGroup" "Successfully called" - - Get-SafeguardAccessCertificationIdentity -Identifier $DATA.appliance -StdOut - goodResult "Get-SafeguardAccessCertificationIdentity" "Successfully called" - - # This assumes some entitlement stuff being around for meaningful output? - Get-SafeguardAccessCertificationEntitlement -Identifier $DATA.appliance -StdOut - goodResult "Get-SafeguardAccessCertificationEntitlement" "Successfully called" - try { $csr = New-SafeguardCsr -CertificateType Ssl -Subject $DATA.newCsrSubject ` -DnsNames $DATA.newCsrDns -IpAddresses $DATA.newCsrIpAddress ` diff --git a/cmdlet-tests-obsolete-commands.ps1 b/cmdlet-tests-obsolete-commands.ps1 index fc432d9..5a2a2f2 100644 --- a/cmdlet-tests-obsolete-commands.ps1 +++ b/cmdlet-tests-obsolete-commands.ps1 @@ -19,14 +19,21 @@ $blockInfo = testBlockHeader $TestBlockName # Reset-SafeguardSessionModule # Set-SafeguardSessionSshAlgorithms # Repair-SafeguardSessionModule -# +# New-SafeguardStarling2faAuthentication function testObsolete($cmd, $extraArgs1) { $cmd = "$cmd $(iif $extraArgs1 $extraArgs1 '') -ErrorAction:SilentlyContinue -WarningAction:Continue" writeCallHeader "$cmd OBSOLETE" try { Invoke-Expression $cmd } catch { - if ($_.Exception.ErrorCode -ne 60385) { badResult "$cmd" "Unexpected error" $_ } + if ($_.Exception.ErrorCode -ne 60385) { + if ($_.Exception.Message -Match 'is not recognized as the name of a cmdlet, function, script file, or operable program'){ + goodResult "$cmd" "Success" + } + else{ + badResult "$cmd" "Unexpected error" $_ + } + } else { goodResult "$cmd" "Success" } } } @@ -59,4 +66,19 @@ testObsolete "Reset-SafeguardSessionModule" testObsolete "Repair-SafeguardSessionModule" +testObsolete "New-SafeguardStarling2faAuthentication" + +testObsolete "Get-SafeguardAccessCertificationAccount" + + +testObsolete "Get-SafeguardAccessCertificationAccount -Identifier $DATA.appliance -StdOut" + +testObsolete "Get-SafeguardAccessCertificationAll -Identifier $DATA.appliance -OutputDirectory $DATA.outputPaths.certificates -DomainName $DATA.domainName -Credential $DATA.domainCredential" +testObsolete "Get-ADAccessCertificationIdentity" + +testObsolete "Get-SafeguardAccessCertificationGroup" + +testObsolete "Get-SafeguardAccessCertificationIdentity" +testObsolete "Get-SafeguardAccessCertificationEntitlement" + testBlockHeader $TestBlockName $blockInfo diff --git a/cmdlet-tests-settings.ps1 b/cmdlet-tests-settings.ps1 index efb7ea7..c20d0ec 100644 --- a/cmdlet-tests-settings.ps1 +++ b/cmdlet-tests-settings.ps1 @@ -20,7 +20,12 @@ $blockInfo = testBlockHeader $TestBlockName try { if ($isLTS -or $testBranch -eq "LTS" -or $testBranch -match "^other:") { - throw "Settings tests are only available on Feature branch" + if ($sgVersion.Baseline){ + infoResult "New baseline so test both Feature and LTS" + } + else{ + throw "Settings tests are only available on Feature branch" + } } Get-SafeguardApplianceSetting | Format-Table diff --git a/cmdlet-tests-starling.ps1 b/cmdlet-tests-starling.ps1 index 88a12b2..eef8b63 100644 --- a/cmdlet-tests-starling.ps1 +++ b/cmdlet-tests-starling.ps1 @@ -31,16 +31,6 @@ try { goodResult "Get-SafeguardStarlingJoinUrl" "Successfully Get-SafeguardStarlingJoinUrl called by Invoke-SafeguardStarlingJoin" goodResult "New-SafeguardStarlingSubscription" "Successfully New-SafeguardStarlingSubscription called by Invoke-SafeguardStarlingJoin" - - if ("Y" -eq (Read-Host "Enter Y if your starling account is set up with a 2fa trial")) { - $ProviderName= Read-Host "Please enter your ProviderName [A string containing the name to give this new identity provider]" - $APiKey = Read-Host "Please enter your ApiKey[A string containing the API Key obtained from Starling 2FA console]" - if ("Y" -eq (Read-Host "Enter Y if your wish to make the identity providor $($ProviderName) with the key $($APiKey)")) { - New-SafeguardStarling2faAuthentication -ProviderName "$($ProviderName)" -ApiKey "$($APiKey)" - goodResult "New-SafeguardStarling2faAuthentication" "Successfully New-SafeguardStarling2faAuthentication" - } - } - Remove-SafeguardStarlingSubscription -Name "Default" -Force goodResult "Remove-SafeguardStarlingSubscription" "Successfully Remove-SafeguardStarlingSubscription" } diff --git a/harness-data.ps1 b/harness-data.ps1 index 8a91b16..83db80b 100644 --- a/harness-data.ps1 +++ b/harness-data.ps1 @@ -14,27 +14,28 @@ $SCRIPT_PATH = if($SCRIPT_PATH) {$SCRIPT_PATH} else {(Get-Location).Path} $DATA = @{ #addresses of LTS and Feature branch appliances - applianceLTS = "10.9.4.222"; - applianceFeature = "10.9.4.227" + applianceLTS = "10.5.34.128"; + applianceFeature = "10.5.34.128" # ip address of appliance to test. # Based on cmdline args this will be set to either LTS or feature appliance - appliance = "10.9.4.222"; + appliance = "10.5.33.128"; # Version numbers to be used when looking for patch files - LTSVersion = "6.0.7"; - FeatureVersion = "6.7.0"; + LTSVersion = "7.0.0"; + FeatureVersion = "7.0.0"; # uber-admin user with all admin permissions. The same user will be used # to run all commands unless otherwise noted. - userName = "sgAdmin"; - secPassword = "Admin4SG" | ConvertTo-SecureString -AsPlainText -Force; + userName = "sudo"; + secPassword = "Test1234" | ConvertTo-SecureString -AsPlainText -Force; # login provider for the above idProvider = "local"; # admin user and password for any SPS appliances. Again, the same user # needs to be provisioned on all appliances. + # Hint ask Brad Nicholes for a good SPS if you don't have one SPSAdmin = "admin"; SPSAdminPassword = "root4EDMZ" | ConvertTo-SecureString -AsPlainText -Force; @@ -59,27 +60,27 @@ $DATA = @{ # real archive server information # This networkaddress will also be used in Network diagnostic tests - # Make sure to edit this to fit your environment - this is one of my - # linux boxes and I don't guarantee it will be up all the time. + ######Create the sub directory ps in /data/archives/archivist, then delete the subdirectory when you're done ##### realArchiveServer = @{ - archSrvName = "ps.ArchSrv_001"; - NetworkAddress = "10.9.6.69"; + archSrvName = "ps.sg-archive"; + NetworkAddress = "sg-archive.sg.lab"; TransferProtocol = "Scp"; Port = "22"; - StoragePath = "/home/sgarchive"; + StoragePath = "/data/archives/archivist/ps"; ServiceAccountCredentialType = "Password"; - ServiceAccountName = "root"; - ServiceAccountPassword = "Password1" | ConvertTo-SecureString -AsPlainText -Force; + ServiceAccountName = "archivist"; + ServiceAccountPassword = "!Deposit0r" | ConvertTo-SecureString -AsPlainText -Force; }; # names of assets, accounts, and groups to be created and meddled with. # Asset and accounts are expected to be "real" and reachable during tests + # as long as this one is up these psusers were made for this test. assetName = "ps.Asset_001"; assetServiceAccount = "root"; - assetServiceAccountPassword = "Password1" | ConvertTo-SecureString -AsPlainText -Force; - assetIpAddress = "10.9.6.69"; + assetServiceAccountPassword = "test123" | ConvertTo-SecureString -AsPlainText -Force; + assetIpAddress = "sg-ubuntu2004.sg.lab"; assetPlatform = "Ubuntu 16.04 LTS x86_64"; - assetAccounts = @("user_0001","user_0002","user_0003","user_0004","user_0005"); + assetAccounts = @("psuser_1","psuser_2","psuser_3","psuser_4","psuser_5"); userGroupName = "ps.UserGroup_001"; assetGroupName = "ps.AssetGroup_001"; accountGroupName = "ps.AccountGroup_001"; @@ -88,8 +89,8 @@ $DATA = @{ entitlementName = "ps.Entitlement" accessPolicy = "ps.TestPolicy" - #license file to be used for license remove/install testing - licenseFile = $SCRIPT_PATH + "\license-123-456-000.dlv"; + #license file to be used for license remove/install testing 7.0 version + licenseFile = $SCRIPT_PATH + "\license-7-0.dlv"; # This DNS must be in the list for X0 in order for certain functions to work. # If the default DNS is sufficient then either set that address here or set @@ -97,11 +98,11 @@ $DATA = @{ requiredDNS = "10.9.6.64"; # Domain information used for testing directory, identity provider, and certificates. - domainName = "jshdevvm.dell.com"; + domainName = "c.sg.lab"; netBIOS = "JSHDEVVM"; - domainAdmin = "administrator"; - domainPassword = "root4EDMZ" | ConvertTo-SecureString -AsPlainText -Force; - directoryAccounts = @("User_001","User_002","User_003"); + domainAdmin = "madmin-c"; + domainPassword = "test123" | ConvertTo-SecureString -AsPlainText -Force; + directoryAccounts = @("muser-c","muser2-c","muser3-c"); # Certificate Signing Request stuff newCsrSubject = "CN=Bedrock,OU=Yabba,O=Dabba"; @@ -123,6 +124,9 @@ $DATA = @{ reports = "$SCRIPT_PATH\reports\"; certificates = "$SCRIPT_PATH\certs\"; } + + #BMC Data for a VM doesn't matter. If testing on hardware change this. + appliancebmc = @{Ipv4Address="0.0.0.0"; Ipv4Gateway = "0.0.0.0"; Ipv4NetMask = "250.250.250.244"; Password="Junk"} } # For things that need to be created based on other hashtable members @@ -139,10 +143,14 @@ $DATA += @{ # TODO still deciding on what to do with clustering... clusterPrimaryLTS = $DATA.applianceLTS; clusterReplicasLTS = @("10.9.4.223","10.9.4.224"); - clusterSessionLTS = @("10.9.4.220","10.9.4.221"); + #Hint ask Brad Nicholes for a good SPS if you don't have one + #for the tests now you only need one. + clusterSessionLTS = @("10.5.33.211","10.9.4.221"); clusterPrimaryFeature = $DATA.applianceFeature; clusterReplicasFeature = @("10.9.4.228","10.9.4.229"); - clusterSessionFeature = @("10.9.4.225","10.9.4.226"); + #Hint ask Brad Nicholes for a good SPS if you don't have one + #for the tests now you only need one. + clusterSessionFeature = @("10.5.33.211","10.9.4.226"); # Based on cmdline args will be set to either LTS or feature appliance values # These appliances are expected to accept the same uber-admin name and diff --git a/license-123-456-000.dlv b/license-123-456-000.dlv deleted file mode 100644 index d5d45ec..0000000 --- a/license-123-456-000.dlv +++ /dev/null @@ -1,13 +0,0 @@ - - - - - Safeguard for Privileged Passwords Desktop/System - 2 - Perpetual - 123-456-000 - 100 - 10 - - - diff --git a/license-7-0.dlv b/license-7-0.dlv new file mode 100644 index 0000000..4b438a3 --- /dev/null +++ b/license-7-0.dlv @@ -0,0 +1,12 @@ + + + + + true + 130-603-237 + Perpetual + Safeguard for Privileged Passwords + 7 + + + \ No newline at end of file From c99a37523a1aac995ac940a0e2165d670bea65a3 Mon Sep 17 00:00:00 2001 From: "mroberts@prod.quest.corp" Date: Fri, 10 Jun 2022 21:29:06 +0000 Subject: [PATCH 2/2] 7.0 fixes and updates --- cmdlet-tests-a2a.ps1 | 19 ++++----- cmdlet-tests-asset-partition.ps1 | 14 +++---- cmdlet-tests-assets-and-accounts.ps1 | 5 +-- cmdlet-tests-directory.ps1 | 13 ++---- cmdlet-tests-entitlement.ps1 | 4 +- cmdlet-tests-event-subscriptions.ps1 | 18 ++++---- cmdlet-tests-groups.ps1 | 8 ++-- cmdlet-tests-miscellaneous.ps1 | 11 ++--- cmdlet-tests-noparameter.ps1 | 2 +- cmdlet-tests-settings.ps1 | 9 ---- cmdlet-tests-users.ps1 | 61 +++++++++++++++++----------- harness-data.ps1 | 8 ++-- harness-functions.ps1 | 3 +- 13 files changed, 85 insertions(+), 90 deletions(-) diff --git a/cmdlet-tests-a2a.ps1 b/cmdlet-tests-a2a.ps1 index ce86008..9b76b6f 100644 --- a/cmdlet-tests-a2a.ps1 +++ b/cmdlet-tests-a2a.ps1 @@ -135,8 +135,6 @@ $newWindowsPolicyStr = '{ "InvalidConnectionPolicy": false }' $newWindowsPolicyBody = $newWindowsPolicyStr.Replace("`n", "").Replace("`r", "").Replace(" ", "") -$newAccessRequestStr = '{"AccountId": #ACCOUNT_ID#,"SystemId": #ASSET_ID#,"AccessRequestType": "SSH"}' -$newAccessRequestBody = $newAccessRequestStr.Replace("`n", "").Replace("`r", "").Replace(" ", "") # managedsystem = {'properties':{'PlatformId':547,'NetworkAddress':'sg-2019-ads.sg.lab','Name':'sg-2019-ads'},'fa':{'properties':{'Name':'sb-sa'},'password':'Test1234'},'ma':{'properties':{'Name':'sb-aa1'},'password':'Test1234'}} # managedsystem = {'properties':{'PlatformId':270,'NetworkAddress':'sg-ubuntu1904.sg.lab','Name':'sg-ubuntu1904'},'fa':{'properties':{'Name':'root'},'password':'test123'},'ma':{'properties':{'Name':'sb-aa1'},'password':'Test1234'},'sshkey':'data/smoke_ssh_rsa','invalidsymbols':['\n', '\r']} @@ -202,7 +200,9 @@ function Cleanup { } } Remove-SafeguardUser -UserToDelete $userUsername > $null - Remove-SafeguardUser -UserToDelete $certUserName > $null + if ($null -ne $certUserName){ + Remove-SafeguardUser -UserToDelete $certUserName > $null + } $allPolicies = Get-SafeguardAccessPolicy if ($null -ne $allPolicies) { @@ -242,7 +242,6 @@ function FindAssetAccount($index) { Write-Host "Failed to find the account " $assetsToCreate[$index].AssetAccountDescription return } - return $accounts[0] } @@ -251,23 +250,24 @@ $ready = $true try { # Create-User #region Users - New-SafeguardUser -NewUserName "Testing" -FirstName "Test" -LastName "ing" -NoPassword -Provider -1 > $null $secPassword = "root4EDMZ" | ConvertTo-SecureString -AsPlainText -Force Set-SafeguardUserPassword -Password $secPassword -UserToEdit "Testing" > $null Edit-SafeguardUser -UserToEdit "Testing" -EmailAddress "blah@test.com" > $null $userUsername = Get-SafeguardUser -UserToGet "Testing" #endregion - + # Create-CertificateUser #region Users + infoResult "New-SafeguardUser -Verbose -NewUserName 'cert-safeguard-ps-user' -FirstName 'safeguard' -LastName 'ps-user' -NoPassword -Provider -2 -Thumbprint '2349a0311c312f6dff57875fd2b2a112b8e2c644' > $null" New-SafeguardUser -NewUserName "cert-safeguard-ps-user" -FirstName "safeguard" -LastName "ps-user" -NoPassword -Provider -2 -Thumbprint "2349a0311c312f6dff57875fd2b2a112b8e2c644" > $null $certUserName = Get-SafeguardUser -UserToGet "cert-safeguard-ps-user" #endregion - + # Create-AssetAccount Write-Host "Create Assets and Accounts" foreach ($asset in $assetsToCreate) { + $newAsset = $null if ([string]::IsNullOrEmpty($asset.ServiceAccountCredentialType)) { $newAsset = New-SafeguardAsset -NetworkAddress $asset.NetworkAddress -Platform $asset.Platform -Description $asset.Description -DisplayName $asset.DisplayName -ServiceAccountCredentialType None -AcceptSshHostKey } @@ -310,10 +310,9 @@ try { Write-Host "Create-AccessRequest" #region AccessRequest $selectedAccount = FindAssetAccount(0) - $selectedAsset = Get-SafeguardAsset -AssetToGet $selectedAccount.AssetId + $selectedAsset = Get-SafeguardAsset -AssetToGet $selectedAccount.Asset.Id $selectedAccount = Get-SafeguardAssetAccount -AccountToGet $selectedAccount.Id - $convertedJson = ConvertFrom-Json $newAccessRequestBody.Replace("#ACCOUNT_ID#", $selectedAccount.Id).Replace("#ASSET_ID#", $selectedAsset.Id) - $newAccessRequest = Invoke-SafeguardMethod Core Post AccessRequests -Body $convertedJson + $newAccessRequest = New-SafeguardAccessRequest $selectedAsset.Id $selectedAccount.Id Ssh Get-SafeguardAccessRequest -RequestId $newAccessRequest.Id > $null Edit-SafeguardAccessRequest $newAccessRequest.Id InitializeSession > $null Get-SafeguardAccessRequestPassword -RequestId $newAccessRequest.Id > $null diff --git a/cmdlet-tests-asset-partition.ps1 b/cmdlet-tests-asset-partition.ps1 index dd5ea79..bd0a3a8 100644 --- a/cmdlet-tests-asset-partition.ps1 +++ b/cmdlet-tests-asset-partition.ps1 @@ -30,16 +30,16 @@ try { $partitionOwnerUser = Find-SafeguardUser $DATA.partitionOwnerUserName if (-not $partitionOwnerUser) { $partitionOwnerUser = New-SafeguardUser -NewUserName $DATA.partitionOwnerUserName -FirstName "Safeguard-ps" -LastName "PartitionOwner" -NoPassword -Provider -1 - infoResult "New-SafeguardUser" "$($partitionOwnerUser.UserName) user created for partition owner testing" $null + infoResult "New-SafeguardUser" "$($partitionOwnerUser.Name) user created for partition owner testing" $null $deletePartitionOwner = $true } else { - infoResult "Find-SafeguardUser" "using existing $($partitionOwnerUser.UserName) user for partition owner testing" $null + infoResult "Find-SafeguardUser" "using existing $($partitionOwnerUser.Name) user for partition owner testing" $null $deletePartitionOwner = $false } - Add-SafeguardAssetPartitionOwner -AssetPartitionToEdit "$($newPartition.name)" -UserList $partitionOwnerUser.UserName > $null - goodResult "Add-SafeguardAssetPartitionOwner" "$($newPartition.name) owner set to $($partitionOwnerUser.UserName)" + Add-SafeguardAssetPartitionOwner -AssetPartitionToEdit "$($newPartition.name)" -UserList $partitionOwnerUser.Name > $null + goodResult "Add-SafeguardAssetPartitionOwner" "$($newPartition.name) owner set to $($partitionOwnerUser.Name)" Get-SafeguardAssetPartitionOwner -AssetPartitionToGet "$($newPartition.name)" | format-table Enter-SafeguardAssetPartition -AssetPartitionToEnter $newPartition.name > $null @@ -48,13 +48,13 @@ try { Exit-SafeguardAssetPartition > $null goodResult "Exit-SafeguardAssetPartition" "exited $($newPartition.name)" Get-SafeguardCurrentAssetPartition | format-table - Remove-SafeguardAssetPartitionOwner -AssetPartitionToEdit "$($newPartition.name)" -UserList $partitionOwnerUser.UserName > $null - goodResult "Remove-SafeguardAssetPartitionOwner" "$($newPartition.name) owner removed $($partitionOwnerUser.UserName)" + Remove-SafeguardAssetPartitionOwner -AssetPartitionToEdit "$($newPartition.name)" -UserList $partitionOwnerUser.Name > $null + goodResult "Remove-SafeguardAssetPartitionOwner" "$($newPartition.name) owner removed $($partitionOwnerUser.Name)" Get-SafeguardAssetPartitionOwner -AssetPartitionToGet "$($newPartition.name)" | format-table if ($deletePartitionOwner) { Remove-SafeguardUser -UserToDelete $DATA.partitionOwnerUserName -ErrorAction:SilentlyContinue > $null - infoResult "Remove-SafeguardUser" "- removed $($partitionOwnerUser.UserName)" + infoResult "Remove-SafeguardUser" "- removed $($partitionOwnerUser.Name)" } Remove-SafeguardAssetPartition -AssetPartitionToDelete "$($newPartition.name)" > $null goodResult "Remove-SafeguardAssetPartition" "$($newPartition.name) removed" diff --git a/cmdlet-tests-assets-and-accounts.ps1 b/cmdlet-tests-assets-and-accounts.ps1 index 528e7cb..d320020 100644 --- a/cmdlet-tests-assets-and-accounts.ps1 +++ b/cmdlet-tests-assets-and-accounts.ps1 @@ -73,9 +73,10 @@ try { $asset = Invoke-SafeguardAssetSshHostKeyDiscovery -Asset $DATA.assetname -AcceptSshHostKey goodResult "Invoke-SafeguardAssetSshHostKeyDiscovery" "Discovered and accepted ssh host key on $($DATA.assetName)" + try { foreach ($acctname in $DATA.assetAccounts.GetEnumerator()) { - $found = Find-SafeguardAssetAccount -QueryFilter "AssetName eq '$($DATA.assetName)' and Name eq '$acctname'" + $found = Find-SafeguardAssetAccount -QueryFilter "Asset.Name eq '$($DATA.assetName)' and Name eq '$acctname'" if ($found) { infoResult "New-SafeguardDirectoryAccount" "$acctname already exists on $($DATA.assetName)" } else { try { @@ -100,11 +101,9 @@ try { if (-not $assetAccount.Description -contains "Description for") { badResult "Edit-SafeguardAssetAccount" "failed for $($DATA.assetName)\$($DATA.assetAccounts[0])" } - $found = Find-SafeguardAssetAccount $DATA.assetAccounts[0] if ($found) { goodResult "Find-SafeguardAssetAccount" "found $($DATA.assetAccounts[0])" } else { badResult "Find-SafeguardAssetAccount" "DID NOT find $($DATA.assetAccounts[0])" } - Test-SafeguardAsset -AssetToTest $DATA.assetName goodResult "Test-SafeguardAsset" "Successfully tested assed $($DATA.assetName) (pass or fail)" diff --git a/cmdlet-tests-directory.ps1 b/cmdlet-tests-directory.ps1 index f887722..3350f80 100644 --- a/cmdlet-tests-directory.ps1 +++ b/cmdlet-tests-directory.ps1 @@ -83,12 +83,8 @@ try { } } - # TODO - # This one keeps failing no matter what gets passed because something is looking for AssetPartitionId - # which is not part of the directory object. So, leaving it here with exception handler and - # letting it fail for the time being. try { - $newDirectory = Edit-SafeguardDirectory -DirectoryToEdit $($DATA.domainName) -Description "New Description for $DATA.domainName" + $newDirectory = (Edit-SafeguardDirectory -DirectoryToEdit $($DATA.domainName) -Description "New Description for $($DATA.domainName)") if ($newDirectory.Description -eq "New Description for $($DATA.domainName)") { goodResult "Edit-SafeguardDirectory" "Successfully edited" } else { badResult "Edit-SafeguardDirectory" "Edit failed" } } catch { @@ -101,11 +97,11 @@ try { $existingAccounts = Get-SafeguardDirectoryAccount -DirectoryToGet $DATA.domainName -Fields Name goodResult "Get-SafeguardDirectoryAccount" "Found $($existingAccounts.Count) accounts" foreach ($acctname in $DATA.directoryAccounts.GetEnumerator()) { - $found = Find-SafeguardAssetAccount -QueryFilter "AssetName eq '$($DATA.domainName)' and Name eq '$acctname'" + $found = Find-SafeguardAssetAccount -QueryFilter "Asset.Name eq '$($DATA.domainName)' and Name eq '$acctname'" if ($found) { infoResult "New-SafeguardDirectoryAccount" "$acctname already exists on $($DATA.domainName)" } else { try { - $newacct = New-SafeguardDirectoryAccount -ParentDirectory $newDirectory -NewAccountName $acctname + $newacct = New-SafeguardDirectoryAccount -ParentDirectory $newDirectory -NewAccountName $acctname -DomainName $DATA.domainName goodResult "New-SafeguardDirectoryAccount" "$acctName successfully created on $($DATA.domainName)" } catch { badResult "New-SafeguardDirectoryAccount" "Unexpected error creating $acctName on $($DATA.domainName)" $_ @@ -113,9 +109,6 @@ try { } } - # TODO - # Can't get this one to work no matter what - # Keep it here and let it "fail" until i figure out wth is going on $diracct = Find-SafeguardDirectoryAccount $DATA.directoryAccounts[0] if ($diracct) { goodResult "Find-SafeguardDirectoryAccount" "Found directory account $($DATA.directoryAccounts[0])" } else { badResult "Find-SafeguardDirectoryAccount" "Did not find directory account $($DATA.directoryAccounts[0])" } diff --git a/cmdlet-tests-entitlement.ps1 b/cmdlet-tests-entitlement.ps1 index 4ca01b5..0e6017f 100644 --- a/cmdlet-tests-entitlement.ps1 +++ b/cmdlet-tests-entitlement.ps1 @@ -24,7 +24,7 @@ $blockInfo = testBlockHeader $TestBlockName try { $entUser = createUser $DATA.userUserName - $entitlement = New-SafeguardEntitlement -Name "$($DATA.entitlementName)" -MemberUsers "$($entUser.UserName)" + $entitlement = New-SafeguardEntitlement -Name "$($DATA.entitlementName)" -MemberUsers "$($entUser.Name)" goodResult "New-SafeguardEntitlement" "Successfully created entitlement $($entitlement.Name)" $entitlement = Get-SafeguardEntitlement -EntitlementToGet $DATA.entitlementName @@ -39,7 +39,7 @@ try { } try { foreach ($acctname in $DATA.assetAccounts.GetEnumerator()) { - $found = Find-SafeguardAssetAccount -QueryFilter "AssetName eq '$($DATA.assetName)' and Name eq '$acctname'" + $found = Find-SafeguardAssetAccount -QueryFilter "Asset.Name eq '$($DATA.assetName)' and Name eq '$acctname'" if ($found) { infoResult "New-SafeguardDirectoryAccount" "$acctname already exists on $($DATA.assetName)" } else { try { diff --git a/cmdlet-tests-event-subscriptions.ps1 b/cmdlet-tests-event-subscriptions.ps1 index 97ce29e..5bafc07 100644 --- a/cmdlet-tests-event-subscriptions.ps1 +++ b/cmdlet-tests-event-subscriptions.ps1 @@ -42,13 +42,17 @@ try { } catch { badResult "Get-SafeguardEventSubscription" "Did NOT retrieve subscription Id=$subscriptionId" $_ } - - $findSubscription = Find-SafeguardEventSubscription -SearchString edited - if ($findSubscription) { - goodResult "Find-SafeguardEventSubscription" "Successfully found event Subscription Id=$($findSubscription.Id)'" - } else { - badResult "Find-SafeguardEventSubscription" "Did NOT find subscription Id=$subscriptionId" - } + try { + infoResult "Find-SafeguardEventSubscription -Verbose -SearchString edited" + $findSubscription = Find-SafeguardEventSubscription -Verbose -SearchString edited + if ($findSubscription) { + goodResult "Find-SafeguardEventSubscription" "Successfully found event Subscription Id=$($findSubscription.Id)'" + } else { + badResult "Find-SafeguardEventSubscription" "Did NOT find subscription Id=$subscriptionId" + } + } catch{ + badResult "Find-SafeguardEventSubscription" "Did NOT find subscription Id=$subscriptionId" $_ + } Remove-SafeguardEventSubscription -SubscriptionId $subscriptionID > $null goodResult "Remove-SafeguardEventSubscription" "Successfully removed event Subscription Id=$($subscription.Id)'" } catch { diff --git a/cmdlet-tests-groups.ps1 b/cmdlet-tests-groups.ps1 index b0bfcf6..526c35d 100644 --- a/cmdlet-tests-groups.ps1 +++ b/cmdlet-tests-groups.ps1 @@ -83,7 +83,7 @@ try { } Add-SafeguardUserGroupMember -Group $userGroup.Name -UserList $DATA.userUsername > $null - $groupMembers = (Get-SafeguardUserGroupMember -Group $userGroup.Name).UserName + $groupMembers = (Get-SafeguardUserGroupMember -Group $userGroup.Name).Name if ($DATA.userUsername -in $groupMembers) { goodResult "Add-SafeguardUserGroupMember" "$($DATA.userUsername) successfully added to $($userGroup.Name)" } @@ -92,7 +92,7 @@ try { } Remove-SafeguardUserGroupMember -Group $userGroup.Name -UserList $DATA.userUsername > $null - $groupMembers = (Get-SafeguardUserGroupMember -Group $userGroup.Name).UserName + $groupMembers = (Get-SafeguardUserGroupMember -Group $userGroup.Name).Name if ($null -eq $groupMembers -or -not $DATA.userUsername -in $groupMembers) { goodResult "Remove-SafeguardUserGroupMember" "$($DATA.userUsername) successfully removed from $($userGroup.Name)" } @@ -101,7 +101,7 @@ try { } Edit-SafeguardUserGroup -GroupToEdit $userGroup.Name -UserList $DATA.userUsername -Operation add > $null - $groupMembers = (Get-SafeguardUserGroupMember -Group $userGroup.Name).UserName + $groupMembers = (Get-SafeguardUserGroupMember -Group $userGroup.Name).Name if ($DATA.userUsername -in $groupMembers) { goodResult "Edit-SafeguardUserGroup" "$($DATA.userUsername) successfully edited to add to $($userGroup.Name)" } @@ -112,7 +112,7 @@ try { Remove-SafeguardUserGroup -GroupToDelete "$($DATA.userGroupName)" > $null goodResult "Remove-SafeguardUserGroup" "Successfully removed $($DATA.userGroupName)" } catch { - badResult "general" "Error adding $userUserName to group $($userGroup.Name)" $_ + badResult "general" "Error adding $($DATA.userUserName) to group $($userGroup.Name)" $_ } } catch { badResult "Groups general" "Unexpected error in Groups tests" $_ diff --git a/cmdlet-tests-miscellaneous.ps1 b/cmdlet-tests-miscellaneous.ps1 index ce629f4..107ef74 100644 --- a/cmdlet-tests-miscellaneous.ps1 +++ b/cmdlet-tests-miscellaneous.ps1 @@ -53,20 +53,15 @@ try { try { $x0 = Get-SafeguardNetworkInterface -Interface "x0" infoResult "Get-SafeguardNetworkInterface" "Existing DNSServers for x0=$($x0.DnsServers -join ' ')" - $setX0 = Set-SafeguardNetworkInterface -Interface "x0" -DnsServers @("10.1.1.37","10.1.1.10") goodResult "Set-SafeguardNetworkInterface" "Successfuly edited X0.DnsServers=$($setX0.DnsServers -join ' ')" - $setX0 = Set-SafeguardNetworkInterface -Interface "x0" -DnsServers $x0.DnsServers infoResult "Set-SafeguardNetworkInterface" "Reset DNSServers for x0=$($x0.DnsServers -join ' ')" - - $x0Dns = Get-SafeguardDnsSuffix -Interface x0 + $x0Dns = Get-SafeguardDnsSuffix infoResult "Get-SafeguardNetworkInterface" "Existing DnsSuffixes for x0=$($x0Dns.DomainNames -join ' ')" - - $setX0Dns = Set-SafeguardDnsSuffix -Interface x0 -DnsSuffixes @("foo.com","bar.com") + $setX0Dns = Set-SafeguardDnsSuffix -DnsSuffixes @("foo.com","bar.com") goodResult "Set-SafeguardDnsSuffix" "Successfuly edited X0 DnsSuffixes=$($setX0Dns.DomainNames -join ' ')" - - $setX0Dns = Set-SafeguardDnsSuffix -Interface x0 -DnsSuffixes "$($x0Dns.DomainNames)" + $setX0Dns = Set-SafeguardDnsSuffix -DnsSuffixes "$($x0Dns.DomainNames)" infoResult "Set-SafeguardDnsSuffix" "Successfuly reset X0 DnsSuffixes=$($setX0Dns.DomainNames -join ' ')" } catch { badResult "Network Interface general" "Unexpected error" $_ diff --git a/cmdlet-tests-noparameter.ps1 b/cmdlet-tests-noparameter.ps1 index 9170592..fa42b27 100644 --- a/cmdlet-tests-noparameter.ps1 +++ b/cmdlet-tests-noparameter.ps1 @@ -60,7 +60,7 @@ $commands = @{ GetSafeguardClusterSummary = @{cmdName = "Get-SafeguardClusterSummary";}; GetSafeguardClusterVpnIpv6Address = @{cmdName = "Get-SafeguardClusterVpnIpv6Address";}; GetSafeguardCsr = @{cmdName = "Get-SafeguardCsr";}; - GetSafeguardDnsSuffix = @{cmdName = "Get-SafeguardDnsSuffix"; cmd = "Get-SafeguardDnsSuffix x0";}; + GetSafeguardDnsSuffix = @{cmdName = "Get-SafeguardDnsSuffix"; cmd = "Get-SafeguardDnsSuffix";}; GetSafeguardEventName = @{cmdName = "Get-SafeguardEventName"; cmd = "(Get-SafeguardEventName) | select -First $DEFAULT_MAXROWS"}; GetSafeguardHealth = @{cmdName = "Get-SafeguardHealth";}; GetSafeguardPlatform = @{cmdName = "Get-SafeguardPlatform"; cmd = "(Get-SafeguardPlatform).DisplayName | select -First $DEFAULT_MAXROWS";}; diff --git a/cmdlet-tests-settings.ps1 b/cmdlet-tests-settings.ps1 index c20d0ec..10c1e0d 100644 --- a/cmdlet-tests-settings.ps1 +++ b/cmdlet-tests-settings.ps1 @@ -19,15 +19,6 @@ $blockInfo = testBlockHeader $TestBlockName # try { - if ($isLTS -or $testBranch -eq "LTS" -or $testBranch -match "^other:") { - if ($sgVersion.Baseline){ - infoResult "New baseline so test both Feature and LTS" - } - else{ - throw "Settings tests are only available on Feature branch" - } - } - Get-SafeguardApplianceSetting | Format-Table goodResult "Get-SafeguardApplianceSetting" "Success" diff --git a/cmdlet-tests-users.ps1 b/cmdlet-tests-users.ps1 index 68cd146..2c87b2d 100644 --- a/cmdlet-tests-users.ps1 +++ b/cmdlet-tests-users.ps1 @@ -28,24 +28,36 @@ try { goodResult "Get-SafeguardUser" "Successfully got $($Data.userUserName)" Set-SafeguardUserPassword -Password $DATA.secUserPassword -UserToEdit $DATA.userUsername > $null - goodResult "Set-SafeguardUserPassword" "$($newUser.UserName) created" + goodResult "Set-SafeguardUserPassword" "$($newUser.Name) created" $newUser = Edit-SafeguardUser -UserToEdit $DATA.userUsername -EmailAddress $DATA.userEmail if (-not $newUser.EmailAddress.Contains($DATA.userEmail)) { badResult "Edit-SafeguardUser" "Email address failed" } else { goodResult "Edit-SafeguardUser" "successfully changed email to $($newUser.EmailAddress)" } - $newUser = Disable-SafeguardUser -UserToEdit $newUser.UserName - goodResult "Disable-SafeguardUser" "User $($newUser.UserName) Disabled is $($newUser.Disabled)" - $newUser = Enable-SafeguardUser -UserToEdit $newUser.UserName - goodResult "Enable-SafeguardUser" "User $($newUser.UserName) Disabled is $($newUser.Disabled)" - - $renamedUser = Rename-SafeguardUser -UserToEdit $newUser.UserName -NewUserName $DATA.renamedUsername - if ($renamedUser.UserName -ne $newUser.UserName) { - goodResult "Rename-SafeguardUser" "User $($newUser.UserName) renamed to $($renamedUser.UserName)" - $newUser = Rename-SafeguardUser -UserToEdit $renamedUser.UserName -NewUserName $newUser.UserName - goodResult "Rename-SafeguardUser" "User $($renamedUser.UserName) changed back to to $($newUser.UserName)" - } - else { - badResult "Rename-SafeguardUser" "User $($newUser.UserName) NOT renamed" + try{ + $newUser = Disable-SafeguardUser -UserToEdit $newUser.Name + goodResult "Disable-SafeguardUser" "User $($newUser.Name) Disabled is $($newUser.Disabled)" + } catch { + badResult "Disable-SafeguardUser" "User $($newUser.Name) " $_ + } + try{ + $newUser = Enable-SafeguardUser -UserToEdit $newUser.Name + goodResult "Enable-SafeguardUser" "User $($newUser.Name) Disabled is $($newUser.Disabled)" + } catch { + badResult "Enable-SafeguardUser" "User $($newUser.Name) " $_ + } + + try{ + $renamedUser = Rename-SafeguardUser -UserToEdit $newUser.Name -NewUserName $DATA.renamedUsername + if ($renamedUser.Name -ne $newUser.Name) { + goodResult "Rename-SafeguardUser" "User $($newUser.Name) renamed to $($renamedUser.Name)" + $newUser = Rename-SafeguardUser -UserToEdit $renamedUser.Name -NewUserName $newUser.Name + goodResult "Rename-SafeguardUser" "User $($renamedUser.Name) changed back to to $($newUser.Name)" + } + else { + badResult "Rename-SafeguardUser" "User $($newUser.Name) NOT renamed" + } + } catch { + badResult "Rename-SafeguardUser" "User $($newUser.Name) NOT renamed" $_ } $foundUser = Find-SafeguardUser $Data.userUserName @@ -54,29 +66,32 @@ try { # create a user to delete, restore, and remove $delResUser = createUser "delres_$($DATA.userUsername)" - Remove-SafeguardUser $delResUser.UserName > $null - infoResult "Deleted User" "Successfully created and deleted user for testing Id=$($delResUser.Id) Name=$($delResUser.UserName)" - + try{ + Remove-SafeguardUser $delResUser.Name > $null + infoResult "Deleted User" "Successfully created and deleted user for testing Id=$($delResUser.Id) Name=$($delResUser.Name)" + } catch{ + badResult "Remove-SafeguardUser" "Failed to remove user: '$($delResUser.Name)'." $_ + } try { - $delUserList = (Get-SafeguardDeletedUser) | Where-Object {$_.UserName -ieq "$($delResUser.UserName)"} + $delUserList = (Get-SafeguardDeletedUser) | Where-Object {$_.Name -ieq "$($delResUser.Name)"} goodResult "Get-SafeguardDeletedUser" "Successfully retrieved $($delUserList.Count) deleted users" } catch { - badResult "Get-SafeguardDeletedUser" "Failed to retrieve deleted user $($delResUser.UserName)" + badResult "Get-SafeguardDeletedUser" "Failed to retrieve deleted user $($delResUser.Name)" } try { $restored = Restore-SafeguardDeletedUser -UserToRestore $delResUser.Id - goodResult "Restore-SafeguardDeletedUser" "Successfully restored deleted user Id=$($delResUser.Id) Name=$($restored.UserName), new Id=$($restored.Id)" + goodResult "Restore-SafeguardDeletedUser" "Successfully restored deleted user Id=$($delResUser.Id) Name=$($restored.Name), new Id=$($restored.Id)" } catch { - badResult "Restore-SafeguardDeletedUser" "Failed to restore deleted user $($delResUser.UserName)" + badResult "Restore-SafeguardDeletedUser" "Failed to restore deleted user $($delResUser.Name)" } try { Remove-SafeguardUser $restored.Id > $null Remove-SafeguardDeletedUser -UserToDelete $restored.Id > $null - goodResult "Remove-SafeguardDeletedUser" "Successfully purged deleted user Id=$($restored.Id) Name=$($restored.UserName)" + goodResult "Remove-SafeguardDeletedUser" "Successfully purged deleted user Id=$($restored.Id) Name=$($restored.Name)" } catch { - badResult "Remove-SafeguardDeletedUser" "Failed to purge deleted user Id=$($restored.Id) $($delResUser.UserName)" + badResult "Remove-SafeguardDeletedUser" "Failed to purge deleted user Id=$($restored.Id) $($delResUser.Name)" } } catch { badResult "Users general" "Unexpected error in Users test" $_ diff --git a/harness-data.ps1 b/harness-data.ps1 index 83db80b..de78593 100644 --- a/harness-data.ps1 +++ b/harness-data.ps1 @@ -99,10 +99,10 @@ $DATA = @{ # Domain information used for testing directory, identity provider, and certificates. domainName = "c.sg.lab"; - netBIOS = "JSHDEVVM"; - domainAdmin = "madmin-c"; - domainPassword = "test123" | ConvertTo-SecureString -AsPlainText -Force; - directoryAccounts = @("muser-c","muser2-c","muser3-c"); + netBIOS = "CSG"; + domainAdmin = "admin-c-ps"; + domainPassword = "Test1234" | ConvertTo-SecureString -AsPlainText -Force; + directoryAccounts = @("ps-user-c-1","ps-user-c-2","ps-user-c-3"); # Certificate Signing Request stuff newCsrSubject = "CN=Bedrock,OU=Yabba,O=Dabba"; diff --git a/harness-functions.ps1 b/harness-functions.ps1 index d66c8a7..37677a8 100644 --- a/harness-functions.ps1 +++ b/harness-functions.ps1 @@ -179,7 +179,7 @@ function showData { # Assumes connect has already been done. function createUser($uname) { try { - $user = Find-SafeguardUser -QueryFilter "UserName ieq '$uname'" + $user = Find-SafeguardUser -QueryFilter "Name ieq '$uname'" if ($user) { infoResult "Find-SafeguardUser" "$($user.UserName) already exists" } else { @@ -191,7 +191,6 @@ function createUser($uname) { badResult "createUser" "Unexpected error fetching or creating $uname" $_.Exception throw $_.Exception } - return $user }