Skip to content

Commit 2adad8a

Browse files
Ryan Johnsontenthirtyam
Ryan Johnson
authored and
tenthirtyam
committed
feat: add sddcmanager expiration cmdlets (#97)
- Added `Request-SddcManagerPasswordExpiration` cmdlet and docs to retrieve the password expiration policy for the default local users on an SDDC Manager appliance. - Added `Update-SddcManagerPasswordExpiration` cmdlet and docs to update the password expiration policy for the default local users on an SDDC Manager appliance. - Updated module version and build to v1.4.0.1000. - Updated `CHANGELOG.md`. Ref: #70 Signed-off-by: Ryan Johnson <[email protected]>
1 parent 77bb5c1 commit 2adad8a

6 files changed

+477
-2
lines changed

Diff for: ‎CHANGELOG.md

+5
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,11 @@
44

55
> Release Date: Unreleased
66
7+
Enhancement:
8+
9+
- Added `Request-SddcManagerPasswordExpiration` cmdlet to retrieve the password expiration policy for the default local users on an SDDC Manager appliance. [GH-97](https://github.com/vmware/powershell-module-for-vmware-cloud-foundation-password-management/pull/97)
10+
- Added `Update-SddcManagerPasswordExpiration` cmdlet to update the password expiration policy for the default local users on an SDDC Manager appliance. [GH-97](https://github.com/vmware/powershell-module-for-vmware-cloud-foundation-password-management/pull/97)
11+
712
Bug Fixes:
813

914
- Updated `Get-PasswordPolicyDefault` to include support for version 4.4.1. [GH-95](https://github.com/vmware/powershell-module-for-vmware-cloud-foundation-password-management/pull/95)

Diff for: ‎VMware.CloudFoundation.PasswordManagement.psm1

+158-1
Original file line numberDiff line numberDiff line change
@@ -1505,6 +1505,90 @@ Function Convert-CssClassStyle {
15051505
##########################################################################
15061506
#Region Begin SDDC Manager Password Management Function ######
15071507

1508+
Function Request-SddcManagerPasswordExpiration {
1509+
<#
1510+
.SYNOPSIS
1511+
Retrieves the password expiration policy for an SDDC Manager.
1512+
1513+
.DESCRIPTION
1514+
The Request-SddcManagerPasswordExpiration cmdlet retrieves the password expiration policy for an SDDC Manager.
1515+
The cmdlet connects to the SDDC Manager using the -server, -user, and -pass values:
1516+
- Validates that network connectivity and authentication is possible to SDDC Manager
1517+
- Retrieves the password expiration policy
1518+
1519+
.EXAMPLE
1520+
Request-SddcManagerPasswordExpiration -server sfo-vcf01.sfo.rainpole.io -user [email protected] -pass VMw@re1! -rootPass VMw@re1!
1521+
This example retrieves the password expiration policy for an SDDC Manager.
1522+
1523+
.EXAMPLE
1524+
Request-SddcManagerPasswordExpiration -server sfo-vcf01.sfo.rainpole.io -user [email protected] -pass VMw@re1! -rootPass VMw@re1! -drift -reportPath "F:\Reporting" -policyFile "passwordPolicyConfig.json"
1525+
This example retrieves the password expiration policy for an SDDC Manager and compares the configuration against passwordPolicyConfig.json.
1526+
1527+
.EXAMPLE
1528+
Request-SddcManagerPasswordExpiration -server sfo-vcf01.sfo.rainpole.io -user [email protected] -pass VMw@re1! -rootPass VMw@re1! -drift
1529+
This example retrieves the password expiration policy for an SDDC Manager and compares the configuration against the product defaults.
1530+
1531+
.PARAMETER server
1532+
The fully qualified domain name of the SDDC Manager instance.
1533+
1534+
.PARAMETER user
1535+
The username to authenticate to the SDDC Manager instance.
1536+
1537+
.PARAMETER pass
1538+
The password to authenticate to the SDDC Manager instance.
1539+
1540+
.PARAMETER rootPass
1541+
The password for the SDDC Manager appliance root account.
1542+
1543+
.PARAMETER drift
1544+
Switch to compare the current configuration against the product defaults or a JSON file.
1545+
1546+
.PARAMETER reportPath
1547+
The path to save the policy report.
1548+
1549+
.PARAMETER policyFile
1550+
The path to the password policy file to compare against.
1551+
#>
1552+
1553+
Param (
1554+
[Parameter (Mandatory = $true)] [ValidateNotNullOrEmpty()] [String]$server,
1555+
[Parameter (Mandatory = $true)] [ValidateNotNullOrEmpty()] [String]$user,
1556+
[Parameter (Mandatory = $true)] [ValidateNotNullOrEmpty()] [String]$pass,
1557+
[Parameter (Mandatory = $true)] [ValidateNotNullOrEmpty()] [String]$rootPass,
1558+
[Parameter (Mandatory = $false, ParameterSetName = 'drift')] [ValidateNotNullOrEmpty()] [Switch]$drift,
1559+
[Parameter (Mandatory = $false)] [ValidateNotNullOrEmpty()] [String]$reportPath,
1560+
[Parameter (Mandatory = $false)] [ValidateNotNullOrEmpty()] [String]$policyFile
1561+
)
1562+
1563+
# Define the Command Switch
1564+
if ($PsBoundParameters.ContainsKey('drift')) { if ($PsBoundParameters.ContainsKey('policyFile')) { $commandSwitch = " -drift -reportPath '$reportPath' -policyFile '$policyFile'" } else { $commandSwitch = " -drift" }} else { $commandSwitch = "" }
1565+
[Array]$localUsers = '"root","vcf","backup"'
1566+
$pvsCmdlet = "Request-LocalUserPasswordExpiration"; $customSwitch = " -domain $((Get-VCFWorkloadDomain | Where-Object {$_.type -eq "MANAGEMENT"}).name) -product sddcManager -vmName $(($server.Split("."))[-0]) -guestUser root -guestPassword $rootPass -localUser $localUsers"
1567+
$command = $pvsCmdlet + " -server $server -user $user -pass $pass" + $commandSwitch + $customSwitch
1568+
1569+
Try {
1570+
if (Test-VCFConnection -server $server) {
1571+
if (Test-VCFAuthentication -server $server -user $user -pass $pass) {
1572+
if (($vcfVcenterDetails = Get-vCenterServerDetail -server $server -user $user -pass $pass -domainType MANAGEMENT)) {
1573+
if (Test-vSphereConnection -server $($vcfVcenterDetails.fqdn)) {
1574+
if (Test-vSphereAuthentication -server $vcfVcenterDetails.fqdn -user $vcfVcenterDetails.ssoAdmin -pass $vcfVcenterDetails.ssoAdminPass) {
1575+
$sddcManagerLocalPasswordPolicyObject = Invoke-Expression $command
1576+
if ($sddcManagerLocalPasswordPolicyObject) { $sddcManagerLocalPasswordPolicyObject }
1577+
}
1578+
}
1579+
}
1580+
}
1581+
}
1582+
} Catch {
1583+
Debug-ExceptionWriter -object $_
1584+
} Finally {
1585+
if ($global:DefaultVIServers) {
1586+
Disconnect-VIServer -Server $global:DefaultVIServers -Confirm:$false -WarningAction SilentlyContinue
1587+
}
1588+
}
1589+
}
1590+
Export-ModuleMember -Function Request-SddcManagerPasswordExpiration
1591+
15081592
Function Request-SddcManagerPasswordComplexity {
15091593
<#
15101594
.SYNOPSIS
@@ -1684,6 +1768,79 @@ Function Request-SddcManagerAccountLockout {
16841768
}
16851769
Export-ModuleMember -Function Request-SddcManagerAccountLockout
16861770

1771+
Function Update-SddcManagerPasswordExpiration {
1772+
<#
1773+
.SYNOPSIS
1774+
Updates the password expiration policy for the default local users on an SDDC Manager.
1775+
1776+
.DESCRIPTION
1777+
The Update-SddcManagerPasswordExpiration cmdlet configures the password complexity policy for an SDDC Manager.
1778+
The cmdlet connects to the SDDC Manager using the -server, -user, and -pass values:
1779+
- Validates that network connectivity and authentication is possible to SDDC Manager
1780+
- Configures the password expiration policy
1781+
1782+
.EXAMPLE
1783+
Update-SddcManagerPasswordExpiration -server sfo-vcf01.sfo.rainpole.io -user [email protected] -pass VMw@re1! -rootPass VMw@re1! -minDays 0 -maxDays 90 -warnDays 14
1784+
This example updates the password expiration policy for the default local users on an SDDC Manager.
1785+
1786+
.PARAMETER server
1787+
The fully qualified domain name of the SDDC Manager instance.
1788+
1789+
.PARAMETER user
1790+
The username to authenticate to the SDDC Manager instance.
1791+
1792+
.PARAMETER pass
1793+
The password to authenticate to the SDDC Manager instance.
1794+
1795+
.PARAMETER rootPass
1796+
The password for the SDDC Manager appliance root account.
1797+
1798+
.PARAMETER minDays
1799+
The minimum number of days between password changes.
1800+
1801+
.PARAMETER maxDays
1802+
The maximum number of days between password changes.
1803+
1804+
.PARAMETER warnDays
1805+
The number of days of warning before password expires.
1806+
1807+
.PARAMETER detail
1808+
Return the details of the policy. One of true or false. Default is true.
1809+
#>
1810+
1811+
Param (
1812+
[Parameter (Mandatory = $true)] [ValidateNotNullOrEmpty()] [String]$server,
1813+
[Parameter (Mandatory = $true)] [ValidateNotNullOrEmpty()] [String]$user,
1814+
[Parameter (Mandatory = $true)] [ValidateNotNullOrEmpty()] [String]$pass,
1815+
[Parameter (Mandatory = $true)] [ValidateNotNullOrEmpty()] [String]$rootPass,
1816+
[Parameter (Mandatory = $true)] [ValidateRange(0, 9999)] [Int]$minDays,
1817+
[Parameter (Mandatory = $true)] [ValidateRange(0, 9999)] [Int]$maxDays,
1818+
[Parameter (Mandatory = $true)] [ValidateRange(0, 9999)] [Int]$warnDays,
1819+
[Parameter (Mandatory = $false)] [ValidateSet('true', 'false')] [String]$detail = 'true'
1820+
)
1821+
1822+
[Array]$localUsers = '"root","vcf","backup"'
1823+
$cmdlet = 'Update-LocalUserPasswordExpiration'; $customSwitch = " -domain $((Get-VCFWorkloadDomain | Where-Object {$_.type -eq 'MANAGEMENT'}).name) -vmName $(($server.Split('.'))[-0]) -guestUser root -guestPassword $rootPass -localUser $localUsers -minDays $minDays -maxDays $maxDays -warnDays $warnDays -detail $detail"
1824+
$command = $cmdlet + " -server $server -user $user -pass $pass" + $customSwitch
1825+
1826+
Try {
1827+
if (Test-VCFConnection -server $server) {
1828+
if (Test-VCFAuthentication -server $server -user $user -pass $pass) {
1829+
Invoke-Expression -Command $command
1830+
}
1831+
}
1832+
}
1833+
Catch {
1834+
Debug-ExceptionWriter -object $_
1835+
}
1836+
Finally {
1837+
if ($global:DefaultVIServers) {
1838+
Disconnect-VIServer -Server $global:DefaultVIServers -Confirm:$false
1839+
}
1840+
}
1841+
}
1842+
Export-ModuleMember -Function Update-SddcManagerPasswordExpiration
1843+
16871844
Function Update-SddcManagerPasswordComplexity {
16881845
<#
16891846
.SYNOPSIS
@@ -8383,7 +8540,7 @@ Function Update-LocalUserPasswordExpiration {
83838540

83848541
.EXAMPLE
83858542
Update-LocalUserPasswordExpiration -server sfo-vcf01.sfo.rainpole.io -user [email protected] -pass VMw@re1! -domain sfo-m01 -vmName sfo-wsa01 -guestUser root -guestPassword VMw@re1! -localUser "root","sshuser" -minDays 0 -maxDays 999 -warnDays 14
8386-
This example updates the global password expiration policy for a vCenter Server instance
8543+
This example updates the password expiration policy for the specified local users on the specified virtual machine.
83878544

83888545
.PARAMETER server
83898546
The fully qualified domain name of the SDDC Manager instance.

Diff for: ‎docs/documentation/functions/Request-SddcManagerPasswordExpiration.md

+163
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
# Request-SddcManagerPasswordExpiration
2+
3+
## Synopsis
4+
5+
Retrieves the password expiration policy for an SDDC Manager.
6+
7+
## Syntax
8+
9+
```powershell
10+
Request-SddcManagerPasswordExpiration -server <String> -user <String> -pass <String> -rootPass <String> [-drift] [-reportPath <String>] [-policyFile <String>] [<CommonParameters>]
11+
```
12+
13+
## Description
14+
15+
The `Request-SddcManagerPasswordExpiration` cmdlet retrieves the password expiration policy for an SDDC Manager.
16+
The cmdlet connects to SDDC Manager using the `-server`, `-user`, and `-pass` values:
17+
18+
- Validates that network connectivity and authentication is possible to SDDC Manager
19+
- Retrieves the password expiration policy
20+
21+
## Examples
22+
23+
### Example 1
24+
25+
```powershell
26+
Request-SddcManagerPasswordExpiration -server sfo-vcf01.sfo.rainpole.io -user [email protected] -pass VMw@re1! -rootPass VMw@re1!
27+
```
28+
29+
This example retrieves the password expiration policy for an SDDC Manager.
30+
31+
### Example 2
32+
33+
```powershell
34+
Request-SddcManagerPasswordExpiration -server sfo-vcf01.sfo.rainpole.io -user [email protected] -pass VMw@re1! -rootPass VMw@re1! -drift -reportPath "F:\Reporting" -policyFile "passwordPolicyConfig.json"
35+
```
36+
37+
This example retrieves the password expiration policy for an SDDC Manager and compares the configuration against passwordPolicyConfig.json.
38+
39+
### Example 3
40+
41+
```powershell
42+
Request-SddcManagerPasswordExpiration -server sfo-vcf01.sfo.rainpole.io -user [email protected] -pass VMw@re1! -rootPass VMw@re1! -drift
43+
```
44+
45+
This example retrieves the password expiration policy for an SDDC Manager and compares the configuration against the product defaults.
46+
47+
## Parameters
48+
49+
### -server
50+
51+
The fully qualified domain name of the SDDC Manager instance.
52+
53+
```yaml
54+
Type: String
55+
Parameter Sets: (All)
56+
Aliases:
57+
58+
Required: True
59+
Position: Named
60+
Default value: None
61+
Accept pipeline input: False
62+
Accept wildcard characters: False
63+
```
64+
65+
### -user
66+
67+
The username to authenticate to the SDDC Manager instance.
68+
69+
```yaml
70+
Type: String
71+
Parameter Sets: (All)
72+
Aliases:
73+
74+
Required: True
75+
Position: Named
76+
Default value: None
77+
Accept pipeline input: False
78+
Accept wildcard characters: False
79+
```
80+
81+
### -pass
82+
83+
The password to authenticate to the SDDC Manager instance.
84+
85+
```yaml
86+
Type: String
87+
Parameter Sets: (All)
88+
Aliases:
89+
90+
Required: True
91+
Position: Named
92+
Default value: None
93+
Accept pipeline input: False
94+
Accept wildcard characters: False
95+
```
96+
97+
### -rootPass
98+
99+
The password for the SDDC Manager appliance root account.
100+
101+
```yaml
102+
Type: String
103+
Parameter Sets: (All)
104+
Aliases:
105+
106+
Required: True
107+
Position: Named
108+
Default value: None
109+
Accept pipeline input: False
110+
Accept wildcard characters: False
111+
```
112+
113+
### -drift
114+
115+
Switch to compare the current configuration against the product defaults or a JSON file.
116+
117+
```yaml
118+
Type: SwitchParameter
119+
Parameter Sets: (All)
120+
Aliases:
121+
122+
Required: False
123+
Position: Named
124+
Default value: False
125+
Accept pipeline input: False
126+
Accept wildcard characters: False
127+
```
128+
129+
### -reportPath
130+
131+
The path to save the policy report.
132+
133+
```yaml
134+
Type: String
135+
Parameter Sets: (All)
136+
Aliases:
137+
138+
Required: False
139+
Position: Named
140+
Default value: None
141+
Accept pipeline input: False
142+
Accept wildcard characters: False
143+
```
144+
145+
### -policyFile
146+
147+
The path to the password policy file to compare against.
148+
149+
```yaml
150+
Type: String
151+
Parameter Sets: (All)
152+
Aliases:
153+
154+
Required: False
155+
Position: Named
156+
Default value: None
157+
Accept pipeline input: False
158+
Accept wildcard characters: False
159+
```
160+
161+
### Common Parameters
162+
163+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).

Diff for: ‎docs/documentation/functions/Update-LocalUserPasswordExpiration.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ The cmdlet connects to SDDC Manager using the `-server`, `-user`, and `-pass` va
2727
Update-LocalUserPasswordExpiration -server sfo-vcf01.sfo.rainpole.io -user [email protected] -pass VMw@re1! -domain sfo-m01 -vmName sfo-wsa01 -guestUser root -guestPassword VMw@re1! -localUser "root","sshuser" -minDays 0 -maxDays 999 -warnDays 14
2828
```
2929

30-
This example updates the global password expiration policy for a vCenter Server instance.
30+
This example updates the password expiration policy for the specified local users on the specified virtual machine.
3131

3232
## Parameters
3333

0 commit comments

Comments
 (0)