Get-SecureSetting.ps1
|
function Get-SecureSetting { <# .Synopsis Gets encrypted settings stored in the registry .Description Gets secured user settings stored in the registry .Example Get-SecureSetting .Example Get-SecureSetting MySetting .Example Get-SecureSetting MySetting -Decrypt .Example Get-SecureSetting MySetting -ValueOnly .Link https://www.youtube.com/watch?v=0haXavQU_nY .Link Add-SecureSetting .Link Remove-SecureSetting .Link ConvertTo-SecureString .Link ConvertFrom-SecureString #> [OutputType('SecureSetting')] param( # The name of the secure setting [Parameter(Position=0,ValueFromPipelineByPropertyName=$true)] [String] $Name, # The type of the secure setting [Parameter(Position=1,ValueFromPipelineByPropertyName=$true)] [Type] $Type, # If set, will decrypt the setting value [Parameter(ValueFromPipelineByPropertyName=$true)] [Switch] $Decrypted, # If set, will decrypt the setting value and return the data [switch] $ValueOnly ) begin { $getSecureSetting = { $Obj = $_ $typeName = $_.pschildName foreach ($propName in ($obj.psobject.properties | Select-Object -ExpandProperty Name)) { if ('PSPath', 'PSParentPath', 'PSChildName', 'PSProvider' -contains $propName) { $obj.psobject.properties.Remove($propname) } } $Obj.psobject.properties | ForEach-Object { $secureSetting = New-Object PSObject $null = $secureSetting.pstypenames.add('SecureSetting') $secureSetting | Add-Member NoteProperty Name $_.Name -PassThru | Add-Member NoteProperty Type ($typename -as [Type]) -PassThru | Add-Member NoteProperty EncryptedData $_.Value -PassThru } } } process { # If Request and Response are present, Get-SecureSetting acts like Get-WebConfigurationSetting if ($Request -and $Response -and -not $inPSNode) { if ($Request -and $request.Params -and $request.Params['Path_Info']) { $path ="$((Split-Path $request['Path_Info']))" $webConfigStore = [Web.Configuration.WebConfigurationManager]::OpenWebConfiguration($path) } else { # Otherwise, use the global one $webConfigStore = [Web.Configuration.WebConfigurationManager]::OpenWebConfiguration($null) } #endregion Load Config Store if ($name) { # Get the custom setting $customSetting = $webConfigStore.AppSettings.Settings["$name"]; # If there is a value, return it. if ($CustomSetting) { $CustomSetting.Value } } return } #region Create Registry Location If It Doesn't Exist $regSubKey = if ($myInvocation.MyCommand.ScriptBlock.Module.Name) { $myInvocation.MyCommand.ScriptBlock.Module.Name } else { "Pipeworks" } $registryPath = "HKCU:\Software\Start-Automating\$regSubKey" $fullRegistryPath = "$registryPath\$($psCmdlet.ParameterSetName)" if (-not (Test-Path $fullRegistryPath)) { $null = New-Item $fullRegistryPath -Force } #endregion Create Registry Location If It Doesn't Exist Get-ChildItem $registryPath | Get-ItemProperty | ForEach-Object $getSecureSetting | Where-Object { if ($psBoundParameters.Name -and $_.Name -notlike "$name*") { return } if ($psBoundParameters.Type -and $_.Type -ne $Type) { return } $true } | ForEach-Object -Begin { $TempCredTable = @{} } -Process { if (-not ($decrypted -or $ValueOnly)) { return $_ } #region Decrypt and Convert Output $inputObject = $_ if ([Hashtable], [string] -contains $_.Type) { # Create a credential to unpack it $convertedAgain = New-Object Management.Automation.PSCredential ' ', ($_.EncryptedData | ConvertTo-SecureString) $decryptedValue= $convertedAgain.GetNetworkCredential().Password if ($_.Type -eq [Hashtable]) { $decryptedValue = . ([ScriptBlock]::Create($decryptedValue)) } } elseif ($_.Type -eq [Security.SecureString]) { $decryptedValue= ($_.EncryptedData | ConvertTo-SecureString) } elseif ($_.Type -eq [Management.Automation.PSCredential]) { # Create a credential to unpack the username, then create a credential with the unpacked password $baseName = $_.Name -ireplace "_UserName", "" if ($_.Name -like "*_UserName") { $convertedAgain = New-Object Management.Automation.PSCredential ' ', ($_.EncryptedData | ConvertTo-SecureString) $decryptedValue= $convertedAgain.GetNetworkCredential().Password $tempCredTable["UserName"] = $decryptedValue } elseif ($_.Name -like "*_Password") { $tempCredTable["Password"] = ($_.EncryptedData | ConvertTo-SecureString) } } $null = $inputObject.psobject.properties.Remove('EncryptedData') if ($inputObject.Name -notlike "*_UserName") { if ($inputObject.Name -like "*_Password" -and $tempCredTable.UserName) { $inputObject | Add-Member NoteProperty Name $baseName -Force $decryptedValue =New-Object Management.Automation.PSCredential $tempCredTable["UserName"], $tempCredTable["PassWord"] } $inputObject | Add-Member NoteProperty DecryptedData $decryptedValue -PassThru | ForEach-Object { if ($ValueOnly) { $_.DecryptedData } else { $_ } } } #endregion Decrypt and Convert Output } } } |