Core/Unprotect-TestSecret.ps1
|
function Unprotect-TestSecret { <# .SYNOPSIS Recovers a secret that Protect-TestSecret wrote .DESCRIPTION The inverse of Protect-TestSecret, switched on the method the record says was used. A DPAPI value is bound to the user and machine that created it, so the failure that matters is a record copied from elsewhere; the error says that, and says to re-run the bootstrap on this machine, rather than reporting a cryptographic detail. .PARAMETER Method How the value was protected: DPAPI or None. .PARAMETER Value The stored value. .OUTPUTS System.String. The secret. .EXAMPLE PS> Unprotect-TestSecret -Method DPAPI -Value $record.tokenProtected DESCRIPTION: Recovers a secret from a credential record OUTPUT: The plaintext USE CASE: A provider's Import-<Provider>Credential .NOTES Author: Jeffrey Stuhr Blog: https://www.techbyjeff.net LinkedIn: https://www.linkedin.com/in/jeffrey-stuhr-034214aa/ #> [CmdletBinding()] [OutputType([string])] param( [Parameter(Mandatory = $true)] [ValidateSet('DPAPI', 'None')] [string]$Method, [Parameter(Mandatory = $true)] [ValidateNotNullOrEmpty()] [string]$Value ) if ($Method -eq 'None') { return $Value } try { $secure = ConvertTo-SecureString -String $Value -ErrorAction Stop return ConvertFrom-TestSecureString -SecureString $secure } catch { throw ('The stored secret could not be decrypted. DPAPI ties it to the user account and ' + 'machine that created it, so this usually means the record was copied from elsewhere. ' + 'Re-run New-TestServiceApp -Force on this machine to mint a new one. ' + "Underlying error: $($_.Exception.Message)") } } |