Private/Checks/VCenter/Test-VcfVcenterPasswordPolicyExpiry.ps1

# Copyright (c) 2026 Broadcom. All Rights Reserved.
# Broadcom Confidential. The term "Broadcom" refers to Broadcom Inc.
# and/or its subsidiaries.
#
# =============================================================================
#
# SOFTWARE LICENSE AGREEMENT
#
# Copyright (c) CA, Inc. All rights reserved.
#
# You are hereby granted a non-exclusive, worldwide, royalty-free license
# under CA, Inc.'s copyrights to use, copy, modify, and distribute this
# software in source code or binary form for use in connection with CA, Inc.
# products.
#
# This copyright notice shall be included in all copies or substantial
# portions of the software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
# IN THE SOFTWARE.
#
# =============================================================================
function Test-VcfVcenterPasswordPolicyExpiry {

    <#
        .SYNOPSIS
        Checks the SSO administrator (PSC/SYSTEM) credential password expiry date for every
        vCenter attached to SDDC Manager.

        .DESCRIPTION
        Queries SSO administrator (PSC/SYSTEM) credential expiration for every vCenter attached to SDDC Manager.

        Retrieves credential IDs via Invoke-VcfGetCredentials, initiates a password expiration task via
        Invoke-VcfGetPasswordExpiration, and polls the task until completion using Invoke-VcfGetPasswordExpirationByTaskID.

        Evaluation logic:
        - Fail: One or more SSO administrator credentials are expired.
        - Warning: One or more SSO administrator credentials expire within WarningThresholdDays (default 30 days).
        - Pass: All SSO administrator credentials are active and beyond WarningThresholdDays.
        - Error: No PSC/SYSTEM credential is found, task execution fails, or polling exceeds MaxPollAttempts.

        Populates a structured Rows table detailing Username, Days Until, Expiry Date, and Status.
        Delegates per-vCenter outcome aggregation to New-VcfCheckPerDomainResults.

        .PARAMETER Context
        The VcfCheck.Context object. Must already be connected to SDDC Manager.

        .PARAMETER DisplayName
        Optional friendly display name for the check result.

        .PARAMETER WarningThresholdDays
        Number of days before expiry to raise a Warning instead of a Pass. Default 30.

        .PARAMETER MaxPollAttempts
        Maximum number of status polls before giving up. Default 10.

        .PARAMETER PollDelaySeconds
        Delay between polls in seconds. Default 5.

        .OUTPUTS
        [PSObject[]] Per-vCenter check results generated by New-VcfCheckPerDomainResults.
    #>


    [CmdletBinding()]
    [OutputType([PSObject])]
    Param (
        [Parameter(Mandatory = $true)] [PSObject]$Context,
        [Parameter(Mandatory = $false)] [String]$DisplayName = '',
        [Parameter(Mandatory = $false)] [ValidateRange(1, 3650)] [Int]$WarningThresholdDays = 30,
        [Parameter(Mandatory = $false)] [ValidateRange(1, 60)] [Int]$MaxPollAttempts = 10,
        [Parameter(Mandatory = $false)] [ValidateRange(0, 300)] [Int]$PollDelaySeconds = 5
    )

    $startedAt = Get-Date
    $checkId = 'vcenter_password_policy_expiry'
    $catalogEntry = (Get-VcfCheckCatalog)[$checkId]
    $displayName = if ([String]::IsNullOrEmpty($DisplayName)) { $catalogEntry.displayName } else { $DisplayName }
    $blocking = Get-VcfCheckBlockingStatusFromCatalog -CheckId $checkId
    $validationCriteria = $catalogEntry.validationCriteria
    $remediation = $catalogEntry.remediation

    try {
        $vcenterFqdns = Get-VcfCheckAllVCenterFqdns -Context $Context
    } catch {
        return New-VcfCheckResult -CheckId $checkId -Area vCenter -Status Error `
            -Exception $_.Exception.Message -ValidationCriteria $validationCriteria -Remediation $remediation -StartedAt $startedAt -CompletedAt (Get-Date) -DisplayName $displayName
    }

    $outcomes = foreach ($vcenterFqdn in $vcenterFqdns) {
        $iterationStartedAt = Get-Date
        $outcome = & {
            try {
                $ssoDomainName = Get-VcfCheckVCenterSsoDomainName -Context $Context -Fqdn $vcenterFqdn
                $ssoCredentials = @((Invoke-VcfGetCredentials -ResourceType PSC -AccountType SYSTEM -DomainName $ssoDomainName -ErrorAction Stop).Elements)
            } catch {
                return [PSCustomObject]@{ VCenterFqdn = $vcenterFqdn; Status = 'Error'; Detail = $_.Exception.Message; Rows = @(); Blocking = $blocking }
            }

            if ($ssoCredentials.Count -eq 0) {
                return [PSCustomObject]@{ VCenterFqdn = $vcenterFqdn; Status = 'Error'; Detail = "No PSC/SYSTEM (SSO administrator) credential found for domain `"$ssoDomainName`"."; Rows = @(); Blocking = $blocking }
            }

            try {
                $spec = Initialize-VcfCredentialsExpirationSpec -ResourceType PSC -CredentialIds @($ssoCredentials.Id)
                $task = Invoke-VcfGetPasswordExpiration -CredentialsExpirationSpec $spec -ErrorAction Stop
            } catch {
                return [PSCustomObject]@{ VCenterFqdn = $vcenterFqdn; Status = 'Error'; Detail = $_.Exception.Message; Rows = @(); Blocking = $blocking }
            }

            $status = [String]$task.Status
            $attempt = 0
            while ($status -match 'IN_?PROGRESS|PENDING' -and $attempt -lt $MaxPollAttempts) {
                Start-Sleep -Seconds $PollDelaySeconds
                try {
                    $task = Invoke-VcfGetPasswordExpirationByTaskID -Id $task.Id -ErrorAction Stop
                } catch {
                    return [PSCustomObject]@{ VCenterFqdn = $vcenterFqdn; Status = 'Error'; Detail = $_.Exception.Message; Rows = @(); Blocking = $blocking }
                }
                $status = [String]$task.Status
                $attempt++
            }

            if ($status -match 'IN_?PROGRESS|PENDING') {
                return [PSCustomObject]@{ VCenterFqdn = $vcenterFqdn; Status = 'Error'; Detail = "Credential-expiration task `"$($task.Id)`" did not complete after $MaxPollAttempts poll(s)."; Rows = @(); Blocking = $blocking }
            }

            $now = [DateTime]::UtcNow
            $expired = [System.Collections.Generic.List[String]]::new()
            $expiringSoon = [System.Collections.Generic.List[String]]::new()
            $rows = @($task.Elements) | ForEach-Object {
                $expiryString = $_.Expiry.ExpiryDate
                if ([String]::IsNullOrEmpty($expiryString)) {
                    return [PSCustomObject]@{
                        Username       = $_.Username
                        'Days Until'   = 'Unknown'
                        'Expiry Date'  = 'Unknown'
                        Status         = 'Unknown'
                    }
                }
                $expiryDate = [DateTime]::Parse($expiryString, [System.Globalization.CultureInfo]::InvariantCulture, [System.Globalization.DateTimeStyles]::AssumeUniversal -bor [System.Globalization.DateTimeStyles]::AdjustToUniversal)
                $daysUntilExpiry = [Math]::Max(0, ($expiryDate - $now).Days)
                $isoExpiry = $expiryDate.ToString('o')
                $credentialStatus = 'Pass'
                if ($expiryDate -lt $now) {
                    $expired.Add($_.Username)
                    $credentialStatus = 'Expired'
                } elseif ($expiryDate -lt $now.AddDays($WarningThresholdDays)) {
                    $expiringSoon.Add($_.Username)
                    $credentialStatus = 'Expiring Soon'
                }
                [PSCustomObject]@{
                    Username       = $_.Username
                    'Days Until'   = $daysUntilExpiry
                    'Expiry Date'  = $isoExpiry
                    Status         = $credentialStatus
                }
            } | Sort-Object -Property Username

            if ($expired.Count -gt 0) {
                return [PSCustomObject]@{ VCenterFqdn = $vcenterFqdn; Status = 'Fail'; Detail = "Expired SSO administrator credential(s): $($expired -join '; ')"; Rows = $rows; Blocking = $blocking }
            } elseif ($expiringSoon.Count -gt 0) {
                return [PSCustomObject]@{ VCenterFqdn = $vcenterFqdn; Status = 'Warning'; Detail = "SSO administrator credential(s) expiring within $WarningThresholdDays day(s): $($expiringSoon -join '; ')"; Rows = $rows; Blocking = $blocking }
            }
            return [PSCustomObject]@{ VCenterFqdn = $vcenterFqdn; Status = 'Pass'; Detail = $null; Rows = $rows; Blocking = $blocking }
        }
        $outcome | Add-Member -NotePropertyName StartedAt -NotePropertyValue $iterationStartedAt -Force
        $outcome | Add-Member -NotePropertyName CompletedAt -NotePropertyValue (Get-Date) -Force
        $outcome
    }

    return New-VcfCheckPerDomainResults -Context $Context -PerVCenterOutcome $outcomes -CheckId $checkId -Area vCenter `
        -ValidationCriteria $validationCriteria -Remediation $remediation -StartedAt $startedAt -DisplayName $displayName
}