Public/Resources/New-SIAWindowsStrongAccount.ps1
|
function New-SIAWindowsStrongAccount { <# .SYNOPSIS Adds a Windows strong account to SIA. .DESCRIPTION Calls the Add strong account operation (SecretDto schema). The secret material and target-specific details are genuinely polymorphic in CyberArk's schema, so -SecretData and -SecretDetails remain generic; see the parameter help below for the exact shape each one expects. .PARAMETER SecretName A display name for the strong account. .PARAMETER SecretType Where the strong account is stored: 'ProvisionerUser' (stored directly in the SIA service) or 'PCloudAccount' (vaulted in Privilege Cloud). .PARAMETER SecretData The secret material, matching the "Secret itself" schema: a hashtable with a required secret_data key (whose own shape depends on the secret type) and an optional tenant_encrypted boolean, e.g. @{ secret_data = 'P@ssw0rd'; tenant_encrypted = $false }. .PARAMETER SecretDetails Target-specific details. For a local account: @{ account_domain = 'local' }. For a domain account: @{ account_domain = 'contoso.local' ephemeral_domain_user_data = @{ domain_controller = @{ domain_controller_name = 'dc01.contoso.local' domain_controller_netbios = 'CONTOSO' domain_controller_use_ldaps = $true domain_controller_enable_certificate_validation = $true domain_controller_ldaps_certificate = 'ldaps_cert_id' } ephemeral_domain_user_location = 'OU=Service Accounts,DC=contoso,DC=local' winrm_info = @{ use_winrm_for_https = $true winrm_enable_certificate_validation = $true winrm_certificate = 'winrm_cert_id' } } } .PARAMETER IsActive Whether the strong account is active. Defaults to $true. .EXAMPLE New-SIAWindowsStrongAccount -SecretName 'svc-app01' -SecretType ProvisionerUser ` -SecretData @{ secret_data = 'P@ssw0rd'; tenant_encrypted = $false } ` -SecretDetails @{ account_domain = 'local' } Adds a new local Windows strong account. .INPUTS None. .OUTPUTS psSIA.WindowsStrongAccount .LINK https://docs.cyberark.com/setup/latest/en/content/privileged-access/apis/dpa-strong-accounts-api.htm #> [CmdletBinding(SupportsShouldProcess)] [OutputType('psSIA.WindowsStrongAccount')] param( [Parameter(Mandatory)] [string]$SecretName, [Parameter(Mandatory)] [ValidateSet('ProvisionerUser', 'PCloudAccount')] [string]$SecretType, [Parameter(Mandatory)] [hashtable]$SecretData, [Parameter(Mandatory)] [hashtable]$SecretDetails, [bool]$IsActive = $true ) if ($PSCmdlet.ShouldProcess($SecretName, 'Add Windows strong account')) { $body = @{ secret_name = $SecretName secret_type = $SecretType secret = $SecretData secret_details = $SecretDetails is_active = $IsActive } Invoke-SIARequest -Method POST -Path '/api/secrets/public/v1' -Body $body | ConvertFrom-SIAResponse -TypeName 'psSIA.WindowsStrongAccount' } } |