Skip to content

Commit f54ba1d

Browse files
eiabeaeiabea
authored
Merge pull request #106 from damienfinck/add_wallix_dynamic_folder
Create "Wallix Bastion (PowerShell).rdfx"
2 parents 8a274a5 + bde11a8 commit f54ba1d

File tree

1 file changed

+189
-0
lines changed

1 file changed

+189
-0
lines changed

‎Dynamic Folder/Wallix Bastion/Wallix Bastion (PowerShell).rdfx

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
<DynamicFolderExport>
2+
<Name>Dynamic Folder Export</Name>
3+
<Objects>
4+
<DynamicFolderExportObject>
5+
<Type>DynamicFolder</Type>
6+
<Name>Wallix Bastion</Name>
7+
<Description>Imports servers SSH and RDP from Wallix Bastion</Description>
8+
<Notes><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
9+
<html xmlns="http://www.w3.org/1999/xhtml">
10+
<head>
11+
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title>
12+
</title>
13+
<style type="text/css">
14+
.csB4B32984{text-align:left;text-indent:0pt;margin:0pt 0pt 0pt 0pt}
15+
.cs6E44565{color:#000000;background-color:transparent;font-family:'Times New Roman';font-size:18pt;font-weight:bold;font-style:normal;}
16+
.cs24E52B3E{text-align:left;text-indent:0pt;margin:12pt 0pt 12pt 0pt}
17+
.csE0E507E5{color:#000000;background-color:transparent;font-family:'Times New Roman';font-size:12pt;font-weight:bold;font-style:normal;}
18+
.cs199E85DE{color:#000000;background-color:transparent;font-family:'Times New Roman';font-size:12pt;font-weight:normal;font-style:normal;}
19+
.cs4397C400{text-align:left;text-indent:0pt;margin:12pt 0pt 0pt 0pt}
20+
.csD5E60F86{color:#000000;background-color:transparent;font-family:'Times New Roman';font-size:13.5pt;font-weight:bold;font-style:normal;}
21+
.csDB5B53AA{text-align:left;margin:0pt 0pt 0pt 0pt;list-style-type:disc;color:#000000;background-color:transparent;font-family:Arial;font-size:12pt;font-weight:normal;font-style:normal}
22+
.csA97625F2{text-align:left;margin:0pt 0pt 0pt 0pt;list-style-type:circle;color:#000000;background-color:transparent;font-family:'Courier New';font-size:12pt;font-weight:normal;font-style:normal}
23+
</style>
24+
</head>
25+
<body>
26+
<h2 class="csB4B32984">
27+
<span class="cs6E44565">Dynamic Folder for Wallix Bastion connections</span></h2>
28+
<p class="cs24E52B3E"><span class="csE0E507E5">Version</span><span class="cs199E85DE">: 1.0</span></p><p class="cs24E52B3E"><span class="cs199E85DE">This Dynamic Folder allows you to import SSH and RDP connections from a Wallix Bastion. It is then possible to connect more easily to a server through the Wallix Bastion, while avoiding the Bastion selection screen.</span></p><h3 class="cs4397C400">
29+
<span class="csD5E60F86">Tested with</span></h3>
30+
<ul style="margin-top:0;margin-bottom:0;">
31+
<li class="csDB5B53AA"><span class="cs199E85DE">Wallix Bastion 9.0 and PowerShell 5.1 on Windows</span></li></ul>
32+
<h3 class="cs4397C400">
33+
<span class="csD5E60F86">Setup</span></h3>
34+
<ul style="margin-top:0;margin-bottom:0;">
35+
<li class="csDB5B53AA"><span class="cs199E85DE">In the &laquo;&nbsp;Custom Properties&nbsp;&raquo;</span><ul style="margin-top:0;margin-bottom:0;">
36+
<li class="csA97625F2"><span class="cs199E85DE">set the hostname of Wallix Bastion</span></li><li class="csA97625F2"><span class="cs199E85DE">define if Wallix API use HTTPS or HTTP</span></li><li class="csA97625F2"><span class="cs199E85DE">set the Wallix Bastion&rsquo;s fingerprint</span></li></ul>
37+
</li><li class="csDB5B53AA"><span class="cs199E85DE">In the &laquo;&nbsp;Credentials&nbsp;&raquo;</span><ul style="margin-top:0;margin-bottom:0;">
38+
<li class="csA97625F2"><span class="cs199E85DE">Configure your credentials</span></li></ul>
39+
</li></ul>
40+
<h3 class="cs4397C400">
41+
<span class="csD5E60F86">How it works</span></h3>
42+
<p class="csB4B32984"><span class="cs199E85DE">This script uses the Bastion API with HTTP/HTTPS to retrieve a list of all SSH and RDP connections. For the connection to a server, it uses the credentials assigned to the dynamic folder. It builds the servers list with the Wallix hostname as computer name and assigns dynamic credentials. If it&#39;s a Linux server, the Wallix Bastion fingerprint is also added. When connecting to a server via SSH or RDP, the dynamic credential script is called. It will use CustomField1, containing the concatenation of some Bastion information to generate the login allowing direct access to the server without having to go through the Bastion selection screen.</span></p><h3 class="cs4397C400">
43+
<span class="csD5E60F86">Limitation</span></h3>
44+
<p class="csB4B32984"><span class="cs199E85DE">With PowerShell 5.1 it is not possible to bypass SSL certificate verification for HTTPS calls to the Wallix Bastion API. You must therefore have a valid certificate to use HTTPS.</span></p></body>
45+
</html>
46+
]]></Notes>
47+
<CustomProperties>
48+
<CustomProperty>
49+
<Name>Hostname</Name>
50+
<Type>Text</Type>
51+
<Value>TODO</Value>
52+
</CustomProperty>
53+
<CustomProperty>
54+
<Name>Use HTTPS ?</Name>
55+
<Type>YesNo</Type>
56+
<Value>True</Value>
57+
</CustomProperty>
58+
<CustomProperty>
59+
<Name>Wallix Fingerprint</Name>
60+
<Type>Text</Type>
61+
<Value>TODO</Value>
62+
</CustomProperty>
63+
</CustomProperties>
64+
<ScriptInterpreter>powershell</ScriptInterpreter>
65+
<Script><![CDATA[# ---------------------------------------------------------------------------------------------------------------------
66+
# Note that the whole output of the script will be parsed as rJSON and should be UTF8 encoded
67+
# The following lines ensure that informational cmdlet output, warnings or errors are not written to the output stream
68+
# ---------------------------------------------------------------------------------------------------------------------
69+
$global:ErrorActionPreference = "Stop"
70+
$global:WarningPreference = "SilentlyContinue"
71+
$global:InformationPreference = "SilentlyContinue"
72+
$global:VerbosePreference = "SilentlyContinue"
73+
$global:DebugPreference = "SilentlyContinue"
74+
$global:ProgressPreference = "SilentlyContinue"
75+
$global:OutputEncoding = New-Object Text.Utf8Encoding -ArgumentList (,$false) # BOM-less
76+
[Console]::OutputEncoding = $global:OutputEncoding
77+
# ---------------------------------------------------------------------------------------------------------------------
78+
79+
<#
80+
Folder script for import Wallix Bastion connections
81+
#>
82+
83+
# Variables replaced by Royal TS (using single quotes to avoid interpretation of the $ character)
84+
$WallixUsername = '$EffectiveUsername$'
85+
$WallixPassword = '$EffectivePassword$'
86+
$WallixHostname = '$CustomProperty.Hostname$'.Trim()
87+
$WallixUseHTPPS = '$CustomProperty.UseHTTPS$'
88+
$WallixFingerprint = '$CustomProperty.WallixFingerprint$'.Trim()
89+
90+
# Constants
91+
$ROYALTS_ID_CREDENTIALS = "DynamicCred01"
92+
93+
$Protocol = "http"
94+
if ($WallixUseHTPPS) {
95+
$Protocol = "https"
96+
}
97+
98+
# Call Wallix Bastion API with basic authentication
99+
$EncodedCreds = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes("${WallixUsername}:${WallixPassword}"))
100+
$Headers = @{
101+
Authorization = "Basic ${EncodedCreds}"
102+
}
103+
$Response = Invoke-RestMethod -Uri "${Protocol}://${WallixHostname}/api/sessionrights?limit=500&fields=service_protocol,account,domain,device,service,authorization,device_description" -Method "GET" -Headers $Headers
104+
$ListObjects = @()
105+
106+
foreach ($Item in $Response) {
107+
$WallixFullTargetName = "$($Item.account)@$($Item.domain)@$($Item.device):$($Item.service):$($Item.authorization)"
108+
$RoyalTSObjectType = $null
109+
$RoyalTSIconName = ""
110+
if ($Item.service_protocol.Equals("SSH")) {
111+
$RoyalTSObjectType = "TerminalConnection"
112+
$RoyalTSIconName = "Flat/Hardware/Platform OS Linux"
113+
}
114+
elseif ($Item.service_protocol.Equals("RDP")) {
115+
$RoyalTSObjectType = "RemoteDesktopConnection"
116+
$RoyalTSIconName = "Flat/Hardware/Platform OS Windows"
117+
}
118+
if ($null -ne $RoyalTSObjectType) {
119+
# Create serveur connection
120+
$Object = @{
121+
Type = $RoyalTSObjectType
122+
Name = $Item.device
123+
ComputerName = $WallixHostname
124+
Description = $Item.device_description
125+
IconName = $RoyalTSIconName
126+
Path = "Connections"
127+
# Dynamic credentials
128+
CredentialID = $ROYALTS_ID_CREDENTIALS
129+
# Used for the dynamic credential Script
130+
CustomField1 = $WallixFullTargetName
131+
}
132+
# Add fingerprint
133+
if ($Item.service_protocol.Equals("SSH") -and $WallixFingerprint.Length -gt 0) {
134+
$Object["Properties"] = @{
135+
Fingerprint = $WallixFingerprint
136+
}
137+
}
138+
$ListObjects += $Object
139+
}
140+
}
141+
142+
# Creating dynamic credentials
143+
$ListObjects += @{
144+
Type = "DynamicCredential"
145+
Name = "Dynamic credentials"
146+
Description = "Dynamically generated identifiers on login"
147+
ID = $ROYALTS_ID_CREDENTIALS
148+
Path = "Credentials"
149+
}
150+
151+
# Create final object
152+
$Result = @{
153+
Objects = ($ListObjects | Sort-Object -Property Path, Name)
154+
}
155+
$Result | ConvertTo-Json -Depth 100 | Write-Host
156+
]]></Script>
157+
<DynamicCredentialScriptInterpreter>powershell</DynamicCredentialScriptInterpreter>
158+
<DynamicCredentialScript><![CDATA[# ---------------------------------------------------------------------------------------------------------------------
159+
# Note that the whole output of the script will be parsed as rJSON and should be UTF8 encoded
160+
# The following lines ensure that informational cmdlet output, warnings or errors are not written to the output stream
161+
# ---------------------------------------------------------------------------------------------------------------------
162+
$global:ErrorActionPreference = "Stop"
163+
$global:WarningPreference = "SilentlyContinue"
164+
$global:InformationPreference = "SilentlyContinue"
165+
$global:VerbosePreference = "SilentlyContinue"
166+
$global:DebugPreference = "SilentlyContinue"
167+
$global:ProgressPreference = "SilentlyContinue"
168+
$global:OutputEncoding = New-Object Text.Utf8Encoding -ArgumentList (,$false) # BOM-less
169+
[Console]::OutputEncoding = $global:OutputEncoding
170+
# ---------------------------------------------------------------------------------------------------------------------
171+
172+
<#
173+
Credentials script for connection to Wallix Bastion throw SSH or RDP
174+
#>
175+
176+
# Variables replaced by Royal TS (using single quotes to avoid interpretation of the $ character)
177+
$WallixUsername = '$Target.CustomField1$:$EffectiveUsername$'
178+
$WallixPassword = '$EffectivePassword$'
179+
180+
# Return credentials
181+
$Object = @{
182+
Username = "${WallixUsername}"
183+
Password = "${WallixPassword}"
184+
}
185+
$Object | ConvertTo-Json -Depth 100 | Write-Host
186+
]]></DynamicCredentialScript>
187+
</DynamicFolderExportObject>
188+
</Objects>
189+
</DynamicFolderExport>

0 commit comments

Comments
 (0)