Validating PowerShell PSCredential
powershell, security
Solution
I believe using `System.DirectoryServices.AccountManagement` is the less ugly way:
This is using ADSI (more ugly?):
$cred = Get-Credential #Read credentials
$username = $cred.username
$password = $cred.GetNetworkCredential().password
# Get current domain using logged-on user's credentials
$CurrentDomain = "LDAP://" + ([ADSI]"").distinguishedName
$domain = New-Object System.DirectoryServices.DirectoryEntry($CurrentDomain,$UserName,$Password)
if ($domain.name -eq $null)
{
write-host "Authentication failed - please verify your username and password."
exit #terminate the script.
}
else
{
write-host "Successfully authenticated with domain $domain.name"
}
Problem
Let's say I have a `PSCrendential` object in PowerShell that I created using `Get-Credential`. How can I validate the input against Active Directory ? By now I found this way, but I feel it's a bit ugly : ``` [void][System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices.AccountManagement") function Validate-Credentials([System.Management.Automation.PSCredential]$credentials) { $pctx = New-Object System.DirectoryServices.AccountManagement.PrincipalContext([System.DirectoryServices.AccountManagement.ContextType]::Domain, "domain") $nc = $credentials.GetNetworkCredential() return $pctx.ValidateCredentials($nc.UserName, $nc.Password) } $credentials = Get-Credential Validate-Credentials $credentials ``` [Edit, two years later] For future readers, please note that `Test-Credential` or `Test-PSCredential` are better names, because `Validate` is not a valid powershell verb (see `Get-Verb`)