How to run AfterProvisioning powershell script without AD app?

[ericisevik]

Which IIQ version are you inquiring about?

8.4p1

Please share any other relevant files that may be required (for example, logs).

IQService log:
IQTrace.txt (10.9 KB)

Share all details about your problem, including any error messages you may have received.

Hello!

We have a issue regarding a AfterProvisioning rule in the SQLLoader connector. As per this documentation in Compass, it is possible to run powershell scripts via the IQService and using Client Authentication to do so. To use client authentication one option is to pass an application object to the RPCService in the AfterProvisioning rule.

However we can only make this work with the AD application. When passing the SQLLoader application object (which has a IQService configuration) it doesn’t seem to be able to decrypt the password for the IQService user? Has anyone had this problem before and how can i properly pass the credentials to IQSerivce?

The powershell script is a simple script that copies a file created by IIQ to another server

The AfterProvisioning rule:

import sailpoint.object.RpcRequest;
import sailpoint.object.RpcResponse;
import sailpoint.connector.RPCService;
import sailpoint.object.Rule;
import sailpoint.object.Application;
import org.apache.log4j.Logger;
import org.apache.log4j.Level;
import sailpoint.object.ProvisioningPlan.AccountRequest;
import sailpoint.object.ProvisioningPlan.AttributeRequest;
import sailpoint.object.ProvisioningPlan.Operation;

Logger log = Logger.getLogger("Transfer File");
log.setLevel(Level.DEBUG);

Rule rule = context.getObjectByName(Rule.class,"RK CWT PowerShell");
Application cwt = context.getObjectByName(Application.class,"CWT2");

log.debug("got application: " + cwt);

Map data = new HashMap();
data.put("postScript", rule);
data.put("Application", cwt.getAttributes());
log.debug("Map Created: " + data);

List fakeAttributeRequests = new ArrayList();

// Fake account request
AccountRequest objectAccountRequest = new AccountRequest();
objectAccountRequest.setApplication("IIQ");
objectAccountRequest.setNativeIdentity("*FAKE*");
objectAccountRequest.setOperation(AccountRequest.Operation.Modify);

// Fake attribute request
AttributeRequest fakeAttribute = new AttributeRequest();
fakeAttribute.setOperation(Operation.Add);
fakeAttribute.setName("param");
fakeAttribute.setValue("value");
fakeAttributeRequests.add(fakeAttribute);
objectAccountRequest.setAttributeRequests(fakeAttributeRequests);

// Add to the IQService params
data.put("Request", objectAccountRequest);

RPCService service = new RPCService("*hostname*", *port*, false, false);
log.debug("RPCService: " + service); 
service.setConnectorServices(new sailpoint.connector.DefaultConnectorServices());
RpcRequest request = new RpcRequest("ScriptExecutor", "runAfterScript", data);
log.debug("RPCRequest: " + request);
RpcResponse response = service.execute(request);
log.debug("Response recieved: " + response.getErrors());

The Powershell Script (ConnectorAfterCreate rule) can be seen in the log file.
The error message:

12/09/2024 14:37:08 : AbstractConnector [ Thread-7 ] DEBUG : "Exception occurred in executing the script : The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters. "

[ryan_toornburg]

@ericisevik - One option is to create a credential file on the IQService Host. Then in your PSScript, Add something like:

Map network drive

New-PSDrive -Name Z -PSProvider FileSystem -Root "\\DC-07\Temp" -Credential $credential -Persist

Then make sure to remove the drive after: Remove-PSDrive -Name Z
I think you can also try Invoke-Command and pass the Copy in a scriptBlock

[paul_hilchey]

You might create an AD application, with the IQService configuration, and pass that in your RpcRequest instead of using the SQLLoader application.

[mkumariaas (M Kumar)]

@ericisevik we have seen this issue ""Exception occurred in executing the script : The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters. "
it seems you are using password which is either not decrypted one or may be password is not from this environment and you are using different encryption key for each environment . resolve the password decryption issue
Note : I hope there is no one way hashing enable in your environment.