Passing script parameters to Windows Server->Execute Powershell Script workflow action

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

I’m trying to set up a workflow that passes a list of identities to a Powershell script, that will then do some AD stuff:

image
image363×496 13.1 KB

The Windows Server step consistently fails with

image

I’ve narrowed this down to the script arguments. If I remove the arguments altogether, or set them to simple text values, the step runs fine. But I need to pass variables from the “Get List of Identities” step as the arguments.

image
image363×441 12.2 KB

I’ve tried a bunch of variations of this that all fail:

  • Picking “Choose Variable” instead of “Enter Value”
  • Formatting the variable in multiple different ways 
    • $.getListOfIdentities.identities.*.attributes.addn

{{$.getListOfIdentities.identities.*.attributes.addn}}

@{{{$.getListOfIdentities.identities.*.attributes.addn}}}

@\{{{$.getListOfIdentities.identities.*.attributes.addn}}\}
  • The “@”’s are just me trying to put it in a Powershell array format, seeing if that would work

If I set it to a variable with a single value instead of a list/array, it works fine

image
image344×206 4.22 KB

image
image505×101 1.71 KB

I can see the variable populating in the Windows Server step input, so no issues there, but I there’s something about it being an array that it doesn’t like. Maybe just some syntax weirdness?

image
image540×197 3.75 KB

Anybody have any ideas to get an array successfully passed as a script argument?

2

how about :

$.getListOfIdentities.identities[*].attributes.addn

3

Gave that a shot, but I get the same error

4

can you check if your script actually accepts an array of string? Just run the poweshell script natively with out workflow by passing an array and validate the outcome or error

5

Yes’m it does

image
image1449×129 7.04 KB

For testing, the script just spits out whatever input it’s given so I could see it in the workflow output in Sailpoint:

param (
   [string[]]$users
)

Write-Output $users
6

Hi @widen9739

Get List of Identities returns a real JSON array, but the Windows Server “Execute PowerShell Script” action’s Script Arguments behave like string name/value pairs. When you “Choose Variable” you’re sending an array type and the step fails.

serialize the array to a string on the workflow side, then deserialize in PowerShell. In the Script Arguments use Enter Value and set:

usersJson = {{$.getListOfIdentities.identities[*].attributes.addn.JSON()}}

(.JSON() forces a raw JSON string)

Then in PowerShell:

param([string]$usersJson)
$users = $usersJson | ConvertFrom-Json
Write-Output ($users -join "`n")

This preserves the list and avoids the action trying to accept a non-scalar argument.

7

Thanks Amr! I tried that and still get the same error.

image
image432×278 7.41 KB

Here’s what the arguments look like now:

image
image647×404 13.1 KB

8

In the workflow action, set the argument value to include outer quotes

usersJson = '{{$.getListOfIdentities.identities[*].attributes.addn.JSON()}}'

Ensure there is no leading newline/whitespace before the [ (your Step Input shows a \n before [), because some remoting layers are surprisingly sensitive.Keep the

argument as Enter Value and force it to be one scalar string all the way through.

in powershell

param([string]$usersJson)

$users = $usersJson | ConvertFrom-Json
Write-Output ($users -join "`n")
9

No whitespace, and added the quotes. To confirm, I checked out the workflow json:

"inputForPag_script_arguments": {
	"usersJson": "'{{$.getListOfIdentities.identities[*].attributes.addn.JSON()}}'"
},

But get same error

image
image641×277 8.55 KB

10

I’ve got a workaround in place that seems to be working, by putting the Windows Server action inside a Loop. That way it iterates through the list of identities and feeds them to the Powershell script one-by-one.

I’m not a huge fan of it running the script multiple times when PS is completely capable of doing it all at once (especially if/when the list is long), so if anyone has any more ideas for getting the array in the proper format to feed it to Powershell, I’m all ears!

11

Glad to know that.

can you check what this returns when you pass the array from workflow to PS :



param(
$UsersJson
)
Write-Output “after param :$UsersJson”
$UsersJson.GetType().Name
12

The workflow fails with that “Failed to invoke PAG connector command” error before it ever gets to the Powershell script