Authentication: Basic AD Auth with -ASCredential "parameter Cannot validate argument on parameter 'Provider'."

[RichardWrinkle]

Hello,

When I enable the parameter "-AsCredential" on the New-PodeAuthScheme cmdlet, I get an error response that says the following:

 "Exception": null,
  "Url": "http://localhost:8080/info",
  "Status": {
    "Description": "Cannot validate argument on parameter 'Provider'. The argument \"\" does not belong to the set \"DirectoryServices,ActiveDirectory,OpenLDAP\" specified by the ValidateSet attribute. Supply an argument that is in the set and then try the command again.",
    "Code": 500
  }
}

Steps To Reproduce

Server Side Config:

Start-PodeServer {

    Enable-PodeSessionMiddleware -Duration 120 -Extend

    # attach to port 8080 for http
    Add-PodeEndpoint -Address localhost -Port 8080 -Protocol Http

    New-PodeAuthScheme -Basic -AsCredential | Add-PodeAuthWindowsAd -Name 'Login' -KeepCredential -ADModule -Fqdn $DomainController -DirectGroups

    Add-PodeRoute -Method Get -Path '/info' -Authentication 'Login' -ScriptBlock {

        $PodeUptimeInSeconds = (Get-PodeServerUptime) / 1000
        $ServerTime = Get-Date
        $ServerTimeUTC = $ServerTime.ToUniversalTime()
        $PodeStartTime = $ServerTime.AddSeconds(-$PodeUptimeInSeconds)

        Write-PodeJsonResponse -Depth 10 -value @{ 
            status          = "ok"
            uptimeInSeconds = $PodeUptimeInSeconds
            PodeStartTime   = $PodeStartTime
            ServerTime      = $ServerTime
            ServerTimeUTC   = $ServerTimeUTC
            responseid      = $ResponseID 
            data            = $WebEvent.Auth
        } -StatusCode 200
    }
}

Client Side Request:
I have tried two methods
1.) The first where I create the header with the PSCredential object:

$Credential = Get-Credential
$pair = "$($Credential.UserName):$($Credential.Password)"
$encodedCreds = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes($pair))
$basicAuthValue = "Basic $encodedCreds"
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("Authorization", $basicAuthValue)

$response = Invoke-RestMethod 'http://localhost:8080/info' -Method 'GET' -Headers $headers
$response | ConvertTo-Json

2.) Where I just add the credential as a "-Credential" parameter to the Invoke-RestMethod cmdlet:

$Credential = Get-Credential
Invoke-Restmethod -method Get -Uri "http://localhost:8080/info" -Credential $Credential

Expected Behavior
User authentication should work with the provided PSCredential object and I get a response back with status code 200.

Platform
OS: Windows 10
Browser: [e.g. Chrome, Safari] N/A
Versions:
Pode: [e.g. Pode v1.7.3] 2.7.2
PowerShell: [e.g. PS6.2.1] 7.3.0

[Badgerati]

Hi @RichardWrinkle,

If you remove -AsCredential on New-PodeAuthScheme it'll work as expected. The switch was put in place for people building custom authentication methods, and needed a PSCredential object rather than the raw username/password. Since you're using the inbuilt WindowsAD authentication method there isn't much need for the -AsCredential switch on the scheme - unless you do have a need for it?

It should technically work though, so does need fixing.

[RichardWrinkle]

@Badgerati - I am trying to automate a PS Script on a local machine where a user runs the script and it runs some functions that ultimately submits a request to Pode. If I was able to capture a PSCredential object when they run the script and then this could be passed to Pode for auth in the Invoke-RestMethod command. This may be possible in a different way, but I'm pretty new to Pode so I'm just trying to figure things out. Thanks!

[Badgerati]

Hi @RichardWrinkle,

You're first idea of setting the Authorization -Header on Invoke-RestMethod should work, it just needs -AsCredential to be removed from New-PodeAuthScheme 😄

[ili101]

I think optimally -AsCredential should be the default and the parameter removed.
But this is a braking change so at you discretion

[Badgerati]

You're correct, it would be a breaking change. I've got a note written down for v3.0 to make the default be PSCredential for all auth types.