Repository navigation
Invoke-WebRequest should directly support Basic authentication #4274
Description
We are working with more and more "Linux" based servers where we get instructions to run curl to say get back content for a .npmrc file from a product called Artifactory. This product uses Basic auth to accept credentials.
The instructions they give are:
curl -u<USERNAME>:<PASSWORD> http://artifactory.it.keysight.com:8081/artifactory/api/npm/authTo get this to work in PowerShell using Invoke-WebRequest, this is the best I could come up with:
$userpassB64 = [byte[]][char[]]"hillr:OpenSesame" | ConvertTo-Base64 -NoLineBreak
$res = Invoke-WebRequest http://artifactory.my.company.com:8081/artifactory/api/npm/auth `
-Headers @{Authorization = "Basic $userpassB64"}First, ConvertTo-Base64 is a PSCX command (we really need B64 encode/decode in PS Core). Second, Basic auth should be built-in like it is in CURL.
This what I'd like to see from Invoke-WebRequest:
$res = Invoke-WebRequest http://artifactory.my.company.com:8081/artifactory/api/npm/auth `
-UseBasicAuth -Credential (Get-Credential)This -UseBasicAuth switch should also support the -UseDefaultCredentials parameter. However the trick is whether or not to include the Domain\ in the username field. That option, when coupled with -UseBasicAuth "probably" should not include the domain. In our scenario, Artifactory will fail to authenticate if the domain is specified. Either way, the user can always fall back to explicitly providing the username with -Credential (Get-Credential).
FYI, the curl docs on -u:
-u, --user user:password
Specify the user name and password to use for server authentication. Overrides -n, --netrc and --netrc-optional.
If you simply specify the user name, curl will prompt for a password.
The user name and passwords are split up on the first colon, which makes it impossible to use a colon in the user name with this option. The password can, still.
When using Kerberos V5 with a Windows based server you should include the Windows domain name in the user name, in order for the server to successfully obtain a Kerberos Ticket. If you don't then the initial authentication handshake may fail.
When using NTLM, the user name can be specified simply as the user name, without the domain, if there is a single domain and forest in your setup for example.
To specify the domain name use either Down-Level Logon Name or UPN (User Principal Name) formats. For example, EXAMPLE\user and user@example.com respectively.
If you use a Windows SSPI-enabled curl binary and perform Kerberos V5, Negotiate, NTLM or Digest authentication then you can tell curl to select the user name and password from your environment by specifying a single colon with this option: "-u :".
If this option is used several times, the last one will be used.
Activity
dragonwolf83 commentedon Jul 17, 2017
We are having the same situation with Device42, an inventory management software. The REST API is requiring the same methods as above to login.
In my case, I didn't use the PSCX extensions though and just did the Base64 conversions in .NET manually. Then, I wrapped it in it's own function, so that all my Device42 cmdlets can reuse the logic.
The
-UseBasicAuthparameter is needed for both Invoke-WebRequest and Invoke-RestMethod.Keith Hill (@rkeithhill) based on the doc you linked, I think
-UseBasicAuthshould be a string with a[ValidateSet]attribute that can allow user to set the different methods of Basic Authentication that exist.SteveL-MSFT commentedon Jul 18, 2017
In the future, we may want to support other forms of Auth, so perhaps have a
-Authenticationparameter. Note thatBasicwon't work with-UseDefaultCredentialsas I believe there's no way to retrieve the password to send to the remote target which is required forBasic.rkeithhill commentedon Jul 18, 2017
Steve Lee (@SteveL-MSFT) That makes sense.
RandomNoun7 commentedon Jul 21, 2017
Add Jenkins and even Github to the list of popular tools that would be easier to work with if iwr and irm supported something like -Authentication Basic
Also, since neither of these tools are really Linux based (Jenkins is Java which I run on my Windows servers), it points out that this is becoming a widespread issue with a lot of the OSS and otherwise community based tools that Windows folks are increasingly trying to work with using PowerShell.
DexterPOSH commentedon Jul 21, 2017
+1
Having the
-Authenticationparameter would make sense.treestryder commentedon Jul 21, 2017
Basic Auth would be nice, but my current struggle is with "OASIS Web Services Security" authentication for Workday's API.
https://www.oasis-open.org/standards#wssv1.1.1
APraestegaard commentedon Jul 21, 2017
+1
vMarkusK commentedon Jul 21, 2017
Maybe the Syntax "-BasicAuth (get-credential)" is more intuitive. But a great enhancement!
mkellerman commentedon Jul 22, 2017
+1 for -Authentication
bitzbyte commentedon Jul 23, 2017
+1 for -Authentication. I have 3 different services that I have to manually Base64 encode credentials for routinely (multiple times per week for each of them) and more that come up on a less frequent basis.
40 remaining items
SteveL-MSFT commentedon Oct 6, 2017
Mark Kraus (@markekraus) I'm assigning this to myself since GitHub won't let me put your name there so that no one duplicates your work
markekraus commentedon Oct 7, 2017
PR #5052
Add Authentication Parameter to Web Cmdlets for Basic and OAuth (#5052)
Add Authentication Parameter to Web Cmdlets for Basic and OAuth (Powe…