Test-SecretVault: Unable to run Test-SecretVault

[AlexeiKlimenko]

Hello.

How to troubleshoot Test-SecretVault issue?
We're using server-side Vault HashiCorp and client-side as your module.

Register-SecretVault -ModuleName SecretManagement.Hashicorp.Vault.KV -Name 'xxx/yyy' -VaultParameters @{ VaultServer = 'https://server:8200'; VaultAuthType = 'LDAP'}

What kind of Name should be specified as name of vault? We're trying - /personal/user, space/unit/secrets/*/ and others types but nothing working

[joshcorr]

Hi @AlexeiKlimenko! The Vault name should be the same as the Engine/mount you are using. If your secret existed under personal/user/me then you should register the vault with the following:

Register-SecretVault -ModuleName SecretManagement.Hashicorp.Vault.KV -Name personal -VaultParameters @{ VaultServer = 'https://server:8200'; VaultAuthType = 'LDAP'}
Get-Secret -Name user/me -Vault personal 

The default version is KV version 2. If you are using a version 1 vault then you should add KVVersion = 'v1' to your -VaultParameters

[AlexeiKlimenko]

Thank you, as server we're using Vault 1.5.5.
To be frank, we were trying various collection of NAME and Vault, but nothing working. We are not able to determine the root cause, because there are not any tools for troubleshooting (only test-secretvault).

[joshcorr]

Are you prompted for credentials when you run Test-SecretVault? If you use -Verbosewith Test-SecretVault do you have any output? After running Test-SecretVault what is the value of $error[0]?

the -Name parameter should only take in the first part of the path on Register-SecretVault and should not have a path like engine/path/secret. -Vault is the name of the vault you registered. You can list your vaults with Get-SecretVault.

I can test with that Vault server version, but I think there might be something going on with your permissions, or how you are trying to register the vault. Please let me know if you have any error or verbose messages.

[AlexeiKlimenko]

Yes.,we'have tested with 'userpass'/'token' and default (in our case) 'LDAP'
With -verbose key we just received:

Test-SecretVault: Unable to run Test-SecretVault on vault personal
VERBOSE: Vault personal failed validation test
False

Permission is valid. Therefore we were trying to use vault application from https://www.vaultproject.io/downloads, then configured $env:VAULT_ADDR="https://%our_vault_server%:8200" and used vault login with token. It executed correctly and we were able to receive secret with ".\vault.exe read personal/user/secret"

[joshcorr]

I should have asked this earlier. What version of Secret Management module are you using? What version of the Vault Extension are you using with that? The Test-SecretVault will prompt you for auth if you do not have a token. If you are not getting prompted for username/password then there might be something wrong in that step..

Will work on testing myself, but may take a day or two as I do not have LDAP setup currently in my lab.

[AlexeiKlimenko]

"What version of Secret Management module are you using"
We're trying both - v2 and v1, but result was the same.

"Test-SecretVault"
It prompts token pass (if we've specified VaultAuthType = 'token') or user/pass (in cases of userpass/LDAP) - it's ok.

"may take a day or two"
OK, thanks a lot, we'll be waiting for.

[joshcorr]

I was able to get it working on 1.5.5 using userpass with the following with a restricted account. (Having unrelated issues with my LDAP test setup).

I am using Microsoft.PowerShell.SecretManagement version 1.1.1 and SecretManagement.Hashicorp.Vault.KV 2.0.0 in that test. The "personal" vault is a v2 KV vault.

[AlexeiKlimenko]

We're also using Microsoft.PowerShell.SecretManagement 1.1.1 and SecretManagement.Hashicorp.Vault.KV 2.0.0
But Get-Secret and Test-SecretVault were failed with userpass/LDAP.
The main difference, that we're using https instead of http as VaultServer. Could it be as an issue and how to troubleshoot it? All PKI chain (containing 3 certificates) was added to Trusted CA.

New info:
We'have installed "Install-Module -Name SecretManagement.Hashicorp.Vault.KV -RequiredVersion 1.1.0"

In this case we're getting True with Test-SecretVault(created with userpass/LDAP):
"PS C:\Users\aiklimenko> Test-SecretVault personal
WARNING: https://VAULT_SERVER:8200/v1/sys/mounts; Forbidden, your authentication details are either incorrect, you don't have access to this feature, or - if CORS is enabled - you made a cross-origin request from an origin that is not allowed to make such requests"

But with Get-Secret we're not prompted to login user/password:
PS C:\Users\aiklimenko> Get-Secret -Name aiklimenko -Vault personal
Get-Secret: Unable to get secret aiklimenko from vault personal
Get-Secret: The secret aiklimenko was not found.

[joshcorr]

Got a bit closer to recreating the error. Have my full test setup back up and am able to test LDAP with an Https instance of Vault.

After a failed Test-SecretVault or Get-Secret could you run the following in your shell $error[0] | fl -force? This will display all of the error message. Please let me know if you see {"errors":["1 error occurred:\n\t* permission denied\n\n"]}

[AlexeiKlimenko]

Good day.
Got back to "SecretManagement.Hashicorp.Vault.KV" version 2.0

Try to register vaults with different types of auth:
Register-SecretVault -ModuleName SecretManagement.Hashicorp.Vault.KV -Name 'userpass' -VaultParameters @{ VaultServer = 'https://XXX:8200'; VaultAuthType = 'userpass'}
Register-SecretVault -ModuleName SecretManagement.Hashicorp.Vault.KV -Name 'ldap' -VaultParameters @{ VaultServer = 'https://XXX:8200'; VaultAuthType = 'ldap'}
Register-SecretVault -ModuleName SecretManagement.Hashicorp.Vault.KV -Name 'token' -VaultParameters @{ VaultServer = 'https://XXX:8200'; VaultAuthType = 'token'}

telnet XXX 8200 was successful

Attempts to Test-SecretVault:
PS C:\Users\me> Test-SecretVault userpass -Verbose

PowerShell credential request
Please Enter UserName and Password credentials
User: me
Password for user me: ***************

Test-SecretVault: Unable to run Test-SecretVault on vault userpass
VERBOSE: Vault userpass failed validation test
False

PS C:\Users\me> $error[0] | fl -force

Exception : System.Management.Automation.PSInvalidOperationException: Unable to run Test-SecretVault on vault userpass
---> System.Management.Automation.RuntimeException: Received an error: {"errors":["invalid username or password"]}

                     ---> System.Management.Automation.RuntimeException: Received an error: {"errors":["invalid username or password"]}

                       --- End of inner exception stack trace ---
                       at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
                       at System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(Runspace rs, Boolean performSyncInvoke)
                       at System.Management.Automation.PowerShell.Worker.CreateRunspaceIfNeededAndDoWork(Runspace rsToUse, Boolean isSync)
                       at System.Management.Automation.PowerShell.CoreInvokeHelper[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output,
                    PSInvocationSettings settings)
                       at System.Management.Automation.PowerShell.CoreInvoke[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings
                    settings)
                       at System.Management.Automation.PowerShell.Invoke(IEnumerable input, PSInvocationSettings settings)
                       at System.Management.Automation.PowerShell.Invoke()
                       at Microsoft.PowerShell.SecretManagement.PowerShellInvoker.InvokeScriptWithHost[T](PSCmdlet cmdlet, String script, Object[] args, Exception&
                    terminatingError) in D:\a\_work\1\s\src\code\Utils.cs:line 1554
                       --- End of inner exception stack trace ---

TargetObject : Microsoft.PowerShell.SecretManagement.ExtensionVaultModule
CategoryInfo : InvalidOperation: (Microsoft.PowerShel…xtensionVaultModule:ExtensionVaultModule) [Test-SecretVault], PSInvalidOperationException
FullyQualifiedErrorId : TestSecretVaultInvalidOperation,Microsoft.PowerShell.SecretManagement.TestSecretVaultCommand
ErrorDetails :
InvocationInfo : System.Management.Automation.InvocationInfo
ScriptStackTrace : at , : line 1
PipelineIterationInfo : {0, 1}
PSMessageDetails :

Test-SecretVault ldap -Verbose
PS C:\Users\me> $error[0] | fl -force

Exception : System.Management.Automation.PSInvalidOperationException: Unable to run Test-SecretVault on vault ldap
---> System.Management.Automation.RuntimeException: Received an error: {"errors":["1 error occurred:\n\t* permission denied\n\n"]}

                     ---> System.Management.Automation.RuntimeException: Received an error: {"errors":["1 error occurred:\n\t* permission denied\n\n"]}

                       --- End of inner exception stack trace ---
                       at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
                       at System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(Runspace rs, Boolean performSyncInvoke)
                       at System.Management.Automation.PowerShell.Worker.CreateRunspaceIfNeededAndDoWork(Runspace rsToUse, Boolean isSync)
                       at System.Management.Automation.PowerShell.CoreInvokeHelper[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output,
                    PSInvocationSettings settings)
                       at System.Management.Automation.PowerShell.CoreInvoke[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings
                    settings)
                       at System.Management.Automation.PowerShell.Invoke(IEnumerable input, PSInvocationSettings settings)
                       at System.Management.Automation.PowerShell.Invoke()
                       at Microsoft.PowerShell.SecretManagement.PowerShellInvoker.InvokeScriptWithHost[T](PSCmdlet cmdlet, String script, Object[] args, Exception&
                    terminatingError) in D:\a\_work\1\s\src\code\Utils.cs:line 1554
                       --- End of inner exception stack trace ---

TargetObject : Microsoft.PowerShell.SecretManagement.ExtensionVaultModule
CategoryInfo : InvalidOperation: (Microsoft.PowerShel…xtensionVaultModule:ExtensionVaultModule) [Test-SecretVault], PSInvalidOperationException
FullyQualifiedErrorId : TestSecretVaultInvalidOperation,Microsoft.PowerShell.SecretManagement.TestSecretVaultCommand
ErrorDetails :
InvocationInfo : System.Management.Automation.InvocationInfo
ScriptStackTrace : at , : line 1
PipelineIterationInfo : {0, 1}
PSMessageDetails :

Test-SecretVault token -Verbose
We got the same issue with "permission denied"

[AlexeiKlimenko]

Addition about Get-Secret

PS C:\Users\me> Get-Secret -Name personal/me/TestPassword -Vault ldap

PowerShell credential request
Please Enter LDAP credentials
User: me
Password for user me: ***************

Get-Secret: Unable to get secret personal/me/TestPassword from vault ldap
Get-Secret: The secret personal/me/TestPassword was not found.

Exception : System.Management.Automation.ItemNotFoundException: The secret personal/me/TestPassword was not found.

If we'are using vault application from official site (look at previous messages):

PS C:\Users\me\Downloads\vault_1.9.0_windows_amd64> .\vault.exe read personal/me/TestPassword
Key Value

---

refresh_interval 768h
Password YYYY

[joshcorr]

I've been trying to test this, but I am getting successful results recently and haven't been able to get it to fail (unless I use an incorrect password or path).

I noticed from your example above that syntax might be wrong.. You cannot pass the full path to the -Name parameter.
Is your full test path in the Vault UI ldap/personal/me/TestPassword or personal/me/TestPassword?
If it is the last one then the syntax you used is incorrect.. Get-Secret -Name personal/me/TestPassword -Vault ldap
Correct syntax would be: Get-Secret -VaultName personal -Name me/TestPassword

The vault name you register must be the same as the first part of the path..

The correct register command for personal/me/TestPassword would be:

Register-SecretVault -ModuleName SecretManagement.Hashicorp.Vault.KV -Name 'personal' -VaultParameters @{ VaultServer = 'https://XXX:8200'; VaultAuthType = 'ldap'}