Set-PSUAuthenticationMethod

SYNOPSIS

Configures an authentication method.

SYNTAX

Set-PSUAuthenticationMethod [-Type <AuthenticationMethodType>] [-ScriptBlock <ScriptBlock>] [-Disabled] [-Configure <ScriptBlock>] [<ConnectionOptions>] [<CommonParameters>]
Set-PSUAuthenticationMethod -CallbackPath <String> [-MetadataAddress <String>] [-SigningKey <String>] [-EntityId <String>] [-IdentityProviderEntityId <String>] [-ServiceCertificate <String>] [-SingleSignOnServiceUrl <String>] [-AllowUnsolicitedAuthnResponse] [-NameIdPolicy <String>] [-LoadMetadata] [<CommonOptions>]
Set-PSUAuthenticationMethod -CallbackPath <String> -ClientId <String> [-ClientSecret <String>] [-ClientCertificate <String>] [-ClientCertificatePassword <String>] [-Resource <String>] [-Authority <String>] [-ResponseType <String>] [-SaveTokens <Boolean>] [-UseTokenLifetime <Boolean>] [-RequireMfa] [-GetClaimsFromUserInfoEndpoint <Boolean>] [-Scopes <String>] [-CorrelationCookieSameSite <String>] [<CommonOptions>]
Set-PSUAuthenticationMethod -CallbackPath <String> -Wtrealm <String> -Wreply <String> -MetadataAddress <String> [-UseTokenLifetime <Boolean>] [-CorrelationCookieSameSite <String>] [<CommonOptions>]
Set-PSUAuthenticationMethod [-LogoutUrl <String>] [<CommonOptions>]
Set-PSUAuthenticationMethod [-Native] [-Domain <String>] [<CommonOptions>]

<CommonOptions>: [-Type <AuthenticationMethodType>] [-ScriptBlock <ScriptBlock>] [-Disabled] [-Configure <ScriptBlock>] [<ConnectionOptions>] [<CommonParameters>]. <ConnectionOptions>: [-ComputerName <String>] [-AppToken <String>] [-Credential <PSCredential>] [-UseDefaultCredentials] [-Integrated] [-TrustCertificate] [-Cookies]. The parameter sets above respectively cover generic, SAML2, OIDC, WS-Federation, logout, and form options. Set -Type to the desired provider; its enum names include Form, Windows, Certificate, OpenIDConnect, WSFederation, Saml2, Basic, and Devolutions.

DESCRIPTION

Creates an authentication-method configuration; the command is also aliased as New-PSUAuthenticationMethod. Forms options include -Native and -Domain; provider-specific options configure OpenID Connect, SAML2, and WS-Federation. For OpenID Connect, -ClientCertificate and -ClientCertificatePassword configure certificate-based client authentication in place of or alongside a client secret. Do not include real secrets in documentation examples.

EXAMPLE

Set-PSUAuthenticationMethod -Type OpenIDConnect -CallbackPath '/signin-oidc' -ClientId 'psu' -Authority 'https://identity.example.com' -ClientCertificate 'C:\certs\psu.pfx' -ClientCertificatePassword $env:PSU_OIDC_CERT_PASSWORD

PARAMETERS

Parameter	Description
-Type	Provider enum: Form, Windows, Certificate, OpenIDConnect, WSFederation, Saml2, Basic, or Devolutions; defaults to Form.
-ScriptBlock	Authentication script stored with the method.
-Disabled	Disables the method.
-Configure	Additional provider configuration script block.
-CallbackPath	Callback URL path; required for SAML2, OIDC, and WS-Federation parameter sets.
-ClientId	OpenID Connect client ID (required for OIDC).
-ClientSecret	OpenID Connect client secret.
-ClientCertificate	OpenID Connect client certificate setting.
-ClientCertificatePassword	Password for the OIDC client certificate.
-Resource	OIDC resource identifier.
-Authority	OIDC authority URL.
-ResponseType	OIDC response type (defaults to code).
-SaveTokens	Whether OIDC tokens are saved.
-UseTokenLifetime	Whether to use token lifetime (OIDC or WS-Federation).
-RequireMfa	Requires MFA for OIDC.
-GetClaimsFromUserInfoEndpoint	Retrieves OIDC claims from the user-info endpoint.
-Scopes	OIDC scopes (defaults to openid profile groups).
-CorrelationCookieSameSite	SameSite setting for OIDC or WS-Federation correlation cookie.
-LogoutUrl	Logout URL.
-Wtrealm	WS-Federation realm (required for WS-Federation).
-Wreply	WS-Federation reply URL (required for WS-Federation).
-MetadataAddress	Provider metadata URL (required for WS-Federation; alias -MetadataUrl).
-SigningKey	SAML2 signing key.
-EntityId	SAML2 service provider entity ID.
-IdentityProviderEntityId	SAML2 identity provider entity ID.
-ServiceCertificate	SAML2 service certificate.
-SingleSignOnServiceUrl	SAML2 sign-on service URL.
-AllowUnsolicitedAuthnResponse	Allows unsolicited SAML2 authentication responses.
-NameIdPolicy	SAML2 name ID policy: undefined, persistent, or transient.
-LoadMetadata	Loads SAML2 provider metadata.
-Native	Enables native form authentication.
-Domain	Domain for form authentication.
-ComputerName	PSU Management API URL or host name (alias -Uri).
-AppToken	Management API app token.
-Credential	Management API credentials.
-UseDefaultCredentials	Uses current Windows credentials.
-Integrated	Uses the in-process management client.
-TrustCertificate	Ignores certificate validation errors.
-Cookies	Reuses session authentication cookies.

PERMISSIONS

The access token requires security.authentication/update to run this cmdlet remotely.