Set-PSUAuthenticationMethod

Sets the authentication method settings.

SYNOPSIS

Sets the authentication method settings.

SYNTAX

Type (Default)

Set-PSUAuthenticationMethod [-ScriptBlock <ScriptBlock>] [-Type <AuthenticationMethodType>] [-Disabled]
 [-Configure <ScriptBlock>] [-ComputerName <String>] [-AppToken <String>] [-Credential <PSCredential>]
 [-UseDefaultCredentials] [-Integrated] [-TrustCertificate] [-Cookies]
 [<CommonParameters>]

SAML2

Set-PSUAuthenticationMethod [-ScriptBlock <ScriptBlock>] [-Type <AuthenticationMethodType>] [-Disabled]
 -CallbackPath <String> [-MetadataAddress <String>] [-SigningKey <String>] [-EntityId <String>]
 [-IdentityProviderEntityId <String>] [-ServiceCertificate <String>] [-SingleSignOnServiceUrl <String>]
 [-Configure <ScriptBlock>] [-AllowUnsolicitedAuthnResponse] [-NameIdPolicy <String>] [-LoadMetadata]
 [-ComputerName <String>] [-AppToken <String>] [-Credential <PSCredential>] [-UseDefaultCredentials]
 [-Integrated] [-TrustCertificate] [-Cookies] [<CommonParameters>]

OIDC

Set-PSUAuthenticationMethod [-ScriptBlock <ScriptBlock>] [-Type <AuthenticationMethodType>] [-Disabled]
 -CallbackPath <String> -ClientId <String> [-ClientSecret <String>] [-Resource <String>] [-Authority <String>]
 [-ResponseType <String>] [-SaveTokens <Boolean>] [-UseTokenLifetime <Boolean>] [-RequireMfa]
 [-GetClaimsFromUserInfoEndpoint <Boolean>] [-Scopes <String>] [-CorrelationCookieSameSite <String>]
 [-Configure <ScriptBlock>] [-ComputerName <String>] [-AppToken <String>] [-Credential <PSCredential>]
 [-UseDefaultCredentials] [-Integrated] [-TrustCertificate] [-Cookies]
 [<CommonParameters>]

WSFed

Set-PSUAuthenticationMethod [-ScriptBlock <ScriptBlock>] [-Type <AuthenticationMethodType>] [-Disabled]
 -CallbackPath <String> [-UseTokenLifetime <Boolean>] [-CorrelationCookieSameSite <String>] -Wtrealm <String>
 -Wreply <String> -MetadataAddress <String> [-Configure <ScriptBlock>] [-ComputerName <String>]
 [-AppToken <String>] [-Credential <PSCredential>] [-UseDefaultCredentials] [-Integrated] [-TrustCertificate]
 [-Cookies] [<CommonParameters>]

LogoutUrl

Set-PSUAuthenticationMethod [-ScriptBlock <ScriptBlock>] [-Type <AuthenticationMethodType>] [-Disabled]
 [-LogoutUrl <String>] [-Configure <ScriptBlock>] [-ComputerName <String>] [-AppToken <String>]
 [-Credential <PSCredential>] [-UseDefaultCredentials] [-Integrated] [-TrustCertificate] [-Cookies]
 [<CommonParameters>]

Form

Set-PSUAuthenticationMethod [-ScriptBlock <ScriptBlock>] [-Type <AuthenticationMethodType>] [-Disabled]
 [-Configure <ScriptBlock>] [-Native] [-ComputerName <String>] [-AppToken <String>]
 [-Credential <PSCredential>] [-UseDefaultCredentials] [-Integrated] [-TrustCertificate] [-Cookies]
 [<CommonParameters>]

Domain

Set-PSUAuthenticationMethod [-ScriptBlock <ScriptBlock>] [-Type <AuthenticationMethodType>] [-Disabled]
 [-Configure <ScriptBlock>] [-Domain <String>] [-ComputerName <String>] [-AppToken <String>]
 [-Credential <PSCredential>] [-UseDefaultCredentials] [-Integrated] [-TrustCertificate] [-Cookies]
 [<CommonParameters>]

DESCRIPTION

Sets the authentication method settings.

Authentication settings are stored in .universal/authentication.ps1

You can also use this cmdlet with the PowerShell Universal Management API.

EXAMPLES

Example 1

PS C:\> Set-PSUAuthenticationMethod -ScriptBlock {
    param($Credential) 

    if ($Credential.UserName -eq 'Adam')
    {
        New-PSUAuthenticationResult -Success -UserName 'Adam'
    }
    else 
    {
        New-PSUAuthenticationResult -ErrorMessage 'Not Adam!'
    }

}

Forms authentication script blocks receive a single $Credential parameter that contains a PSCredential object. You need to return a New-PSUAuthenticationResult from the script block to grant and deny access.

PARAMETERS

-AppToken

The AppToken that is used for calling the PowerShell Universal Management API. You can also call Connect-PSUServer before calling this cmdlet to set the AppToken for the entire session.

Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ComputerName

Specifies the computer name or URL that should be called when accessing the PowerShell Universal Management API. You can also use Connect-PSUServer before calling this cmdlet to set the computer name for the entire session.

Type: String
Parameter Sets: (All)
Aliases: Uri

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ScriptBlock

The script block to execute when a user is logging in.

Type: ScriptBlock
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Disabled

Whether forms authentication is disabled.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-UseDefaultCredentials

Use default credentials when connecting to the management API

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Authority

The OpenID Connect authority URL.

Type: String
Parameter Sets: OIDC
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-CallbackPath

The callback path the authority will call after authentication.

Type: String
Parameter Sets: SAML2, OIDC, WSFed
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ClientId

The OpenID Connect Client ID to supply the authority with.

Type: String
Parameter Sets: OIDC
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ClientSecret

The OpenID Connect Client Secret to supply the authority with.

Type: String
Parameter Sets: OIDC
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Configure

Additional configuration script that can be run to update the authentication provider settings. See our online documentation for more information.

Type: ScriptBlock
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-CorrelationCookieSameSite

The CorrelationCookieSameSite setting to use for OpenID Conenct or WS-Federation authentication.

Type: String
Parameter Sets: OIDC, WSFed
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-EntityId

The entity ID for SAML2 authentication.

Type: String
Parameter Sets: SAML2
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-GetClaimsFromUserInfoEndpoint

Whether to return additional claims information from the OpenID Connect authority. This setting is not supported by all authorities.

Type: Boolean
Parameter Sets: OIDC
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-IdentityProviderEntityId

The Idetity Provider Entity ID for SAML2 authentication. This is usually the URL to call for authentication.

Type: String
Parameter Sets: SAML2
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Integrated

Executes the command internally rather than using the Management API. Only works when running script from within PowerShell Universal.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-MetadataAddress

The SAML2 or WS-Federation metadata address. For SAML2, this should be specified if it is different than the Identity Provider Entity ID. For WS-Federation, this setting is required.

Type: String
Parameter Sets: SAML2
Aliases: MetadataUrl

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

Type: String
Parameter Sets: WSFed
Aliases: MetadataUrl

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Resource

A resource to grant a token for when authenticating with OpenID Connect.

Type: String
Parameter Sets: OIDC
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ResponseType

The OpenID Connect response type. This can be token or code.

Type: String
Parameter Sets: OIDC
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-SaveTokens

Whether to save the tokens within the OpenID Connect cookie.

Type: Boolean
Parameter Sets: OIDC
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Scopes

Scopes to request during OpenID Connect authentication.

Type: String
Parameter Sets: OIDC
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ServiceCertificate

The service certificate to use when authenticating against the SAML2 Identity Provider.

Type: String
Parameter Sets: SAML2
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Type

The Authentication Method Type.

Type: AuthenticationMethodType
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-UseTokenLifetime

Whether to use the token lifetime as the cookie lifetime.

Type: Boolean
Parameter Sets: OIDC, WSFed
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Wreply

The WS-Federation Wreply setting.

Type: String
Parameter Sets: WSFed
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Wtrealm

The WS-Federation Wrealm setting.

Type: String
Parameter Sets: WSFed
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-RequireMfa

Enforce the MFA requirement for OpenID Connect.

Type: SwitchParameter
Parameter Sets: OIDC
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-SigningKey

A certificate signing key to use with SAML2.

Type: String
Parameter Sets: SAML2
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-SingleSignOnServiceUrl

The single signon service URL for SAML2.

Type: String
Parameter Sets: SAML2
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-LogoutUrl

The logout URL for OpenAPI Connect or WS-Federation.

Type: String
Parameter Sets: LogoutUrl
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-AllowUnsolicitedAuthnResponse

Allow unsolicited authentication responses for SAML2.

Type: SwitchParameter
Parameter Sets: SAML2
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Credential

Credentials to login to the PowerShell Universal Management API.

Type: PSCredential
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-TrustCertificate

Whether the cmdlet should ignore certificate issues.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-LoadMetadata

Whether to load metadata for SAML2 authentication.

Type: SwitchParameter
Parameter Sets: SAML2
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-NameIdPolicy

The SAML2 Name ID policy.

Type: String
Parameter Sets: SAML2
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Domain

The domain to login when using native authentication.

Type: String
Parameter Sets: Domain
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Native

Forms authentication will use the native operating system for login. Currently, only supported on Windows.

Type: SwitchParameter
Parameter Sets: Form
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Cookies

Reuses and persists authentication cookies for the current PowerShell session.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -Verbose, -WarningAction, -WarningVariable, and -ProgressAction. For more information, see about_CommonParameters.

INPUTS

None

OUTPUTS

System.Object

NOTES

RELATED LINKS

New-PSUAuthenticationResult