PAM A2A client returns codes 446 and 447 for powershell scripts
Article ID: 275599
Updated On:
Products
Issue/Introduction
While trying to configure and test using A2A with powershell scripts, enabling options "Check Execution Path" and "Check File Path" results in the following errors:
PS C:\cspm\cloakware\cspmclient\examples> C:\cspm\cloakware\cspmclient\examples\example.ps1 ps1alias
Return Code: 446 (or 447)
User ID: null
Password: null
error.code.446=Authorization mapping validation error. Invalid execution path specified for request script.
error.code.447=Authorization mapping validation error. Invalid file path specified for request script.
Environment
CA Privileged Access Manager (PAM) A2A client.
Cause
The tomcat log, which can be downloaded from the Configuration > Diagnostics > Diagnostic Logs > Download page, contains messages similar to the following with the log level set to Info on parent page Configuration > Diagnostics > Diagnostic Logs:
023-11-01T12:32:55.983+0000 INFO [TP2] com.cloakware.cspm.server.app.impl.RegisterRequestServerCmd.validateParameters RegisterRequestServerCmd.validateParameters hostname:10.10.10.10, ip:10.10.10.10,, port:null, version:4.12.3, clientType:java osName:Windows 10, osVersion:10.0, osArch:amd64 fipsEnabled:true clientToken:##### fingerprint:###### nodeIdXML:<?xml version="1.0" encoding="utf-8" ?><nodeid><macaddr>##:##:##:##:##:##</macaddr><machineid></machineid><applicationtype>cspm</applicationtype></nodeid>
2023-11-01T12:32:55.988+0000 INFO [TP2] com.cloakware.cspm.server.app.impl.GetScriptCredentialsCmd.validateParameters hostname:10.10.10.10, ip:10.10.10.10, port:null, version:4.12.3, clientType:java osName:Windows 10, osVersion:10.0, osArch:amd64 fipsEnabled:true, clientToken:##### fingerprint:###### nodeIdXML:<?xml version="1.0" encoding="utf-8" ?><nodeid><macaddr>##:##:##:##:##:##</macaddr><machineid></machineid><applicationtype>cspm</applicationtype></nodeid>, targetAliasName=ps1alias, scriptName=powershell.exe, scriptFilePath=C:\Windows\System32\WindowsPowerShell\v1.0, scriptExePath=C:\cspm\cloakware\cspmclient\examples, scriptHash=#######, executionUID=<My User>
2023-11-01T12:32:55.994+0000 INFO [TP2] com.cloakware.cspm.server.app.impl.GetScriptCredentialsCmd.checkForGroupBasedScriptAuth No script in DB named powershell.exe. Checking request groups using a dummy script
2023-11-01T12:32:55.998+0000 INFO [TP2] com.cloakware.cspm.server.app.impl.GetScriptCredentialsCmd.checkForGroupBasedScriptAuth No script in DB named powershell.exe. Checking request groups using a dummy script
2023-11-01T12:32:56.004+0000 WARNING [TP2] com.cloakware.cspm.server.app.impl.GetScriptCredentialsCmd.invoke GetScriptCredentials failed to retrieve credentials for request { targetAliasName=ps1alias, scriptName=powershell.exe, scriptFilePath=C:\Windows\System32\WindowsPowerShell\v1.0, scriptExePath=C:\cspm\cloakware\cspmclient\examples, executionUID=<My User>, requestServerHostname=10.10.10.10, clientType=java, osName=Windows 10, osVersion=10.0, osArchitecture=amd64, version=4.12.3, hash=#######, reason:GetScriptCredentials.invoke script authorization not found for script name.}
The configured A2A script and mapping did not match the values sent by the A2A client to the PAM server.
Resolution
On the Credentials > Manage A2A > Scripts page the script needs to be configured to match the parameters that the A2A client sends to the PAM server and that are logged in the GetScriptCredentialsCmd.validateParameters message at level INFO in the tomcat log, see the example above. Specifically the following settings are required, if you want to enable all script validation options:
- Script/App Name - value of parameter scriptName.
Example: powershell.exe - Execution Path - value of parameter scriptExePath.
Example: C:\cspm\cloakware\cspmclient\examples - File Path - value of parameter scriptFilePath.
Example: C:\Windows\System32\WindowsPowerShell\v1.0 - Hash - value of parameter scriptHash.
On page Credentials > Manage A2A > Mappings define a mapping between this script and the A2A client, or a request group that includes this client, and enter the value of executionUID from the log message in the Execution User field, if you want to enable the Check Execution User checkbox.
Additional Information
Changing the tomcat log level does not happen in real time. It can take about 30 seconds before the change takes effect. The tomcat log level can remain at level Info over extended periods of time. A CRON job checks the file size once an hour at 17 minutes past the hour and rotates the log if it is larger than 10MB. If you test around that time, the downloaded log may be missing the messages of interest because it just rolled over.
Feedback
