New-OAuthSecurityContext

Creates an OAuth2 security context object that you can use to authenticate to any system that is configured to trust the specified authentication server.For more information about security contexts, see the about_security_context article.To use this command, you need to create an OAuth client in the authentication server. Take a note of the client ID and secret generated by the server as you need to pass them to the command. Some authentication servers might not require a client secret in some cases.To use this command, you need to know the URLs where the authentication server is listening for requests. You can find these in the openid-configuration file of your server or in the documentation for your server. The system that you try to login might also be able to provide these URLs or the URL to the openid-configuration file. For example, if a vCenter server is configured to trust an Open ID server, you can see the required URLs in the vCenter server configuration user interface. For Microsoft Active Directory Federation Service, the openid-configuration file is located at https://.../adfs/.well-known/openid-configuration.Some authentication servers might require you to pass additional parameters that are not specified in the OAuth2 specification but are custom for your particular server. You should check the documentation of the authentication server for information about these. You can use the OtherArguments parameter to pass the additional parameters. For example, if you work with the Microsoft Active Directory Federation Service and the Application Group, you must use the "resource" custom parameter to pass the Application Group identifier.This command supports the following authentication options: - authorization_code grant type: authenticate as a user by using the web browser. For this flow, you need to create an OAuth2 client with a redirect URL on localhost and a free port. See example 1.- client_credentials grant type: authenticate as a service that is identified by the client ID. For this flow, you need to create an OAuth2 client that has a client secret. See example 2.- refresh_token grant type: authenticate as a user by using a refresh token from a previous authentication. For this flow, you need to have access to a refresh token and the client credentials of the OAuth2 client that this token was given to.- password grant type: authenticate as a user by using the user's credentials. For this flow, you need to create an OAuth2 client that can use the password grant type. See example 3.

Syntax

Output

Examples

Example 1

$oauthCtx = New-OAuthSecurityContext `
    -TokenEndpointUrl "https://<ADFS FQDN>/adfs/oauth2/token/" `
    -AuthorizationEndpointUrl "https://<ADFS FQDN>/adfs/oauth2/authorize/" `
    -RedirectUrl "http://localhost:8844/auth" `
    -ClientId "powercli-native" `
    -OtherArguments @{ "resource" = "my-vcenter" }

Creates an OAuth2 security context object by authenticating through the authorization server using a browser. In this example, the authentication server is Microsoft Active Directory Federation Service. There is an Application Group with the ID of "my-vcenter". There is also a native client in that group with the ID of "powercli-native" and a redirect URL of "http://localhost:8844/auth".

Example 2

$oauthCtx = New-OAuthSecurityContext `
    -TokenEndpointUrl "https://<ADFS FQDN>/adfs/oauth2/token/" `
    -ClientId "powercli-service" `
    -ClientSecret "...." `
    -OtherArguments @{ "resource" = "my-vcenter" }

Creates an OAuth2 security context object by authenticating as a service application using the client ID and secret. In this example, the authentication server is Microsoft Active Directory Federation Service. There is an Application Group with the ID of "my-vcenter". There is also a native client in that group with the ID of "powercli-service" and a client secret.

Example 3

$oauthCtx = New-OAuthSecurityContext `
    -TokenEndpointUrl "https://<ADFS FQDN>/adfs/oauth2/token/" `
    -ClientId "powercli-native" `
    -Username "[email protected]" `
    -Password "the password" `
    -OtherArguments @{ "resource" = "my-vcenter" }

Creates an OAuth2 security context object by authenticating as the user using his credentials. In this example, the authentication server is Microsoft Active Directory Federation Service. An Application Group is created with the ID of "my-vcenter". There is also a native client in that group with the ID of "powercli-native".

Related Commands

OAuthSecurityContext

Creates an OAuth2 security context object that you can use to authenticate to any system that is configured to trust the specified authentication server.