When I create a folder within a vault, I want to set the permissions to that folder using the Devolutions.PowerShell module version 2025.3.1. Though when I try to assign the permissions this works as intended for Users and User Groups, but not for Application Identities.
The following code can be used to reproduce my situation. Please note that Get-SecureEnvironmentHash is a private function which retrieves hashed secrets. We can assume these work as intended since the folder can be created and permissions can be set.
function New-DevolutionsFolder {
[CmdletBinding()]
param (
[Parameter(Mandatory = $true)]
[string]$Uri,
[Parameter(Mandatory = $false)]
[string]$Vault = "Test",
[Parameter(Mandatory = $false)]
[string]$Folder = "TestFolder",
[Parameter(Mandatory = $false)]
[string]$UserGroup = "test_group"
)
begin {
Import-Module -Name "Devolutions.PowerShell"
try {
# Create credentials
$applicationSecret = Get-SecureEnvironmentHash -Name "DevolutionsTestSecret" | ConvertTo-SecureString -AsPlainText -Force
$applicationID = Get-SecureEnvironmentHash -Name "DevolutionsTestID"
[pscredential]$Credential = New-Object System.Management.Automation.PSCredential ($applicationID, $applicationSecret)
# Connect
New-DSSession -BaseUri $Uri -Credential $Credential -AsApplication
} catch {
throw "Could not connect to '$Uri'"
}
}
process {
# Generate permissions
$roleID = Get-DSRole -All |
Where-Object { $_.name -eq $UserGroup } |
Select-Object -ExpandProperty "Id" |
Select-Object -ExpandProperty "Guid"
$permissions = @(
# View
[RemoteDesktopManager.PowerShellModule.Private.models.ConnectionPermission]@{
IsEmpty = $false
Override = [RemoteDesktopManager.PowerShellModule.Private.enums.SecurityRoleOverride]::Custom
Right = [RemoteDesktopManager.PowerShellModule.Private.enums.SecurityRoleRight]::View
Roles = @($roleID, $applicationID)
}
)
# Get the vault
$targetVault = Get-DSVault -All | Where-Object { $_.Name -eq $Vault }
# Create the folder
$createdFolder = New-DSFolder -Name $Folder -VaultID $targetVault.ID
# Set permissions
Set-DSEntityPermissions -EntityId $createdFolder.id -Permissions $permissions
}
end {
# Close the session
Close-DSSession
}
}
The below screenshot shows the Folder has been created and permissions have been set for the User Group, but not for the Application Identity, which effectively locks me out of this folder for further actions like adding entries.
[image]
If I create an instance of RemoteDesktopManager.PowerShellModule.Private.models.ConnectionPermission I cannot see any other methods than the 4 I already use, so I believe adding the Application Identity ID into the Roles should be the way to go.
What am I doing wrong here?
