Native Login with Domain fails to deserialize authentication.ps1 after restart

Native Login with Domain fails to deserialize authentication.ps1 after restart

avatar

## Description of Issue:

Forms Authentication with Native Login fails to reload when both `-Native` and `-Domain` are configured on `Set-PSUAuthenticationMethod`.

The intended configuration is to allow users to authenticate with native/domain credentials and then use the resulting group claims for role authorization. The role mapping itself is not the failing part. The failure occurs when PSU reloads `.universal/authentication.ps1`.

A minimal failing configuration is:

```powershell
Set-PSUAuthenticationMethod -Type "Form" -Native -Domain "ExampleDomain"
```

This also fails when a script block is included:

```powershell
Set-PSUAuthenticationMethod -Type "Form" -ScriptBlock {
param(
[PSCredential]$Credential
)

New-PSUAuthenticationResult -ErrorMessage 'Invalid credentials'
} -Native -Domain "ExampleDomain"
```

Isolation results:

* `Set-PSUAuthenticationMethod -Type "Form" -Native` loads successfully.
* `Set-PSUAuthenticationMethod -Type "Form" -Domain "ExampleDomain"` loads successfully.
* `Set-PSUAuthenticationMethod -Type "Form" -Native -Domain "ExampleDomain"` fails during reload/deserialization.
* Git Sync is not required to reproduce.
* A multi-node setup is not required to reproduce.
* A shared SQL backend is not required to reproduce.
* The same type of failure was observed after a service restart when PSU attempted to reload `authentication.ps1`.

Reproduction steps:

1. Start PowerShell Universal.
2. Configure `.universal/authentication.ps1` with:

```powershell
Set-PSUAuthenticationMethod -Type "Form" -Native -Domain "ExampleDomain"
```

3. Restart PowerShell Universal or otherwise cause the repository configuration to reload.
4. Review the system logs.
5. Attempt to load the login page.

Expected result:

PowerShell Universal should reload the Forms Authentication Native Login configuration successfully, and the login page should remain usable.

Actual result:

PowerShell Universal fails to deserialize `authentication.ps1`. The login page may render in an incomplete or unusable state.

Observed error:

```text
Error deserializing /home/data/UniversalAutomation/Repository/.universal/authentication.ps1. Parameter set cannot be resolved using the specified named parameters. One or more parameters issued cannot be used together or an insufficient number of parameters were provided.
```

This appears to be related specifically to the `-Native -Domain` parameter combination.

## Version:

Confirmed affected:

* PowerShell Universal 2026.1.7, reproduced in Docker using `ironmansoftware/universal:2026.1.7-ubuntu-24.04`.
* PowerShell Universal 2026.1.6, observed in an MSI Windows Service environment.

## Severity

High - Bug has serious impact on usage, impacts a large number of users.

## Hosting Method?

Docker Container

## Operating System?

Linux

## What Database are you running?

Unknown

## Is this instance licensed?

Yes

## Features:

* Forms Authentication
* Native Login
* Repository-based configuration
* Role authorization using claims

## Additional Environment data:

* Reproduced using Docker image: `ironmansoftware/universal:2026.1.7-ubuntu-24.04`
* Git Sync was not required to reproduce.
* Multi-node hosting was not required to reproduce.
* Shared SQL backend was not required to reproduce.
* Customer-observed environment was also affected on PSU 2026.1.6 with MSI Windows Service hosting, but the minimal reproduction was confirmed independently in Docker.

All Comments (2)

avatar

Hello,

Sorry for the late reply.

Just to let you know that a ticket has been opened internally for this issue. Thank you for reporting.

Best regards,

Jeff Dagenais

avatar

#14071
Thanks Jeff