Alexandre Martigny

Hi Andreas,

Thank you for bringing this issue to our attention. We’ve investigated the matter, and a fix has been implemented. It will be included in the next release of Devolutions Server.

As for your follow-up questions: both global administrators and vault owners have access to expired and expiring notifications. Additionally, users can manually subscribe to specific entries and choose to receive notifications for expired or expiring items. To do this, simply click the bell icon in the entry dashboard toolbar and select the desired notification options.

If you have any further questions or need assistance, feel free to reach out.

Best regards,

Hello,

Thank you for reaching out to us. We want to make sure we fully understand your use case and requirements, but based on your message, it's not entirely clear what your exact needs are. If you've already explored our official PowerShell module (Devolutions.PowerShell) or logging into the API using a standard application user/password and found that these approaches don't meet your needs, the next option would be to manually obtain an OAuth token and include it in the authorization header of your requests.

When it comes to scripting scenarios, we recommend the device code flow, as it is simpler to implement for non-interactive contexts. We also support the authorization code flow with PKCE, but it tends to be more complex and is generally not intended for automation.

The PowerShell script we provided is only meant as a reference to illustrate the necessary HTTP calls. It doesn't rely on any DLLs from Remote Desktop Manager—it's purely a set of examples showing how to request and refresh access tokens. You can adapt this logic to any programming language or environment you prefer.

We understand that an API key feature (with user-specific permissions) could simplify your workflow. However, as François mentioned, this functionality isn't in our short-term roadmap.

If there's anything else we can do to assist you or clarify, please let us know.

Best regards,

Hello,

Our server supports the device code authentication flow. You can refer to this article for information;

https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow

I've roughly documented the steps to do so. I also provided you with a sample to obtain an access token using a device code flow written using Powershell.

1. Discover Endpoints:

Query the well-known OpenID configuration endpoint to retrieve the server’s endpoints, specifically the token endpoint and the device authorization endpoint.

2. Request a Device Code:

Send a request (client ID: "dvls", scopes: "openid offline_access") to the device authorization endpoint. In response, you receive a device code, a user code, a verification URL (and a complete verification URL), plus details about how long the code is valid and how frequently to check.

3. Prompt the User:

Direct the user to the provided verification URL (or automatically open their browser) so they can enter the user code and approve the device’s access request.

4. Poll for the Access Token:

Start a loop that periodically sends a request to the token endpoint with the device code and client ID. Continue polling until the server confirms that the user has authorized the request by returning an access token.

5. Refresh the Access Token:

When needed, use the refresh token (obtained alongside the access token) to request a new access token from the token endpoint, ensuring ongoing access to the application.

Best regards,

Hi Damien,

We need to make some changes to how we internally handle paging to better utilize Okta's API. The changes will be coming in a later release of Devolutions Server.

Best regards,

Hi Dianna,

The CMDlet "Get-DSEntrySensitiveData" returns the sensitive data for a given entry. An entry can have a lot of different fields that are considered sensitive, such as the password, credentials or OTP key. You can select what property you want by piping the result to "ForEach-Object" like so;

$SensitiveData | ForEach-Object { $_.passwordItem }

The new version should be available for download on PSGallery in the following hour.

Best regards,

Hello Jennifer,

Please try again after adding the "-All" switch parameter after your command. There seems to be a case that slipped by me.

Get-DSEntry -VaultID $YourVaultId -All

Best regards,

Hello Jennifer,

You can change an entry's password by overriding the "passwordItem" property with your new password. Here's the code to do so;

$Entry = (Get-DSEntry -EntryId $EntryId).Body.data
$Entry.data.passwordItem = @{
    hasSensitiveData = $false
    sensitiveData = $YourNewPassword
}        
Update-DSEntryBase (ConvertTo-Json $Entry -Depth 10)

Best regards,

Hello Jen,

Here are some ways to retrieve the information you are looking for.

1. From Devolutions Server (two ways):

   1. Navigate to the entry and look at the URL. The URL will contain 2 different GUIDs. First one is the vault you are in, next on is your entry's ID.

   2. Open your entry's properties, then go to "Entry information". Your entry's ID should be there for you to copy.

2. From RDM:

   1. Open your entry's properties, then go to "Entry Information". Your entry's ID should be there for you to copy.

3. From Devolutions Server's PowerShell module:

   1. You could use the "Get-DSEntry" command with your correct vault ID and/or filters to find the entry you are looking for. I'm listing this as an option, but the methods above are faster and easier.

Do not hesitate if you have any more questions regarding the module.

Best regards,

Hello Thoj,

It is currently not possible to export the password history using our Powershell module. I will look into it and provide a CMDlet in the next release, which will be available later this week.

Thank you for bringing this to my attention.

Best regards,

Hello Fredrik,

There is a parameter to change the permission override. Please see the example below;

$vaultID = "878254ae-fee1-45e9-ba14-0feee2a1e358"
$root = (Get-DSFolders ($vaultID)).Body.data | ? { $_.connectionType -eq 92 }

Set-DSEntityPermissions -EntityId $root.id -PermissionOverride [SecurityRoleOverride]::Inherited

Best regards,

Hi Andreas,

Just a reminder that fetching an entry as a RDM connection and converting from and to XML is only necessary when trying to create or update an entry that has yet to be supported in DVLS. In this case, it is not necessary since you are trying to update a folder.

I have successfully updated a folder's credential to a private vault search including ampersand using the following code;

#Fetch folder
$Folder = (Get-DSEntry -EntryId $FolderID).Body.data

#Handle folder's path...
$Folder.group = $Folder.group.Substring(0, $Folder.group.LastIndexOf('\'))

#... or if folder's at root
$Folder.group = ''

#Change credential mode, add credentialConnectionId, add privateVaultSearchString
$Folder.data | Add-Member -NotePropertyName 'credentialMode' -NotePropertyValue ([CredentialSourceMode]::PrivateVaultSearch) -Force
$Folder.data | Add-Member -NotePropertyName 'credentialConnectionId' -NotePropertyValue $CredentialConnectionId -Force
$Folder.data | Add-Member -NotePropertyName 'privateVaultSearchString' -NotePropertyValue "Ampersand&test&" -Force

#Save updated folder
$ServerResponse = (Update-DSEntryBase -jsonBody (ConvertTo-Json $Folder -Depth 10)).Body.data

As you can see from above, I added code to handle the folder's path. This is necessary when updating a folder in order to keep the correct path once saved.

For future reference, if you need to include an ampersand in any string when creating or updating an unsupported entry (converting from and to XML), you need to escape them like this;

"Ampersand&test&"

Best regards,

Hi Andreas,

Everything works as expected on my end. Could you please provide more information and/or the script you are trying to execute so that I can further assist you?

Best regards,

Hi Andreas,

The "Field" structure gets properly loaded with the module in recent versions of the module. The "Field" structure needs to be respected or the CMDlet won't work with those fields. Here's how to use it;

$descField = [Field]::new('description', 'root', 'this is a desc')
        
$RequestParams = @{
	Name = 'NewRDPEntry'
	Username = 'username'
	NewFieldsList = @($descField)
	Host = 'newhost'
}

$res = New-DSRDPEntry @RequestParams

Using "NewFieldsList" require some knowledge as to where the property go in our "Connection" object. In this exemple, "Description" is found at the root of the object.

Best regards,

Hi Andreas

There's a sample script available to edit/add any entry type that is yet to be supported by our PowerShell module. The script is "NonSupportedEntry".

TLDR (Basic sample provided below);

1. Fetch your entry ("Get-DSEntry" with flag parameter "-AsRDMConnection")

2. Using Convert-XMLToPSCustomObject, convert data/metadata depending on your needs

3. Edit the required fields in those

4. Once done, convert each one back to XML using "Convert-PSCustomObjectToXML"

5. Serialize those XML object using "Convert-XMLToSerializedString"

6. Set data/metadata on the original object with those serialized strings

7. Convert your whole object to JSON and save

I just tested and everything works as expected. I'm curious as to how you successfully used the script you provided, since the only parts of our connection object that needs xml serialization is "Connection.data" and "Connection.metadata"

$SSHTunnelEntryID = '8e35193a-cb73-4ede-a3d1-eee5458a1d35'

$SSHTunnelEntry = (Get-DSEntry -EntryId $SSHTunnelEntryID -AsRDMConnection).Body.data.connectionInfo

$ConnectionData = Convert-XMLToPSCustomObject ([xml]$SSHTunnelEntry.Data)
$ConnectionMetaData = Convert-XMLToPSCustomObject ([xml]$SSHTunnelEntry.MetaDataString)

$ConnectionData.Connection.Terminal.PortForwards.PortForward.DestinationPort = '9999'

$ConnectionDataXML = Convert-PSCustomObjectToXML $ConnectionData.Connection 

$SSHTunnelEntry.Data = (Convert-XMLToSerializedString $ConnectionDataXML)

$Body = ConvertTo-Json ($SSHTunnelEntry) -Depth 10
$res = Invoke-WebRequest -Uri 'http://localhost/dps/api/connection/save' -Method 'PUT' -Body $Body -ContentType 'application/json' -WebSession $Global:WebSession

As stated in my sample script, due to the complex nature of our software, it is not a particularly straight forward and simple process but it is available nonetheless for our most adventurous users.

Thank you for your interest in helping the community, it is greatly appreciated.

Best regards,

Hello Jakub,

I've tried logging in with a domain user and it works as expected on my end.

Could you please check your logs after a failed attempt to see if we could find anything useful there?

"Reports -> Data source logs" & "Reports -> Login attempts"

Also, please let me know your current Devolutions Server's version.

Best regards,

Hello Claudio,

Thank you for reporting the issue.

I went ahead and fixed that CMDlet . I tested on Devolutions Server version 2022.1.13.0 and could successfully update my entry.

I am currently having issues with PSGallery, but the new version should be deployed in the following hour.

Thank you for your patience and do not hesitate to reach out to us again if need be.

Best regards,

Hi Andreas,

'Get-DSVault' default parameter set is 'GetPage', which takes 'PageSize' (default 25) and 'PageNumber' (default 1). When calling 'Get-DSVault' without specifying the parameter we're passing, PowerShell expects to receive two integers, hence the first error message received.

I fixed 'Update-DSVault' by adding the parameter name to 'Get-DSVault' to use the correct parameter set.

Thank you and have a nice day,

Hello Andreas,

From your first post, we thought that you were trying to create a "SSH Tunnel" entry but from the UI in those pictures, it seems like you are trying to create a "SSH VPN" entry and those 2 are different. "SSH VPN" entries are not yet supported in DVLS, but "SSH Tunnel" are. You can create a "SSH Tunnel" entry using my above script, but you will need to follow the unsupported entry sample script to create a "SSH VPN" entry.

I went ahead wrote a working sample to base your script upon;

$NewGuid = [Guid]::NewGuid()
$NewName = 'NewEntryName'
        
$SSH_VPN = (Get-DSEntry -EntryId 'cb1b097c-b2b7-44ba-a629-c3bef72c94ad' -AsRDMConnection).Body.data.connectionInfo

$ConnectionData = Convert-XMLToPSCustomObject ([xml]$SSH_VPN.Data)
$ConnectionMetaData = Convert-XMLToPSCustomObject ([xml]$SSH_VPN.metaDataString)

$ConnectionData.Connection.Id = $NewGuid
$ConnectionData.Connection.PSObject.Properties.Remove('CreationDateTime')
$ConnectionData.Connection.PSObject.Properties.Remove('Stamp')

$ConnectionData.Connection.Name = $NewName
$ConnectionData.Connection.Terminal.Host = 'newHost'
$ConnectionData.Connection.Terminal.HostPort = 4444

$ConnectionMetaData.ConnectionMetaDataEntity.Name = $NewName

$ConnectionDataXML = Convert-PSCustomObjectToXML $ConnectionData.Connection
$ConnectionMetaDataXML = Convert-PSCustomObjectToXML $ConnectionMetaData.ConnectionMetaDataEntity -RootName 'ConnectionMetaDataEntity'

$SSH_VPN.Id = $NewGuid
$SSH_VPN.name = $NewName
$SSH_VPN.data = $ConnectionDataXML.OuterXML
$SSH_VPN.metaDataString = $ConnectionMetaDataXML.OuterXML
$SSH_VPN.metaData.name = $NewName

$Body = ConvertTo-Json ($SSH_VPN) -Depth 15

$res = Invoke-WebRequest -Uri 'http://localhost/dps/api/connection/save' -Method 'PUT' -Body $Body -ContentType 'application/json' -WebSession $Global:WebSession

This script worked on my end. I am able to create a new "SSH VPN" with the required fields edited.

Let me know if you need any more assistance.

Best regards,

Hello Andreas,

Here are the steps in order to create a new SSH tunnel entry;

1. Create a new entry from DVLS/RDM (Editing will be easier if you fill out the fields you know you will need later on)

2. Fetch newly created entry using "Get-DSEntry" (AsRDMConnection flag is not needed in this case)

3. Create a copy of the object

4. Clear some fields in order to create the new entry (listed below)

5. Edit the required fields

6. Save new entry using "New-DSEntryBase"

$SSHTunnelEntry = (Get-DSEntry -EntryId '142c0872-5ab6-440b-bc0e-d624bd84a771').Body.data #Newly created entry ID
$NewSSHTunnelEntry = $SSHTunnelEntry.PSObject.Copy() #Deep copy

#Those properties need to be removed in order to create a new entry
$NewSSHTunnelEntry.PSObject.Properties.Remove('id')
$NewSSHTunnelEntry.PSObject.Properties.Remove('metaInformation')
$NewSSHTunnelEntry.PSObject.Properties.Remove('resolvedInheritedPermissions')
$NewSSHTunnelEntry.PSObject.Properties.Remove('resolvedTimeBasedUsageSettings')

#Most of the properties are located in "data"
$NewSSHTunnelEntry.data.host = 'newHost'
$NewSSHTunnelEntry.data.hostPort = '4444'
$NewSSHTunnelEntry.data.username = 'newUsername'

$NewSSHTunnelEntry.name = 'newSSHTunnel'
$NewSSHTunnelEntry.userName = 'newUsername'

$NewEntryRes = New-DSEntryBase (ConvertTo-Json $NewSSHTunnelEntry)

The unsupported entry sample script was specifically made for entries which are not yet supported in Devolutions Server.

Let me know if you need any help with a specific property not saving properly and I'll send you an updated version of the script to fit your needs.

Best regards,

Hello Andreas,

This part of the script is meant to refresh your oAuth token. To login via oAuth, call 'New-DSSession' without providing the 'Credential' parameter and you should be prompted for your credentials. (Keep in mind this part is not 100% functional yet, as it only works if your default browser is Google Chrome.)

When logged in the 'old' way, your token should automatically refresh itself on each call. If you received an 'Unauthorized', you might need to log in again. If I remember correctly, a session expires after being idle for 7 minutes.

With that being said, 'Get-Variable' errors should be ignored in this case and the script should be able to continue executing. You should then be able to get the result of your call with a proper error message.

If I missed something, please fill in with some more details and I'll further assist you with this issue.

Thank you for your input, I will fix this as soon as possible.

Best regards,

Hi Brian,

After going through the authentication part of the code base with the developer who worked on it, we narrowed down the issue to 2 options with the information you gave us.

First thing to check would be that "Cli" and "Scripting" are both allowed in your Devolutions Server settings. Those settings are located under Administration -> System Settings -> Application Access.

After that, check under Administration -> Server Settings -> Security and make sure "Force token public IP validation" and "Use X-Forwarded-For" are unchecked. Also clear the first 4 fields on that page.

If the issue persist after those validations, I'd suggest you schedule a remote session with our support team so they can better investigate your setup. To do so, send an email to service@devolutions.net with a link to this thread attached.

Best regards,

Hi Brian,

In order to investigate any further, I will need another log from you.

Logs related to token validation are located in your Devolutions Server installation folder under "App_Data". The file should be called "DPS_Main.log". If there's no such file, you need to edit the folder security and give your user write permissions. After that, try to log in again and send us the "DPS_Main" log file using the same link previously given to you.

This log will contain detailed explanations as to why your token was not valid and should help us track down your issue.

Best regards,

Hi Brian,

This is hard one for me verify. We were not able to successfully reproduce the issue on our end with a more "streamlined" installation of Devolutions Server, but be assured that we are actively working on the case to fix it for you.

I cannot affirm this with 100% certainty, but I am pretty sure the issue comes from how your Devolutions Server is set up. I will need to investigate deeper with the developers responsible for the authentication part of our code base and come back to you later.

Best regards,

Hi Brian,

Could you please send us a copy of your login attempt & data source logs? We will try to find out what's happening from those and get back to you as soon as possible.

To do so, export them via the web interface and fill the form at https://devolutions.sharefile.com/share/filedrop. If possible, please rename the files with my last name so they can be easily redirected to me.

Best regards,

Hi Brian,

Your application key could be disabled, but I do not believe this to be the case since it's not the error sent back to the client when logging in with a disabled secret key. It is not likely to have been invalidated after an update, as I am using an older key with no issue on my end. However, let's not rule out this option just yet. Have you tried with a newly generated application key as mentioned previously?

Best regards,