I have seen the API token approach mentioned several times, but I have not personally tested or implemented it yet.
For my automation and custom reporting solutions, I use a different approach that I originally picked up from a process shared by HCL during a user group meeting. The original implementation used a Fixlet and created a local file to store the encrypted credentials. I simplified the process by storing the encrypted values in the Windows Registry instead.
If you find it useful, feel free to review and adapt the approach for your own environment. Rest I am leaving the stage for HCL team to suggest on api token part.
One limitation to be aware of is that the credentials can only be decrypted by the same Windows account (NT ID) that was used to encrypt them. If a different account attempts to decrypt the stored values, the operation will fail.
I currently use this method across multiple automation scripts and custom reporting solutions.
Workflow:
Username/Password
↓
Encrypt
↓
Store in Registry
↓
Read from Registry
↓
Decrypt
↓
Use for Authentication
I am attaching both the encryption and decryption scripts for reference.
# Encryption Script (Run Once)
# Replace with your own values before running
$PlainUser = "<BigFix_API_Username>"
$PlainPass = "<BigFix_API_Password>"
$RegPath = "HKLM:\SOFTWARE\CompanyName\ApplicationName"
$UserValueName = "APIBFXMOIDEnc"
$PassValueName = "ApiBFXMIPassEnc"
# Must remain identical in both encryption and decryption scripts
[Byte[]]$Key = 1..16
if (-not (Test-Path $RegPath)) {
New-Item -Path $RegPath -Force | Out-Null
}
$UserSecure = ConvertTo-SecureString -String $PlainUser -AsPlainText -Force
$PassSecure = ConvertTo-SecureString -String $PlainPass -AsPlainText -Force
$UserEnc = ConvertFrom-SecureString -SecureString $UserSecure -Key $Key
$PassEnc = ConvertFrom-SecureString -SecureString $PassSecure -Key $Key
New-ItemProperty -Path $RegPath -Name $UserValueName -Value $UserEnc -PropertyType String -Force | Out-Null
New-ItemProperty -Path $RegPath -Name $PassValueName -Value $PassEnc -PropertyType String -Force | Out-Null
Write-Host "Encrypted credentials stored successfully."
# Decryption Script
$RegPath = "HKLM:\SOFTWARE\CompanyName\ApplicationName"
$UserValueName = "APIBFXMOIDEnc"
$PassValueName = "ApiBFXMIPassEnc"
# Must be identical to the key used during encryption
[Byte[]]$Key = 1..16
$UserEnc = (Get-ItemProperty -Path $RegPath -Name $UserValueName).$UserValueName
$PassEnc = (Get-ItemProperty -Path $RegPath -Name $PassValueName).$PassValueName
$UserSecure = ConvertTo-SecureString $UserEnc -Key $Key
$PassSecure = ConvertTo-SecureString $PassEnc -Key $Key
$Credential = New-Object System.Management.Automation.PSCredential (
[System.Net.NetworkCredential]::new("", $UserSecure).Password,
$PassSecure
)
# Example:
# $Credential.UserName
# $Credential.GetNetworkCredential().Password
).
