Possible to query (and set) the "Contact" as defined in the "Certificate" tab within VED?

[Xeleema]

Question: is it possible to query (and set) the "Contact" as defined in the "Certificate" tab within VED?

Scenario: I need to query the value for "Contact" as defined in the "Policy" tab, and set the "Contact" for the "Certificate" tab to that value.

Progress Thusfar:
I have figured out how to query the "Contact" defined in the "Policy" tab for a specific folder (top half of image).

New-VenafiSession -Server $VTTP -Credential $cred -ClientId 'vcert-cli' -Scope @{'configuration'='manage'} -verbose

$entries = Find-TppObject -Path '\ved\policy\APPLICATIONS' | sort Name

$applications = ForEach ( $entry in $entries ) {
   $v = $null
   $v = Get-TppAttribute -Path $entry.Path 
   [pscustomobject]@{
      Name = "$($entry.Name)"     ; #
      Type = "$($entry.TypeName)" ; #
      Path = "$($entry.Path)"     ; #
      Guid = "$($entry.Guid)"     ; #
      Contact   = "$(($v|?{$_.Name -like 'Contact'}).Value)"     ; #
      CreatedBy = "$(($v|?{$_.Name -like 'Created By'}).Value)"     ; #
   } ## end PScustomObject
} ## end ForEach entry in entries

The above code stores entries like the following into the $applications array;

   Name      : application3
   Type      : Policy
   Path      : \VED\Policy\APPLICATIONS\application3
   Guid      : abcdefg-123a-456b-789c-90210abcd
   Contact   : AD+DOMAIN:4gf16435bc1g7cfffff40easdfc4asdf
   CreatedBy : Web SDK

But I cannot figure out how to query the "Contact" defined in the folder's "Certificate" section (bottom half of image).

Is it possible to query (and set) the "Contact" listed on the "Certificate" tab of a given folder, using this powershell module?

[gdbarron]

Hi @Xeleema. First off, thanks so much for the detailed info as it makes helping you so much easier.

You can accomplish what you want with a small caveat. Getting an attribute on an object is directly supported with a built-in function, whereas getting a policy attribute isn't yet (but will be soon). It can still be done...

Get the policy contact with:
$contact = Get-TppAttribute -Path '\ved\policy\rest\of\path' -Attribute Contact | Select-Object -ExpandProperty Value

Set the certificate contact with:
Invoke-VenafiRestMethod -VenafiSession $VenafiSession -Method post -UriLeaf 'config/writepolicy' -Body @{'ObjectDN'='\ved\policy\rest\of\path';'Class'='X509 Certificate';'AttributeName'='Contact';'Values'=@($contact)}

To get the certificate contact:
Invoke-VenafiRestMethod -VenafiSession $VenafiSession -Method post -UriLeaf 'config/readpolicy' -Body @{'ObjectDN'='\ved\policy\rest\of\path';'Class'='X509 Certificate';'AttributeName'='Contact'}

Let me know how this goes.

[miyunda]

Hi @gdbarron ,
Thanks for the great tool. It really helps.
Is it possible to set a value in a custom field?
Below is from my Get-VenafiCertificate:
CustomFields : {@{Name=Owner Group; Type=Text; Value=System.Object[]}}
I am about to update owner group for hundreds certs.
Thank you very much.

[miyunda]

I wrote this:
Invoke-VenafiRestMethod -VenafiSession $VenafiSession -Method post -UriLeaf 'config/writepolicy' -Body @{'ObjectDN' = $certPath; 'Class' = 'X509 Certificate'; 'AttributeName' = 'CustomFields'; 'Values' = @{Name = 'Owner Group'; Type = 'Text'; Value = $newOwner } }
It returns:
Error : Write policy for "X509 Certificate:CustomFields";
Path
CacheEntryNotFound
Result : 601

[gdbarron]

Hi @gdbarron ,
Thanks for the great tool. It really helps.
Is it possible to set a value in a custom field?
Below is from my Get-VenafiCertificate:
CustomFields : {@{Name=Owner Group; Type=Text; Value=System.Object[]}}
I am about to update owner group for hundreds certs.
Thank you very much.

You can use Set-TppAttribute. Have a look at the examples and let me know how it goes.

[miyunda]

My bad, I tried Set-TppAttribute, it returns internal 500 error, so I thought I would need POST thing.
When I pasting my code here, I found a typo in it, wrong custom field label.
Fat fingers, don't laugh too loud. :)

[gdbarron]

@Xeleema, in v3.4.0 I've added the ability to get and set policies with Get-TppAttribute -Policy and Set-TppAttribute -Policy.

[Xeleema]

@gdbarron Thank you very much! I was able to refactor my code and get everything straightened out :)

[HFS-CG]

Very handy thread! Bookmarking this for later :)
Is there any sort of user-community around this VenafiPS module? I'd like to know how other folks are leveraging this to accomplish various things . . . .

[gdbarron]

@HFS-CG, just for you 😄
https://venafi-integrations.slack.com/archives/C038C9A1F41

[gdbarron]

this was just created so let's spread the word!