How to validate Windows account and password with Perl? - perl

Question

I have solved this in Powershell 2.0, but need to port to Perl 5.10 for a legacy app.
I have Windows service account credentials which cannot INTERACTIVELY LOGON passed to a perl script as $Account and $Password. The $Account variable includes the domain name and AD user account name. My Powershell solution (one-liner) is:
PS C:\> New-PsSession -Credential (new-object -typename System.Management.Automation.PSCredential -argumentlist '$Account', (ConvertTo-SecureString '$Password' -AsPlainText -Force)); exit-PsSession;
If the new PsSession gets created then the account validation passed and I get output to STDOUT like:
Id Name ComputerName State ConfigurationName Availability
-- ---- ------------ ----- ----------------- ------------
1 Session1 localhost Opened Microsoft.PowerShell Available
If the validation failed I get output like this to STDERR:
[localhost] Connecting to remote server failed with the following error message
: Access is denied. For more information, see the about_Remote_Troubleshooting
Help topic.
+ CategoryInfo : OpenError: (System.Manageme....RemoteRunspace:Re
moteRunspace) [], PSRemotingTransportException
+ FullyQualifiedErrorId : PSSessionOpenFailed
I can parse these results in my program. I want to do a similar thing in Perl 5.10 on Windows. All I want to do is test that a password works for an account bearing in mind that interactive logon is denied. Any ideas?

Answer 1

A completely different approach is to contact AD directly using Net::LDAP, but then you have a lot of new challenges.
I also used something like the following (calling win ole) long time ago. But had to abandon on win200X-server i think. If it may be of any help: (Please excuse poor coding)
But this will actually check that the current user is a member of a group.
I presume it may be used to verify username pwd somehow as well.
require Win32::OLE;
sub GetObject {
Win32::OLE->GetObject(#_);
}
my ( $module, $database, $mode ) = #_;
my $env = {%ENV}; #makes a copy, makes it possible to override $ENV for test etc
my $oRoot = GetObject("LDAP://rootDSE");
my $domain_name = $oRoot && $oRoot->Get("defaultNamingContext");
my $domain_host = $oRoot && $oRoot->Get("dnsHostName");
$domain_host .= "/" unless $domain_host =~ /\/$/;
my $strAttributeName ="sAMAccountname"; #could be userPrincipalName, cn etc
my #user_parts = ($user_name); # the last one (i.e. -1) will be the user name
my $alias = $user_name;
my $group_prefix = $system_info_defs->{adAuthGroupPrefix};
my $strADsPath = "LDAP://$domain_host$domain_name";
my $objConnection = Win32::OLE->new("ADODB.Connection")
or do{warn "Cannot create ADODB Connection!";return undef};#die ("Cannot create ADODB object!");
my $objCommand = Win32::OLE->new("ADODB.Command")
or do{warn "Cannot create ADODB command!";return undef};#die ("Cannot create ADODB object!");
$objConnection->{Provider} = ("ADsDSOObject");
$objConnection->Open();
$objCommand->{ActiveConnection} = ($objConnection);
etc. etc.

Answer 2

use a system call from perl i.e. backticks
my $a = `powershell -command "ls;exit;"`;
if ($a =~ /pl$/) {
print "folder contains a perl file";
} else {
print "folder contains no perl file (strange)";
}
if this works then replace the simple ls-command with your more complex text.
Probalby you may need to elaborate on \" " ' \' "" and '' to get it right.