The complete PowerShell interface to Idira (CyberArk) Privileged Access Security — one consistent, pipeline-native module for Privilege Cloud (SaaS) and Privileged Access Manager Self-Hosted alike.
Full documentation: https://pspas.pspete.dev
| Master Branch | Latest Build | PowerShell Gallery | CodeFactor | Coverage | License |
|---|---|---|---|---|---|
 |
 |
 |
 |
||
 |
 |
 |
- First-class Privilege Cloud / ISPSS support — authenticate as an Identity or Service user (via the companion IdentityCommand module) and use the same
psPASmodule as self-hosted PVWA. Some commands are Privilege Cloud-only, some self-hosted-only —psPASenforces that automatically instead of leaving you to work it out. See Authenticate. - Complete API coverage — Over 250 commands spanning every major area of Idira: Accounts, Safes, Users & Directories, Platforms, Authentication, PSM, Privileged Threat Analytics, Vault Remote Manager, Reports and more. See psPAS Functions.
- Trusted at scale — 230,000+ downloads on the PowerShell Gallery and counting (see the live badge above).
- Built for the PowerShell pipeline, not just the REST API — commands accept and emit typed objects, so
Get-PASSafe | Get-PASSafeMember(and much longer chains) just work, instead of you gluingInvoke-RestMethodcalls and JSON parsing together by hand. - Tested, not just written — every public function ships with a Pester test and is gated by PSScriptAnalyzer in CI; nothing reaches the PowerShell Gallery without passing both.
- In active use and development since 2017 — regular releases, a maintained changelog, and ongoing contributions/sponsorship — see Acknowledgements.
- Usage
- psPAS Functions
- Installation
- Sponsors
- Changelog
- Author
- License
- Contributing
- Support
- Acknowledgements
Install-Module -Name psPAS -Scope CurrentUser
$cred = Get-Credential
New-PASSession -Credential $cred -BaseURI https://pvwa.somedomain.com
Get-PASSafe -search Finance | Get-PASSafeMember
UserName SafeName Permissions
-------- -------- -----------
FinanceAdmin FinanceSafe01 @{useAccounts=True; retrieveAccounts=True; listAccounts=True;...
Close-PASSessionEverything else in psPAS builds on this pattern: authenticate once with New-PASSession, then pipe psPAS commands together like any other PowerShell objects.
Everything begins with a Logon:
To submit a logon request to the Idira API, use the psPAS New-PASSession command.
All subsequent operations are carried out by psPAS using the input data provided for the New-PASSession request (URL, Certificate), as well as data received from the API after successful authentication (Authentication Token, PVWA Version).
Most new Idira deployments today are Privilege Cloud (SaaS), so that's the first option below — self-hosted PVWA is just as fully supported and follows straight after.
Privilege Cloud authentication flows require the pspete IdentityCommand module, available from the Powershell Gallery & GitHub. psPAS uses it to handle the ISPSS logon; from there it's the same module used against self-hosted PVWA — some commands are Privilege Cloud-only, some self-hosted-only, and psPAS enforces that automatically rather than letting the API reject an unsupported call.
Provide Identity User credentials and tenant details for authentication to Idira for Privilege Cloud:
#using URL
New-PASSession -IdentityTenantURL https://SomeTenantName.id.cyberark.cloud -PrivilegeCloudURL https://SomeTenant.privilegecloud.cyberark.cloud -Credential $Cred -IdentityUser
#using subdomain
New-PASSession -TenantSubdomain SomeTenantName -Credential $Cred -IdentityUser
Provide tenant ID and non-interactive API User credentials for authentication via Idira Identity for Privilege Cloud:
New-PASSession -TenantSubdomain YourPrivilegeCloudTenantID -Credential $ServiceUserCreds -ServiceUser
Consult the vendor documentation for guidance on setting up a dedicated API Service user for non-interactive API use.
- Use a PowerShell credential object containing a valid vault username and password.
$cred = Get-Credential
PowerShell credential request
Enter your credentials.
User: safeadmin
Password for user safeadmin: **********
New-PASSession -Credential $cred -BaseURI https://pvwa.somedomain.com- Specify LDAP credentials allowed to authenticate to the vault.
$cred = Get-Credential
PowerShell credential request
Enter your credentials.
User: xApprover_1
Password for user xApprover_1: **********
New-PASSession -Credential $cred -BaseURI https://pvwa.somedomain.com -type LDAP
Get-PASLoggedOnUser
UserName Source UserTypeName AgentUser Expired Disabled Suspended
-------- ------ ------------ --------- ------- -------- ---------
xApprover_1 LDAP EPVUser False False False False$cred = Get-Credential
PowerShell credential request
Enter your credentials.
User: DuoUser
Password for user DuoUser: **********
New-PASSession -Credential $cred -BaseURI https://pvwa.somedomain.com -type RADIUS -OTP 123456
Get-PASLoggedOnUser
UserName Source UserTypeName AgentUser Expired Disabled Suspended
-------- ------ ------------ --------- ------- -------- ---------
DuoUser LDAP EPVUser False False False FalseSAML SSO authentication using IWA and ADFS can be performed
New-PASSession -BaseURI $url -SAMLAuthWhere IWA SSO is not possible, the PS-SAML-Interactive module can be used to get the SAMLResponse from an authentication service.
The SAMLResponse received from the IdP is sent to complete saml authentication to the API.
import-module -name 'C:\PS-SAML-Interactive.psm1'
$loginURL = 'https://company.okta.com/home/app1/0oa11xddwdzhvlbiZ5d7/aln1k2HsUl5d7'
$baseURL = 'https://pvwa.mycompany.com'
$loginResponse = New-SAMLInteractive -LoginIDP $loginURL
New-PASSession -SAMLAuth -concurrentSession $true -BaseURI $baseURL -SAMLResponse $loginResponse- Where PVWA/IIS requires client certificates, 'psPAS' will use any specified certificates for the duration of the session.
PKI Authentication Example:
Add-Type -AssemblyName System.Security
# Get Valid Certs
$MyCerts = [System.Security.Cryptography.X509Certificates.X509Certificate2[]](Get-ChildItem Cert:\CurrentUser\My)
# Select Cert
$Cert = [System.Security.Cryptography.X509Certificates.X509Certificate2UI]::SelectFromCollection(
$MyCerts,
'Choose a certificate',
'Choose a certificate',
'SingleSelection'
) | select -First 1
New-PASSession -Credential $cred -BaseURI $url -type PKI -Certificate $CertShared Authentication Example:
$Cert = "0E199489C57E666115666D6E9990C2ACABDB6EDB"
New-PASSession -UseSharedAuthentication -BaseURI https://pvwa.somedomain.com -CertificateThumbprint $CertpsPAS commands return typed objects, so standard PowerShell cmdlets and multi-command chains work exactly as you'd expect:
# Find directory groups assigned to Safes
Get-PASSafe -search Finance | Get-PASSafeMember -memberType group -includePredefinedUsers $false |
Where-Object { Get-PASGroup -search $_.UserName -groupType Directory }
UserName SafeName Permissions
-------- -------- -----------
ACC-G-FinanceSafe01-Usr FinanceSafe01 @{useAccounts=True; retrieveAccounts=True; listAccounts=True;...
ACC-G-FinanceSafe01-Adm FinanceSafe01 @{useAccounts=True; retrieveAccounts=True; listAccounts=True;...Three ordinary psPAS commands and a standard Where-Object — no manual JSON or REST calls in sight.
Rather than duplicate a manual's worth of code in this file, worked examples for common tasks live in the psPAS Module Guide, each with the same real request/response output style as above:
- Search — finding Safes, Safe Members, Users and Accounts
- Administration — adding accounts, Safes and Safe Members, importing platforms & connection components
- CPM Operations — verify, change & reconcile tasks
- Bulk Operations — onboarding/removing accounts and Safes in bulk from a CSV
- Safe Permissions — defining reusable Safe permission "roles" and applying them
- PSM Sessions — finding, monitoring and terminating live sessions
- Update Accounts — single & multi-property JSON patch updates
- Methods — using the ScriptMethods attached to psPAS output objects (e.g.
Get-PASSafe'sSafeMembers(), or converting a retrieved password straight to aPSCredential) - API Sessions — working with more than one authenticated session at once
A larger collection of ready-to-run scripts is maintained in the psPAS-Examples repository.
psPAS includes over 250 commands, grouped below by the area of Idira they cover:
| Category | Commands | Covers |
|---|---|---|
| Accounts & Secrets | 55 | Onboard, retrieve, rotate, link & audit privileged accounts; CPM verify/change/reconcile; JIT access; discovered & dependent accounts; discovery scans |
| Privileged Threat Analytics | 31 | Security events, risky command rules, remediation & PTA configuration |
| Users, Groups & Directories | 27 | Vault users and groups, LDAP directory configuration and mappings |
| Authentication & Sessions | 25 | Every logon flow (CyberArk, LDAP, RADIUS, SAML, PKI, OIDC, Shared Services), session timeout/idle tracking, FIDO2 & SSH keys, OAuth Identity Providers |
| Platforms & Onboarding | 22 | Import/export/copy/rename CPM platforms, master policy, automatic onboarding rules |
| System, Server & Integrations | 17 | System health, server info, custom ticketing, IP allow lists, BYOK |
| PSM Session Monitoring | 12 | Live & recorded session activity, suspend/resume/terminate |
| Safes & Safe Members | 9 | Safe lifecycle and Safe membership/permissions |
| Vault Remote Manager | 9 | Self-hosted Vault/DR service control, status & failover |
| UI Customization | 9 | Custom UI themes |
| Reports | 8 | Available reports, schedules & exports |
| Access Requests | 7 | Dual-control request/approve/deny workflow |
| ACLs (Account & Policy) | 6 | OPM privileged command rules |
| Applications (AAM) | 6 | Application Access Manager identities & authentication methods |
| Account Groups | 5 | Grouping accounts for coordinated password changes |
| Connections | 4 | Connection Components & PSM Servers |
Full detail for every command — parameters, examples, and the minimum Idira (CyberArk) version required — is in the online Command Reference, or straight from PowerShell once the module is installed:
# List every command in the module
Get-Command -Module psPAS
# Full help, including examples, for one command
Get-Help Get-PASAccount -FullVersion requirements are enforced at runtime too — if your Idira version doesn't support a parameter you've supplied, psPAS tells you before the request is sent rather than letting the API reject it.
- PowerShell Core, or Windows Powershell v5 (minimum)
- Idira REST API/PVWA Web Service (available and accessible over HTTPS using TLS 1.2 and TLS 1.3)
- A user who can authenticate and has the necessary Vault/Safe permissions.
Users can download psPAS from GitHub or the PowerShell Gallery.
Choose any of the following ways to download the module and install it:
This is the easiest and most popular way to install the module.
PowerShell 5.0 or above must be used to download the module from the PowerShell Gallery.
-
Open a PowerShell prompt
-
Execute the following command:
Install-Module -Name psPAS -Scope CurrentUserThe module files can be manually copied to one of your PowerShell module directories.
Use the following command to get the paths to your local PowerShell module folders:
$env:PSModulePath.split(';')
The module files must be placed in one of the listed directories, in a folder called psPAS.
More: about_PSModulePath
The module files are available to download using a variety of methods:
- Download from the module from the PowerShell Gallery:
- Run the PowerShell command
Save-Module -Name psPAS -Path C:\temp - Copy the
C:\temp\psPASfolder to your "Powershell Modules" directory of choice.
- Run the PowerShell command
- Download the latest GitHub release
- Unblock & Extract the archive
- Rename the extracted
psPAS-v#.#.#folder topsPAS - Copy the
psPASfolder to your "Powershell Modules" directory of choice.
- Download
GitHub Branch- Unblock & Extract the archive
- Copy the
psPAS(\<Archive Root>\psPAS-master\psPAS) folder to your "Powershell Modules" directory of choice.
Validate Install:
Get-Module -ListAvailable psPAS
Import the module:
Import-Module psPAS
List Module Commands:
Get-Command -Module psPAS
Get detailed information on specific commands:
Get-Help New-PASUser -Full
A huge thank you to the organizations and individuals supporting this project.
Johannes Persson Consulting AB
Please support continued psPAS development; consider sponsoring @pspete on GitHub Sponsors
All notable changes to this project will be documented in the Changelog
- Pete Maan - pspete
This project is licensed under the MIT License.
Any and all contributions to this project are appreciated.
See the CONTRIBUTING.md for a few more details.
psPAS is neither developed nor supported by Palo Alto Networks; any official support channels offered by the vendor are not appropriate for seeking help with the psPAS module.
Help and support should be sought by opening an issue, or emailing pspas@pspete.dev.
Priority support could be considered for sponsors of @pspete, contact us to discuss options.
Hat Tips:
JP-Consulting (JP-Consulting) for the high effort contributions to the project
Joe Garcia (infamousjoeg) for the unofficial API documentation, general API wizardry & knowledge sharing.
Jesse McWilliams
(JesseMcWilliamss)
For the information needed to add PKIPN authentication into New-PASSession
Wojciech Ossowski (Qrelis) For sharing the details of the account unlock API.
Allyn Lindsay (allynl93) for PS-SAML-Interactive
Assaf Miron (AssafMiron) For the JSON formatting assistance.
Warren Frame (RamblingCookieMonster) for Add-ObjectDetail.ps1.
Chapeau!