If you take the pas-vault-deploy.json template for v13.2 and modify the CustomScriptExtension to execute a custom script that calls configure-vault.ps1, the password of the Administrator user will change during deployment.
param(
[string]$StorageAccountName,
[string]$ContainerName,
[string]$StorageAccountKey,
[string]$AdminPass,
[string]$MasterPass,
[string]$PrimaryOrDR,
[string]$PrimaryVaultIP,
[string]$DRPassword,
[string]$LicenseFileName,
[string]$RecPubFileName,
[string]$VKMName,
[string]$Secret
)
&".\configure-vault.ps1" -AdminPass $AdminPass, -MasterPass $MasterPass -PrimaryOrDR $PrimaryOrDR -PrimaryVaultIP $PrimaryVaultIP -DRPassword $DRPassword -LicenseFileName $LicenseFileName -RecPubFileName $RecPubFileName -StorageName $StorageAccountName -ContainerName $ContainerName -StorageAccountKey $StorageAccountKey -VKMName $VKMName -Secret $Secret{
"condition":"[not(empty(parameters ('DR User Secret')))]",
"type":"Microsoft.Compute/virtualMachines/extensions",
"name":"[concat(parameters('Primary Vault VM Name'),'/', 'registration_script')]",
"apiVersion":"2022-08-01",
"location":"[resourceGroup().location]",
"tags":{
"displayName":"activate-vault"
},
"properties":{
"publisher":"Microsoft.Compute",
"type":"CustomScriptExtension",
"typeHandlerVersion":"1.9",
"autoUpgradeMinorVersion":true,
"settings":{
"fileUris":[
"https://raw.githubusercontent.com/cyberark/pas-on-cloud/v13.2/azure/configure-vault.ps1",
"[concat('https://', parameters('Storage Account Name'),'.blob.core.windows.net/', parameters('Container name'), '/', parameters('Custom Script'))]"
]
},
"protectedSettings":{
"storageAccountName": "[parameters('Storage Account Name')]",
"storageAccountKey": "[parameters('Storage account access key')]",
"commandToExecute":"[concat('powershell -ExecutionPolicy Unrestricted -file ', parameters('Custom Script'), ' -AdminPass ', parameters('Primary Vault Admin Password'), ' -MasterPass ', parameters('Primary Vault Master Password'), ' -PrimaryOrDR Primary -PrimaryVaultIP 1.1.1.1 -DRPassword ', parameters('DR User Password'), ' -LicenseFileName ', parameters('Vault License File'), ' -RecPubFileName ', parameters('Recovery Public Key'), ' -StorageAccountName ', parameters('Storage Account Name'), ' -ContainerName ', parameters('Container name'), ' -StorageAccountKey ', parameters('Storage account access key'), ' -VKMName ', parameters ('Key Vault Name'), ' -Secret ', parameters ('DR User Secret'))]"
}
},
"dependsOn":[
"[concat('Microsoft.Compute/virtualMachines/', parameters('Primary Vault VM Name'), '/extensions/ManagedIdentityExtensionForWindows')]",
"[concat('Microsoft.KeyVault/vaults/', variables('vaultName'))]"
]
}The vault should deploy in the same manner as before the modifications. The Administrator's password should remain the one provided during deployment.
Trying to login as Administrator with the provided password results in an Authentication error.
The deployment is made to a deployment stack in Azure.
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent