Editing Custom Commands

The SSH type changers use the SSH protocol to access the machine. This type contains custom commands for password reset and can contain commands for the verify password functionality but most SSH type changers simply verify that a connection can be established with the username and password. The Telnet type changers use the Telnet protocol in order to access the machine and contain custom commands for both the password reset and the verify password functionality. The verify functionality is used in the heartbeat, as well as verifying that the password was changed successfully.

SSH key rotation type changers also include post-reset success and failure custom commands. These extra command sets are run after both the reset and verify functions are run and are used to either finalize the key rotation and password change (success) or clean up after a failure. If both the reset and verify functions are successful, the post-reset success command set is run. If either the reset or the verify fail, the post-reset failure command set is run.

To edit the custom commands, click on the Edit Commands button. This sets the command grids into Edit mode where you can add, update, or delete the commands in order to suit their purpose.

RPC-Mapped Text-Entry Fields

Prepend a $ to any text-entry field name to access that field. For example, to echo the notes value for a secret, you would use this command: echo $Notes. Commonly accessed fields include:

$USERNAME The username text-entry field mapped in RPC on the secret template. Resolves to the same value in every command set.
$PASSWORD The password field as loaded at the start of the operation. In a password change command set this is the existing, pre-change password used to authenticate. In a verify command set running after a change it may still hold the pre-change value, so use $CURRENTPASSWORD there instead.
$CURRENTPASSWORD The password text-entry field mapped in RPC on the secret template. In a verify command set that follows a password change this is the post-change password; in a heartbeat it is the password currently stored on the secret.
$NEWPASSWORD The next password (filled in Next Password textbox or auto-generated). This is the value being set during a password change. In a heartbeat it resolves to the current or temporary password, not a newly generated one.
$PRIORPASSWORD The password on the secret before the current change began.
$PRIVATEKEY The private key text-entry field mapped in RPC on the secret template.
$NEWPRIVATEKEY The next private key (filled in Next Private Key text box or auto-generated).
$CURRENTPUBLICKEY The public key text-entry field mapped in RPC on the secret template.
$NEWPUBLICKEY The next public key (generated from the next private key).
$PASSPHRASE The passphrase text-entry field mapped in RPC on the secret template.
$NEWPASSPHRASE The next passphrase (filled in Next Private Key Passphrase text box or auto-generated).

The Verify Password Changed command set runs in two situations: on every heartbeat, and immediately after a successful password change. A command set that passes a heartbeat test can still fail after a password change if it authenticates with $PASSWORD. Test both paths.

The guidance above applies to unprefixed tokens. Tokens prefixed with $[1]$ reference an associated secret and follow different rules — see Associated Reset Secrets below.

For the full token list across all Secret Server scripting contexts, including validity by context and confidential-field restrictions, see Complete Scripting Token Reference. For tokens in dependency scripts, see Dependency Token List.

Associated Reset Secrets

$[1]$ Adding this prefix to any text-entry field targets the associated reset secret with order 1.
$[1]$USERNAME The mapped username of the associated secret, identified by order. Can also reference any other property on the associated secret. Common examples include:
$[1]$PASSWORD
$[1]$PRIVATE KEY
$[1]$PRIVATE KEY PASSPHRASE
$[SID:105] Adding this prefix to any text-entry field targets the associated reset secret with a secret Id of 105.
$[SID:105]$USERNAME The mapped username of the associated secret, identified by secret id. Like referencing an associated secret by order, referencing by secret id can also access any text-entry field on the secret by name.

Use $[1]$PASSWORD to authenticate as an associated secret. $[1]$CURRENTPASSWORD and $[1]$PRIORPASSWORD resolve to a previous password. If the associated secret has only been vaulted and has never had a password change run against it, no previous password exists and the password change fails with Authenticate information expected an Associated Secret to have a field for $[1]$CURRENTPASSWORD.

Both the mapped text-entry fields and secret text-entry field names can be used.

Check-Result Commands

$$CHECKCONTAINS <text> Checks that the response from last command contains <text>.
$$CHECKFOR <text> Checks that the response from the last command equals <text>.
$$CHECKNOTCONTAINS <text> Checks that the response from last command does not contain <text>.

If these conditions are not met the process fails and immediately returns a result.

If you want to exit out of the command set early without triggering a failure, echo an "OK" on the line immediately preceding the exit 0; statement. "OK" must be the only text in the response from the server for this to work.

You can test out your password reset and verify password command sets by clicking on the Test Action buttons next to the relevant sections. All communication between Secret Server and the target machine is displayed when using these test buttons.

ConditionalTab Command

The script now includes the command <ConditionalTab_TAB_SIZE_VAL_>, where _TAB_SIZE_VAL_ is replaced by an integer value (e.g., <ConditionalTab10>). The behavior of this command is as follows:

If the prior specified size is 10 and the previous input is 10 or greater characters, the command does nothing, or the Tab command is skipped.

If the previous input is less than the specified value but greater than zero, the tab will be executed.

A zero value will disable the command.