SysCommand batch file needs credentials

scott-torrance

I have created a workflow that uses a SysCommand to check if a given network directory exists, and if not, create it so that we can add files to it.

The SysCommand references a batch file, which looks like this:

@echo off

set myDirName=%1

IF exist %myDirName% ( echo %myDirName% exists ) ELSE ( mkdir %myDirName% && echo %myDirName% created)

Where %1 is a parameter passed in. When running this locally from the designer, it works as expected. However, when uploaded to our IPA server, we get this error: 

Executing System Command Activity createDir...
Full system command: cmd.exe /C "E:BatchFilesForIPACheckDirectory.bat" \networkLocationgroupfiles1
Command output (combined): The user name or password is incorrect.
Command error output: The user name or password is incorrect.
createDir_errorOutput = The user name or password is incorrect.
System command error: command returned error code 1
Variables:
lastReturnMessage(Type=String) = System command error: command returned error code 1
lastErrorCode(Type=Integer) = 10
lastOutputData(Type=Object) = The user name or password is incorrect.

lastInformationCode(Type=Integer) = 1
createDir_errorCode = 10
createDir_informationCode = 1
createDir_returnMessage = System command error: command returned error code 1
createDir_outputData = The user name or password is incorrect.
Activity name:persDir id:6 failed @ 06/14/2024 04:11:34.407 PM
Executing Assign90 because activity persDir encountered an error

This error telling us we need to pass in credentials to create the directory, but how? 

edit: fixing the wording of my question

russel-cornelson

Good afternoon,   If I had to hazard a guess the error is telling you that you need credentials to access the network share.


Technical Points
1.   Infor Process Automation system command will by default "run as" the user that you installed to run Landmark Grid.

2.  By default,  the locallawson account runs landmark grid but you should verify;  or simply run a system command prompt that executes "whoami"

3.  Assuming I am correct you have multiple choices.


Option#1
Add security to the network share for the local lawson account on the Landmark Server.    I think this is a hacky type option, as you would need to find the computer that the networks share resides on, add a local user on that server with the same username/password that is used by the landmark server.

Option#2
Configure your landmark runtime grid to run as a domain account and ensure that domain user has access to the network share.   I also am not a fan of this as I have seen customers have issues with unc shares where someone had to periodically go in and re-establish connection to that share manually so the flow would start working again (aka literally log onto the landmark server, access the share drive to intermittently fix connection error)

Option #3
I've used powershell successfully in the past to create an encrypted key file that contains my network credentials.   That would encrypt the password using that computers key, stored in a user directory that is locked down so only the lawson account has access.   Then use these credentials in another powershell script to leverage net use to the network share;  then additional powershell command to check if the path is there and create it if is new.


Something like...

createPass.ps1
param([string]$myPass)
try
{
$SecureString = ConvertTo-SecureString $myPass -AsPlainText -Force
$EncryptedPass = ConvertFrom-SecureString -SecureString $SecureString
Set-Content -Path C:Usersusername.sshservice.key -Value $EncryptedPass
}
catch
{
return 10
}
return -1

^USAGE:  powershell.exe .createPass.ps1  mytestpassword
Creates a key with my password in my user directory



Then something like ..  checkdir.ps1

param([string]$directoryPath, [string]$folderPath)

######################################################
# Function Decrypt #
# Accepts: contents of a file (securedPass variable) #
# Output: decrypted contents of input #
######################################################
function Decrypt([string]$passwordfile)
{
$securedstring = ConvertTo-SecureString $passwordfile
$helper = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $securedstring
$global:password = $helper.GetNetworkCredential().Password
}

######################################################
# Function Log-Message #
# Accepts: String #
# Output: Sends message to output with timestamp #
######################################################
function Log-Message
{
[CmdletBinding()]
Param
(
[Parameter(Mandatory=$true, Position=0)]
[string]$LogMessage
)

$output = $output + $LogMessage
Write-Output ("{0} - {1}" -f (Get-Date), $LogMessage)
}

######################################################
# READ ME #
######################################################
# For this process to work, you must log into Landmark Server, and execute the following line from Windows Powershell (as administrator)
# When executing this script it will drop the cursor down one line, and wait for you to type the password for the domain user you are going to use to connect.
# As you type the password it will draw *** for characters, ensure you correctly type the password.
# Powershell Command= read-host -assecurestring | convertfrom-securestring | out-file C:Userslawson.sshUSERNAME.key

######################################################
#VARIABLE DEFINITIONS #
######################################################
#The DOMAINUser for shared drive must have access to the share on client's print server
$username = "DOMAINusername"
#securedPass must match the path you used when you ran the password encryption generator (line 10 out-file)
$securedPass = "C:Usersusername.sshservice.key"


######################################################
# MAIN PROGRAM #
######################################################
#Save the contents of the encrypted password in variable by reading the securedPass file
$passwordfile = get-content $securedPass
#Call decrypt function and pass the encrypted variable, unencrypted password is stored in $global:pass
Decrypt $passwordfile

#Begin main program
$error.clear()

Log-Message "-------Check Directory -------"

#Map the Drive using credentials
try {
net use $directoryPath $global:password /USER:$username | out-null
if ($LASTEXITCODE -eq 0) {
} else {
throw $error[0].Exception
}
}
catch [Exception]{
Log-Message ("Failed to establish network drive to " + $directoryPath)
Log-Message ("Error:" + $error[0].Exception.GetType().FullName)
Log-Message ("Exception:" + $_.Exception.Message)
Log-Message "-------CONNECTION FAILED Error 001-------"
exit 1
}

try {
if (Test-Path -Path $folderPath) {
Log-Message ($directoryPath + "" + $folderPath + " already exists")
} else {
New-Item -Path $folderPath -ItemType Directory | out-null
Log-Message ($directoryPath + "" + $folderPath + " created")
}
}
catch [Exception]{
Log-Message "Failed to disconnect network drive."
Log-Message ("Error:" + $error[0].Exception.GetType().FullName)
Log-Message ("Exception:" + $_.Exception.Message)
exit 3
}

try {
net use $directoryPath /DELETE | out-null
if ($LASTEXITCODE -eq 0) {
} else {
throw $error[0].Exception
}
}
catch [Exception]{
Log-Message "Failed to disconnect network drive."
Log-Message ("Error:" + $error[0].Exception.GetType().FullName)
Log-Message ("Exception:" + $_.Exception.Message)
exit 3
}

Log-Message "-------Check Directory Complete -------"
return 0