TechIDManager provides options for retrieving managed credentials through scripts and automation workflows. Depending on your environment, you can use TechIDClient.Get.exe to interact with a local TechIDClient installation or use PowerShell scripts with the TechIDHost REST API to retrieve credentials without requiring TechIDClient to be installed on the machine running the automation.
This guide explains both approaches, their requirements, and how to determine which method best fits your automation needs.
Option 1: Using TechIDClient.Get.exe for Local Automation
TechIDClient.Get.exe allows scripts and command-line tools to interact with TechIDClient.Windows to retrieve managed credentials.
This method requires TechIDClient.Windows to be installed and configured on a machine associated with an authorized TechIDManager technician.
Requirements
- A Windows machine configured for a TechIDManager technician.
- TechIDClient.Windows installed and configured.
- An authorized technician account with access to the required credentials.
- TechIDClient.Get.exe available on the machine.
How It Works
TechIDClient.Get.exe supports command-line operations that allow automation to:
- Unlock TechIDClient using a configured passphrase.
- Retrieve an authorized credential.
- Lock TechIDClient when credential retrieval is complete.
The commands for locking and unlocking TechIDClient include:
Lock TechIDClient:
TechIDClient.Get.exe lock
Unlock TechIDClient:
TechIDClient.Get.exe passphrase "<SecretPassPhrase>"
Once TechIDClient is unlocked, an authorized script can retrieve the required credential using TechIDClient.Get.exe.
Using a Dedicated Automation Machine
If your automation runs independently of a technician’s workstation, you can configure a dedicated environment for credential retrieval.
|
1
|
Create a dedicated technician account in TechIDManager for automation. | |||
|
2
|
Assign only the permissions necessary to access the required credentials. | |||
|
3
|
Provision a dedicated Windows virtual machine (VM). | |||
|
4
|
Install and configure TechIDClient.Windows on the VM using the dedicated technician account. | |||
|
5
|
Configure your automation to execute TechIDClient.Get.exe on that machine. | |||
|
6
|
Retrieve the required credentials as part of the automation workflow. | |||
|
7
|
Lock TechIDClient when credential retrieval is complete. | |||
This approach allows automation to retrieve TechIDManager-managed credentials while using the existing TechIDClient environment.
Important: TechIDClient.Get.exe interacts with the local TechIDClient.Windows installation. It cannot directly retrieve credentials from an unrelated machine without that configured client environment.
For additional information about TechIDClient.Get.exe, see:
Secure Use of TechIDManager in Scripts, AI, and Automation Workflows
Option 2: Using PowerShell and the TechIDHost REST API
For automation that cannot run on a machine configured with TechIDClient.Windows, TechIDManager also provides access to the REST API used by TechIDClient.
This approach allows PowerShell scripts to retrieve managed credential information directly from TechIDHost without requiring a local TechIDClient installation.
How It Works
See documentation here
Secure Use of TechIDManager in Scripts, AI, and Automation Workflows
Requirements
- An authorized TechIDManager technician account.
- Access to the technician’s exported private key.
- The password protecting the TechIDClient export file, if extracting the key from an export.
- PowerShell and the ability to execute the provided scripts.
- Network access to the appropriate TechIDHost endpoint.
- The information required to identify the credential being retrieved.
Step 1: Create a Dedicated Technician Account
For automation purposes, we recommend creating a dedicated technician account rather than using an individual technician’s existing account.
Assign the dedicated technician only the permissions necessary to retrieve the required credentials.
This helps separate automated credential retrieval from individual technician activity and limits the scope of credentials available to the automation.
Step 2: Export the Technician’s Private Key
TechIDManager provides a PowerShell script that can extract a technician’s private key from a TechIDClient export file.
Download:
TechIDManager-GetPrivateKey.ps1
The script requires the password associated with the TechIDClient export file.
Once the private key has been extracted, it can be used by the credential retrieval script.
Security consideration: A technician’s private key is sensitive authentication material. Anyone who obtains the key and can use it successfully may be able to retrieve credentials within that technician’s authorized scope. Store it securely and restrict access to the automation process that requires it.
Step 3: Retrieve Credentials Using PowerShell
TechIDManager provides a second PowerShell script that can retrieve credential information directly from TechIDHost.
Download:
TechIDManager-GetCredential.ps1
This script uses the following information:
- Technician private key: The RSA private key associated with the authorized technician.
- Client GUID: The identifier for the target client.
- TechIDClientLink URL: The URL used to identify the credential retrieval target.
Using these inputs, the script can retrieve a managed password and its associated information without requiring TechIDClient.Windows on the machine executing the script.
Review the script’s parameters and usage instructions before incorporating it into an automation workflow.
Step 4: Use the Retrieved Credential in Your Automation
Once the credential has been retrieved, your PowerShell workflow can use the current password for its intended task.
For example, an automation process might:
|
1
|
Authenticate to TechIDHost using the authorized technician’s private key. | |||
|
2
|
Retrieve the current managed credential. | |||
|
3
|
Pass the credential to the application, script, or process that requires it. | |||
|
4
|
Complete the authorized operation without maintaining a permanently hardcoded password. | |||
Recommended practice: Retrieve the current password when the automation runs rather than embedding a managed password directly into a script.
This is particularly important when working with credentials that TechIDManager rotates automatically.
Security Best Practices
- Use dedicated technician accounts. Create separate technician identities for automation and assign only the access required for each workflow.
- Protect private keys and passphrases. Do not hardcode RSA private keys, TechIDClient passphrases, or retrieved passwords into scripts. Use an appropriately secured secret store or other protected mechanism for providing sensitive values at runtime.
- Limit credential exposure. Avoid displaying retrieved passwords in console output, log files, transcripts, or error messages.
- Retrieve credentials when needed. Whenever practical, retrieve the current password at execution time instead of storing a copy that could become outdated after password rotation.
- Restrict automation access. Limit who can execute the automation, access its configuration, and retrieve the associated authentication material.
- Review permissions regularly. Periodically review the permissions assigned to dedicated automation technician accounts to ensure they remain appropriate.
Choosing the Right Method
| Requirement | TechIDClient.Get.exe | PowerShell / REST API |
| Requires TechIDClient.Windows | Yes | No |
| Can retrieve managed credentials | Yes | Yes |
| Supports command-line automation | Yes | Yes |
| Requires a configured technician machine | Yes | No |
| Uses a technician’s exported private key directly | No | Yes |
| Suitable for a dedicated automation VM | Yes | Yes |
| Can run independently of TechIDClient | No | Yes |
Important Considerations for REST API Usage
The TechIDHost REST API is available for automation, but its interface is subject to change.
Although TechIDManager has historically maintained backward compatibility, future API changes are not guaranteed to preserve existing integrations.
When building automation against the REST API, review compatibility when updating TechIDManager and test workflows before deploying changes to production environments.
Summary
TechIDManager offers two approaches for retrieving managed credentials through scripts and automation.
TechIDClient.Get.exe is appropriate when automation can run on a Windows machine configured with TechIDClient. It allows scripts to unlock the client, retrieve credentials, and lock the client using command-line operations.
PowerShell with the TechIDHost REST API provides an alternative for workflows that need to retrieve credentials without a locally installed TechIDClient. By using an authorized technician’s private key, automation can retrieve current managed credentials directly from TechIDHost.
Both approaches allow organizations to use TechIDManager-managed credentials in automation workflows without embedding static managed passwords in their scripts.
For related guidance, see:
Secure Use of TechIDManager in Scripts, AI, and Automation Workflows
