Overview
How to extract and pass only the “username” (from a “domain\username” format) when connecting via SSH to Linux servers or network devices that require local authentication.
Description
Many automated systems including NPS, however, retrieve credentials in the format “domain\username” or “resource\username” If you attempt to pass this full string to an SSH resource (via a proxy or automation tool), authentication will fail because the target system recognizes only the plain “username”
To address this behavior and ensure that only the username (without “domain\” or “resource\”) is passed, you can run the following PowerShell script as a “Run Custom PowerShell Script” step in the Pre-Session Grant stage:
# This is how to access the current activity session
$activitySession = Get-SbPAMActivitySession -Id $SessionId
$username = $activitySession.loginaccountname
if ($activitySession.loginaccountname.contains('\'))
{
($domain,$username)=$activitySession.loginaccountname.Split('\')
}
$LoginAccount = $username
if ($LoginAccount -ne $activitySession.loginaccountname)
{
# Change the loginaccount
Set-SbPAMActivitySessionLoginAccount -SessionId $SessionId -LoginAccount $LoginAccount
}
After implementing this script, only the username will be passed during authentication, with the prefix (“domain\” or “resource\”) removed as required by the target device.
