Secret Variables not working when called as a script parameter

[robderickson]

Actually, Jesse’s answer in this thread might be helpful:

Secret Variable in Scheduled jobs - PSU 5.5.1

Hi All, I’m having another wierd one here. I’ve got an automation script that connects to a database and returns data. I’ve created a secret variable and wish to use that. I’m using the following: $sec = ($Secret:MySecretName).password | Convertfrom-SecureString -AsPlainText This works great when executing the script manually or through an app. But it throws an error when doing it as an scheduled job? The error message is: “Cannot bind argument to parameter ‘SecureString’ because it is nul…

Essentially, you need an app token to retrieve the secret, but the app token can’t also be a secret. I think that might be what Jesse was talking about in his initial reply to you.

So your schedule would invoke the script which would retrieve the app token from an environment variable or a plain text PSU variable, then that token would be used with Get-PSUVariable to retrieve your credential object. Something like:

$cred = Get-PSUVariable -Name MyCred -AppToken $env:PSUMySchedAppToken

I would try it with an app token with the admin role to confirm it works. If it does, you can try to create a more restrictive custom role in roles.ps1. I think it would need a permission like platform.variables.MyCred/read.