Inconsistent role assignments

Oct 13, 2025 by talynt.org 14 views

Introduction

PowerShell Universal (PSU) is a powerful tool for managing and automating tasks in Windows environments. However, with the release of PSU v5.3.1, users have reported issues with Windows authentication via IIS. In this article, we will delve into the problem, explore the steps to reproduce it, and discuss the expected behavior.

Description of Issue

After upgrading to PowerShell Universal v5.3.1, Windows authentication via IIS fails to log in users automatically. Users are required to manually authenticate, and role assignments are inconsistent. This issue was not present in PSU v4.x.

A temporary workaround involves using the direct API authentication endpoint (/api/v1/signin/windows?returnUrl=...), which successfully authenticates users and redirects them. However, this is not the expected behavior, as users should be automatically signed in when accessing PSU via Windows SSO.

Steps to Reproduce

To reproduce this issue, follow these steps:

Install PSU v5.3.1: Install PowerShell Universal v5.3.1 on a Windows server with IIS configured for Windows Authentication.
Enable Windows SSO: Enable Windows SSO in PSU and verify that the setup matches the documentation.
Access PSU via browser: Access PSU via browser (Edge, Chrome, Firefox).
Manual login required: Instead of being logged in automatically, users are prompted for manual login.
Inconsistent role assignments: After logging in, role assignments do not always apply correctly.
Using the /api/v1/signin/windows?returnUrl=[target] bypasses the issue: Using the direct API authentication endpoint bypasses the issue, allowing users to log in successfully.

Expected Behavior

Users should be automatically signed in when accessing PSU via IIS with Windows Authentication enabled. Role assignments should be correctly processed upon authentication.

Stack Trace / Logs

There are no relevant error messages in the PSU logs. However, users see inconsistent behavior with Windows SSO, where credentials are passed but authentication does not occur as expected.

Version

PSU: 5.3.1
IIS: Not specified
PowerShell: 7.x
Database: SQL Server

Severity

High

Hosting Method

IIS

Operating System

Windows

Database

SQL

Licensed

Yes

Features

Windows Authentication
Git Sync
Role-based Access Control

Additional Environment data

OS Version: Windows Server 2019 / 2022
PowerShell Version: 7.x
Database Version: SQL Server

Screenshots/Animations

No response

Troubleshooting

To troubleshoot this issue, follow these steps:

Verify IIS configuration: Verify that IIS is configured correctly for Windows Authentication.
Check PSU configuration: Check PSU configuration to ensure that Windows SSO is enabled and set up correctly.
Check PSU logs: Check PSU logs for any error messages related to Windows SSO.
Test with direct API authentication endpoint: Test with the direct API authentication endpoint to see if it bypasses the issue.

Conclusion

Q: What is the issue with Windows authentication in PowerShell Universal v5.3.1?

A: The issue is that Windows authentication via IIS fails to log in users automatically. Users are required to manually authenticate, and role assignments are inconsistent.

Q: Is this issue specific to PowerShell Universal v5.3.1?

A: No, this issue was not present in PowerShell Universal v4.x. It was introduced in v5.3.1.

Q: What is the expected behavior for Windows authentication in PowerShell Universal?

A: Users should be automatically signed in when accessing PowerShell Universal via IIS with Windows Authentication enabled. Role assignments should be correctly processed upon authentication.

Q: What is the temporary workaround for this issue?

A: The temporary workaround involves using the direct API authentication endpoint (/api/v1/signin/windows?returnUrl=...), which successfully authenticates users and redirects them.

Q: Why is the direct API authentication endpoint not the expected behavior?

A: The direct API authentication endpoint is not the expected behavior because users should be automatically signed in when accessing PowerShell Universal via Windows SSO.

Q: What are the steps to reproduce this issue?

A: To reproduce this issue, follow these steps:

Install PowerShell Universal v5.3.1 on a Windows server with IIS configured for Windows Authentication.
Enable Windows SSO in PowerShell Universal and verify that the setup matches the documentation.
Access PowerShell Universal via browser (Edge, Chrome, Firefox).
Instead of being logged in automatically, users are prompted for manual login.
After logging in, role assignments do not always apply correctly.

Q: What are the troubleshooting steps for this issue?

A: To troubleshoot this issue, follow these steps:

Verify IIS configuration to ensure that Windows Authentication is enabled and set up correctly.
Check PowerShell Universal configuration to ensure that Windows SSO is enabled and set up correctly.
Check PowerShell Universal logs for any error messages related to Windows SSO.
Test with the direct API authentication endpoint to see if it bypasses the issue.

Q: Is this issue specific to a particular version of Windows or IIS?

A: No, this issue is not specific to a particular version of Windows or IIS. It has been reported on Windows Server 2019 and 2022, and IIS 10 and 11.

Q: Is there a known fix for this issue?

A: No, there is no known fix for this issue at this time. However, the PowerShell Universal team is working on a solution and will provide an update when it is available.

Q: How can I stay up-to-date with the latest information on this issue?

A: You can stay up-to-date with the latest information on this issue by following the PowerShell Universal blog and social media channels.