1

We are using the AIP Classic Client to apply classification to documents.

We have an internal solution for gathering files to apply classification to and would like to automate the classification of these files.

A dev has created a PowerShell script that takes in a list of files and uses the Set-AIPFileLabel cmdlet to classify all the files passed to the script. We want to move this system into production however have encountered a roadblock.

In our production system, the service account we want to use does not have log on locally permissions. It is a service account and has log on as batch rights. We just want to run the script on a windows task once every arbitrary amount of time.

Before you can use the Set-AIPFileLabel cmdlet, you must first set the aip token with the Set-AIPAuthentication cmdlet.

This cmdlet is interactive, when an account can log into the machine, it can run this cmdlet with ease (obviously supplying the $WebAppId, $WebAppKey, $NativeAppId values).

Obviously this interaction is interactive, I went digging the Microsoft docs and found the following pages (about the scanner, but hoping the principles transfer):

Deploy the scanner with alternative configurations.

Restriction: The service account for the scanner cannot be granted the Log on locally right

Specify and use the Token parameter for Set-AIPAuthentication

These instructions boil down to:

  • Create a script that runs Set-AIPAuthentication
  • Run the script to generate a token
  • Copy that token back into the script (script would look like this):
    $AIPToken = ""
    $WebAppId = ""
    $WebAppKey = ""
    $NativeAppId = ""

    Set-AIPAuthentication -WebAppId $WebAppId -WebAppKey $WebAppKey -NativeAppId $NativeAppId -Token $AIPToken
  • Copy that script to the server you want to set auth for
  • Create a windows task to call the script, make the service account run the script
  • Run the script, check the service account has a token

When i run the script, no script is created but a log file is generated. Inside is the following error:

One of two conditions was encountered: 1. The PromptBehavior.Never flag was passed, but the constraint could not be honored, because user interaction was required. 2. An error occurred during a silent web authentication that prevented the http authentication flow from completing in a short enough time frame

I have passed the token and followed the microsoft documentation however it fails to set the token by what looks to me like an error in logic in the application.

I have contacted Microsoft support but keep getting bounced around to different technicians, nobody has an answer for me.

I was wondering if anybody here had encountered this issue and has a fix for it. There is no way we can give the service account log on locally permissions.

The AIP Unified Labelling Client can set auth tokens on behalf of users, this issue affects only the classic client.

I would like to tag this post with 'aip' & 'azure-information-protection' however my rep score on this forum is not high enough. Sorry i'm a developer and usually post on Stack Overflow, however this sort of question is more config and felt more appropriate to ask here. If any kind soul could add those tag's I'd appreciate it!

Thanks

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.