Jamf Pro LAPS: Retrieving Password via Terminal

lapss () {    # [l]ocal [a]dministrator [p]assword [s]olution in the [s]tage lane

    expectedLocalAdminAccount="localadmin"

    if [ -z ${1} ]; then
        printf "\n###\n# [l]ocal [a]dministrator [p]assword [s]olution in the [s]tage lane\n###\n\n"
        printf "Usage:\n1. Type \"lapss\", followed by a [Space]\n2. Paste the computer's Serial Number or Jamf Pro Computer ID\n3. Press [Return]\n\n"
        printf "(Enter \"lapss help\" for initial setup.)\n\n"
        return
    fi

    if [ ${1} = "help" ]; then

        apiURL=$( /usr/bin/defaults read "/Library/Preferences/com.jamfsoftware.jamf.plist" jss_url )
        /usr/bin/clear
        printf "\n###\n# [l]ocal [a]dministrator [p]assword [s]olution in the [s]tage lane Help\n# (some code inspired by: Joshua Smith)\n###\n\n"
        printf "Use the following commands to create entries in Keychain Access:\n\n"
        printf "    security add-generic-password -s \"lapssApiUrl\" -a ${USER} -w \"${apiURL}\"\n"
        printf "    security add-generic-password -s \"lapssApiUser\" -a ${USER} -w \"API Username Goes Here\"\n"
        printf "    security add-generic-password -s \"lapssApiPassword\" -a ${USER} -w \"API Password Goes Here\"\n\n"
        printf "Once the Keychain entries have been created …\n\n"
        printf "    1. Enter \"lapss\", followed by a [Space]\n    2. Paste the computer's Serial Number or Jamf Pro Computer ID\n    3. Press [Return]\n\n"

    else

        apiURL=$( security find-generic-password -s "lapssApiUrl" -a "${USER}" -w 2>/dev/null )
        apiUser=$( security find-generic-password -s "lapssApiUser" -a "${USER}" -w 2>/dev/null )
        apiPassword=$( security find-generic-password -s "lapssApiPassword" -a "${USER}" -w 2>/dev/null )

        if [ -z ${apiURL} ] || [ -z ${apiUser} ] || [ -z ${apiUser} ]; then
            printf "\n###\n# ERROR: Unable to read API credentials\n###\n\nPlease run \"lapss help\" to configure API credentials.\n\n"
            return
        fi

        # Obtain Jamf Pro Bearer Token via Basic Authentication
        apiBearerToken=$( /usr/bin/curl -X POST --silent -u "${apiUser}:${apiPassword}" "${apiURL}/api/v1/auth/token" | /usr/bin/plutil -extract token raw - )
        # echo "apiBearerToken: ${apiBearerToken}"

        # Determine if user provided a Jamf Pro Computer ID (i.e., a number) or a Serial Number (i.e., NOT a number)
        numberValidation='^[0-9]+$'
        if ! [[ "${1}" =~ "${numberValidation}" ]] ; then
            # Determine the computer's Jamf Pro Computer ID via the computer's Serial Number, "${1}"
            jssID=$( /usr/bin/curl -H "Authorization: Bearer ${apiBearerToken}" -s "${apiURL}"/JSSResource/computers/serialnumber/"${1}"/subset/general | xpath -e "/computer/general/id/text()" )
        else
            jssID="${1}"
        fi
        # echo "JSS ID: ${jssID}"

        generalComputerInfo=$( /usr/bin/curl -H "Authorization: Bearer ${apiBearerToken}" -H "Accept: text/xml" -sfk "${apiURL}"/JSSResource/computers/id/"${jssID}/subset/General" -X GET )

        # echo "generalComputerInfo: ${generalComputerInfo}"

        computerName=$( echo ${generalComputerInfo} | xpath -q -e "/computer/general/name/text()" )
        computerSerialNumber=$( echo ${generalComputerInfo} | xpath -q -e "/computer/general/serial_number/text()" ) 
        computerIpAddress=$( echo ${generalComputerInfo} | xpath -q -e "/computer/general/ip_address/text()" ) 
        computerIpAddressLastReported=$( echo ${generalComputerInfo} | xpath -q -e "/computer/general/last_reported_ip/text()" )

        printf "\nRetrieving '${expectedLocalAdminAccount}' password for:\n"
        printf "• Name: $computerName\n"
        printf "• Serial Number: $computerSerialNumber\n"
        printf "• IP Address: $computerIpAddress\n"
        printf "• IP Address (LR): $computerIpAddressLastReported\n\n"

        printf "Via MDM:\n"
        printf "• Server: ${apiURL}\n"
        # printf "• Username: ${apiUser}\n"
        printf "• Computer ID: ${jssID}\n\n"

        computerInventoryGeneral=$( /usr/bin/curl -H "Authorization: Bearer ${apiBearerToken}" -s "${apiURL}"/api/v1/computers-inventory/"${jssID}"?section=GENERAL -H "accept: application/json" ) # on-prem
        # computerInventoryGeneral=$( /usr/bin/curl -H "Authorization: Bearer ${apiBearerToken}" -s "${apiURL}/api/v1/computers-inventory?section=GENERAL&filter=id==${jssID}" -H "accept: application/json" -X GET ) # thanks, @Alec V; Jamf Cloud ???

        # echo "computerInventoryGeneral: ${computerInventoryGeneral}"       

        managementId=$( echo "${computerInventoryGeneral}" | awk '/managementId/{print $NF}' | tr -d '",' )
        # echo "managementId: ${managementId}"

        localAdminAccountsRaw=$( /usr/bin/curl -H "Authorization: Bearer ${apiBearerToken}" -s "${apiURL}"/api/v1/local-admin-password/${managementId}/accounts -H "accept: application/json" )
        # echo "localAdminAccountsRaw: ${localAdminAccountsRaw}"

        username=$( echo "${localAdminAccountsRaw}" | awk '/username/{print $NF}' | tr -d '",' )
        # echo "username: ${username}"

        if [[ "${username}" == *"${expectedLocalAdminAccount}"* ]]; then

            # echo "Found Expected Local Admin Account '${expectedLocalAdminAccount}'; proceeding …"

            localAdminPasswordRaw=$( /usr/bin/curl -H "Authorization: Bearer ${apiBearerToken}" -s "${apiURL}"/api/v1/local-admin-password/${managementId}/account/${expectedLocalAdminAccount}/password -H "accept: application/json" )
            # echo "localAdminPasswordRaw: ${localAdminPasswordRaw}"

            password=$( echo "${localAdminPasswordRaw}" | awk '/password/{print $NF}' | tr -d '",' )
            # echo "password: ${password}"

            printf "\n${expectedLocalAdminAccount} password for S/N ${1}\ndisplayed below and copied to the clipboard:\n\n${prefix}${password}\n\n"
            echo "${password}" | tr -d '\n' | pbcopy

            # Invalidate the Bearer Token
            apiBearerToken=$( /usr/bin/curl "${apiURL}/api/v1/auth/invalidate-token" --silent  --header "Authorization: Bearer ${apiBearerToken}" -X POST )
            apiBearerToken=""

            printf "\n\n"

        else

            echo "Expected Local Admin Account '${expectedLocalAdminAccount}' NOT found; exiting."
            return

        fi

    fi

}