XC1 Portal Northbound (On‑prem) — PS7 Auth + Thin Client

A small PowerShell 7 script that authenticates to an on‑prem Lenovo XClarity One (XC1) Portal using OAuth2 client_credentials and calls northbound REST APIs under:

• Token endpoint: https://<portal>/idp/realms/Atlas_northbound/protocol/openid-connect/token
• Northbound API base: https://<portal>/apis/v1

This repo is intentionally narrow: it hardens auth/token refresh and provides a few read‑only API calls that work even when there are no managers/hubs registered yet.

Status / Scope

✅ Implemented

• Token acquisition (client_credentials)
• Token caching + early renew (skew)
• Optional retry-on-401 (refresh token, retry once)
• JWT payload sanity check (claims only; never prints the token)
• Context object to reduce parameter threading
• Read-only wrappers:
  • jobs-management/jobs
  • monitoring/alerts
  • managers-management/managers

🚫 Not implemented (todo)

• Hub/Manager workflows (boarding/discovery/management) — require a manager/hub to be present
• Portal UI/internal API plane (/api/v1/...)
• SMTP configuration on PUT /api/v1/communications/smtp, but this endpoint is not yet accessible with the northbound client_credentials bearer token in the current Portal OnPrem version v25P.3.0

Requirements

• PowerShell 7+
• Network reachability to the XC1 Portal
• An OAuth2 client in XC1 Portal (client_credentials) with appropriate privileges

Quick start

# dot-source the script
. .\src\xc1-portal-northbound.ps1

$Xc1PortalHostOrIp = '<xc1 ip>'
$Xc1PortalClientId = '<client id>'
$Xc1PortalClientSecret = Read-Host "XC1 Portal Client Secret" -AsSecureString

$Xc1 = New-Xc1PortalContext `
  -Xc1PortalHostOrIp $Xc1PortalHostOrIp `
  -Xc1PortalClientId $Xc1PortalClientId `
  -Xc1PortalClientSecret $Xc1PortalClientSecret

Test-Xc1PortalAuthWithContext $Xc1 -Verbose | Format-List
Get-Xc1PortalJobsWithContext $Xc1
Get-Xc1PortalAlertsWithContext $Xc1
Get-Xc1PortalManagersWithContext $Xc1 -Offset 0 -Limit 10

Certificate trust (lab/dev)

For lab/dev only:

$Xc1 = New-Xc1PortalContext ... -SkipCertificateCheck

Prefer installing the XC1 Portal CA chain on the host running the script instead of bypassing validation.

Files

• src/xc1-portal-northbound.ps1 — implementation
• examples/usage.ps1 — minimal usage sample
• docs/notes.md — design notes / observations

License

MIT — see LICENSE.