We are using the following PowerShell script to monitor Azure AD authentication-enabled URLs in Splunk. However, when incorrect credentials are entered, a 200 response code is returned instead of the expected failure response (e.g., 401 Unauthorized). Has anyone encountered this issue? Please help us rectify this and ensure that incorrect credentials are flagged with the appropriate response code. # Prompt User for Credentials $credential = Get-Credential # Define Target URL $targetUrl = "<TARGET_URL>" # URL to monitor # Convert Credentials to Base64 for Authorization Header $username = $credential.UserName $password = $credential.GetNetworkCredential().Password $authValue = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("$username`:$password")) $headers = @{ Authorization = "Basic $authValue" } # Send Request with Authorization try { $response = Invoke-WebRequest -Uri $targetUrl -Headers $headers -Method Get -UseBasicParsing -ErrorAction Stop # Check if the server actually challenges for authentication if ($response.StatusCode -eq 200 -and $response.Headers["WWW-Authenticate"]) { Write-Host "Authentication failed: Invalid credentials provided." } else { Write-Host "Response Code: $($response.StatusCode)" } } catch { if ($_.Exception.Response.StatusCode -eq 401) { Write-Host "Authentication failed: Invalid credentials provided." } else { Write-Host "Request failed with error: $($_.Exception.Message)" } }
... View more