SPAppCatalog: Resource should not depend on CredSSP

Problem description

The resource SPAppCatalog requires CredSSP to elevate the credentials of the used Farm account to be able to perform all actions needed.

However, Microsoft states,

Caution

Credential Security Support Provider (CredSSP) authentication, in which the user credentials are passed to a remote computer to be authenticated, is designed for commands that require authentication on more than one resource, such as accessing a remote network share. This mechanism increases the security risk of the remote operation. If the remote computer is compromised, the credentials that are passed to it can be used to control the network session.

Verbose logs

VERBOSE: [SRVXXX1]         [[SPAppCatalog]My_AppCatalog] Executing using a provided credential and local PSSession
                           as User local\SPFarm
Connecting to remote server SRVXXX1 failed with the following error message: The WinRM client cannot process the
request. CredSSP authentication is currently disabled in the client configuration. [...]

DSC configuration

SPAppCatalog 'Setup_AppCatalog' {
  PsDescRunAsCredential = $SpFarmCredential
  SiteUrl               = 'https://mysite.local/apps'
}

Suggested solution

Use PowerShell Configured Sessions instead of CredSSP

$SessionName = (New-GUID).Guid
Register-PSSessionConfiguration -Name $SessionName -RunAsCredential $Credential

Invoke-Command localhost {
  # Code to run as another user
} -ConfigurationName $SessionName

Unregister-PSSessionConfiguration $SessionName -Force

Named sessions can even be locked down as in JEA (Just Enough Administration) to only allow certain users to attach to it.

or setup and remove CredSSP within the resource when needed.
(this should only be done if CredSSP isn't set at all to avoid side effects)

SharePoint version and build

SharePoint Subscription Edition 16.0.15601.20747

Operating system the target node is running

OsName               : Microsoft Windows Server 2022 Standard
OsOperatingSystemSKU : StandardServerEdition
OSArchitecture       : 64-bit
WindowsVersion       : 2009
WindowsBuildLabEx    : 20348.2849.amd64free.fe_release_svc_prod1.241101-1732
OsLanguage           : en-US
OsMuiLanguages       : {en-US}

PowerShell version and build the target node is running

Name                       Value
----                       -----
PSVersion                  5.1.20348.4163
PSEdition                  Desktop
PSCompatibleVersions       {1.0, 2.0, 3.0, 4.0...}
BuildVersion               10.0.20348.4163
CLRVersion                 4.0.30319.42000
WSManStackVersion          3.0
PSRemotingProtocolVersion  2.3
SerializationVersion       1.1.0.1

SharePointDsc version

Name          Version Path
----          ------- ----
SharePointDsc 5.6.1   C:\Program Files\WindowsPowerShell\Modules\SharePointDSC\5.6.1\SharePoindDSC.psd1

Start at the SPAppCatalog resource entry point and trace how its local PSSession and CredSSP authentication are used with PsDescRunAsCredential. Compare that flow with the suggested PowerShell configured-session approach, and verify that all required resource actions work without introducing unwanted CredSSP changes.