Add secret provider functionality and enhance configuration data resolution

2026-07-02 14:36:04 +02:00
parent 1cd225c7a0
commit 115b8be385
12 changed files with 343 additions and 11 deletions
--- a/Providers/Provider.KeePass.ps1
+++ b/Providers/Provider.KeePass.ps1
@@ -0,0 +1,84 @@
+$KeePassProvider = @{
+    Name = "KeePass"
+    SupportedTypes = @(
+        "credential",
+        "securestring",
+        "string"
+    )
+    Resolver = {
+        Param(
+            [Parameter(Mandatory=$true)]
+            [System.Collections.IDictionary]
+            $Reference,
+
+            [Parameter(Mandatory=$true)]
+            [ValidateSet("credential", "securestring", "string")]
+            [string]
+            $ExpectedType,
+
+            [Parameter(Mandatory=$false)]
+            [hashtable]
+            $ProviderSettings = @{}
+        )
+
+        $KeePassCommand = Get-Command -Name Get-KeePassEntry -ErrorAction SilentlyContinue
+        if($null -eq $KeePassCommand){
+            throw "KeePass provider requires the [PoShKeePass] module command [Get-KeePassEntry]."
+        }
+
+        $Vault = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Vault" -DefaultValue "")
+        $Name = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Name")
+        $Options = Get-ConfigurationDataMapValue -Map $Reference -Key "Options" -DefaultValue @{}
+
+        if([string]::IsNullOrWhiteSpace($Vault) -and $ProviderSettings.ContainsKey("DefaultVault")){
+            $Vault = [string]$ProviderSettings.DefaultVault
+        }
+
+        $CommandParameters = @{}
+        if(-not [string]::IsNullOrWhiteSpace($Vault)){
+            $CommandParameters["DatabaseProfileName"] = $Vault
+        }
+
+        if($Options -is [System.Collections.IDictionary]){
+            foreach($Key in $Options.Keys){
+                $CommandParameters[$Key] = $Options[$Key]
+            }
+        }
+
+        if(-not $CommandParameters.ContainsKey("Title") -and -not $CommandParameters.ContainsKey("Path")){
+            $CommandParameters["Title"] = $Name
+        }
+
+        $Entry = & $KeePassCommand @CommandParameters
+        if($null -eq $Entry){
+            throw "KeePass entry [$Name] was not found."
+        }
+
+        $Entry = @($Entry)[0]
+        $UserName = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "UserName" -DefaultValue "")
+        if([string]::IsNullOrWhiteSpace($UserName)){
+            $UserName = [string]$Entry.UserName
+        }
+
+        $Password = $Entry.Password
+        if($ExpectedType -eq "credential"){
+            if([string]::IsNullOrWhiteSpace($UserName)){
+                throw "KeePass entry [$Name] does not provide a username and no [UserName] override was defined."
+            }
+
+            return ConvertTo-ConfigurationDataCredential -UserName $UserName -Password $Password
+        }
+
+        if($Password -is [System.Security.SecureString]){
+            return $Password
+        }
+
+        if($ExpectedType -eq "securestring"){
+            return ConvertTo-SecureString -String ([string]$Password) -AsPlainText -Force
+        }
+
+        return [string]$Password
+    }
+}
+
+Register-ConfigurationDataSecretProvider @KeePassProvider