Refactor secret management providers and introduce unified handling
- Removed KeePass and SecretStore provider implementations. - Integrated KeePass and SecretStore as vaults under the SecretManagement provider. - Added new functions: Get-DSCConfigurationDataCredentialProvider and Set-DSCConfigurationDataCredentialProvider for managing credential providers. - Implemented Unlock-ConfigurationDataSecretManagementVault to handle vault unlocking with master passwords. - Updated README to reflect changes in provider usage and examples. - Enhanced error handling and validation for vault registration and settings.
This commit is contained in:
49
Private/Unlock-ConfigurationDataSecretManagementVault.ps1
Normal file
49
Private/Unlock-ConfigurationDataSecretManagementVault.ps1
Normal file
@@ -0,0 +1,49 @@
|
||||
function Unlock-ConfigurationDataSecretManagementVault {
|
||||
[CmdletBinding()]
|
||||
Param(
|
||||
[Parameter(Mandatory=$false)]
|
||||
[hashtable]
|
||||
$ProviderSettings = @{}
|
||||
)
|
||||
|
||||
if(-not $ProviderSettings.ContainsKey("SecretManagement")){
|
||||
return
|
||||
}
|
||||
|
||||
$SecretManagementSettings = $ProviderSettings.SecretManagement
|
||||
if(-not ($SecretManagementSettings -is [System.Collections.IDictionary])){
|
||||
return
|
||||
}
|
||||
|
||||
if(-not (Test-ConfigurationDataMapContainsKey -Map $SecretManagementSettings -Key "MasterPassword")){
|
||||
return
|
||||
}
|
||||
|
||||
$Vault = [string](Get-ConfigurationDataMapValue -Map $SecretManagementSettings -Key "DefaultVault" -DefaultValue "")
|
||||
if([string]::IsNullOrWhiteSpace($Vault)){
|
||||
throw "SecretManagement provider settings define [MasterPassword], but [DefaultVault] is not defined."
|
||||
}
|
||||
|
||||
$UnlockSecretVaultCommand = Get-Command -Name Unlock-SecretVault -ErrorAction SilentlyContinue
|
||||
if($null -eq $UnlockSecretVaultCommand){
|
||||
throw "Command [Unlock-SecretVault] was not found. Install module [Microsoft.PowerShell.SecretManagement]."
|
||||
}
|
||||
|
||||
$MasterPassword = Resolve-ConfigurationDataProviderSecureString -Value $SecretManagementSettings.MasterPassword
|
||||
& $UnlockSecretVaultCommand -Name $Vault -Password $MasterPassword
|
||||
|
||||
$TestSecretVaultCommand = Get-Command -Name Test-SecretVault -ErrorAction SilentlyContinue
|
||||
if($null -ne $TestSecretVaultCommand){
|
||||
$IsUnlocked = $false
|
||||
try {
|
||||
$IsUnlocked = [bool](& $TestSecretVaultCommand -Name $Vault -ErrorAction Stop)
|
||||
}
|
||||
catch {
|
||||
throw "SecretManagement vault [$Vault] could not be unlocked. $($_.Exception.Message)"
|
||||
}
|
||||
|
||||
if(-not $IsUnlocked){
|
||||
throw "SecretManagement vault [$Vault] could not be unlocked. Verify the KeePass database path, KeePass key file, and protected master password in the provider settings."
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user