Refactor secret management providers and introduce unified handling
- Removed KeePass and SecretStore provider implementations. - Integrated KeePass and SecretStore as vaults under the SecretManagement provider. - Added new functions: Get-DSCConfigurationDataCredentialProvider and Set-DSCConfigurationDataCredentialProvider for managing credential providers. - Implemented Unlock-ConfigurationDataSecretManagementVault to handle vault unlocking with master passwords. - Updated README to reflect changes in provider usage and examples. - Enhanced error handling and validation for vault registration and settings.
This commit is contained in:
Torsten Brendgen
@@ -1,94 +0,0 @@
|
||||
$AzureKeyVaultProvider = @{
|
||||
Name = "AzureKeyVault"
|
||||
SupportedTypes = @(
|
||||
"credential",
|
||||
"securestring",
|
||||
"string"
|
||||
)
|
||||
Resolver = {
|
||||
Param(
|
||||
[Parameter(Mandatory=$true)]
|
||||
[System.Collections.IDictionary]
|
||||
$Reference,
|
||||
|
||||
[Parameter(Mandatory=$true)]
|
||||
[ValidateSet("credential", "securestring", "string")]
|
||||
[string]
|
||||
$ExpectedType,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[hashtable]
|
||||
$ProviderSettings = @{}
|
||||
)
|
||||
|
||||
$GetSecretCommand = Get-Command -Name Get-AzKeyVaultSecret -ErrorAction SilentlyContinue
|
||||
if($null -eq $GetSecretCommand){
|
||||
throw "AzureKeyVault provider requires the module [Az.KeyVault] and command [Get-AzKeyVaultSecret]."
|
||||
}
|
||||
|
||||
$Vault = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Vault" -DefaultValue "")
|
||||
$Name = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Name")
|
||||
$UserName = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "UserName" -DefaultValue "")
|
||||
$Options = Get-ConfigurationDataMapValue -Map $Reference -Key "Options" -DefaultValue @{}
|
||||
|
||||
if([string]::IsNullOrWhiteSpace($Vault) -and $ProviderSettings.ContainsKey("DefaultVault")){
|
||||
$Vault = [string]$ProviderSettings.DefaultVault
|
||||
}
|
||||
|
||||
if([string]::IsNullOrWhiteSpace($Vault)){
|
||||
throw "AzureKeyVault secret [$Name] requires [Vault] or provider setting [DefaultVault]."
|
||||
}
|
||||
|
||||
if($ProviderSettings.ContainsKey("SubscriptionId") -or $ProviderSettings.ContainsKey("TenantId")){
|
||||
$SetContextCommand = Get-Command -Name Set-AzContext -ErrorAction SilentlyContinue
|
||||
if($null -eq $SetContextCommand){
|
||||
throw "AzureKeyVault provider settings define Azure context values, but command [Set-AzContext] was not found. Install [Az.Accounts] or remove SubscriptionId/TenantId from provider settings."
|
||||
}
|
||||
|
||||
$ContextParameters = @{}
|
||||
if($ProviderSettings.ContainsKey("SubscriptionId") -and -not [string]::IsNullOrWhiteSpace([string]$ProviderSettings.SubscriptionId)){
|
||||
$ContextParameters["SubscriptionId"] = [string]$ProviderSettings.SubscriptionId
|
||||
}
|
||||
|
||||
if($ProviderSettings.ContainsKey("TenantId") -and -not [string]::IsNullOrWhiteSpace([string]$ProviderSettings.TenantId)){
|
||||
$ContextParameters["Tenant"] = [string]$ProviderSettings.TenantId
|
||||
}
|
||||
|
||||
if($ContextParameters.Count -gt 0){
|
||||
& $SetContextCommand @ContextParameters | Out-Null
|
||||
}
|
||||
}
|
||||
|
||||
$CommandParameters = @{
|
||||
VaultName = $Vault
|
||||
Name = $Name
|
||||
}
|
||||
|
||||
if($Options -is [System.Collections.IDictionary]){
|
||||
foreach($Key in $Options.Keys){
|
||||
$CommandParameters[$Key] = $Options[$Key]
|
||||
}
|
||||
}
|
||||
|
||||
if($ExpectedType -eq "string" -and $GetSecretCommand.Parameters.ContainsKey("AsPlainText") -and -not $CommandParameters.ContainsKey("AsPlainText")){
|
||||
$CommandParameters["AsPlainText"] = $true
|
||||
}
|
||||
|
||||
$Secret = & $GetSecretCommand @CommandParameters
|
||||
if($null -eq $Secret){
|
||||
throw "Azure Key Vault secret [$Name] was not found in vault [$Vault]."
|
||||
}
|
||||
|
||||
if($ExpectedType -eq "string" -and $Secret -is [string]){
|
||||
return $Secret
|
||||
}
|
||||
|
||||
if($Secret.PSObject.Properties["SecretValue"]){
|
||||
return ConvertFrom-ConfigurationDataSecretValue -Secret $Secret.SecretValue -ExpectedType $ExpectedType -Name $Name -UserName $UserName
|
||||
}
|
||||
|
||||
return ConvertFrom-ConfigurationDataSecretValue -Secret $Secret -ExpectedType $ExpectedType -Name $Name -UserName $UserName
|
||||
}
|
||||
}
|
||||
|
||||
Register-ConfigurationDataSecretProvider @AzureKeyVaultProvider
|
||||
@@ -1,88 +0,0 @@
|
||||
$KeePassProvider = @{
|
||||
Name = "KeePass"
|
||||
SupportedTypes = @(
|
||||
"credential",
|
||||
"securestring",
|
||||
"string"
|
||||
)
|
||||
Resolver = {
|
||||
Param(
|
||||
[Parameter(Mandatory=$true)]
|
||||
[System.Collections.IDictionary]
|
||||
$Reference,
|
||||
|
||||
[Parameter(Mandatory=$true)]
|
||||
[ValidateSet("credential", "securestring", "string")]
|
||||
[string]
|
||||
$ExpectedType,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[hashtable]
|
||||
$ProviderSettings = @{}
|
||||
)
|
||||
|
||||
$KeePassCommand = Get-Command -Name Get-KeePassEntry -ErrorAction SilentlyContinue
|
||||
if($null -eq $KeePassCommand){
|
||||
throw "KeePass provider requires the [PoShKeePass] module command [Get-KeePassEntry]."
|
||||
}
|
||||
|
||||
$Vault = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Vault" -DefaultValue "")
|
||||
$Name = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Name")
|
||||
$Options = Get-ConfigurationDataMapValue -Map $Reference -Key "Options" -DefaultValue @{}
|
||||
|
||||
if([string]::IsNullOrWhiteSpace($Vault) -and $ProviderSettings.ContainsKey("DefaultVault")){
|
||||
$Vault = [string]$ProviderSettings.DefaultVault
|
||||
}
|
||||
|
||||
$CommandParameters = @{}
|
||||
if(-not [string]::IsNullOrWhiteSpace($Vault)){
|
||||
$CommandParameters["DatabaseProfileName"] = $Vault
|
||||
}
|
||||
|
||||
if($Options -is [System.Collections.IDictionary]){
|
||||
foreach($Key in $Options.Keys){
|
||||
$CommandParameters[$Key] = $Options[$Key]
|
||||
}
|
||||
}
|
||||
|
||||
if($ProviderSettings.ContainsKey("MasterKey")){
|
||||
$CommandParameters["MasterKey"] = Resolve-ConfigurationDataProviderSecureString -Value $ProviderSettings.MasterKey
|
||||
}
|
||||
|
||||
if(-not $CommandParameters.ContainsKey("Title") -and -not $CommandParameters.ContainsKey("Path")){
|
||||
$CommandParameters["Title"] = $Name
|
||||
}
|
||||
|
||||
$Entry = & $KeePassCommand @CommandParameters
|
||||
if($null -eq $Entry){
|
||||
throw "KeePass entry [$Name] was not found."
|
||||
}
|
||||
|
||||
$Entry = @($Entry)[0]
|
||||
$UserName = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "UserName" -DefaultValue "")
|
||||
if([string]::IsNullOrWhiteSpace($UserName)){
|
||||
$UserName = [string]$Entry.UserName
|
||||
}
|
||||
|
||||
$Password = $Entry.Password
|
||||
if($ExpectedType -eq "credential"){
|
||||
if([string]::IsNullOrWhiteSpace($UserName)){
|
||||
throw "KeePass entry [$Name] does not provide a username and no [UserName] override was defined."
|
||||
}
|
||||
|
||||
return ConvertTo-ConfigurationDataCredential -UserName $UserName -Password $Password
|
||||
}
|
||||
|
||||
if($Password -is [System.Security.SecureString]){
|
||||
return $Password
|
||||
}
|
||||
|
||||
if($ExpectedType -eq "securestring"){
|
||||
return ConvertTo-SecureString -String ([string]$Password) -AsPlainText -Force
|
||||
}
|
||||
|
||||
return [string]$Password
|
||||
}
|
||||
}
|
||||
|
||||
Register-ConfigurationDataSecretProvider @KeePassProvider
|
||||
@@ -1,57 +0,0 @@
|
||||
$SecretStoreProvider = @{
|
||||
Name = "SecretStore"
|
||||
SupportedTypes = @(
|
||||
"credential",
|
||||
"securestring",
|
||||
"string"
|
||||
)
|
||||
Resolver = {
|
||||
Param(
|
||||
[Parameter(Mandatory=$true)]
|
||||
[System.Collections.IDictionary]
|
||||
$Reference,
|
||||
|
||||
[Parameter(Mandatory=$true)]
|
||||
[ValidateSet("credential", "securestring", "string")]
|
||||
[string]
|
||||
$ExpectedType,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[hashtable]
|
||||
$ProviderSettings = @{}
|
||||
)
|
||||
|
||||
$GetSecretCommand = Get-Command -Name Get-Secret -ErrorAction SilentlyContinue
|
||||
if($null -eq $GetSecretCommand){
|
||||
throw "SecretStore provider requires the module [Microsoft.PowerShell.SecretManagement] and command [Get-Secret]."
|
||||
}
|
||||
|
||||
$Vault = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Vault" -DefaultValue "")
|
||||
$Name = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Name")
|
||||
$UserName = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "UserName" -DefaultValue "")
|
||||
$Options = Get-ConfigurationDataMapValue -Map $Reference -Key "Options" -DefaultValue @{}
|
||||
|
||||
if([string]::IsNullOrWhiteSpace($Vault) -and $ProviderSettings.ContainsKey("DefaultVault")){
|
||||
$Vault = [string]$ProviderSettings.DefaultVault
|
||||
}
|
||||
|
||||
$CommandParameters = @{
|
||||
Name = $Name
|
||||
}
|
||||
|
||||
if(-not [string]::IsNullOrWhiteSpace($Vault)){
|
||||
$CommandParameters["Vault"] = $Vault
|
||||
}
|
||||
|
||||
if($Options -is [System.Collections.IDictionary]){
|
||||
foreach($Key in $Options.Keys){
|
||||
$CommandParameters[$Key] = $Options[$Key]
|
||||
}
|
||||
}
|
||||
|
||||
$Secret = & $GetSecretCommand @CommandParameters
|
||||
return ConvertFrom-ConfigurationDataSecretValue -Secret $Secret -ExpectedType $ExpectedType -Name $Name -UserName $UserName
|
||||
}
|
||||
}
|
||||
|
||||
Register-ConfigurationDataSecretProvider @SecretStoreProvider
|
||||
Reference in New Issue
Block a user