Refactor secret management providers and introduce unified handling
- Removed KeePass and SecretStore provider implementations. - Integrated KeePass and SecretStore as vaults under the SecretManagement provider. - Added new functions: Get-DSCConfigurationDataCredentialProvider and Set-DSCConfigurationDataCredentialProvider for managing credential providers. - Implemented Unlock-ConfigurationDataSecretManagementVault to handle vault unlocking with master passwords. - Updated README to reflect changes in provider usage and examples. - Enhanced error handling and validation for vault registration and settings.
This commit is contained in:
Torsten Brendgen
119
Public/Get-DSCConfigurationDataCredentialProvider.ps1
Normal file
119
Public/Get-DSCConfigurationDataCredentialProvider.ps1
Normal file
@@ -0,0 +1,119 @@
|
||||
function Get-DSCConfigurationDataCredentialProvider {
|
||||
[CmdletBinding()]
|
||||
Param(
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$Vault,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$SettingsPath,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$TestVault
|
||||
)
|
||||
|
||||
DynamicParam {
|
||||
$ProviderNames = @(Get-ConfigurationDataSecretProviderName)
|
||||
if($ProviderNames.Count -eq 0){
|
||||
$ProviderNames = @("__NoProvidersRegistered__")
|
||||
}
|
||||
|
||||
$ParameterAttribute = [System.Management.Automation.ParameterAttribute]::new()
|
||||
$ParameterAttribute.Mandatory = $false
|
||||
$ParameterAttribute.Position = 0
|
||||
|
||||
$ValidateSetAttribute = New-Object System.Management.Automation.ValidateSetAttribute -ArgumentList (,[string[]]$ProviderNames)
|
||||
$Attributes = [System.Collections.ObjectModel.Collection[System.Attribute]]::new()
|
||||
$Attributes.Add($ParameterAttribute)
|
||||
$Attributes.Add($ValidateSetAttribute)
|
||||
|
||||
$RuntimeParameter = [System.Management.Automation.RuntimeDefinedParameter]::new(
|
||||
"Provider",
|
||||
[string],
|
||||
$Attributes
|
||||
)
|
||||
|
||||
$Dictionary = [System.Management.Automation.RuntimeDefinedParameterDictionary]::new()
|
||||
$Dictionary.Add("Provider", $RuntimeParameter)
|
||||
return $Dictionary
|
||||
}
|
||||
|
||||
begin {
|
||||
$Provider = [string]$PSBoundParameters["Provider"]
|
||||
if([string]::IsNullOrWhiteSpace($Provider)){
|
||||
$ProviderNames = @(Get-ConfigurationDataSecretProviderName)
|
||||
if($ProviderNames.Count -eq 1){
|
||||
$Provider = $ProviderNames[0]
|
||||
}elseif($ProviderNames.Count -eq 0){
|
||||
throw "No configuration data secret providers are registered."
|
||||
}else{
|
||||
throw "Provider is required. Registered providers: $($ProviderNames -join ', ')."
|
||||
}
|
||||
}
|
||||
|
||||
$ResolvedSettingsPath = Resolve-ConfigurationDataProviderSettingsPath -Provider $Provider -SettingsPath $SettingsPath
|
||||
}
|
||||
|
||||
process {
|
||||
$Settings = @{}
|
||||
$SettingsExists = Test-Path -LiteralPath $ResolvedSettingsPath -PathType Leaf
|
||||
if($SettingsExists){
|
||||
$Settings = Import-PowerShellDataFile -LiteralPath $ResolvedSettingsPath
|
||||
}
|
||||
|
||||
$ProviderSettings = @{}
|
||||
if($Settings -is [System.Collections.IDictionary] -and $Settings.ContainsKey($Provider)){
|
||||
$ProviderSettings = $Settings[$Provider]
|
||||
}
|
||||
|
||||
$DefaultVault = ""
|
||||
if($ProviderSettings -is [System.Collections.IDictionary] -and $ProviderSettings.ContainsKey("DefaultVault")){
|
||||
$DefaultVault = [string]$ProviderSettings.DefaultVault
|
||||
}
|
||||
|
||||
if([string]::IsNullOrWhiteSpace($Vault)){
|
||||
$Vault = $DefaultVault
|
||||
}
|
||||
|
||||
$Vaults = @()
|
||||
$GetSecretVaultCommand = Get-Command -Name Get-SecretVault -ErrorAction SilentlyContinue
|
||||
if($null -ne $GetSecretVaultCommand){
|
||||
if([string]::IsNullOrWhiteSpace($Vault)){
|
||||
$Vaults = @(& $GetSecretVaultCommand)
|
||||
}else{
|
||||
$Vaults = @(& $GetSecretVaultCommand -Name $Vault -ErrorAction SilentlyContinue)
|
||||
}
|
||||
}
|
||||
|
||||
$TestResult = $null
|
||||
$TestError = $null
|
||||
if($TestVault -and -not [string]::IsNullOrWhiteSpace($Vault)){
|
||||
$TestSecretVaultCommand = Get-Command -Name Test-SecretVault -ErrorAction SilentlyContinue
|
||||
if($null -eq $TestSecretVaultCommand){
|
||||
$TestError = "Command [Test-SecretVault] was not found."
|
||||
}else{
|
||||
try {
|
||||
$TestResult = [bool](& $TestSecretVaultCommand -Name $Vault -ErrorAction Stop)
|
||||
}
|
||||
catch {
|
||||
$TestResult = $false
|
||||
$TestError = $_.Exception.Message
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
[PSCustomObject]@{
|
||||
Provider = $Provider
|
||||
SettingsPath = $ResolvedSettingsPath
|
||||
SettingsExists = $SettingsExists
|
||||
DefaultVault = $DefaultVault
|
||||
RequestedVault = $Vault
|
||||
ProviderSettings = $ProviderSettings
|
||||
RegisteredVaults = $Vaults
|
||||
TestVault = $TestResult
|
||||
TestError = $TestError
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,10 +1,19 @@
|
||||
function Register-DSCConfigurationDataCredentialProvider {
|
||||
[CmdletBinding(SupportsShouldProcess=$true)]
|
||||
Param(
|
||||
[Parameter(Mandatory=$true)]
|
||||
[Parameter(Mandatory=$true, Position=1)]
|
||||
[string]
|
||||
$Vault,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[ValidateSet("Generic", "KeePass")]
|
||||
[string]
|
||||
$VaultType = "Generic",
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$DatabasePath,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$KeyPath,
|
||||
@@ -13,10 +22,6 @@ function Register-DSCConfigurationDataCredentialProvider {
|
||||
[string]
|
||||
$SettingsPath,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[System.Security.SecureString]
|
||||
$MasterKey,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$ModuleName,
|
||||
@@ -25,14 +30,6 @@ function Register-DSCConfigurationDataCredentialProvider {
|
||||
[hashtable]
|
||||
$VaultParameters = @{},
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$SubscriptionId,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$TenantId,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$RegisterVault,
|
||||
@@ -47,25 +44,17 @@ function Register-DSCConfigurationDataCredentialProvider {
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$ConfigureSecretStore,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[ValidateSet("None", "Password")]
|
||||
[string]
|
||||
$Authentication = "None",
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[ValidateSet("None", "Prompt")]
|
||||
[string]
|
||||
$Interaction = "None",
|
||||
$UseMasterPassword,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[Alias("MasterKey")]
|
||||
[System.Security.SecureString]
|
||||
$Password,
|
||||
$MasterPassword,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[int]
|
||||
$PasswordTimeout,
|
||||
[Alias("MasterKeyPath")]
|
||||
[string]
|
||||
$MasterPasswordKeyPath,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
@@ -120,63 +109,98 @@ function Register-DSCConfigurationDataCredentialProvider {
|
||||
|
||||
process {
|
||||
switch($Provider){
|
||||
"KeePass" {
|
||||
if([string]::IsNullOrWhiteSpace($KeyPath)){
|
||||
throw "Provider [KeePass] requires [KeyPath]."
|
||||
}
|
||||
|
||||
if($null -eq $MasterKey){
|
||||
$MasterKey = Read-Host -Prompt "KeePass MasterKey for vault [$Vault]" -AsSecureString
|
||||
}
|
||||
|
||||
if($PSCmdlet.ShouldProcess($SettingsPath, "Create provider settings for [$Provider]")){
|
||||
$Key = New-ConfigurationDataAesKeyFile -Path $KeyPath -Force:$Force
|
||||
$ProtectedValue = $MasterKey | ConvertFrom-SecureString -Key $Key
|
||||
|
||||
$ProviderSettings = [ordered]@{
|
||||
KeePass = [ordered]@{
|
||||
DefaultVault = $Vault
|
||||
MasterKey = [ordered]@{
|
||||
ProtectedValue = $ProtectedValue
|
||||
KeyPath = $KeyPath
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Export-PowerShellDataFile -InputObject $ProviderSettings -Path $SettingsPath -Force:$Force
|
||||
|
||||
if($PassThru){
|
||||
return $ProviderSettings
|
||||
}
|
||||
|
||||
Write-Verbose "Provider settings written to [$SettingsPath]."
|
||||
}
|
||||
}
|
||||
"SecretManagement" {
|
||||
if([string]::IsNullOrWhiteSpace($ModuleName)){
|
||||
$ModuleName = "Microsoft.PowerShell.SecretStore"
|
||||
if($VaultType -eq "KeePass"){
|
||||
$ModuleName = "SecretManagement.KeePass"
|
||||
}else{
|
||||
$ModuleName = "Microsoft.PowerShell.SecretStore"
|
||||
}
|
||||
}
|
||||
|
||||
if($RegisterVault -or $PSBoundParameters.ContainsKey("ModuleName")){
|
||||
$CommandParameters = @{
|
||||
Name = $Vault
|
||||
ModuleName = $ModuleName
|
||||
$ShouldRegisterVault = $RegisterVault -or $PSBoundParameters.ContainsKey("ModuleName")
|
||||
|
||||
if($VaultType -eq "KeePass" -and $ShouldRegisterVault){
|
||||
if([string]::IsNullOrWhiteSpace($DatabasePath) -and -not $VaultParameters.ContainsKey("Path")){
|
||||
throw "SecretManagement KeePass vault registration requires [DatabasePath] or VaultParameters['Path']."
|
||||
}
|
||||
|
||||
if($VaultParameters.Count -gt 0){
|
||||
$CommandParameters["VaultParameters"] = $VaultParameters
|
||||
if(-not [string]::IsNullOrWhiteSpace($DatabasePath)){
|
||||
$VaultParameters["Path"] = $DatabasePath
|
||||
}
|
||||
|
||||
if($DefaultVault){
|
||||
$CommandParameters["DefaultVault"] = $true
|
||||
if(-not [string]::IsNullOrWhiteSpace($KeyPath)){
|
||||
$VaultParameters["KeyPath"] = $KeyPath
|
||||
}
|
||||
|
||||
if($AllowClobber){
|
||||
$CommandParameters["AllowClobber"] = $true
|
||||
if($UseMasterPassword){
|
||||
$VaultParameters["UseMasterPassword"] = $true
|
||||
}
|
||||
}
|
||||
|
||||
if($PSCmdlet.ShouldProcess($Vault, "Register SecretManagement vault [$ModuleName]")){
|
||||
Register-SecretVault @CommandParameters
|
||||
if($ShouldRegisterVault){
|
||||
if($VaultType -eq "KeePass"){
|
||||
$KeePassModule = Get-Module -Name SecretManagement.KeePass -ListAvailable | Sort-Object -Property Version -Descending | Select-Object -First 1
|
||||
if($null -eq $KeePassModule){
|
||||
throw "SecretManagement KeePass vault registration requires module [SecretManagement.KeePass]."
|
||||
}
|
||||
|
||||
$ModuleReference = $KeePassModule.Name
|
||||
if(-not [string]::IsNullOrWhiteSpace($KeePassModule.Path)){
|
||||
$ModuleReference = $KeePassModule.Path
|
||||
}
|
||||
|
||||
$CommandParameters = @{
|
||||
Name = $Vault
|
||||
ModuleName = $ModuleReference
|
||||
VaultParameters = @{
|
||||
Path = $VaultParameters["Path"]
|
||||
UseMasterPassword = $false
|
||||
UseWindowsAccount = $false
|
||||
KeyPath = $null
|
||||
ShowFullTitle = $false
|
||||
ShowRecycleBin = $false
|
||||
}
|
||||
}
|
||||
|
||||
foreach($Key in @("KeyPath", "UseMasterPassword", "UseWindowsAccount", "ShowFullTitle", "ShowRecycleBin", "SkipValidate")){
|
||||
if($VaultParameters.ContainsKey($Key)){
|
||||
$CommandParameters.VaultParameters[$Key] = $VaultParameters[$Key]
|
||||
}
|
||||
}
|
||||
|
||||
if($DefaultVault){
|
||||
$CommandParameters["DefaultVault"] = $true
|
||||
}
|
||||
|
||||
if($AllowClobber){
|
||||
$CommandParameters["AllowClobber"] = $true
|
||||
}
|
||||
|
||||
if($PSCmdlet.ShouldProcess($Vault, "Register KeePass SecretManagement vault [$ModuleReference]")){
|
||||
Register-SecretVault @CommandParameters
|
||||
}
|
||||
}else{
|
||||
$CommandParameters = @{
|
||||
Name = $Vault
|
||||
ModuleName = $ModuleName
|
||||
}
|
||||
|
||||
if($VaultParameters.Count -gt 0){
|
||||
$CommandParameters["VaultParameters"] = $VaultParameters
|
||||
}
|
||||
|
||||
if($DefaultVault){
|
||||
$CommandParameters["DefaultVault"] = $true
|
||||
}
|
||||
|
||||
if($AllowClobber){
|
||||
$CommandParameters["AllowClobber"] = $true
|
||||
}
|
||||
|
||||
if($PSCmdlet.ShouldProcess($Vault, "Register SecretManagement vault [$ModuleName]")){
|
||||
Register-SecretVault @CommandParameters
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -186,80 +210,21 @@ function Register-DSCConfigurationDataCredentialProvider {
|
||||
}
|
||||
}
|
||||
|
||||
if($PSCmdlet.ShouldProcess($SettingsPath, "Create provider settings for [$Provider]")){
|
||||
Export-PowerShellDataFile -InputObject $ProviderSettings -Path $SettingsPath -Force:$Force
|
||||
if($VaultType -ne "Generic"){
|
||||
$ProviderSettings.SecretManagement["VaultType"] = $VaultType
|
||||
}
|
||||
|
||||
if($PassThru){
|
||||
return $ProviderSettings
|
||||
}
|
||||
}
|
||||
"SecretStore" {
|
||||
if($ConfigureSecretStore){
|
||||
$CommandParameters = @{
|
||||
Authentication = $Authentication
|
||||
Interaction = $Interaction
|
||||
if($null -ne $MasterPassword){
|
||||
if([string]::IsNullOrWhiteSpace($MasterPasswordKeyPath)){
|
||||
throw "MasterPassword requires [MasterPasswordKeyPath]."
|
||||
}
|
||||
|
||||
if($null -ne $Password){
|
||||
$CommandParameters["Password"] = $Password
|
||||
$Key = New-ConfigurationDataAesKeyFile -Path $MasterPasswordKeyPath -Force:$Force
|
||||
$ProtectedValue = $MasterPassword | ConvertFrom-SecureString -Key $Key
|
||||
$ProviderSettings.SecretManagement["MasterPassword"] = [ordered]@{
|
||||
ProtectedValue = $ProtectedValue
|
||||
KeyPath = $MasterPasswordKeyPath
|
||||
}
|
||||
|
||||
if($PasswordTimeout -gt 0){
|
||||
$CommandParameters["PasswordTimeout"] = $PasswordTimeout
|
||||
}
|
||||
|
||||
if($PSCmdlet.ShouldProcess("SecretStore", "Configure local SecretStore")){
|
||||
Set-SecretStoreConfiguration @CommandParameters -Confirm:$false
|
||||
}
|
||||
}
|
||||
|
||||
if($RegisterVault){
|
||||
$CommandParameters = @{
|
||||
Name = $Vault
|
||||
ModuleName = "Microsoft.PowerShell.SecretStore"
|
||||
}
|
||||
|
||||
if($DefaultVault){
|
||||
$CommandParameters["DefaultVault"] = $true
|
||||
}
|
||||
|
||||
if($AllowClobber){
|
||||
$CommandParameters["AllowClobber"] = $true
|
||||
}
|
||||
|
||||
if($PSCmdlet.ShouldProcess($Vault, "Register SecretStore vault")){
|
||||
Register-SecretVault @CommandParameters
|
||||
}
|
||||
}
|
||||
|
||||
$ProviderSettings = [ordered]@{
|
||||
SecretStore = [ordered]@{
|
||||
DefaultVault = $Vault
|
||||
}
|
||||
}
|
||||
|
||||
if($PSCmdlet.ShouldProcess($SettingsPath, "Create provider settings for [$Provider]")){
|
||||
Export-PowerShellDataFile -InputObject $ProviderSettings -Path $SettingsPath -Force:$Force
|
||||
}
|
||||
|
||||
if($PassThru){
|
||||
return $ProviderSettings
|
||||
}
|
||||
}
|
||||
"AzureKeyVault" {
|
||||
$ProviderSettings = [ordered]@{
|
||||
AzureKeyVault = [ordered]@{
|
||||
DefaultVault = $Vault
|
||||
}
|
||||
}
|
||||
|
||||
if(-not [string]::IsNullOrWhiteSpace($SubscriptionId)){
|
||||
$ProviderSettings["AzureKeyVault"]["SubscriptionId"] = $SubscriptionId
|
||||
}
|
||||
|
||||
if(-not [string]::IsNullOrWhiteSpace($TenantId)){
|
||||
$ProviderSettings["AzureKeyVault"]["TenantId"] = $TenantId
|
||||
}
|
||||
|
||||
if($PSCmdlet.ShouldProcess($SettingsPath, "Create provider settings for [$Provider]")){
|
||||
|
||||
@@ -28,6 +28,7 @@ function Resolve-DSCConfigurationData {
|
||||
}
|
||||
|
||||
if(-not $SkipSecrets){
|
||||
Unlock-ConfigurationDataSecretManagementVault -ProviderSettings $ProviderSettings
|
||||
$ConfigurationData = Resolve-ConfigurationDataParameterSecrets -ConfigurationData $ConfigurationData -ProviderSettings $ProviderSettings
|
||||
}
|
||||
|
||||
|
||||
258
Public/Set-DSCConfigurationDataCredentialProvider.ps1
Normal file
258
Public/Set-DSCConfigurationDataCredentialProvider.ps1
Normal file
@@ -0,0 +1,258 @@
|
||||
function Set-DSCConfigurationDataCredentialProvider {
|
||||
[CmdletBinding(SupportsShouldProcess=$true)]
|
||||
Param(
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$Vault,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[AllowEmptyString()]
|
||||
[ValidateSet("", "Generic", "KeePass")]
|
||||
[string]
|
||||
$VaultType = "",
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$DatabasePath,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$KeyPath,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$DisableKeePassKeyFile,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$ModuleName,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[hashtable]
|
||||
$VaultParameters = @{},
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$RegisterVault,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$DefaultVault,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$AllowClobber,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[Alias("UseMasterKey")]
|
||||
[switch]
|
||||
$UseMasterPassword,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[Alias("NoMasterKey", "NoMasterPassword")]
|
||||
[switch]
|
||||
$DisableMasterPassword,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[Alias("MasterKey")]
|
||||
[System.Security.SecureString]
|
||||
$MasterPassword,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[Alias("MasterKeyPath")]
|
||||
[string]
|
||||
$MasterPasswordKeyPath,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$UseWindowsAccount,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$ShowFullTitle,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$ShowRecycleBin,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$SkipValidate,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$SettingsPath,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$Force,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$PassThru
|
||||
)
|
||||
|
||||
DynamicParam {
|
||||
$ProviderNames = @(Get-ConfigurationDataSecretProviderName)
|
||||
if($ProviderNames.Count -eq 0){
|
||||
$ProviderNames = @("__NoProvidersRegistered__")
|
||||
}
|
||||
|
||||
$ParameterAttribute = [System.Management.Automation.ParameterAttribute]::new()
|
||||
$ParameterAttribute.Mandatory = $false
|
||||
$ParameterAttribute.Position = 0
|
||||
|
||||
$ValidateSetAttribute = New-Object System.Management.Automation.ValidateSetAttribute -ArgumentList (,[string[]]$ProviderNames)
|
||||
$Attributes = [System.Collections.ObjectModel.Collection[System.Attribute]]::new()
|
||||
$Attributes.Add($ParameterAttribute)
|
||||
$Attributes.Add($ValidateSetAttribute)
|
||||
|
||||
$RuntimeParameter = [System.Management.Automation.RuntimeDefinedParameter]::new(
|
||||
"Provider",
|
||||
[string],
|
||||
$Attributes
|
||||
)
|
||||
|
||||
$Dictionary = [System.Management.Automation.RuntimeDefinedParameterDictionary]::new()
|
||||
$Dictionary.Add("Provider", $RuntimeParameter)
|
||||
return $Dictionary
|
||||
}
|
||||
|
||||
begin {
|
||||
$Provider = [string]$PSBoundParameters["Provider"]
|
||||
if([string]::IsNullOrWhiteSpace($Provider)){
|
||||
$ProviderNames = @(Get-ConfigurationDataSecretProviderName)
|
||||
if($ProviderNames.Count -eq 1){
|
||||
$Provider = $ProviderNames[0]
|
||||
}elseif($ProviderNames.Count -eq 0){
|
||||
throw "No configuration data secret providers are registered."
|
||||
}else{
|
||||
throw "Provider is required. Registered providers: $($ProviderNames -join ', ')."
|
||||
}
|
||||
}
|
||||
|
||||
$ProviderInfo = Get-DSCConfigurationDataCredentialProvider -Provider $Provider -Vault $Vault -SettingsPath $SettingsPath
|
||||
if([string]::IsNullOrWhiteSpace($Vault)){
|
||||
$Vault = [string]$ProviderInfo.DefaultVault
|
||||
}
|
||||
|
||||
if([string]::IsNullOrWhiteSpace($Vault)){
|
||||
throw "Vault is required. Pass [Vault] or define [DefaultVault] in the provider settings file."
|
||||
}
|
||||
}
|
||||
|
||||
process {
|
||||
$ExistingVault = @($ProviderInfo.RegisteredVaults | Select-Object -First 1)
|
||||
$ExistingVaultParameters = @{}
|
||||
if($ExistingVault.Count -gt 0 -and $ExistingVault[0].PSObject.Properties["VaultParameters"] -and $ExistingVault[0].VaultParameters -is [System.Collections.IDictionary]){
|
||||
foreach($Key in $ExistingVault[0].VaultParameters.Keys){
|
||||
$ExistingVaultParameters[$Key] = $ExistingVault[0].VaultParameters[$Key]
|
||||
}
|
||||
}
|
||||
|
||||
$EffectiveVaultType = $VaultType
|
||||
if([string]::IsNullOrWhiteSpace($EffectiveVaultType) -and $ProviderInfo.ProviderSettings -is [System.Collections.IDictionary] -and $ProviderInfo.ProviderSettings.ContainsKey("VaultType")){
|
||||
$EffectiveVaultType = [string]$ProviderInfo.ProviderSettings.VaultType
|
||||
}
|
||||
|
||||
if([string]::IsNullOrWhiteSpace($EffectiveVaultType) -and $ExistingVault.Count -gt 0 -and $ExistingVault[0].PSObject.Properties["ModuleName"]){
|
||||
if([string]$ExistingVault[0].ModuleName -match "SecretManagement\.KeePass"){
|
||||
$EffectiveVaultType = "KeePass"
|
||||
}
|
||||
}
|
||||
|
||||
if([string]::IsNullOrWhiteSpace($EffectiveVaultType)){
|
||||
$EffectiveVaultType = "Generic"
|
||||
}
|
||||
|
||||
$EffectiveVaultParameters = @{}
|
||||
foreach($Key in $ExistingVaultParameters.Keys){
|
||||
$EffectiveVaultParameters[$Key] = $ExistingVaultParameters[$Key]
|
||||
}
|
||||
|
||||
foreach($Key in $VaultParameters.Keys){
|
||||
$EffectiveVaultParameters[$Key] = $VaultParameters[$Key]
|
||||
}
|
||||
|
||||
if(-not [string]::IsNullOrWhiteSpace($DatabasePath)){
|
||||
$EffectiveVaultParameters["Path"] = $DatabasePath
|
||||
}
|
||||
|
||||
if(-not [string]::IsNullOrWhiteSpace($KeyPath)){
|
||||
$EffectiveVaultParameters["KeyPath"] = $KeyPath
|
||||
}
|
||||
|
||||
if($DisableKeePassKeyFile){
|
||||
$EffectiveVaultParameters["KeyPath"] = $null
|
||||
}
|
||||
|
||||
if($UseMasterPassword -and $DisableMasterPassword){
|
||||
throw "Use either [UseMasterPassword] or [DisableMasterPassword], not both."
|
||||
}
|
||||
|
||||
foreach($SwitchName in @("UseMasterPassword", "UseWindowsAccount", "ShowFullTitle", "ShowRecycleBin", "SkipValidate")){
|
||||
if($PSBoundParameters.ContainsKey($SwitchName)){
|
||||
$EffectiveVaultParameters[$SwitchName] = [bool]$PSBoundParameters[$SwitchName]
|
||||
}
|
||||
}
|
||||
|
||||
if($DisableMasterPassword){
|
||||
$EffectiveVaultParameters["UseMasterPassword"] = $false
|
||||
}
|
||||
|
||||
if($PSCmdlet.ShouldProcess($Vault, "Update DSC configuration data credential provider settings")){
|
||||
$EffectiveMasterPasswordKeyPath = $MasterPasswordKeyPath
|
||||
if([string]::IsNullOrWhiteSpace($EffectiveMasterPasswordKeyPath) -and
|
||||
$ProviderInfo.ProviderSettings -is [System.Collections.IDictionary] -and
|
||||
$ProviderInfo.ProviderSettings.ContainsKey("MasterPassword") -and
|
||||
$ProviderInfo.ProviderSettings.MasterPassword -is [System.Collections.IDictionary] -and
|
||||
$ProviderInfo.ProviderSettings.MasterPassword.ContainsKey("KeyPath")){
|
||||
$EffectiveMasterPasswordKeyPath = [string]$ProviderInfo.ProviderSettings.MasterPassword.KeyPath
|
||||
}
|
||||
|
||||
$CommandParameters = @{
|
||||
Provider = $Provider
|
||||
Vault = $Vault
|
||||
VaultType = $EffectiveVaultType
|
||||
SettingsPath = $SettingsPath
|
||||
VaultParameters = $EffectiveVaultParameters
|
||||
Force = $Force
|
||||
PassThru = $true
|
||||
}
|
||||
|
||||
if(-not [string]::IsNullOrWhiteSpace($ModuleName)){
|
||||
$CommandParameters["ModuleName"] = $ModuleName
|
||||
}
|
||||
|
||||
if($RegisterVault){
|
||||
$CommandParameters["RegisterVault"] = $true
|
||||
}
|
||||
|
||||
if($DefaultVault){
|
||||
$CommandParameters["DefaultVault"] = $true
|
||||
}
|
||||
|
||||
if($AllowClobber){
|
||||
$CommandParameters["AllowClobber"] = $true
|
||||
}
|
||||
|
||||
if($null -ne $MasterPassword){
|
||||
$CommandParameters["MasterPassword"] = $MasterPassword
|
||||
}
|
||||
|
||||
if(-not [string]::IsNullOrWhiteSpace($EffectiveMasterPasswordKeyPath)){
|
||||
$CommandParameters["MasterPasswordKeyPath"] = $EffectiveMasterPasswordKeyPath
|
||||
}
|
||||
|
||||
$Result = Register-DSCConfigurationDataCredentialProvider @CommandParameters
|
||||
}
|
||||
|
||||
if($PassThru){
|
||||
if($null -ne $Result){
|
||||
return $Result
|
||||
}
|
||||
|
||||
return (Get-DSCConfigurationDataCredentialProvider -Provider $Provider -Vault $Vault -SettingsPath $SettingsPath)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -5,10 +5,6 @@ function Unregister-DSCConfigurationDataCredentialProvider {
|
||||
[string]
|
||||
$Vault,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$KeyPath,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$SettingsPath,
|
||||
@@ -17,18 +13,10 @@ function Unregister-DSCConfigurationDataCredentialProvider {
|
||||
[switch]
|
||||
$RemoveSettings,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$RemoveKeyFile,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$UnregisterVault,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$ResetSecretStore,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$Force,
|
||||
@@ -86,9 +74,7 @@ function Unregister-DSCConfigurationDataCredentialProvider {
|
||||
Vault = $Vault
|
||||
SettingsPath = $SettingsPath
|
||||
RemovedSettings = $false
|
||||
RemovedKeyFile = $false
|
||||
UnregisteredVault = $false
|
||||
ResetSecretStore = $false
|
||||
}
|
||||
|
||||
if($RemoveSettings -or (-not $PSBoundParameters.ContainsKey("RemoveSettings"))){
|
||||
@@ -100,38 +86,10 @@ function Unregister-DSCConfigurationDataCredentialProvider {
|
||||
}
|
||||
}
|
||||
|
||||
if($RemoveKeyFile){
|
||||
if([string]::IsNullOrWhiteSpace($KeyPath)){
|
||||
throw "RemoveKeyFile requires [KeyPath]."
|
||||
}
|
||||
|
||||
if(Test-Path -Path $KeyPath -PathType Leaf){
|
||||
if($PSCmdlet.ShouldProcess($KeyPath, "Remove provider key file")){
|
||||
Remove-Item -Path $KeyPath -Force:$Force
|
||||
$Result.RemovedKeyFile = $true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if($UnregisterVault){
|
||||
if($Provider -notin @("SecretManagement", "SecretStore")){
|
||||
Write-Verbose "Provider [$Provider] does not register a SecretManagement vault."
|
||||
}else{
|
||||
if($PSCmdlet.ShouldProcess($Vault, "Unregister SecretManagement vault")){
|
||||
Unregister-SecretVault -Name $Vault
|
||||
$Result.UnregisteredVault = $true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if($ResetSecretStore){
|
||||
if($Provider -ne "SecretStore"){
|
||||
Write-Verbose "ResetSecretStore is only applicable to provider [SecretStore]."
|
||||
}else{
|
||||
if($PSCmdlet.ShouldProcess("SecretStore", "Reset local SecretStore and delete all contained secrets")){
|
||||
Reset-SecretStore -Force -Confirm:$false
|
||||
$Result.ResetSecretStore = $true
|
||||
}
|
||||
if($PSCmdlet.ShouldProcess($Vault, "Unregister SecretManagement vault")){
|
||||
Unregister-SecretVault -Name $Vault
|
||||
$Result.UnregisteredVault = $true
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user