Refactor secret management providers and introduce unified handling

- Removed KeePass and SecretStore provider implementations. - Integrated KeePass and SecretStore as vaults under the SecretManagement provider. - Added new functions: Get-DSCConfigurationDataCredentialProvider and Set-DSCConfigurationDataCredentialProvider for managing credential providers. - Implemented Unlock-ConfigurationDataSecretManagementVault to handle vault unlocking with master passwords. - Updated README to reflect changes in provider usage and examples. - Enhanced error handling and validation for vault registration and settings.
2026-07-06 22:50:39 +02:00
parent 3fa52d7ada
commit 45e71c093c
12 changed files with 608 additions and 550 deletions
--- a/Public/Get-DSCConfigurationDataCredentialProvider.ps1
+++ b/Public/Get-DSCConfigurationDataCredentialProvider.ps1
@@ -0,0 +1,119 @@
+function Get-DSCConfigurationDataCredentialProvider {
+    [CmdletBinding()]
+    Param(
+        [Parameter(Mandatory=$false)]
+        [string]
+        $Vault,
+
+        [Parameter(Mandatory=$false)]
+        [string]
+        $SettingsPath,
+
+        [Parameter(Mandatory=$false)]
+        [switch]
+        $TestVault
+    )
+
+    DynamicParam {
+        $ProviderNames = @(Get-ConfigurationDataSecretProviderName)
+        if($ProviderNames.Count -eq 0){
+            $ProviderNames = @("__NoProvidersRegistered__")
+        }
+
+        $ParameterAttribute = [System.Management.Automation.ParameterAttribute]::new()
+        $ParameterAttribute.Mandatory = $false
+        $ParameterAttribute.Position = 0
+
+        $ValidateSetAttribute = New-Object System.Management.Automation.ValidateSetAttribute -ArgumentList (,[string[]]$ProviderNames)
+        $Attributes = [System.Collections.ObjectModel.Collection[System.Attribute]]::new()
+        $Attributes.Add($ParameterAttribute)
+        $Attributes.Add($ValidateSetAttribute)
+
+        $RuntimeParameter = [System.Management.Automation.RuntimeDefinedParameter]::new(
+            "Provider",
+            [string],
+            $Attributes
+        )
+
+        $Dictionary = [System.Management.Automation.RuntimeDefinedParameterDictionary]::new()
+        $Dictionary.Add("Provider", $RuntimeParameter)
+        return $Dictionary
+    }
+
+    begin {
+        $Provider = [string]$PSBoundParameters["Provider"]
+        if([string]::IsNullOrWhiteSpace($Provider)){
+            $ProviderNames = @(Get-ConfigurationDataSecretProviderName)
+            if($ProviderNames.Count -eq 1){
+                $Provider = $ProviderNames[0]
+            }elseif($ProviderNames.Count -eq 0){
+                throw "No configuration data secret providers are registered."
+            }else{
+                throw "Provider is required. Registered providers: $($ProviderNames -join ', ')."
+            }
+        }
+
+        $ResolvedSettingsPath = Resolve-ConfigurationDataProviderSettingsPath -Provider $Provider -SettingsPath $SettingsPath
+    }
+
+    process {
+        $Settings = @{}
+        $SettingsExists = Test-Path -LiteralPath $ResolvedSettingsPath -PathType Leaf
+        if($SettingsExists){
+            $Settings = Import-PowerShellDataFile -LiteralPath $ResolvedSettingsPath
+        }
+
+        $ProviderSettings = @{}
+        if($Settings -is [System.Collections.IDictionary] -and $Settings.ContainsKey($Provider)){
+            $ProviderSettings = $Settings[$Provider]
+        }
+
+        $DefaultVault = ""
+        if($ProviderSettings -is [System.Collections.IDictionary] -and $ProviderSettings.ContainsKey("DefaultVault")){
+            $DefaultVault = [string]$ProviderSettings.DefaultVault
+        }
+
+        if([string]::IsNullOrWhiteSpace($Vault)){
+            $Vault = $DefaultVault
+        }
+
+        $Vaults = @()
+        $GetSecretVaultCommand = Get-Command -Name Get-SecretVault -ErrorAction SilentlyContinue
+        if($null -ne $GetSecretVaultCommand){
+            if([string]::IsNullOrWhiteSpace($Vault)){
+                $Vaults = @(& $GetSecretVaultCommand)
+            }else{
+                $Vaults = @(& $GetSecretVaultCommand -Name $Vault -ErrorAction SilentlyContinue)
+            }
+        }
+
+        $TestResult = $null
+        $TestError = $null
+        if($TestVault -and -not [string]::IsNullOrWhiteSpace($Vault)){
+            $TestSecretVaultCommand = Get-Command -Name Test-SecretVault -ErrorAction SilentlyContinue
+            if($null -eq $TestSecretVaultCommand){
+                $TestError = "Command [Test-SecretVault] was not found."
+            }else{
+                try {
+                    $TestResult = [bool](& $TestSecretVaultCommand -Name $Vault -ErrorAction Stop)
+                }
+                catch {
+                    $TestResult = $false
+                    $TestError = $_.Exception.Message
+                }
+            }
+        }
+
+        [PSCustomObject]@{
+            Provider = $Provider
+            SettingsPath = $ResolvedSettingsPath
+            SettingsExists = $SettingsExists
+            DefaultVault = $DefaultVault
+            RequestedVault = $Vault
+            ProviderSettings = $ProviderSettings
+            RegisteredVaults = $Vaults
+            TestVault = $TestResult
+            TestError = $TestError
+        }
+    }
+}