Refactor secret management providers and introduce unified handling
- Removed KeePass and SecretStore provider implementations. - Integrated KeePass and SecretStore as vaults under the SecretManagement provider. - Added new functions: Get-DSCConfigurationDataCredentialProvider and Set-DSCConfigurationDataCredentialProvider for managing credential providers. - Implemented Unlock-ConfigurationDataSecretManagementVault to handle vault unlocking with master passwords. - Updated README to reflect changes in provider usage and examples. - Enhanced error handling and validation for vault registration and settings.
This commit is contained in:
Torsten Brendgen
258
Public/Set-DSCConfigurationDataCredentialProvider.ps1
Normal file
258
Public/Set-DSCConfigurationDataCredentialProvider.ps1
Normal file
@@ -0,0 +1,258 @@
|
||||
function Set-DSCConfigurationDataCredentialProvider {
|
||||
[CmdletBinding(SupportsShouldProcess=$true)]
|
||||
Param(
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$Vault,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[AllowEmptyString()]
|
||||
[ValidateSet("", "Generic", "KeePass")]
|
||||
[string]
|
||||
$VaultType = "",
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$DatabasePath,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$KeyPath,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$DisableKeePassKeyFile,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$ModuleName,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[hashtable]
|
||||
$VaultParameters = @{},
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$RegisterVault,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$DefaultVault,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$AllowClobber,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[Alias("UseMasterKey")]
|
||||
[switch]
|
||||
$UseMasterPassword,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[Alias("NoMasterKey", "NoMasterPassword")]
|
||||
[switch]
|
||||
$DisableMasterPassword,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[Alias("MasterKey")]
|
||||
[System.Security.SecureString]
|
||||
$MasterPassword,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[Alias("MasterKeyPath")]
|
||||
[string]
|
||||
$MasterPasswordKeyPath,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$UseWindowsAccount,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$ShowFullTitle,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$ShowRecycleBin,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$SkipValidate,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[string]
|
||||
$SettingsPath,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$Force,
|
||||
|
||||
[Parameter(Mandatory=$false)]
|
||||
[switch]
|
||||
$PassThru
|
||||
)
|
||||
|
||||
DynamicParam {
|
||||
$ProviderNames = @(Get-ConfigurationDataSecretProviderName)
|
||||
if($ProviderNames.Count -eq 0){
|
||||
$ProviderNames = @("__NoProvidersRegistered__")
|
||||
}
|
||||
|
||||
$ParameterAttribute = [System.Management.Automation.ParameterAttribute]::new()
|
||||
$ParameterAttribute.Mandatory = $false
|
||||
$ParameterAttribute.Position = 0
|
||||
|
||||
$ValidateSetAttribute = New-Object System.Management.Automation.ValidateSetAttribute -ArgumentList (,[string[]]$ProviderNames)
|
||||
$Attributes = [System.Collections.ObjectModel.Collection[System.Attribute]]::new()
|
||||
$Attributes.Add($ParameterAttribute)
|
||||
$Attributes.Add($ValidateSetAttribute)
|
||||
|
||||
$RuntimeParameter = [System.Management.Automation.RuntimeDefinedParameter]::new(
|
||||
"Provider",
|
||||
[string],
|
||||
$Attributes
|
||||
)
|
||||
|
||||
$Dictionary = [System.Management.Automation.RuntimeDefinedParameterDictionary]::new()
|
||||
$Dictionary.Add("Provider", $RuntimeParameter)
|
||||
return $Dictionary
|
||||
}
|
||||
|
||||
begin {
|
||||
$Provider = [string]$PSBoundParameters["Provider"]
|
||||
if([string]::IsNullOrWhiteSpace($Provider)){
|
||||
$ProviderNames = @(Get-ConfigurationDataSecretProviderName)
|
||||
if($ProviderNames.Count -eq 1){
|
||||
$Provider = $ProviderNames[0]
|
||||
}elseif($ProviderNames.Count -eq 0){
|
||||
throw "No configuration data secret providers are registered."
|
||||
}else{
|
||||
throw "Provider is required. Registered providers: $($ProviderNames -join ', ')."
|
||||
}
|
||||
}
|
||||
|
||||
$ProviderInfo = Get-DSCConfigurationDataCredentialProvider -Provider $Provider -Vault $Vault -SettingsPath $SettingsPath
|
||||
if([string]::IsNullOrWhiteSpace($Vault)){
|
||||
$Vault = [string]$ProviderInfo.DefaultVault
|
||||
}
|
||||
|
||||
if([string]::IsNullOrWhiteSpace($Vault)){
|
||||
throw "Vault is required. Pass [Vault] or define [DefaultVault] in the provider settings file."
|
||||
}
|
||||
}
|
||||
|
||||
process {
|
||||
$ExistingVault = @($ProviderInfo.RegisteredVaults | Select-Object -First 1)
|
||||
$ExistingVaultParameters = @{}
|
||||
if($ExistingVault.Count -gt 0 -and $ExistingVault[0].PSObject.Properties["VaultParameters"] -and $ExistingVault[0].VaultParameters -is [System.Collections.IDictionary]){
|
||||
foreach($Key in $ExistingVault[0].VaultParameters.Keys){
|
||||
$ExistingVaultParameters[$Key] = $ExistingVault[0].VaultParameters[$Key]
|
||||
}
|
||||
}
|
||||
|
||||
$EffectiveVaultType = $VaultType
|
||||
if([string]::IsNullOrWhiteSpace($EffectiveVaultType) -and $ProviderInfo.ProviderSettings -is [System.Collections.IDictionary] -and $ProviderInfo.ProviderSettings.ContainsKey("VaultType")){
|
||||
$EffectiveVaultType = [string]$ProviderInfo.ProviderSettings.VaultType
|
||||
}
|
||||
|
||||
if([string]::IsNullOrWhiteSpace($EffectiveVaultType) -and $ExistingVault.Count -gt 0 -and $ExistingVault[0].PSObject.Properties["ModuleName"]){
|
||||
if([string]$ExistingVault[0].ModuleName -match "SecretManagement\.KeePass"){
|
||||
$EffectiveVaultType = "KeePass"
|
||||
}
|
||||
}
|
||||
|
||||
if([string]::IsNullOrWhiteSpace($EffectiveVaultType)){
|
||||
$EffectiveVaultType = "Generic"
|
||||
}
|
||||
|
||||
$EffectiveVaultParameters = @{}
|
||||
foreach($Key in $ExistingVaultParameters.Keys){
|
||||
$EffectiveVaultParameters[$Key] = $ExistingVaultParameters[$Key]
|
||||
}
|
||||
|
||||
foreach($Key in $VaultParameters.Keys){
|
||||
$EffectiveVaultParameters[$Key] = $VaultParameters[$Key]
|
||||
}
|
||||
|
||||
if(-not [string]::IsNullOrWhiteSpace($DatabasePath)){
|
||||
$EffectiveVaultParameters["Path"] = $DatabasePath
|
||||
}
|
||||
|
||||
if(-not [string]::IsNullOrWhiteSpace($KeyPath)){
|
||||
$EffectiveVaultParameters["KeyPath"] = $KeyPath
|
||||
}
|
||||
|
||||
if($DisableKeePassKeyFile){
|
||||
$EffectiveVaultParameters["KeyPath"] = $null
|
||||
}
|
||||
|
||||
if($UseMasterPassword -and $DisableMasterPassword){
|
||||
throw "Use either [UseMasterPassword] or [DisableMasterPassword], not both."
|
||||
}
|
||||
|
||||
foreach($SwitchName in @("UseMasterPassword", "UseWindowsAccount", "ShowFullTitle", "ShowRecycleBin", "SkipValidate")){
|
||||
if($PSBoundParameters.ContainsKey($SwitchName)){
|
||||
$EffectiveVaultParameters[$SwitchName] = [bool]$PSBoundParameters[$SwitchName]
|
||||
}
|
||||
}
|
||||
|
||||
if($DisableMasterPassword){
|
||||
$EffectiveVaultParameters["UseMasterPassword"] = $false
|
||||
}
|
||||
|
||||
if($PSCmdlet.ShouldProcess($Vault, "Update DSC configuration data credential provider settings")){
|
||||
$EffectiveMasterPasswordKeyPath = $MasterPasswordKeyPath
|
||||
if([string]::IsNullOrWhiteSpace($EffectiveMasterPasswordKeyPath) -and
|
||||
$ProviderInfo.ProviderSettings -is [System.Collections.IDictionary] -and
|
||||
$ProviderInfo.ProviderSettings.ContainsKey("MasterPassword") -and
|
||||
$ProviderInfo.ProviderSettings.MasterPassword -is [System.Collections.IDictionary] -and
|
||||
$ProviderInfo.ProviderSettings.MasterPassword.ContainsKey("KeyPath")){
|
||||
$EffectiveMasterPasswordKeyPath = [string]$ProviderInfo.ProviderSettings.MasterPassword.KeyPath
|
||||
}
|
||||
|
||||
$CommandParameters = @{
|
||||
Provider = $Provider
|
||||
Vault = $Vault
|
||||
VaultType = $EffectiveVaultType
|
||||
SettingsPath = $SettingsPath
|
||||
VaultParameters = $EffectiveVaultParameters
|
||||
Force = $Force
|
||||
PassThru = $true
|
||||
}
|
||||
|
||||
if(-not [string]::IsNullOrWhiteSpace($ModuleName)){
|
||||
$CommandParameters["ModuleName"] = $ModuleName
|
||||
}
|
||||
|
||||
if($RegisterVault){
|
||||
$CommandParameters["RegisterVault"] = $true
|
||||
}
|
||||
|
||||
if($DefaultVault){
|
||||
$CommandParameters["DefaultVault"] = $true
|
||||
}
|
||||
|
||||
if($AllowClobber){
|
||||
$CommandParameters["AllowClobber"] = $true
|
||||
}
|
||||
|
||||
if($null -ne $MasterPassword){
|
||||
$CommandParameters["MasterPassword"] = $MasterPassword
|
||||
}
|
||||
|
||||
if(-not [string]::IsNullOrWhiteSpace($EffectiveMasterPasswordKeyPath)){
|
||||
$CommandParameters["MasterPasswordKeyPath"] = $EffectiveMasterPasswordKeyPath
|
||||
}
|
||||
|
||||
$Result = Register-DSCConfigurationDataCredentialProvider @CommandParameters
|
||||
}
|
||||
|
||||
if($PassThru){
|
||||
if($null -ne $Result){
|
||||
return $Result
|
||||
}
|
||||
|
||||
return (Get-DSCConfigurationDataCredentialProvider -Provider $Provider -Vault $Vault -SettingsPath $SettingsPath)
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user