Refactor secret management providers and introduce unified handling

- Removed KeePass and SecretStore provider implementations.
- Integrated KeePass and SecretStore as vaults under the SecretManagement provider.
- Added new functions: Get-DSCConfigurationDataCredentialProvider and Set-DSCConfigurationDataCredentialProvider for managing credential providers.
- Implemented Unlock-ConfigurationDataSecretManagementVault to handle vault unlocking with master passwords.
- Updated README to reflect changes in provider usage and examples.
- Enhanced error handling and validation for vault registration and settings.
This commit is contained in:
Torsten Brendgen
2026-07-06 22:50:39 +02:00
parent 3fa52d7ada
commit 45e71c093c
12 changed files with 608 additions and 550 deletions

View File

@@ -5,10 +5,6 @@ function Unregister-DSCConfigurationDataCredentialProvider {
[string]
$Vault,
[Parameter(Mandatory=$false)]
[string]
$KeyPath,
[Parameter(Mandatory=$false)]
[string]
$SettingsPath,
@@ -17,18 +13,10 @@ function Unregister-DSCConfigurationDataCredentialProvider {
[switch]
$RemoveSettings,
[Parameter(Mandatory=$false)]
[switch]
$RemoveKeyFile,
[Parameter(Mandatory=$false)]
[switch]
$UnregisterVault,
[Parameter(Mandatory=$false)]
[switch]
$ResetSecretStore,
[Parameter(Mandatory=$false)]
[switch]
$Force,
@@ -86,9 +74,7 @@ function Unregister-DSCConfigurationDataCredentialProvider {
Vault = $Vault
SettingsPath = $SettingsPath
RemovedSettings = $false
RemovedKeyFile = $false
UnregisteredVault = $false
ResetSecretStore = $false
}
if($RemoveSettings -or (-not $PSBoundParameters.ContainsKey("RemoveSettings"))){
@@ -100,38 +86,10 @@ function Unregister-DSCConfigurationDataCredentialProvider {
}
}
if($RemoveKeyFile){
if([string]::IsNullOrWhiteSpace($KeyPath)){
throw "RemoveKeyFile requires [KeyPath]."
}
if(Test-Path -Path $KeyPath -PathType Leaf){
if($PSCmdlet.ShouldProcess($KeyPath, "Remove provider key file")){
Remove-Item -Path $KeyPath -Force:$Force
$Result.RemovedKeyFile = $true
}
}
}
if($UnregisterVault){
if($Provider -notin @("SecretManagement", "SecretStore")){
Write-Verbose "Provider [$Provider] does not register a SecretManagement vault."
}else{
if($PSCmdlet.ShouldProcess($Vault, "Unregister SecretManagement vault")){
Unregister-SecretVault -Name $Vault
$Result.UnregisteredVault = $true
}
}
}
if($ResetSecretStore){
if($Provider -ne "SecretStore"){
Write-Verbose "ResetSecretStore is only applicable to provider [SecretStore]."
}else{
if($PSCmdlet.ShouldProcess("SecretStore", "Reset local SecretStore and delete all contained secrets")){
Reset-SecretStore -Force -Confirm:$false
$Result.ResetSecretStore = $true
}
if($PSCmdlet.ShouldProcess($Vault, "Unregister SecretManagement vault")){
Unregister-SecretVault -Name $Vault
$Result.UnregisteredVault = $true
}
}