Add Azure Key Vault support and enhance credential handling in configuration data

2026-07-03 10:34:25 +02:00
parent 9b36693444
commit 943894b8fe
8 changed files with 453 additions and 3 deletions
--- a/Providers/Provider.AzureKeyVault.ps1
+++ b/Providers/Provider.AzureKeyVault.ps1
@@ -0,0 +1,94 @@
+$AzureKeyVaultProvider = @{
+    Name = "AzureKeyVault"
+    SupportedTypes = @(
+        "credential",
+        "securestring",
+        "string"
+    )
+    Resolver = {
+        Param(
+            [Parameter(Mandatory=$true)]
+            [System.Collections.IDictionary]
+            $Reference,
+
+            [Parameter(Mandatory=$true)]
+            [ValidateSet("credential", "securestring", "string")]
+            [string]
+            $ExpectedType,
+
+            [Parameter(Mandatory=$false)]
+            [hashtable]
+            $ProviderSettings = @{}
+        )
+
+        $GetSecretCommand = Get-Command -Name Get-AzKeyVaultSecret -ErrorAction SilentlyContinue
+        if($null -eq $GetSecretCommand){
+            throw "AzureKeyVault provider requires the module [Az.KeyVault] and command [Get-AzKeyVaultSecret]."
+        }
+
+        $Vault = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Vault" -DefaultValue "")
+        $Name = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Name")
+        $UserName = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "UserName" -DefaultValue "")
+        $Options = Get-ConfigurationDataMapValue -Map $Reference -Key "Options" -DefaultValue @{}
+
+        if([string]::IsNullOrWhiteSpace($Vault) -and $ProviderSettings.ContainsKey("DefaultVault")){
+            $Vault = [string]$ProviderSettings.DefaultVault
+        }
+
+        if([string]::IsNullOrWhiteSpace($Vault)){
+            throw "AzureKeyVault secret [$Name] requires [Vault] or provider setting [DefaultVault]."
+        }
+
+        if($ProviderSettings.ContainsKey("SubscriptionId") -or $ProviderSettings.ContainsKey("TenantId")){
+            $SetContextCommand = Get-Command -Name Set-AzContext -ErrorAction SilentlyContinue
+            if($null -eq $SetContextCommand){
+                throw "AzureKeyVault provider settings define Azure context values, but command [Set-AzContext] was not found. Install [Az.Accounts] or remove SubscriptionId/TenantId from provider settings."
+            }
+
+            $ContextParameters = @{}
+            if($ProviderSettings.ContainsKey("SubscriptionId") -and -not [string]::IsNullOrWhiteSpace([string]$ProviderSettings.SubscriptionId)){
+                $ContextParameters["SubscriptionId"] = [string]$ProviderSettings.SubscriptionId
+            }
+
+            if($ProviderSettings.ContainsKey("TenantId") -and -not [string]::IsNullOrWhiteSpace([string]$ProviderSettings.TenantId)){
+                $ContextParameters["Tenant"] = [string]$ProviderSettings.TenantId
+            }
+
+            if($ContextParameters.Count -gt 0){
+                & $SetContextCommand @ContextParameters | Out-Null
+            }
+        }
+
+        $CommandParameters = @{
+            VaultName = $Vault
+            Name = $Name
+        }
+
+        if($Options -is [System.Collections.IDictionary]){
+            foreach($Key in $Options.Keys){
+                $CommandParameters[$Key] = $Options[$Key]
+            }
+        }
+
+        if($ExpectedType -eq "string" -and $GetSecretCommand.Parameters.ContainsKey("AsPlainText") -and -not $CommandParameters.ContainsKey("AsPlainText")){
+            $CommandParameters["AsPlainText"] = $true
+        }
+
+        $Secret = & $GetSecretCommand @CommandParameters
+        if($null -eq $Secret){
+            throw "Azure Key Vault secret [$Name] was not found in vault [$Vault]."
+        }
+
+        if($ExpectedType -eq "string" -and $Secret -is [string]){
+            return $Secret
+        }
+
+        if($Secret.PSObject.Properties["SecretValue"]){
+            return ConvertFrom-ConfigurationDataSecretValue -Secret $Secret.SecretValue -ExpectedType $ExpectedType -Name $Name -UserName $UserName
+        }
+
+        return ConvertFrom-ConfigurationDataSecretValue -Secret $Secret -ExpectedType $ExpectedType -Name $Name -UserName $UserName
+    }
+}
+
+Register-ConfigurationDataSecretProvider @AzureKeyVaultProvider