45e71c093c
- Removed KeePass and SecretStore provider implementations. - Integrated KeePass and SecretStore as vaults under the SecretManagement provider. - Added new functions: Get-DSCConfigurationDataCredentialProvider and Set-DSCConfigurationDataCredentialProvider for managing credential providers. - Implemented Unlock-ConfigurationDataSecretManagementVault to handle vault unlocking with master passwords. - Updated README to reflect changes in provider usage and examples. - Enhanced error handling and validation for vault registration and settings.
50 lines
1.9 KiB
PowerShell
50 lines
1.9 KiB
PowerShell
function Unlock-ConfigurationDataSecretManagementVault {
|
|
[CmdletBinding()]
|
|
Param(
|
|
[Parameter(Mandatory=$false)]
|
|
[hashtable]
|
|
$ProviderSettings = @{}
|
|
)
|
|
|
|
if(-not $ProviderSettings.ContainsKey("SecretManagement")){
|
|
return
|
|
}
|
|
|
|
$SecretManagementSettings = $ProviderSettings.SecretManagement
|
|
if(-not ($SecretManagementSettings -is [System.Collections.IDictionary])){
|
|
return
|
|
}
|
|
|
|
if(-not (Test-ConfigurationDataMapContainsKey -Map $SecretManagementSettings -Key "MasterPassword")){
|
|
return
|
|
}
|
|
|
|
$Vault = [string](Get-ConfigurationDataMapValue -Map $SecretManagementSettings -Key "DefaultVault" -DefaultValue "")
|
|
if([string]::IsNullOrWhiteSpace($Vault)){
|
|
throw "SecretManagement provider settings define [MasterPassword], but [DefaultVault] is not defined."
|
|
}
|
|
|
|
$UnlockSecretVaultCommand = Get-Command -Name Unlock-SecretVault -ErrorAction SilentlyContinue
|
|
if($null -eq $UnlockSecretVaultCommand){
|
|
throw "Command [Unlock-SecretVault] was not found. Install module [Microsoft.PowerShell.SecretManagement]."
|
|
}
|
|
|
|
$MasterPassword = Resolve-ConfigurationDataProviderSecureString -Value $SecretManagementSettings.MasterPassword
|
|
& $UnlockSecretVaultCommand -Name $Vault -Password $MasterPassword
|
|
|
|
$TestSecretVaultCommand = Get-Command -Name Test-SecretVault -ErrorAction SilentlyContinue
|
|
if($null -ne $TestSecretVaultCommand){
|
|
$IsUnlocked = $false
|
|
try {
|
|
$IsUnlocked = [bool](& $TestSecretVaultCommand -Name $Vault -ErrorAction Stop)
|
|
}
|
|
catch {
|
|
throw "SecretManagement vault [$Vault] could not be unlocked. $($_.Exception.Message)"
|
|
}
|
|
|
|
if(-not $IsUnlocked){
|
|
throw "SecretManagement vault [$Vault] could not be unlocked. Verify the KeePass database path, KeePass key file, and protected master password in the provider settings."
|
|
}
|
|
}
|
|
}
|