Merge pull request #67 from Keyfactor/release-3.1

spbsoluble · web-flow · commit 89b726508ef4 · 2025-10-01T13:47:33.000-07:00
Release 3.1.9
diff --git a/AzureKeyVault/AkvProperties.cs b/AzureKeyVault/AkvProperties.cs
@@ -45,7 +45,7 @@ internal protected string VaultEndpoint
                 {
                     return PrivateEndpoint.TrimStart('.');
                 }
-                switch (AzureCloud)
+                switch (AzureCloud?.Trim()?.ToLowerInvariant())
                 {
                     case "china":
                         return "vault.azure.cn";
@@ -58,6 +58,6 @@ internal protected string VaultEndpoint
                 }
             }
         }
-        internal protected string VaultURL => $"https://{VaultName}.{VaultEndpoint}/";
+        public string VaultURL => $"https://{VaultName}.{VaultEndpoint}/";
     }
 }
diff --git a/AzureKeyVault/AzureClient.cs b/AzureKeyVault/AzureClient.cs
@@ -17,13 +17,11 @@
 using Azure.ResourceManager.KeyVault;
 using Azure.ResourceManager.KeyVault.Models;
 using Azure.ResourceManager.Resources;
-using Azure.ResourceManager.Resources.Models;
 using Azure.Security.KeyVault.Certificates;
 using Keyfactor.Logging;
 using Keyfactor.Orchestrators.Common.Enums;
 using Keyfactor.Orchestrators.Extensions;
 using Microsoft.Extensions.Logging;
-using Newtonsoft.Json;
 
 namespace Keyfactor.Extensions.Orchestrator.AzureKeyVault
 {
@@ -34,16 +32,19 @@ private Uri AzureCloudEndpoint
         {
             get
             {
-                switch (VaultProperties.AzureCloud?.ToLower())
+                logger.LogTrace($"the AzureCloud is {VaultProperties.AzureCloud}, so we will use the following endpoint for authentication: ");
+                switch (VaultProperties.AzureCloud?.Trim()?.ToLowerInvariant())
                 {
-
                     case "china":
+                        logger.LogTrace(AzureAuthorityHosts.AzureChina.ToString());
                         return AzureAuthorityHosts.AzureChina;
                     //case "germany":
                     //    return AzureAuthorityHosts.AzureGermany; // germany is no longer a valid azure authority host as of 2021
                     case "government":
+                        logger.LogTrace(AzureAuthorityHosts.AzureGovernment.ToString());
                         return AzureAuthorityHosts.AzureGovernment;
                     default:
+                        logger.LogTrace(AzureAuthorityHosts.AzurePublicCloud.ToString());
                         return AzureAuthorityHosts.AzurePublicCloud;
                 }
             }
@@ -94,6 +95,8 @@ internal protected virtual ArmClient getArmClient(string tenantId)
         {
             TokenCredential credential;
             var credentialOptions = new DefaultAzureCredentialOptions { AuthorityHost = AzureCloudEndpoint, AdditionallyAllowedTenants = { "*" } };
+            logger.LogTrace($"creating an ARM client for management operations with authorityhost {AzureCloudEndpoint.ToString()}");
+
             if (this.VaultProperties.UseAzureManagedIdentity)
             {
                 logger.LogTrace("getting management client for a managed identity");
@@ -196,7 +199,7 @@ public virtual async Task<KeyVaultResource> CreateVault()
             }
         }
 
-        public virtual async Task<KeyVaultCertificateWithPolicy> ImportCertificateAsync(string certName, string contents, string pfxPassword, string tags = null)
+        public virtual async Task<KeyVaultCertificateWithPolicy> ImportCertificateAsync(string certName, string contents, string pfxPassword, Dictionary<string,string> tags)
         {
             try
             {
@@ -217,25 +220,14 @@ public virtual async Task<KeyVaultCertificateWithPolicy> ImportCertificateAsync(
 
                 logger.LogTrace($"calling ImportCertificateAsync on the KeyVault certificate client to import certificate {certName}");
 
-                var tagDict = new Dictionary<string, string>();
+                var options = new ImportCertificateOptions(certName, p12bytes);
 
-                if (!string.IsNullOrEmpty(tags))
+                if (tags.Any())
                 {
-                    if (!tags.IsValidJson())
+                    foreach (var tag in tags)
                     {
-                        logger.LogError($"the entry parameter provided for Certificate Tags: \" {tags} \", does not seem to be valid JSON.");
-                        throw new Exception($"the string \" {tags} \" is not a valid json string. Please enter a valid json string for CertificateTags in the entry parameter or leave empty for no tags to be applied.");
+                        options.Tags.Add(tag);
                     }
-                    logger.LogTrace($"converting the json value provided for tags into a Dictionary<string,string>");
-                    tagDict = JsonConvert.DeserializeObject<Dictionary<string, string>>(tags);
-                    logger.LogTrace($"{tagDict.Count} tag(s) will be associated with the certificate in Azure KeyVault");
-                }
-
-                var options = new ImportCertificateOptions(certName, p12bytes);
-
-                foreach (var tag in tagDict.Keys)
-                {
-                    options.Tags.Add(tag, tagDict[tag]);
                 }
 
                 var cert = await CertClient.ImportCertificateAsync(options);
@@ -396,9 +388,9 @@ public virtual (List<string>, List<string>) GetVaults()
                 var warning = $"Exception thrown performing discovery on tenantId {searchTenantId} and subscription ID {searchSubscription}.  Exception message: {ex.Message}";
 
                 logger.LogWarning(warning);
-                warnings.Add(warning);
-                //throw;
+                warnings.Add(warning);                
             }
+
             return (vaultNames, warnings);
         }
     }
diff --git a/AzureKeyVault/Constants.cs b/AzureKeyVault/Constants.cs
@@ -13,6 +13,11 @@ static class AzureKeyVaultConstants
         public const string STORE_TYPE_NAME = "AKV";
     }
 
+    static class EntryParameters {
+        public const string TAGS = "CertificateTags";
+        public const string PRESERVE_TAGS = "PreserveExistingTags";
+    }
+
     static class JobTypes
     {
         public const string CREATE = "Create";
diff --git a/AzureKeyVault/Jobs/AzureKeyVaultJob.cs b/AzureKeyVault/Jobs/AzureKeyVaultJob.cs
@@ -18,10 +18,8 @@ namespace Keyfactor.Extensions.Orchestrator.AzureKeyVault
     public abstract class AzureKeyVaultJob<T> : IOrchestratorJobExtension
     {
         public string ExtensionName => AzureKeyVaultConstants.STORE_TYPE_NAME;
-
         internal protected virtual AzureClient AzClient { get; set; }
         internal protected virtual AkvProperties VaultProperties { get; set; }
-
         internal protected IPAMSecretResolver PamSecretResolver { get; set; }
         internal protected ILogger logger { get; set; }
 
@@ -96,12 +94,15 @@ public void InitializeStore(dynamic config)
                     VaultProperties.SubscriptionId = properties.SubscriptionId ?? VaultProperties.SubscriptionId;
                     VaultProperties.ResourceGroupName = !string.IsNullOrEmpty(properties.ResourceGroupName as string) ? properties.ResourceGroupName : VaultProperties.ResourceGroupName;
                     VaultProperties.VaultName = properties.VaultName ?? VaultProperties.VaultName; // check the field in case of legacy paths.                    
+                    
                     VaultProperties.TenantId = !string.IsNullOrEmpty(VaultProperties.TenantId) ? VaultProperties.TenantId : config.CertificateStoreDetails?.ClientMachine; // Client Machine could be null in the case of managed identity.  That's ok.
-                    VaultProperties.AzureCloud = !string.IsNullOrEmpty(properties.AzureCloud as string) ? properties.AzureCloud : VaultProperties.AzureCloud;
-                    VaultProperties.PrivateEndpoint = !string.IsNullOrEmpty(properties.PrivateEndpoint as string) ? properties.PrivateEndpoint : VaultProperties.PrivateEndpoint;
-
+                    VaultProperties.AzureCloud = properties.AzureCloud;
+                    logger.LogTrace($"Azure Cloud: {VaultProperties.AzureCloud}");
+                    VaultProperties.PrivateEndpoint = properties.PrivateEndpoint;
+                    logger.LogTrace($"Private Endpoint: {VaultProperties.PrivateEndpoint}");
                     string skuType = !string.IsNullOrEmpty(properties.SkuType as string) ? properties.SkuType : null;
                     VaultProperties.PremiumSKU = skuType?.ToLower() == "premium";
+                    
                     VaultProperties.VaultRegion = !string.IsNullOrEmpty(properties.VaultRegion as string) ? properties.VaultRegion : VaultProperties.VaultRegion;
                     VaultProperties.VaultRegion = VaultProperties.VaultRegion?.ToLower();
                 }
diff --git a/AzureKeyVault/Jobs/Inventory.cs b/AzureKeyVault/Jobs/Inventory.cs
@@ -40,7 +40,7 @@ public JobResult ProcessJob(InventoryJobConfiguration config, SubmitInventoryUpd
 
                 inventoryItems = AzClient.GetCertificatesAsync().Result?.ToList();
 
-                logger.LogTrace($"Found {inventoryItems.Count()} Total Certificates in Azure Key Vault.");
+                logger.LogTrace($"Found {inventoryItems.Count} Total Certificates in Azure Key Vault.");
             }
 
             catch (Exception ex)
diff --git a/AzureKeyVault/Jobs/Management.cs b/AzureKeyVault/Jobs/Management.cs
@@ -15,6 +15,8 @@
 using Keyfactor.Orchestrators.Extensions;
 using Microsoft.Extensions.Logging;
 using Keyfactor.Orchestrators.Extensions.Interfaces;
+using System.Collections.Generic;
+using Newtonsoft.Json;
 
 namespace Keyfactor.Extensions.Orchestrator.AzureKeyVault
 {
@@ -38,8 +40,18 @@ public JobResult ProcessJob(ManagementJobConfiguration config)
                 Result = OrchestratorJobStatusJobResult.Failure,
                 FailureMessage = "Invalid Management Operation"
             };
+            object tagsObj;
+            object preserveTagsObj;
+            string tagsJSON;
+            bool preserveTags;
 
-            var tagsJSON = config.JobProperties["CertificateTags"]?.ToString();
+            config.JobProperties.TryGetValue("CertificateTags", out tagsObj);
+
+            config.JobProperties.TryGetValue(EntryParameters.PRESERVE_TAGS, out preserveTagsObj);
+
+            preserveTags = (bool)preserveTagsObj;
+
+            tagsJSON = tagsObj as string;
 
             switch (config.OperationType)
             {
@@ -49,8 +61,8 @@ public JobResult ProcessJob(ManagementJobConfiguration config)
                     break;
                 case CertStoreOperationType.Add:
                     logger.LogDebug($"Begin Management > Add...");
-                    
-                    complete = PerformAddition(config.JobCertificate.Alias, config.JobCertificate.PrivateKeyPassword, config.JobCertificate.Contents, tagsJSON, config.JobHistoryId, config.Overwrite);
+
+                    complete = PerformAddition(config.JobCertificate.Alias, config.JobCertificate.PrivateKeyPassword, config.JobCertificate.Contents, tagsJSON, config.JobHistoryId, config.Overwrite, preserveTags);
                     break;
                 case CertStoreOperationType.Remove:
                     logger.LogDebug($"Begin Management > Remove...");
@@ -92,10 +104,25 @@ protected async Task<JobResult> PerformCreateVault(long jobHistoryId)
         #endregion
 
         #region Add
-        protected virtual JobResult PerformAddition(string alias, string pfxPassword, string entryContents, string tagsJSON, long jobHistoryId, bool overwrite)
+        protected virtual JobResult PerformAddition(string alias, string pfxPassword, string entryContents, string tagsJSON, long jobHistoryId, bool overwrite, bool preserveTags)
         {
             var complete = new JobResult() { Result = OrchestratorJobStatusJobResult.Failure, JobHistoryId = jobHistoryId };
 
+            var tagDict = new Dictionary<string, string>();
+
+            if (!string.IsNullOrEmpty(tagsJSON))
+            {
+                if (!tagsJSON.IsValidJson())
+                {
+                    logger.LogError($"the entry parameter provided for Certificate Tags: \" {tagsJSON} \", does not seem to be valid JSON.");
+                    throw new Exception($"the string \" {tagsJSON} \" is not a valid json string. Please enter a valid json string for CertificateTags in the entry parameter or leave empty for no tags to be applied.");
+                }
+                else
+                {
+                    tagDict = JsonConvert.DeserializeObject<Dictionary<string, string>>(tagsJSON);
+                }
+            }
+
             if (!string.IsNullOrWhiteSpace(pfxPassword)) // This is a PFX Entry
             {
                 if (string.IsNullOrWhiteSpace(alias))
@@ -106,11 +133,27 @@ protected virtual JobResult PerformAddition(string alias, string pfxPassword, st
 
                 try
                 {
+                    var existingTags = new Dictionary<string, string>();
+                    logger.LogTrace($"checking for an existing cert with the alias {alias}");
+                    var existing = AzClient.GetCertificate(alias).Result;
+                    if (existing != null)
+                    {
+                        logger.LogTrace($"there is an existing cert..");
+                    }
+
+                    existingTags = existing?.Properties.Tags as Dictionary<string, string> ?? new Dictionary<string, string>();
+
+                    logger.LogTrace("existing cert tags: ");
+                    if (!existingTags.Any()) logger.LogTrace("(none)");
+
+                    foreach (var tag in existingTags)
+                    {
+                        logger.LogTrace(tag.Key + " : " + tag.Value);
+                    }
+
                     // if overwrite is unchecked, check for an existing cert first
                     if (!overwrite)
                     {
-                        logger.LogTrace($"checking for an existing cert with the alias {alias}");
-                        var existing = AzClient.GetCertificate(alias).Result;
                         if (existing != null)
                         {
                             var message = $"A certificate named {alias} already exists and the overwrite checkbox was unchecked.  No action was taken.";
@@ -120,8 +163,18 @@ protected virtual JobResult PerformAddition(string alias, string pfxPassword, st
                             return complete;
                         }
                     }
+                    else if (preserveTags)
+                    { // if preserveTags is true, we want to get the existing tags before replacing the cert
+                        foreach (var existingTag in existingTags)
+                        {
+                            if (!tagDict.ContainsKey(existingTag.Key)) // if it's not being overwritten by what was provided..
+                            {
+                                tagDict[existingTag.Key] = existingTag.Value; // then we include it
+                            }
+                        }
+                    }
 
-                    var cert = AzClient.ImportCertificateAsync(alias, entryContents, pfxPassword, tagsJSON).Result;
+                    var cert = AzClient.ImportCertificateAsync(alias, entryContents, pfxPassword, tagDict).Result;
 
                     // Ensure the return object has a AKV version tag, and Thumbprint
                     if (!string.IsNullOrEmpty(cert.Properties.Version) &&
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,7 @@
+- 3.1.9
+  - Added optional entry parameter to indicate that existing tags should be preserved if certificate is replaced
+  - bug fix for government cloud host name resolution
+
 - 3.1.8
   - Fixed bug where enrollment would fail if the CertificateTags field was not defined as an entry parameter	
   - Convert to .net6/8 dual build
diff --git a/README.md b/README.md
diff --git a/integration-manifest.json b/integration-manifest.json

Original file line number	Diff line number	Diff line change
`@@ -45,7 +45,7 @@ internal protected string VaultEndpoint`
`45`	`45`	`{`
`46`	`46`	`return PrivateEndpoint.TrimStart('.');`
`47`	`47`	`}`
`48`		`- switch (AzureCloud)`
	`48`	`+ switch (AzureCloud?.Trim()?.ToLowerInvariant())`
`49`	`49`	`{`
`50`	`50`	`case "china":`
`51`	`51`	`return "vault.azure.cn";`
`@@ -58,6 +58,6 @@ internal protected string VaultEndpoint`
`58`	`58`	`}`
`59`	`59`	`}`
`60`	`60`	`}`
`61`		`- internal protected string VaultURL => $"https://{VaultName}.{VaultEndpoint}/";`
	`61`	`+ public string VaultURL => $"https://{VaultName}.{VaultEndpoint}/";`
`62`	`62`	`}`
`63`	`63`	`}`
Original file line number	Diff line number	Diff line change
`@@ -17,13 +17,11 @@`
`17`	`17`	`using Azure.ResourceManager.KeyVault;`
`18`	`18`	`using Azure.ResourceManager.KeyVault.Models;`
`19`	`19`	`using Azure.ResourceManager.Resources;`
`20`		`-using Azure.ResourceManager.Resources.Models;`
`21`	`20`	`using Azure.Security.KeyVault.Certificates;`
`22`	`21`	`using Keyfactor.Logging;`
`23`	`22`	`using Keyfactor.Orchestrators.Common.Enums;`
`24`	`23`	`using Keyfactor.Orchestrators.Extensions;`
`25`	`24`	`using Microsoft.Extensions.Logging;`
`26`		`-using Newtonsoft.Json;`
`27`	`25`
`28`	`26`	`namespace Keyfactor.Extensions.Orchestrator.AzureKeyVault`
`29`	`27`	`{`
`@@ -34,16 +32,19 @@ private Uri AzureCloudEndpoint`
`34`	`32`	`{`
`35`	`33`	`get`
`36`	`34`	`{`
`37`		`- switch (VaultProperties.AzureCloud?.ToLower())`
	`35`	`+ logger.LogTrace($"the AzureCloud is {VaultProperties.AzureCloud}, so we will use the following endpoint for authentication: ");`
	`36`	`+ switch (VaultProperties.AzureCloud?.Trim()?.ToLowerInvariant())`
`38`	`37`	`{`
`39`		`-`
`40`	`38`	`case "china":`
	`39`	`+ logger.LogTrace(AzureAuthorityHosts.AzureChina.ToString());`
`41`	`40`	`return AzureAuthorityHosts.AzureChina;`
`42`	`41`	`//case "germany":`
`43`	`42`	`// return AzureAuthorityHosts.AzureGermany; // germany is no longer a valid azure authority host as of 2021`
`44`	`43`	`case "government":`
	`44`	`+ logger.LogTrace(AzureAuthorityHosts.AzureGovernment.ToString());`
`45`	`45`	`return AzureAuthorityHosts.AzureGovernment;`
`46`	`46`	`default:`
	`47`	`+ logger.LogTrace(AzureAuthorityHosts.AzurePublicCloud.ToString());`
`47`	`48`	`return AzureAuthorityHosts.AzurePublicCloud;`
`48`	`49`	`}`
`49`	`50`	`}`
`@@ -94,6 +95,8 @@ internal protected virtual ArmClient getArmClient(string tenantId)`
`94`	`95`	`{`
`95`	`96`	`TokenCredential credential;`
`96`	`97`	`var credentialOptions = new DefaultAzureCredentialOptions { AuthorityHost = AzureCloudEndpoint, AdditionallyAllowedTenants = { "*" } };`
	`98`	`+ logger.LogTrace($"creating an ARM client for management operations with authorityhost {AzureCloudEndpoint.ToString()}");`
	`99`	`+`
`97`	`100`	`if (this.VaultProperties.UseAzureManagedIdentity)`
`98`	`101`	`{`
`99`	`102`	`logger.LogTrace("getting management client for a managed identity");`
`@@ -196,7 +199,7 @@ public virtual async Task<KeyVaultResource> CreateVault()`
`196`	`199`	`}`
`197`	`200`	`}`
`198`	`201`
`199`		`- public virtual async Task<KeyVaultCertificateWithPolicy> ImportCertificateAsync(string certName, string contents, string pfxPassword, string tags = null)`
	`202`	`+ public virtual async Task<KeyVaultCertificateWithPolicy> ImportCertificateAsync(string certName, string contents, string pfxPassword, Dictionary<string,string> tags)`
`200`	`203`	`{`
`201`	`204`	`try`
`202`	`205`	`{`
`@@ -217,25 +220,14 @@ public virtual async Task<KeyVaultCertificateWithPolicy> ImportCertificateAsync(`
`217`	`220`
`218`	`221`	`logger.LogTrace($"calling ImportCertificateAsync on the KeyVault certificate client to import certificate {certName}");`
`219`	`222`
`220`		`- var tagDict = new Dictionary<string, string>();`
	`223`	`+ var options = new ImportCertificateOptions(certName, p12bytes);`
`221`	`224`
`222`		`- if (!string.IsNullOrEmpty(tags))`
	`225`	`+ if (tags.Any())`
`223`	`226`	`{`
`224`		`- if (!tags.IsValidJson())`
	`227`	`+ foreach (var tag in tags)`
`225`	`228`	`{`
`226`		`- logger.LogError($"the entry parameter provided for Certificate Tags: \" {tags} \", does not seem to be valid JSON.");`
`227`		`- throw new Exception($"the string \" {tags} \" is not a valid json string. Please enter a valid json string for CertificateTags in the entry parameter or leave empty for no tags to be applied.");`
	`229`	`+ options.Tags.Add(tag);`
`228`	`230`	`}`
`229`		`- logger.LogTrace($"converting the json value provided for tags into a Dictionary<string,string>");`
`230`		`- tagDict = JsonConvert.DeserializeObject<Dictionary<string, string>>(tags);`
`231`		`- logger.LogTrace($"{tagDict.Count} tag(s) will be associated with the certificate in Azure KeyVault");`
`232`		`- }`
`233`		`-`
`234`		`- var options = new ImportCertificateOptions(certName, p12bytes);`
`235`		`-`
`236`		`- foreach (var tag in tagDict.Keys)`
`237`		`- {`
`238`		`- options.Tags.Add(tag, tagDict[tag]);`
`239`	`231`	`}`
`240`	`232`
`241`	`233`	`var cert = await CertClient.ImportCertificateAsync(options);`
`@@ -396,9 +388,9 @@ public virtual (List<string>, List<string>) GetVaults()`
`396`	`388`	`var warning = $"Exception thrown performing discovery on tenantId {searchTenantId} and subscription ID {searchSubscription}. Exception message: {ex.Message}";`
`397`	`389`
`398`	`390`	`logger.LogWarning(warning);`
`399`		`- warnings.Add(warning);`
`400`		`- //throw;`
	`391`	`+ warnings.Add(warning);`
`401`	`392`	`}`
	`393`	`+`
`402`	`394`	`return (vaultNames, warnings);`
`403`	`395`	`}`
`404`	`396`	`}`
Original file line number	Diff line number	Diff line change
`@@ -13,6 +13,11 @@ static class AzureKeyVaultConstants`
`13`	`13`	`public const string STORE_TYPE_NAME = "AKV";`
`14`	`14`	`}`
`15`	`15`
	`16`	`+ static class EntryParameters {`
	`17`	`+ public const string TAGS = "CertificateTags";`
	`18`	`+ public const string PRESERVE_TAGS = "PreserveExistingTags";`
	`19`	`+ }`
	`20`	`+`
`16`	`21`	`static class JobTypes`
`17`	`22`	`{`
`18`	`23`	`public const string CREATE = "Create";`
Original file line number	Diff line number	Diff line change
`@@ -40,7 +40,7 @@ public JobResult ProcessJob(InventoryJobConfiguration config, SubmitInventoryUpd`
`40`	`40`
`41`	`41`	`inventoryItems = AzClient.GetCertificatesAsync().Result?.ToList();`
`42`	`42`
`43`		`- logger.LogTrace($"Found {inventoryItems.Count()} Total Certificates in Azure Key Vault.");`
	`43`	`+ logger.LogTrace($"Found {inventoryItems.Count} Total Certificates in Azure Key Vault.");`
`44`	`44`	`}`
`45`	`45`
`46`	`46`	`catch (Exception ex)`