Skip to content

Commit 7b35ed6

Browse files
bhillkeyfactorBob PokornyMichael Henderson
authored
Pamupdates (#23)
* Adding Re-Enrollment * Added ReEnrollment logic for Fortanix HSM * Pam Updates * Remove unused solution * add secret for readme build * fixed unused import * Update integration-manifest.json Co-authored-by: Bob Pokorny <[email protected]> Co-authored-by: Michael Henderson <[email protected]>
1 parent 3a15c2b commit 7b35ed6

File tree

7 files changed

+105
-58
lines changed

7 files changed

+105
-58
lines changed

‎IISU/IISManager.cs‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ public class IISManager
4242
/// Performs a Reenrollment of a certificate in IIS
4343
/// </summary>
4444
/// <param name="config"></param>
45-
public IISManager(ReenrollmentJobConfiguration config)
45+
public IISManager(ReenrollmentJobConfiguration config,string serverUserName,string serverPassword)
4646
{
4747
Logger = LogHandler.GetClassLogger<IISManager>();
4848

@@ -56,8 +56,8 @@ public IISManager(ReenrollmentJobConfiguration config)
5656
IpAddress = config.JobProperties["IPAddress"].ToString();
5757

5858
PrivateKeyPassword = ""; // A reenrollment does not have a PFX Password
59-
ServerUserName = config.ServerUsername;
60-
ServerPassword = config.ServerPassword;
59+
ServerUserName = serverUserName;
60+
ServerPassword = serverPassword;
6161
RenewalThumbprint = ""; // A reenrollment will always be empty
6262
ClientMachine = config.CertificateStoreDetails.ClientMachine;
6363
Path = config.CertificateStoreDetails.StorePath;
@@ -81,7 +81,7 @@ public IISManager(ReenrollmentJobConfiguration config)
8181
/// Performs Management functions of Adding or updating certificates in IIS
8282
/// </summary>
8383
/// <param name="config"></param>
84-
public IISManager(ManagementJobConfiguration config)
84+
public IISManager(ManagementJobConfiguration config, string serverUserName, string serverPassword)
8585
{
8686
Logger = LogHandler.GetClassLogger<IISManager>();
8787

@@ -95,8 +95,8 @@ public IISManager(ManagementJobConfiguration config)
9595
IpAddress = config.JobProperties["IPAddress"].ToString();
9696

9797
PrivateKeyPassword = config.JobCertificate.PrivateKeyPassword;
98-
ServerUserName = config.ServerUsername;
99-
ServerPassword = config.ServerPassword;
98+
ServerUserName = serverUserName;
99+
ServerPassword = serverPassword;
100100
ClientMachine = config.CertificateStoreDetails.ClientMachine;
101101
Path = config.CertificateStoreDetails.StorePath;
102102
CertContents = config.JobCertificate.Contents;

‎IISU/IISU.csproj‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,30 @@
1-
<Project Sdk="Microsoft.NET.Sdk">
2-
3-
<PropertyGroup>
4-
<TargetFramework>netcoreapp3.1</TargetFramework>
1+
<Project Sdk="Microsoft.NET.Sdk">
2+
3+
<PropertyGroup>
4+
<TargetFramework>netcoreapp3.1</TargetFramework>
55
<RootNamespace>Keyfactor.Extensions.Orchestrator.IISU</RootNamespace>
6-
<CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
7-
</PropertyGroup>
8-
9-
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|AnyCPU'">
10-
<DebugType>none</DebugType>
11-
<DebugSymbols>false</DebugSymbols>
12-
</PropertyGroup>
13-
6+
<CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
7+
</PropertyGroup>
8+
9+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|AnyCPU'">
10+
<DebugType>none</DebugType>
11+
<DebugSymbols>false</DebugSymbols>
12+
</PropertyGroup>
13+
1414
<ItemGroup>
1515
<Compile Remove="PowerShellCertRequest.cs" />
1616
</ItemGroup>
1717

1818
<ItemGroup>
19-
<PackageReference Include="Keyfactor.Logging" Version="1.1.1" />
20-
<PackageReference Include="Keyfactor.Orchestrators.IOrchestratorJobExtensions" Version="0.6.0" />
21-
<PackageReference Include="System.Management.Automation" Version="7.0.5" />
22-
</ItemGroup>
23-
24-
<ItemGroup>
25-
<None Update="manifest.json">
26-
<CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
27-
</None>
28-
</ItemGroup>
29-
30-
</Project>
19+
<PackageReference Include="Keyfactor.Logging" Version="1.1.1" />
20+
<PackageReference Include="Keyfactor.Orchestrators.IOrchestratorJobExtensions" Version="0.7.0" />
21+
<PackageReference Include="System.Management.Automation" Version="7.0.5" />
22+
</ItemGroup>
23+
24+
<ItemGroup>
25+
<None Update="manifest.json">
26+
<CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
27+
</None>
28+
</ItemGroup>
29+
30+
</Project>

‎IISU/Jobs/Inventory.cs‎

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,23 +7,41 @@
77
using Keyfactor.Logging;
88
using Keyfactor.Orchestrators.Common.Enums;
99
using Keyfactor.Orchestrators.Extensions;
10+
using Keyfactor.Orchestrators.Extensions.Interfaces;
1011
using Microsoft.Extensions.Logging;
1112
using Newtonsoft.Json;
1213

1314
namespace Keyfactor.Extensions.Orchestrator.IISU.Jobs
1415
{
1516
public class Inventory : IInventoryJobExtension
1617
{
17-
private readonly ILogger<Inventory> _logger;
18-
19-
public Inventory(ILogger<Inventory> logger) =>
20-
_logger = logger;
18+
private ILogger _logger;
19+
20+
private IPAMSecretResolver _resolver;
21+
22+
private string ServerUserName { get; set; }
23+
private string ServerPassword { get; set; }
24+
25+
public Inventory(IPAMSecretResolver resolver)
26+
{
27+
_resolver = resolver;
28+
}
29+
30+
private string ResolvePamField(string name, string value)
31+
{
32+
_logger.LogTrace($"Attempting to resolved PAM eligible field {name}");
33+
return _resolver.Resolve(value);
34+
}
2135

2236
private JobResult PerformInventory(InventoryJobConfiguration config, SubmitInventoryUpdate submitInventory)
2337
{
2438
try
25-
{
26-
_logger.MethodEntry();
39+
{
40+
_logger = LogHandler.GetClassLogger<Inventory>();
41+
_logger.MethodEntry();
42+
ServerUserName = ResolvePamField("Server UserName", config.ServerUsername);
43+
ServerPassword = ResolvePamField("Server Password", config.ServerPassword);
44+
2745
_logger.LogTrace($"Job Configuration: {JsonConvert.SerializeObject(config)}");
2846
var storePath = JsonConvert.DeserializeObject<JobProperties>(config.CertificateStoreDetails.Properties, new JsonSerializerSettings { DefaultValueHandling = DefaultValueHandling.Populate });
2947
var inventoryItems = new List<CurrentInventoryItem>();
@@ -35,10 +53,10 @@ private JobResult PerformInventory(InventoryJobConfiguration config, SubmitInven
3553

3654
if (storePath != null)
3755
{
38-
var pw = new NetworkCredential(config.ServerUsername, config.ServerPassword)
56+
var pw = new NetworkCredential(ServerUserName, ServerPassword)
3957
.SecurePassword;
40-
_logger.LogTrace($"Credentials: UserName:{config.ServerUsername} Password:{config.ServerPassword}");
41-
connInfo.Credential = new PSCredential(config.ServerUsername, pw);
58+
_logger.LogTrace($"Credentials: UserName:{ServerUserName} Password:{ServerPassword}");
59+
connInfo.Credential = new PSCredential(ServerUserName, pw);
4260
_logger.LogTrace($"PSCredential Created {pw}");
4361

4462
using var runSpace = RunspaceFactory.CreateRunspace(connInfo);

‎IISU/Jobs/Management.cs‎

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,26 +6,41 @@
66
using Keyfactor.Logging;
77
using Keyfactor.Orchestrators.Common.Enums;
88
using Keyfactor.Orchestrators.Extensions;
9+
using Keyfactor.Orchestrators.Extensions.Interfaces;
910
using Microsoft.Extensions.Logging;
1011
using Newtonsoft.Json;
1112

1213
namespace Keyfactor.Extensions.Orchestrator.IISU.Jobs
1314
{
1415
public class Management : IManagementJobExtension
1516
{
16-
private readonly ILogger<Management> _logger;
17+
private ILogger _logger;
18+
19+
private IPAMSecretResolver _resolver;
1720

1821
private string _thumbprint = string.Empty;
1922

20-
public Management(ILogger<Management> logger)
23+
private string ServerUserName { get; set; }
24+
private string ServerPassword { get; set; }
25+
26+
public Management(IPAMSecretResolver resolver)
2127
{
22-
_logger = logger;
28+
_resolver = resolver;
2329
}
2430

2531
public string ExtensionName => "IISU";
2632

33+
private string ResolvePamField(string name,string value)
34+
{
35+
_logger.LogTrace($"Attempting to resolved PAM eligible field {name}");
36+
return _resolver.Resolve(value);
37+
}
38+
2739
public JobResult ProcessJob(ManagementJobConfiguration jobConfiguration)
2840
{
41+
_logger = LogHandler.GetClassLogger<Management>();
42+
ServerUserName = ResolvePamField("Server UserName", jobConfiguration.ServerUsername);
43+
ServerPassword = ResolvePamField("Server Password", jobConfiguration.ServerPassword);
2944
_logger.MethodEntry();
3045
_logger.LogTrace($"Job Configuration: {JsonConvert.SerializeObject(jobConfiguration)}");
3146
var complete = new JobResult
@@ -83,10 +98,10 @@ private JobResult PerformRemoval(ManagementJobConfiguration config)
8398
{
8499
_logger.LogTrace($"IncludePortInSPN: {storePath.SpnPortFlag}");
85100
connInfo.IncludePortInSPN = storePath.SpnPortFlag;
86-
var pw = new NetworkCredential(config.ServerUsername, config.ServerPassword)
101+
var pw = new NetworkCredential(ServerUserName, ServerPassword)
87102
.SecurePassword;
88-
_logger.LogTrace($"Credentials: UserName:{config.ServerUsername} Password:{config.ServerPassword}");
89-
connInfo.Credential = new PSCredential(config.ServerUsername, pw);
103+
_logger.LogTrace($"Credentials: UserName:{ServerUserName} Password:{ServerPassword}");
104+
connInfo.Credential = new PSCredential(ServerUserName, pw);
90105
_logger.LogTrace($"PSCredential Created {pw}");
91106
using var runSpace = RunspaceFactory.CreateRunspace(connInfo);
92107
_logger.LogTrace("runSpace Created");
@@ -212,7 +227,7 @@ private JobResult PerformAddition(ManagementJobConfiguration config)
212227
{
213228
_logger.MethodEntry();
214229

215-
var iisManager=new IISManager(config);
230+
var iisManager=new IISManager(config,ServerUserName,ServerPassword);
216231
return iisManager.AddCertificate();
217232
}
218233
catch (Exception ex)

‎IISU/Jobs/ReEnrollment.cs‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
using System;
2-
using System.Collections;
1+
using System;
32
using System.Collections.ObjectModel;
43
using System.Linq;
54
using System.Management.Automation;
@@ -10,25 +9,35 @@
109
using Keyfactor.Logging;
1110
using Keyfactor.Orchestrators.Common.Enums;
1211
using Keyfactor.Orchestrators.Extensions;
12+
using Keyfactor.Orchestrators.Extensions.Interfaces;
1313
using Microsoft.Extensions.Logging;
1414
using Newtonsoft.Json;
1515

1616
namespace Keyfactor.Extensions.Orchestrator.IISU.Jobs
1717
{
1818
public class ReEnrollment:IReenrollmentJobExtension
1919
{
20-
private readonly ILogger<ReEnrollment> _logger;
20+
private ILogger _logger;
2121

22-
public ReEnrollment(ILogger<ReEnrollment> logger)
22+
private IPAMSecretResolver _resolver;
23+
24+
public ReEnrollment(IPAMSecretResolver resolver)
2325
{
24-
_logger = logger;
26+
_resolver = resolver;
2527
}
2628

2729
public string ExtensionName => "IISU";
2830

31+
private string ResolvePamField(string name, string value)
32+
{
33+
_logger.LogTrace($"Attempting to resolved PAM eligible field {name}");
34+
return _resolver.Resolve(value);
35+
}
36+
2937
public JobResult ProcessJob(ReenrollmentJobConfiguration config, SubmitReenrollmentCSR submitReEnrollmentUpdate)
3038
{
3139
_logger.MethodEntry();
40+
_logger = LogHandler.GetClassLogger<ReEnrollment>();
3241
_logger.LogTrace($"Job Configuration: {JsonConvert.SerializeObject(config)}");
3342
var storePath = JsonConvert.DeserializeObject<JobProperties>(config.CertificateStoreDetails.Properties, new JsonSerializerSettings { DefaultValueHandling = DefaultValueHandling.Populate });
3443
_logger.LogTrace($"WinRm Url: {storePath?.WinRmProtocol}://{config.CertificateStoreDetails.ClientMachine}:{storePath?.WinRmPort}/wsman");
@@ -44,17 +53,19 @@ private JobResult PerformReEnrollment(ReenrollmentJobConfiguration config, Submi
4453
try
4554
{
4655
_logger.MethodEntry();
56+
var serverUserName = ResolvePamField("Server UserName", config.ServerUsername);
57+
var serverPassword = ResolvePamField("Server Password", config.ServerPassword);
4758

4859
// Extract values necessary to create remote PS connection
4960
JobProperties properties = JsonConvert.DeserializeObject<JobProperties>(config.CertificateStoreDetails.Properties,
5061
new JsonSerializerSettings { DefaultValueHandling = DefaultValueHandling.Populate });
5162

5263
WSManConnectionInfo connectionInfo = new WSManConnectionInfo(new Uri($"{properties?.WinRmProtocol}://{config.CertificateStoreDetails.ClientMachine}:{properties?.WinRmPort}/wsman"));
5364
connectionInfo.IncludePortInSPN = properties.SpnPortFlag;
54-
var pw = new NetworkCredential(config.ServerUsername, config.ServerPassword).SecurePassword;
55-
_logger.LogTrace($"Credentials: UserName:{config.ServerUsername} Password:{config.ServerPassword}");
65+
var pw = new NetworkCredential(serverUserName, serverPassword).SecurePassword;
66+
_logger.LogTrace($"Credentials: UserName:{serverUserName} Password:{serverPassword}");
5667

57-
connectionInfo.Credential = new PSCredential(config.ServerUsername, pw);
68+
connectionInfo.Credential = new PSCredential(serverUserName, pw);
5869
_logger.LogTrace($"PSCredential Created {pw}");
5970

6071
// Establish new remote ps session
@@ -64,6 +75,7 @@ private JobResult PerformReEnrollment(ReenrollmentJobConfiguration config, Submi
6475
runSpace.Open();
6576
_logger.LogTrace("Workspace opened");
6677

78+
// NEW
6779
var ps = PowerShell.Create();
6880
ps.Runspace = runSpace;
6981

@@ -176,8 +188,7 @@ private JobResult PerformReEnrollment(ReenrollmentJobConfiguration config, Submi
176188
runSpace.Close();
177189

178190
// Bind the certificate to IIS
179-
_logger.LogTrace("Binding the certificate to IIS.");
180-
var iisManager = new IISManager(config);
191+
var iisManager = new IISManager(config,serverUserName,serverPassword);
181192
return iisManager.ReEnrollCertificate(myCert);
182193
}
183194
else

‎README.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,11 @@ The Universal Orchestrator is the successor to the Windows Orchestrator. This Ca
2020

2121

2222

23-
## Platform Specific Notes
23+
## Keyfactor Version Supported
24+
25+
The minimum version of the Keyfactor Universal Orchestrator Framework needed to run this version of the extension is 10.1
2426

25-
The minimum version of the Universal Orchestrator Framework needed to run this version of the extension is
27+
## Platform Specific Notes
2628

2729
The Keyfactor Universal Orchestrator may be installed on either Windows or Linux based platforms. The certificate operations supported by a capability may vary based what platform the capability is installed on. The table below indicates what capabilities are supported based on which platform the encompassing Universal Orchestrator is running.
2830
| Operation | Win | Linux |

‎integration-manifest.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
"description": "The IIS Orchestrator treats the certificates bound (actively in use) on a Microsoft Internet Information Server (IIS) as a Keyfactor certificate store. Inventory and Management functions are supported. The orchestrator replaces the IIS orchestrator that ships with Keyfactor Command (which did not support binding.)",
88
"about": {
99
"orchestrator": {
10+
"UOFramework": "10.1",
1011
"win": {
1112
"supportsCreateStore": false,
1213
"supportsDiscovery": false,

0 commit comments

Comments
 (0)