Skip to content

Commit 6a2cc25

Browse files
fiddlermikeyfiddlermikey
authored
Win cert changes (#49) (#50)
* Win cert changes (#49) * Refactored code adding Windows cert store logic, including renaming IISU to WinIIS. * Added PowerShell class to perform get-childitem from cert store * Refactored code allowing multiple types of Cert Stores, including Win Cert and IIS (WebHosting) Cert Stores. * Update generated README * Fixed a problem adding certs to a cert store that had a space in the name (ie. Remote Desktop) * Updated Change Log. * Removed logging of PAM credentials which was logging the info in plain text. (#55) * Created custom Configuration Property Parser (#57) * Created custom Configuration Property Parser so not to display or log passwords. * Masked Private Ket Password * Modified logging to write out as JSON object * adding store-type definitions for `WinCert` and `IISU` * Updated ReadMe to better reflect IISU and WinCert settings. * Update generated README * Updated Cert Stores and images * Replaced Images
1 parent 35ce10e commit 6a2cc25

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+892
-203
lines changed

‎CHANGELOG.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
1-
2.0.1
1+
2.1.0
22
* Fixed issue that was occuring during renewal when there were bindings outside of http and https like net.tcp
33
* Added PAM registration/initialization documentation in README.md
4+
* Resolved Null HostName error
5+
* Added WinCert Cert Store Type
6+
* Added custom property parser to not show any passwords
7+
* Removed any password references in trace logs and output settings in JSON format
48

59
2.0.0
610
* Add support for reenrollment jobs (On Device Key Generation) with the ability to specify a cryptographic provider. Specification of cryptographic provider allows HSM (Hardware Security Module) use.

‎IISU/ClientPSCertStoreManager.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ function InstallPfxToMachineStore([byte[]]$bytes, [string]$password, [string]$st
7878
$certStore.Open(5)
7979
$cert = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Certificate2 -ArgumentList $bytes, $password, 18 <# Persist, Machine #>
8080
$certStore.Add($cert)
81+
8182
$certStore.Close();
8283
}";
8384

‎IISU/ClientPSCertStoreReEnrollment.cs‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@
1212
// See the License for the specific language governing permissions and
1313
// limitations under the License.
1414

15-
using Keyfactor.Extensions.Orchestrator.WindowsCertStore.WinIIS;
1615
using Keyfactor.Logging;
1716
using Keyfactor.Orchestrators.Common.Enums;
1817
using Keyfactor.Orchestrators.Extensions;
@@ -34,8 +33,8 @@ namespace Keyfactor.Extensions.Orchestrator.WindowsCertStore
3433
{
3534
internal class ClientPSCertStoreReEnrollment
3635
{
37-
private ILogger _logger;
38-
private IPAMSecretResolver _resolver;
36+
private readonly ILogger _logger;
37+
private readonly IPAMSecretResolver _resolver;
3938

4039
public ClientPSCertStoreReEnrollment(ILogger logger, IPAMSecretResolver resolver)
4140
{
@@ -59,8 +58,10 @@ public JobResult PerformReEnrollment(ReenrollmentJobConfiguration config, Submit
5958
JobProperties properties = JsonConvert.DeserializeObject<JobProperties>(config.CertificateStoreDetails.Properties,
6059
new JsonSerializerSettings { DefaultValueHandling = DefaultValueHandling.Populate });
6160

62-
WSManConnectionInfo connectionInfo = new WSManConnectionInfo(new Uri($"{properties?.WinRmProtocol}://{config.CertificateStoreDetails.ClientMachine}:{properties?.WinRmPort}/wsman"));
63-
connectionInfo.IncludePortInSPN = properties.SpnPortFlag;
61+
WSManConnectionInfo connectionInfo = new WSManConnectionInfo(new Uri($"{properties?.WinRmProtocol}://{config.CertificateStoreDetails.ClientMachine}:{properties?.WinRmPort}/wsman"))
62+
{
63+
IncludePortInSPN = properties.SpnPortFlag
64+
};
6465
var pw = new NetworkCredential(serverUserName, serverPassword).SecurePassword;
6566
_logger.LogTrace($"Credentials: UserName:{serverUserName}");
6667

@@ -91,7 +92,7 @@ public JobResult PerformReEnrollment(ReenrollmentJobConfiguration config, Submit
9192
Collection<PSObject> results;
9293

9394
// If the provider name is null, default it to the Microsoft CA
94-
if (providerName == null) providerName = "Microsoft Strong Cryptographic Provider";
95+
providerName ??= "Microsoft Strong Cryptographic Provider";
9596

9697
// Create the script file
9798
ps.AddScript("$infFilename = New-TemporaryFile");

‎IISU/ClientPSIIManager.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,8 @@ internal class ClientPSIIManager
5050

5151
private long JobHistoryID { get; set; }
5252

53-
private ILogger _logger;
54-
private Runspace _runSpace;
53+
private readonly ILogger _logger;
54+
private readonly Runspace _runSpace;
5555

5656
private PowerShell ps;
5757

@@ -82,7 +82,7 @@ public ClientPSIIManager(ReenrollmentJobConfiguration config, string serverUsern
8282
Port = config.JobProperties["Port"].ToString();
8383
HostName = config.JobProperties["HostName"]?.ToString();
8484
Protocol = config.JobProperties["Protocol"].ToString();
85-
SniFlag = config.JobProperties["SniFlag"].ToString()?.Substring(0, 1);
85+
SniFlag = config.JobProperties["SniFlag"]?.ToString()[..1];
8686
IPAddress = config.JobProperties["IPAddress"].ToString();
8787

8888
PrivateKeyPassword = ""; // A reenrollment does not have a PFX Password
@@ -119,7 +119,7 @@ public ClientPSIIManager(ManagementJobConfiguration config, string serverUsernam
119119
Port = config.JobProperties["Port"].ToString();
120120
HostName = config.JobProperties["HostName"]?.ToString();
121121
Protocol = config.JobProperties["Protocol"].ToString();
122-
SniFlag = config.JobProperties["SniFlag"].ToString()?.Substring(0, 1);
122+
SniFlag = config.JobProperties["SniFlag"].ToString()?[..1];
123123
IPAddress = config.JobProperties["IPAddress"].ToString();
124124

125125
PrivateKeyPassword = ""; // A reenrollment does not have a PFX Password

‎IISU/ImplementedStoreTypes/Win/Inventory.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
using Microsoft.Extensions.Logging;
2626
using Newtonsoft.Json;
2727

28-
namespace Keyfactor.Extensions.Orchestrator.WindowsCertStore.Win
28+
namespace Keyfactor.Extensions.Orchestrator.WindowsCertStore.WinCert
2929
{
3030
public class Inventory : WinCertJobTypeBase, IInventoryJobExtension
3131
{
@@ -55,7 +55,7 @@ private JobResult PerformInventory(InventoryJobConfiguration config, SubmitInven
5555
{
5656
var inventoryItems = new List<CurrentInventoryItem>();
5757

58-
_logger.LogTrace($"Job Configuration: {JsonConvert.SerializeObject(config)}");
58+
_logger.LogTrace(JobConfigurationParser.ParseInventoryJobConfiguration(config));
5959

6060
string serverUserName = PAMUtilities.ResolvePAMField(_resolver, _logger, "Server UserName", config.ServerUsername);
6161
string serverPassword = PAMUtilities.ResolvePAMField(_resolver, _logger, "Server Password", config.ServerPassword);

‎IISU/ImplementedStoreTypes/Win/Management.cs‎

Lines changed: 6 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
using System.Net;
2525
using Keyfactor.Logging;
2626

27-
namespace Keyfactor.Extensions.Orchestrator.WindowsCertStore.Win
27+
namespace Keyfactor.Extensions.Orchestrator.WindowsCertStore.WinCert
2828
{
2929
public class Management : WinCertJobTypeBase, IManagementJobExtension
3030
{
@@ -47,11 +47,13 @@ public Management(IPAMSecretResolver resolver)
4747

4848
public JobResult ProcessJob(ManagementJobConfiguration config)
4949
{
50-
_logger = LogHandler.GetClassLogger<Management>();
51-
_logger.MethodEntry();
52-
5350
try
5451
{
52+
_logger = LogHandler.GetClassLogger<Management>();
53+
_logger.MethodEntry();
54+
55+
_logger.LogTrace(JobConfigurationParser.ParseManagementJobConfiguration(config));
56+
5557
string serverUserName = PAMUtilities.ResolvePAMField(_resolver, _logger, "Server UserName", config.ServerUsername);
5658
string serverPassword = PAMUtilities.ResolvePAMField(_resolver, _logger, "Server Password", config.ServerPassword);
5759

@@ -112,56 +114,6 @@ public JobResult ProcessJob(ManagementJobConfiguration config)
112114
}
113115
}
114116

115-
//private JobResult PerformManagement(ManagementJobConfiguration config)
116-
//{
117-
// try
118-
// {
119-
// _logger.MethodEntry();
120-
121-
// ServerUserName = PAMUtilities.ResolvePAMField(_resolver, _logger, "Server UserName", config.ServerUsername);
122-
// ServerPassword = PAMUtilities.ResolvePAMField(_resolver, _logger, "Server Password", config.ServerPassword);
123-
124-
// var complete = new JobResult
125-
// {
126-
// Result = OrchestratorJobStatusJobResult.Failure,
127-
// JobHistoryId = config.JobHistoryId,
128-
// FailureMessage =
129-
// "Invalid Management Operation"
130-
// };
131-
132-
// switch (config.OperationType)
133-
// {
134-
// case CertStoreOperationType.Add:
135-
// {
136-
// _logger.LogTrace("Adding...");
137-
// if (config.JobProperties.ContainsKey("RenewalThumbprint"))
138-
// {
139-
// _thumbprint = config.JobProperties["RenewalThumbprint"].ToString();
140-
// _logger.LogTrace($"Found Thumbprint Will renew all cers with this Thumbprint: {_thumbprint}");
141-
// }
142-
143-
// _logger.LogTrace("Before PerformAddition...");
144-
// complete = performAddition(config);
145-
// _logger.LogTrace("After PerformAddition...");
146-
147-
// break;
148-
// }
149-
// case CertStoreOperationType.Remove:
150-
// {
151-
// break;
152-
// }
153-
// }
154-
155-
// return complete;
156-
// }
157-
158-
// catch (Exception e)
159-
// {
160-
// _logger.LogError($"Error Occurred in Management.PerformManagement: {e.Message}");
161-
// throw;
162-
// }
163-
//}
164-
165117
private JobResult performAddition(ManagementJobConfiguration config)
166118
{
167119
try

‎IISU/ImplementedStoreTypes/Win/ReEnrollment.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
using Keyfactor.Orchestrators.Extensions.Interfaces;
1717
using Microsoft.Extensions.Logging;
1818

19-
namespace Keyfactor.Extensions.Orchestrator.WindowsCertStore.Win
19+
namespace Keyfactor.Extensions.Orchestrator.WindowsCertStore.WinCert
2020
{
2121
public class ReEnrollment : WinCertJobTypeBase, IReenrollmentJobExtension
2222
{

‎IISU/ImplementedStoreTypes/Win/WinInventory.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
using System.Management.Automation.Runspaces;
2020
using System.Text;
2121

22-
namespace Keyfactor.Extensions.Orchestrator.WindowsCertStore.Win
22+
namespace Keyfactor.Extensions.Orchestrator.WindowsCertStore.WinCert
2323
{
2424
internal class WinInventory : ClientPSCertStoreInventory
2525
{

‎IISU/ImplementedStoreTypes/WinIIS/IISManager.cs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
using Microsoft.Extensions.Logging;
2525
using Newtonsoft.Json;
2626

27-
namespace Keyfactor.Extensions.Orchestrator.WindowsCertStore.WinIIS
27+
namespace Keyfactor.Extensions.Orchestrator.WindowsCertStore.IISU
2828
{
2929
public class IISManager
3030
{
@@ -66,7 +66,7 @@ public IISManager(ReenrollmentJobConfiguration config, string serverUserName, st
6666
Port = config.JobProperties["Port"].ToString();
6767
HostName = config.JobProperties["HostName"]?.ToString();
6868
Protocol = config.JobProperties["Protocol"].ToString();
69-
SniFlag = config.JobProperties["SniFlag"].ToString()?.Substring(0, 1);
69+
SniFlag = config.JobProperties["SniFlag"].ToString()?[..1];
7070
IpAddress = config.JobProperties["IPAddress"].ToString();
7171

7272
PrivateKeyPassword = ""; // A reenrollment does not have a PFX Password
@@ -105,7 +105,7 @@ public IISManager(ManagementJobConfiguration config, string serverUserName, stri
105105
Port = config.JobProperties["Port"].ToString();
106106
HostName = config.JobProperties["HostName"]?.ToString();
107107
Protocol = config.JobProperties["Protocol"].ToString();
108-
SniFlag = config.JobProperties["SniFlag"].ToString()?.Substring(0, 1);
108+
SniFlag = config.JobProperties["SniFlag"].ToString()?[..1];
109109
IpAddress = config.JobProperties["IPAddress"].ToString();
110110

111111
PrivateKeyPassword = config.JobCertificate.PrivateKeyPassword;

‎IISU/ImplementedStoreTypes/WinIIS/Inventory.cs‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
using Microsoft.Extensions.Logging;
2626
using Newtonsoft.Json;
2727

28-
namespace Keyfactor.Extensions.Orchestrator.WindowsCertStore.WinIIS
28+
namespace Keyfactor.Extensions.Orchestrator.WindowsCertStore.IISU
2929
{
3030
public class Inventory : WinCertJobTypeBase, IInventoryJobExtension
3131
{
@@ -52,7 +52,9 @@ private JobResult PerformInventory(InventoryJobConfiguration config, SubmitInven
5252
{
5353
var inventoryItems = new List<CurrentInventoryItem>();
5454

55-
_logger.LogTrace($"Job Configuration: {JsonConvert.SerializeObject(config)}");
55+
string myConfig = config.ToString();
56+
57+
_logger.LogTrace(JobConfigurationParser.ParseInventoryJobConfiguration(config));
5658

5759
string serverUserName = PAMUtilities.ResolvePAMField(_resolver, _logger, "Server UserName", config.ServerUsername);
5860
string serverPassword = PAMUtilities.ResolvePAMField(_resolver, _logger, "Server Password", config.ServerPassword);

0 commit comments

Comments
 (0)