secret management

src/KeyVault/KeyVault/SecretManagementExtension/SecretManagementExtension.psd1 → src/KeyVault/KeyVault/Az.KeyVault.Extension/Az.KeyVault.Extension.psd1

@@ -1,5 +1,5 @@
 @{
     ModuleVersion = '1.0'
-    RootModule = '.\SecretManagementExtension.psm1'
+    RootModule = '.\Az.KeyVault.Extension.psm1'
     FunctionsToExport = @('Set-Secret','Get-Secret','Remove-Secret','Get-SecretInfo','Test-SecretVault')
 }

src/KeyVault/KeyVault/Az.KeyVault.Extension/Az.KeyVault.Extension.psm1

@@ -0,0 +1,287 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+function Check-SubscriptionLogIn
+{
+    param (
+        [string] $SubscriptionId,
+        [string] $AzKVaultName
+    )
+
+    $azContext = Az.Accounts\Get-AzContext
+    if (($azContext -eq $null) -or ($azContext.Subscription.Id -ne $SubscriptionId))
+    {
+        throw "To use ${AzKVaultName} Azure vault, the current user must be logged into Azure account subscription ${SubscriptionId}. Run 'Connect-AzAccount -SubscriptionId ${SubscriptionId}'."
+    }
+}
+
+function Get-Secret
+{
+    param (
+        [string] $Name,
+        [string] $VaultName,
+        [hashtable] $AdditionalParameters
+    )
+
+    Check-SubscriptionLogIn $AdditionalParameters.SubscriptionId $AdditionalParameters.AZKVaultName
+
+    $secret = Az.KeyVault\Get-AzKeyVaultSecret -Name $Name -VaultName $AdditionalParameters.AZKVaultName
+    if ($secret -ne $null)
+    {
+        switch ($secret.ContentType) {
+            'ByteArray' 
+            {  
+                $SecretValue = Get-ByteArray $Secret
+            }
+            'String'
+            {
+                $SecretValue = Get-String $Secret
+            }
+            'SecureString'
+            {
+                $SecretValue = Get-SecureString $Secret
+            }
+            'PSCredential' 
+            {
+                Get-PSCredential $Secret
+            }
+            'Hashtable' 
+            {  
+                Get-Hashtable $Secret
+            }
+            Default 
+            {
+                throw "Unknown secret type"
+            }
+        }
+        return $SecretValue
+    }
+}
+
+function Get-ByteArray
+{
+    param (
+        [Parameter(Mandatory=$true, Position=0)]
+        [object] $Secret
+    )
+    $secretValueText = Get-String $Secret
+    return [System.Text.Encoding]::ASCII.GetBytes($secretValueText)
+}
+
+function Get-String
+{
+    param (
+        [Parameter(Mandatory=$true, Position=0)]
+        [object] $Secret
+    )
+
+    $ssPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Secret.SecretValue)
+    try {
+        $secretValueText = [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ssPtr)
+    } finally {
+        [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ssPtr)
+    }
+    return $secretValueText
+}
+
+function Get-SecureString
+{
+    param (
+        [Parameter(Mandatory=$true, Position=0)]
+        [object] $Secret
+    )
+
+    return $Secret.SecretValue
+}
+
+function Get-PSCredential
+{
+    param (
+        [Parameter(Mandatory=$true, Position=0)]
+        [object] $Secret
+    )
+
+    $secretHashTable = Get-Hashtable $Secret
+    return [System.Management.Automation.PSCredential]::new($secretHashTable["UserName"], ($secretHashTable["Password"] | ConvertTo-SecureString -AsPlainText -Force)) 
+}
+
+function Get-Hashtable
+{
+    param (
+        [Parameter(Mandatory=$true, Position=0)]
+        [object] $Secret
+    )
+
+    $secretValueText = Get-String $Secret
+    return ConvertFrom-Json $secretValueText -AsHashtable
+}
+
+function Set-Secret
+{
+    param (
+        [string] $Name,
+        [object] $Secret,
+        [string] $VaultName,
+        [hashtable] $AdditionalParameters
+    )
+
+    Check-SubscriptionLogIn $AdditionalParameters.SubscriptionId $AdditionalParameters.AZKVaultName
+
+    switch ($Secret.GetType().Name) {
+        'Byte[]' 
+        {
+            Set-ByteArray -Name $Name -Secret $Secret -AZKVaultName $AdditionalParameters.AZKVaultName -ContentType 'ByteArray'
+        }
+        'String'
+        {
+            Set-String -Name $Name -Secret $Secret -AZKVaultName $AdditionalParameters.AZKVaultName -ContentType 'String'
+        }
+        'SecureString'
+        {
+            Set-SecureString -Name $Name -Secret $Secret -AZKVaultName $AdditionalParameters.AZKVaultName -ContentType 'SecureString'
+        }
+        'PSCredential' 
+        {
+            Set-PSCredential -Name $Name -Secret $Secret -AZKVaultName $AdditionalParameters.AZKVaultName -ContentType 'PSCredential'
+        }
+        'Hashtable' 
+        {  
+            Set-Hashtable -Name $Name -Secret $Secret -AZKVaultName $AdditionalParameters.AZKVaultName -ContentType 'Hashtable'
+        }
+        Default
+        {
+            throw "Invalid type. Types supported: byte[], string, SecureString, PSCredential, Hashtable";
+        }
+    }
+
+    return $?
+}
+
+function Set-ByteArray
+{
+    param (
+        [string] $Name,
+        [Byte[]] $Secret,
+        [string] $AZKVaultName,
+        [string] $ContentType
+    )
+
+    $SecretString = [System.Text.Encoding]::ASCII.GetString($Secret)
+    Set-String -Name $Name -Secret $SecretString -AZKVaultName $AZKVaultName -ContentType $ContentType
+}
+
+function Set-String
+{
+    param (
+        [string] $Name,
+        [string] $Secret,
+        [string] $AZKVaultName,
+        [string] $ContentType
+    )
+    $SecureSecret = ConvertTo-SecureString -String $Secret -AsPlainText -Force
+    $null = Az.KeyVault\Set-AzKeyVaultSecret -Name $Name -SecretValue $SecureSecret -VaultName $AZKVaultName -ContentType $ContentType
+}
+
+function Set-SecureString
+{
+    param (
+        [string] $Name,
+        [SecureString] $Secret,
+        [string] $AZKVaultName,
+        [string] $ContentType
+    )
+
+    $null = Az.KeyVault\Set-AzKeyVaultSecret -Name $Name -SecretValue $Secret -VaultName $AZKVaultName -ContentType $ContentType
+}
+
+function Set-PSCredential
+{
+    param (
+        [string] $Name,
+        [PSCredential] $Secret,
+        [string] $AZKVaultName,
+        [string] $ContentType
+    )
+    $secretHashTable = @{"UserName" = $Secret.UserName; "Password" = $Secret.GetNetworkCredential().Password}
+    $SecretString = ConvertTo-Json $secretHashTable
+    Set-String -Name $Name -Secret $SecretString -AZKVaultName $AZKVaultName -ContentType $ContentType
+}
+
+function Set-Hashtable
+{
+    param (
+        [string] $Name,
+        [Hashtable] $Secret,
+        [string] $AZKVaultName,
+        [string] $ContentType
+    )
+    $SecretString = ConvertTo-Json $Secret
+    Set-String -Name $Name -Secret $SecretString -AZKVaultName $AZKVaultName -ContentType $ContentType
+}
+
+function Remove-Secret
+{
+    param (
+        [string] $Name,
+        [string] $VaultName,
+        [hashtable] $AdditionalParameters
+    )
+
+    Check-SubscriptionLogIn $AdditionalParameters.SubscriptionId $AdditionalParameters.AZKVaultName
+
+    $null = Az.KeyVault\Remove-AzKeyVaultSecret -Name $Name -VaultName $AdditionalParameters.AZKVaultName -Force
+    return $?
+}
+
+function Get-SecretInfo
+{
+    param (
+        [string] $Filter,
+        [string] $VaultName,
+        [hashtable] $AdditionalParameters
+    )
+
+    Check-SubscriptionLogIn $AdditionalParameters.SubscriptionId $AdditionalParameters.AZKVaultName
+
+    if ([string]::IsNullOrEmpty($Filter))
+    {
+        $Filter = "*"
+    }
+
+    $pattern = [WildcardPattern]::new($Filter)
+
+    $vaultSecretInfos = Az.KeyVault\Get-AzKeyVaultSecret -VaultName $AdditionalParameters.AZKVaultName
+
+    foreach ($vaultSecretInfo in $vaultSecretInfos)
+    {
+        if ($pattern.IsMatch($vaultSecretInfo.Name))
+        {
+            Write-Output (
+                [Microsoft.PowerShell.SecretManagement.SecretInformation]::new(
+                    $vaultSecretInfo.Name,
+                    [Microsoft.PowerShell.SecretManagement.SecretType]::SecureString,
+                    $VaultName)
+            )
+        }
+    }
+}
+
+function Test-SecretVault
+{
+    param (
+        [string] $VaultName,
+        [hashtable] $AdditionalParameters
+    )
+
+    try
+    {
+        Check-SubscriptionLogIn $AdditionalParameters.SubscriptionId $AdditionalParameters.AZKVaultName
+    }
+    catch
+    {
+        Write-Error $_
+        return $false
+    }
+
+    return $true
+}

src/KeyVault/KeyVault/Az.KeyVault.psd1

@@ -73,7 +73,7 @@ RequiredAssemblies = 'Microsoft.Azure.KeyVault.dll',
 FormatsToProcess = 'KeyVault.format.ps1xml'
 
 # Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
-NestedModules = @('Microsoft.Azure.PowerShell.Cmdlets.KeyVault.dll')
+NestedModules = @('Microsoft.Azure.PowerShell.Cmdlets.KeyVault.dll', '.\Az.KeyVault.Extension')
 
 # Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
 FunctionsToExport = @()

src/KeyVault/KeyVault/KeyVault.csproj

@@ -28,7 +28,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <None Update="SecretManagementExtension\*" CopyToOutputDirectory="PreserveNewest" />
+    <None Update="Az.KeyVault.Extension\*" CopyToOutputDirectory="PreserveNewest" />
   </ItemGroup>
 
   <ItemGroup>