Skip to content

Commit 39d3271

Browse files
fiddlermikeyfiddlermikey
authored
Merge pull request #37 from Keyfactor/full-chain-inclusion-bug-fix
Full chain inclusion bug fix
2 parents efe49ad + 2d65207 commit 39d3271

File tree

7 files changed

+62
-57
lines changed

7 files changed

+62
-57
lines changed

‎.github/workflows/keyfactor-starter-workflow.yml‎

Lines changed: 16 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,19 @@
1-
name: Starter Workflow
2-
on: [workflow_dispatch, push, pull_request]
1+
name: Keyfactor Bootstrap Workflow
32

4-
jobs:
5-
call-create-github-release-workflow:
6-
uses: Keyfactor/actions/.github/workflows/github-release.yml@main
7-
8-
call-assign-from-json-workflow:
9-
uses: Keyfactor/actions/.github/workflows/assign-env-from-json.yml@main
10-
11-
call-dotnet-build-and-release-workflow:
12-
needs: [call-create-github-release-workflow, call-assign-from-json-workflow]
13-
uses: Keyfactor/actions/.github/workflows/dotnet-build-and-release.yml@main
14-
with:
15-
release_version: ${{ needs.call-create-github-release-workflow.outputs.release_version }}
16-
release_url: ${{ needs.call-create-github-release-workflow.outputs.release_url }}
17-
release_dir: ${{ needs.call-assign-from-json-workflow.outputs.release_dir }}
18-
19-
secrets:
20-
token: ${{ secrets.PRIVATE_PACKAGE_ACCESS }}
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
types: [opened, closed, synchronize, edited, reopened]
7+
push:
8+
create:
9+
branches:
10+
- 'release-*.*'
2111

22-
call-generate-readme-workflow:
23-
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
24-
uses: Keyfactor/actions/.github/workflows/generate-readme.yml@main
12+
jobs:
13+
call-starter-workflow:
14+
uses: keyfactor/actions/.github/workflows/starter.yml@v2
2515
secrets:
26-
token: ${{ secrets.APPROVE_README_PUSH }}
27-
28-
call-update-catalog-workflow:
29-
needs: call-assign-from-json-workflow
30-
if: needs.call-assign-from-json-workflow.outputs.update_catalog == 'True' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
31-
uses: Keyfactor/actions/.github/workflows/update-catalog.yml@main
32-
secrets:
33-
token: ${{ secrets.SDK_SYNC_PAT }}
34-
16+
token: ${{ secrets.V2BUILDTOKEN}}
17+
APPROVE_README_PUSH: ${{ secrets.APPROVE_README_PUSH}}
18+
gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }}
19+
gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }}

‎AzureKeyVault/AzureClient.cs‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
using Azure.ResourceManager.KeyVault.Models;
1919
using Azure.ResourceManager.Resources;
2020
using Azure.Security.KeyVault.Certificates;
21+
using Azure.Security.KeyVault.Secrets;
2122
using Keyfactor.Logging;
2223
using Keyfactor.Orchestrators.Common.Enums;
2324
using Keyfactor.Orchestrators.Extensions;
@@ -28,7 +29,7 @@ namespace Keyfactor.Extensions.Orchestrator.AzureKeyVault
2829
public class AzureClient
2930
{
3031
internal protected virtual AkvProperties VaultProperties { get; set; }
31-
32+
private SecretClient _secretClient;
3233
private Uri AzureCloudEndpoint
3334
{
3435
get
@@ -82,7 +83,7 @@ private protected virtual CertificateClient CertClient
8283
cred = new ClientSecretCredential(VaultProperties.TenantId, VaultProperties.ClientId, VaultProperties.ClientSecret, new ClientSecretCredentialOptions() { AuthorityHost = AzureCloudEndpoint, AdditionallyAllowedTenants = { "*" } });
8384
logger.LogTrace("generated credentials", cred);
8485
}
85-
86+
_secretClient = new SecretClient(new Uri(VaultProperties.VaultURL), credential: cred);
8687
_certClient = new CertificateClient(new Uri(VaultProperties.VaultURL), credential: cred);
8788

8889
return _certClient;
@@ -211,10 +212,21 @@ public virtual async Task<KeyVaultCertificateWithPolicy> ImportCertificateAsync(
211212
}
212213
logger.LogTrace("begin creating x509 certificate from contents.");
213214
var bytes = Convert.FromBase64String(contents);
214-
var x509 = new X509Certificate2(bytes, pfxPassword, X509KeyStorageFlags.Exportable);
215-
var certWithKey = x509.Export(X509ContentType.Pkcs12);
215+
216+
var x509Collection = new X509Certificate2Collection();//(bytes, pfxPassword, X509KeyStorageFlags.Exportable);
217+
218+
x509Collection.Import(bytes, pfxPassword, X509KeyStorageFlags.Exportable);
219+
220+
var certWithKey = x509Collection.Export(X509ContentType.Pkcs12);
221+
222+
216223
logger.LogTrace($"importing created x509 certificate named {1}", certName);
224+
logger.LogTrace($"There are {x509Collection.Count} certificates in the chain.");
217225
var cert = await CertClient.ImportCertificateAsync(new ImportCertificateOptions(certName, certWithKey));
226+
227+
// var fullCert = _secretClient.GetSecret(certName);
228+
// The certificate must be retrieved as a secret from AKV in order to have the full chain included.
229+
218230
return cert;
219231
}
220232
catch (Exception ex)

‎AzureKeyVault/AzureKeyVault.csproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
<PackageReference Include="Azure.ResourceManager.Resources" Version="1.4.0" />
3030
<PackageReference Include="Azure.Security.KeyVault.Administration" Version="4.3.0" />
3131
<PackageReference Include="Azure.Security.KeyVault.Certificates" Version="4.5.1" />
32+
<PackageReference Include="Azure.Security.KeyVault.Secrets" Version="4.5.0" />
3233
<PackageReference Include="Azure.Storage.Blobs" Version="12.16.0" />
3334
<PackageReference Include="CSS.Common" Version="1.7.0" />
3435
<PackageReference Include="Keyfactor.Common" Version="2.3.7" />

‎AzureKeyVault/Jobs/Inventory.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ public JobResult ProcessJob(InventoryJobConfiguration config, SubmitInventoryUpd
3535

3636
try
3737
{
38-
logger.LogDebug($"Making Request for {0}...", VaultProperties.VaultURL);
38+
logger.LogDebug($"Making Request for {VaultProperties.VaultURL}...");
3939

4040
inventoryItems = AzClient.GetCertificatesAsync().Result?.ToList();
4141

‎CHANGELOG.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
- 3.1.2
2+
- Fixed bug that was preventing the full certificate chain from being sent to the Azure Keyvault API endpoint.
3+
4+
- 3.1.1
5+
- Updated documentation to clarify required orchestrator access.
16

27
- 3.1.1
38
- Documentation updates

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ The Universal Orchestrator is the successor to the Windows Orchestrator. This Or
1616

1717
## Support for Azure Key Vault Orchestrator
1818

19-
Azure Key Vault Orchestrator is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket with your Keyfactor representative.
19+
Azure Key Vault Orchestrator is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com
2020

2121
###### To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab.
2222

‎integration-manifest.json‎

Lines changed: 22 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,12 @@
77
"link_github": true,
88
"release_dir": "AzureKeyVault\\bin\\Release",
99
"support_level": "kf-supported",
10+
"release_dir": "AzureKeyVault\\bin\\Release",
1011
"description": "This integration allows the orchestrator to act as a client with access to an instance of the Azure Key Vault; allowing you to manage your certificates stored in the Azure Keyvault via Keyfactor.",
1112
"about": {
1213
"orchestrator": {
1314
"UOFramework": "10.1",
15+
"keyfactor_platform_version": "9.1",
1416
"pam_support": true,
1517
"win": {
1618
"supportsCreateStore": true,
@@ -32,17 +34,20 @@
3234
},
3335
"store_types": [
3436
{
35-
"Name": "Azure Keyvault",
36-
"ShortName": "AKV",
37+
"BlueprintAllowed": false,
3738
"Capability": "AKV",
39+
"CustomAliasAllowed": "Optional",
40+
"EntryParameters": null,
41+
"JobProperties": [],
3842
"LocalStore": false,
39-
"SupportedOperations": {
40-
"Add": true,
41-
"Create": true,
42-
"Discovery": true,
43-
"Enrollment": false,
44-
"Remove": true
43+
"Name": "Azure Keyvault",
44+
"PasswordOptions": {
45+
"EntrySupported": false,
46+
"StoreRequired": false,
47+
"Style": "Default"
4548
},
49+
"PowerShell": false,
50+
"PrivateKeyAllowed": "Optional",
4651
"Properties": [
4752
{
4853
"Name": "TenantId",
@@ -85,20 +90,17 @@
8590
"Required": false
8691
}
8792
],
88-
"EntryParameters": null,
89-
"PasswordOptions": {
90-
"EntrySupported": false,
91-
"StoreRequired": false,
92-
"Style": "Default"
93-
},
93+
"ServerRequired": true,
94+
"ShortName": "AKV",
9495
"StorePathType": "",
9596
"StorePathValue": "",
96-
"PrivateKeyAllowed": "Optional",
97-
"JobProperties": [],
98-
"ServerRequired": true,
99-
"PowerShell": false,
100-
"BlueprintAllowed": false,
101-
"CustomAliasAllowed": "Optional"
97+
"SupportedOperations": {
98+
"Add": true,
99+
"Create": true,
100+
"Discovery": true,
101+
"Enrollment": false,
102+
"Remove": true
103+
}
102104
}
103105

104106
]

0 commit comments

Comments
 (0)