Skip to content

[KeyVault] adding soft-delete support for KeyVault certificates #4400

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 20 commits into from
Aug 28, 2017
Merged

[KeyVault] adding soft-delete support for KeyVault certificates #4400

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
7c3f73f
Merge remote-tracking branch 'refs/remotes/Azure/preview' into preview
May 5, 2017
de7528f
Merge remote-tracking branch 'refs/remotes/Azure/preview' into preview
Jun 27, 2017
5fdedbf
Merge remote-tracking branch 'refs/remotes/Azure/preview' into preview
Jun 27, 2017
e0d808a
Merge branch 'preview' of https://github.com/dragav/azure-powershell …
Jul 31, 2017
de26802
adding support for soft deletion of certificates
Jul 26, 2017
4cb144c
addressing review feedback
Aug 5, 2017
b892bcc
more review feedback - writing the deleted certificate on passthrough
Aug 5, 2017
6d44d10
Merge remote-tracking branch 'refs/remotes/Azure/preview' into featur…
Aug 7, 2017
0fdd3cc
restoring the PurgeDisabled flag, to prevent this from being a breaki…
Aug 7, 2017
468d2e9
Merge remote-tracking branch 'refs/remotes/Azure/release-4.3.0' into …
Aug 7, 2017
ee24b97
Merge branch 'release-4.3.0' into feature/updates4aug
dragav Aug 8, 2017
c083c5f
addressing breaking change issues uncovered by the official build
Aug 8, 2017
a8b3c4c
Reverting Certificate cmdlets to use PSH-defined types
Aug 25, 2017
6d4a184
Merge remote-tracking branch 'refs/remotes/Azure/preview' into featur…
Aug 25, 2017
54f758e
Merge remote-tracking branch 'refs/remotes/Azure/preview' into preview
Aug 25, 2017
10ea130
KeyVault: adding soft-delete support for certificates
Aug 25, 2017
1c69b0f
Merge branch 'feature/updates4aug' of https://github.com/dragav/azure…
Aug 25, 2017
8ac520a
reverting inadvertent change picked up from merge
Aug 25, 2017
d26cb1b
removing project references to Newtonsoft.Json v9
Aug 28, 2017
b71b908
[KeyVault] Suppressing exception for changing the return type of cmdl…
Aug 28, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 22 additions & 12 deletions src/ResourceManager/KeyVault/AzureRM.KeyVault.psd1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,29 +87,39 @@ CmdletsToExport = 'Add-AzureKeyVaultCertificate',
'Remove-AzureKeyVaultCertificateIssuer',
'Remove-AzureKeyVaultCertificateOperation',
'Set-AzureKeyVaultCertificateIssuer',
'Set-AzureKeyVaultCertificatePolicy', 'Get-AzureRmKeyVault',
'New-AzureRmKeyVault', 'Remove-AzureRmKeyVault',
'Undo-AzureRmKeyVaultRemoval', 'Remove-AzureRmKeyVaultAccessPolicy',
'Set-AzureRmKeyVaultAccessPolicy', 'Backup-AzureKeyVaultKey',
'Get-AzureKeyVaultKey', 'Get-AzureKeyVaultSecret',
'Undo-AzureKeyVaultKeyRemoval', 'Undo-AzureKeyVaultSecretRemoval',
'Add-AzureKeyVaultKey', 'Remove-AzureKeyVaultKey',
'Remove-AzureKeyVaultSecret', 'Restore-AzureKeyVaultKey',
'Set-AzureKeyVaultKeyAttribute', 'Set-AzureKeyVaultSecret',
'Set-AzureKeyVaultCertificatePolicy',
'Get-AzureRmKeyVault',
'New-AzureRmKeyVault',
'Remove-AzureRmKeyVault',
'Undo-AzureRmKeyVaultRemoval',
'Remove-AzureRmKeyVaultAccessPolicy',
'Set-AzureRmKeyVaultAccessPolicy',
'Backup-AzureKeyVaultKey',
'Get-AzureKeyVaultKey',
'Get-AzureKeyVaultSecret',
'Undo-AzureKeyVaultKeyRemoval',
'Undo-AzureKeyVaultSecretRemoval',
'Add-AzureKeyVaultKey',
'Remove-AzureKeyVaultKey',
'Remove-AzureKeyVaultSecret',
'Restore-AzureKeyVaultKey',
'Set-AzureKeyVaultKeyAttribute',
'Set-AzureKeyVaultSecret',
'Set-AzureKeyVaultSecretAttribute',
'Get-AzureKeyVaultCertificatePolicy',
'New-AzureKeyVaultCertificateAdministratorDetails',
'New-AzureKeyVaultCertificateOrganizationDetails',
'Backup-AzureKeyVaultSecret', 'Restore-AzureKeyVaultSecret',
'Backup-AzureKeyVaultSecret',
'Restore-AzureKeyVaultSecret',
'Get-AzureKeyVaultManagedStorageAccount',
'Add-AzureKeyVaultManagedStorageAccount',
'Remove-AzureKeyVaultManagedStorageAccount',
'Update-AzureKeyVaultManagedStorageAccount',
'Update-AzureKeyVaultManagedStorageAccountKey',
'Get-AzureKeyVaultManagedStorageSasDefinition',
'Set-AzureKeyVaultManagedStorageSasDefinition',
'Remove-AzureKeyVaultManagedStorageSasDefinition'

'Remove-AzureKeyVaultManagedStorageSasDefinition',
'Undo-AzureKeyVaultCertificateRemoval'
# Variables to export from this module
# VariablesToExport = @()

Expand Down
4 changes: 4 additions & 0 deletions src/ResourceManager/KeyVault/ChangeLog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,10 @@
## Version 3.3.0

## Version 3.2.1
* New/updated Cmdlets to support soft-delete for KeyVault certificates
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dragav please move this to under Current Release; the versions that are already listed are the notes from previous releases

* Get-AzureKeyVaultCertificate
* Remove-AzureKeyVaultCertificate
* Undo-AzureKeyVaultCertificateRemoval

## Version 3.2.0
* Remove email address from the directory query when -UserPrincipalName is specified to the Set-AzureRMKeyVaultAccessPolicy and Remove-AzureRMKeyVaultAccessPolicy cmdlets.
Expand Down
12 changes: 6 additions & 6 deletions src/ResourceManager/KeyVault/Commands.KeyVault.Test/Commands.KeyVault.Test.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,12 +65,12 @@
<Reference Include="Microsoft.Azure.Graph.RBAC">
<HintPath>..\..\..\packages\Microsoft.Azure.Graph.RBAC.3.4.0-preview\lib\net452\Microsoft.Azure.Graph.RBAC.dll</HintPath>
</Reference>
<Reference Include="Microsoft.Azure.KeyVault, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
<HintPath>..\..\..\packages\Microsoft.Azure.KeyVault.2.3.0-preview\lib\net452\Microsoft.Azure.KeyVault.dll</HintPath>
<Reference Include="Microsoft.Azure.KeyVault">
<HintPath>..\..\..\packages\Microsoft.Azure.KeyVault.2.3.2\lib\net452\Microsoft.Azure.KeyVault.dll</HintPath>
<Private>True</Private>
</Reference>
<Reference Include="Microsoft.Azure.KeyVault.WebKey, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
<HintPath>..\..\..\packages\Microsoft.Azure.KeyVault.WebKey.2.0.6\lib\net452\Microsoft.Azure.KeyVault.WebKey.dll</HintPath>
<Reference Include="Microsoft.Azure.KeyVault.WebKey">
<HintPath>..\..\..\packages\Microsoft.Azure.KeyVault.WebKey.2.0.7\lib\net452\Microsoft.Azure.KeyVault.WebKey.dll</HintPath>
<Private>True</Private>
</Reference>
<Reference Include="Microsoft.Azure.Management.Authorization">
Expand Down Expand Up @@ -138,9 +138,9 @@
<SpecificVersion>False</SpecificVersion>
<HintPath>..\..\..\packages\Moq.4.2.1510.2205\lib\net40\Moq.dll</HintPath>
</Reference>
<Reference Include="Newtonsoft.Json, Version=6.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
<SpecificVersion>False</SpecificVersion>
<Reference Include="Newtonsoft.Json">
<HintPath>..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll</HintPath>
<Private>True</Private>
</Reference>
<Reference Include="System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
<SpecificVersion>False</SpecificVersion>
Expand Down
111 changes: 74 additions & 37 deletions src/ResourceManager/KeyVault/Commands.KeyVault.Test/Scripts/Common.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -207,7 +207,16 @@ function Cleanup-OldCertificates
$certificatePattern = Get-CertificateName '*'
Get-AzureKeyVaultCertificate $keyVault |
Where-Object {$_.Name -like $certificatePattern} |
Remove-AzureKeyVaultCertificate -Force -Confirm:$false
Remove-AzureKeyVaultCertificate -Name $_.Name -VaultName $_.VaultName -Force -Confirm:$false

if($global:softDeleteEnabled -eq $true)
{
Get-AzureKeyVaultCertificate -VaultName $keyVault -InRemovedState |
Where-Object {$_.Name -like $certificatePattern} | %{
Remove-AzureKeyVaultCertificate -Name $_.Name -VaultName $_.VaultName -InRemovedState -Force -Confirm:$false
Wait-Seconds 5;
}
}
}

<#
Expand Down Expand Up @@ -313,50 +322,49 @@ function Cleanup-SingleKeyTest

function Cleanup-Key ([string]$keyName)
{
$oldPref = $ErrorActionPreference
$ErrorActionPreference = "Stop"
try
$oldPref = $ErrorActionPreference
$ErrorActionPreference = "Stop"
try
{
$keyVault = Get-KeyVault
Write-Debug "Removing key with name $_ in vault $keyVault"
$catch = Remove-AzureKeyVaultKey $keyVault $keyName -Force -Confirm:$false
if($global:softDeleteEnabled -eq $true)
{
$keyVault = Get-KeyVault
Write-Debug "Removing key with name $_ in vault $keyVault"
$catch = Remove-AzureKeyVaultKey $keyVault $keyName -Force -Confirm:$false
if($global:softDeleteEnabled -eq $true)
{
Wait-ForDeletedKey $keyVault $keyName
Remove-AzureKeyVaultKey $keyVault $keyName -Force -Confirm:$false -InRemovedState
}
Wait-ForDeletedKey $keyVault $keyName
Remove-AzureKeyVaultKey $keyVault $keyName -Force -Confirm:$false -InRemovedState
}
catch {

}
finally
{
$ErrorActionPreference = $oldPref
}
}
catch {

}
finally
{
$ErrorActionPreference = $oldPref
}
}

function Cleanup-Secret ([string]$secretName)
{
$oldPref = $ErrorActionPreference
$ErrorActionPreference = "Stop"
try
{
$keyVault = Get-KeyVault
Write-Debug "Removing secret with name $_ in vault $keyVault"
$catch = Remove-AzureKeyVaultSecret $keyVault $secretName -Force -Confirm:$false
if($global:softDeleteEnabled -eq $true)
{
Wait-ForDeletedSecret $keyVault $secretName
Remove-AzureKeyVaultSecret $keyVault $secretName -Force -Confirm:$false -InRemovedState
}
}
catch {

}
finally
$oldPref = $ErrorActionPreference
$ErrorActionPreference = "Stop"
try
{
$keyVault = Get-KeyVault
Write-Debug "Removing secret with name $_ in vault $keyVault"
$catch = Remove-AzureKeyVaultSecret $keyVault $secretName -Force -Confirm:$false
if($global:softDeleteEnabled -eq $true)
{
$ErrorActionPreference = $oldPref
Wait-ForDeletedSecret $keyVault $secretName
Remove-AzureKeyVaultSecret $keyVault $secretName -Force -Confirm:$false -InRemovedState
}
}
catch {
}
finally
{
$ErrorActionPreference = $oldPref
}
}

<#
Expand Down Expand Up @@ -389,6 +397,11 @@ function Cleanup-SingleCertificateTest
$keyVault = Get-KeyVault
Write-Debug "Removing certificate with name $_ in vault $keyVault"
$catch = Remove-AzureKeyVaultCertificate $keyVault $_ -Force -Confirm:$false
if($global:softDeleteEnabled -eq $true)
{
Wait-ForDeletedCertificate $keyVault $_
Remove-AzureKeyVaultCertificate $keyVault $_ -Force -Confirm:$false -InRemovedState
}
}
catch
{
Expand Down Expand Up @@ -452,6 +465,30 @@ function Wait-ForDeletedSecret ([string] $vault, [string] $secretName)
return $secret
}

<#
.SYNOPSIS
Waits for a deleted certificate to show up.
#>
function Wait-ForDeletedCertificate ([string] $vault, [string] $certName)
{
$cert = $null
do {
try
{
$cert = Get-AzureKeyVaultCertificate -VaultName $vault -Name $certName -InRemovedState
}
catch
{
# Certificate is not found.
$cert = $null
Write-Host "Sleeping for 5 seconds to wait for deleted certificate $certName"
Wait-Seconds 5
}
} while($cert -ne $null)

return $cert
}

<#
.SYNOPSIS
Removes all managed storage accounts.
Expand Down
3 changes: 2 additions & 1 deletion ...eManager/KeyVault/Commands.KeyVault.Test/Scripts/ControlPlane/KeyVaultManagementTests.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,8 @@ function Get-AllCertPermissions
"listissuers",
"managecontacts",
"manageissuers",
"setissuers"
"setissuers",
"recover"
)
}

Expand Down
24 changes: 18 additions & 6 deletions src/ResourceManager/KeyVault/Commands.KeyVault.Test/Scripts/RunKeyVaultTests.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,10 @@ If true, then tests that require a premium vault are skipped (optional).
The object ID of the user (optional). If no object ID is provided, then
the object ID is extracted from whomever is currently logged in.

.PARAMETER SoftDeleteEnabled
If true, turns on 'soft-delete' mode for tests: vault is created as soft-delete-enabled (if not exists), soft-delete
tests are executed, delete + purge sequence is used for clean-up.

.PARAMETER NoADCmdLetMode
If true, then active directory related tests are skipped.

Expand Down Expand Up @@ -249,16 +253,24 @@ function Run-AllDataPlaneTests
Run-TestProtected { Run-KeyTest {Test_GetDeletedKeys} "Test_GetDeletedKeys" } "Test_GetDeletedKeys"
Run-TestProtected { Run-KeyTest {Test_UndoRemoveKey} "Test_UndoRemoveKey" } "Test_UndoRemoveKey"
Run-TestProtected { Run-KeyTest {Test_RemoveDeletedKey} "Test_RemoveDeletedKey" } "Test_RemoveDeletedKey"
Run-TestProtected { Run-KeyTest {Test_RemoveNonExistKey} "Test_RemoveNonExistDeletedKey" } "Test_RemoveNonExistDeletedKey"
Run-TestProtected { Run-KeyTest {Test_RemoveNonExistDeletedKey} "Test_RemoveNonExistDeletedKey" } "Test_RemoveNonExistDeletedKey"
Run-TestProtected { Run-KeyTest {Test_PipelineRemoveDeletedKeys} "Test_PipelineRemoveDeletedKeys" } "Test_PipelineRemoveDeletedKeys"

# Secret soft delete tests
Run-TestProtected { Run-KeyTest {Test_GetDeletedKey} "Test_GetDeletedSecret" } "Test_GetDeletedKey"
Run-TestProtected { Run-KeyTest {Test_GetDeletedKey} "Test_GetDeletedSecret" } "Test_GetDeletedSecret"
Run-TestProtected { Run-KeyTest {Test_GetDeletedKeys} "Test_GetDeletedSecrets" } "Test_GetDeletedSecrets"
Run-TestProtected { Run-KeyTest {Test_UndoRemoveKey} "Test_UndoRemoveSecret" } "Test_UndoRemoveSecret"
Run-TestProtected { Run-KeyTest {Test_RemoveDeletedKey} "Test_RemoveDeletedSecret" } "Test_RemoveDeletedSecret"
Run-TestProtected { Run-KeyTest {Test_RemoveNonExistKey} "Test_RemoveNonExistDeletedSecret" } "Test_RemoveNonExistDeletedSecret"
Run-TestProtected { Run-KeyTest {Test_PipelineRemoveDeletedKeys} "Test_PipelineRemoveDeletedSecrets" } "Test_PipelineRemoveDeletedSecrets"
Run-TestProtected { Run-KeyTest {Test_UndoRemoveSecret} "Test_UndoRemoveSecret" } "Test_UndoRemoveSecret"
Run-TestProtected { Run-KeyTest {Test_RemoveDeletedSecret} "Test_RemoveDeletedSecret" } "Test_RemoveDeletedSecret"
Run-TestProtected { Run-KeyTest {Test_RemoveNonExistDeletedSecret} "Test_RemoveNonExistDeletedSecret" } "Test_RemoveNonExistDeletedSecret"
Run-TestProtected { Run-KeyTest {Test_PipelineRemoveDeletedSecrets} "Test_PipelineRemoveDeletedSecrets" } "Test_PipelineRemoveDeletedSecrets"

# certificate soft delete tests
Run-TestProtected { Run-KeyTest {Test_GetDeletedCertificate} "Test_GetDeletedCertificate" } "Test_GetDeletedCertificate"
Run-TestProtected { Run-KeyTest {Test_GetDeletedCertificates} "Test_GetDeletedCertificates" } "Test_GetDeletedCertificates"
Run-TestProtected { Run-KeyTest {Test_UndoRemoveCertificate} "Test_UndoRemoveCertificate" } "Test_UndoRemoveCertificate"
Run-TestProtected { Run-KeyTest {Test_RemoveDeletedCertificate} "Test_RemoveDeletedCertificate" } "Test_RemoveDeletedCertificate"
Run-TestProtected { Run-KeyTest {Test_RemoveNonExistDeletedCertificate} "Test_RemoveNonExistDeletedCertificate" } "Test_RemoveNonExistDeletedCertificate"
Run-TestProtected { Run-KeyTest {Test_PipelineRemoveDeletedCertificates} "Test_PipelineRemoveDeletedCertificate" } "Test_PipelineRemoveDeletedCertificates"
}

# Add-AzureKeyVaultKey tests.
Expand Down
Loading