Skip to content

Feat/pam extension support #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
indrora merged 10 commits into from
Jul 13, 2026
Merged

Feat/pam extension support #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
29776d5
Merge pull request #11 from Keyfactor/release-2.0
spbsoluble Nov 11, 2025
c4dd4ca
Added Pam Extension support for inventory and management jobs
CoconutMage Jun 26, 2026
4780ea2
docs: auto-generate README and documentation [skip ci]
github-actions[bot] Jun 26, 2026
7d1abce
Dummy Commit
CoconutMage Jun 30, 2026
46557f6
docs: auto-generate README and documentation [skip ci]
github-actions[bot] Jun 30, 2026
cba9c9d
[skip ci] Update keyfactor-release-workflow.yml
indrora Jun 30, 2026
dbdc250
Merge branch 'release-2.0' into feat/pam-extension-support
CoconutMage Jul 1, 2026
6abb465
Changelog + logging change
CoconutMage Jul 8, 2026
1b5b3f2
docs: auto-generate README and documentation [skip ci]
github-actions[bot] Jul 8, 2026
2945e0d
Removed secret logging
CoconutMage Jul 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
# v2.0.1
- Added PAM resolution support
# v2.0.0
- .Net 6 and .Net 8 Support and Documentation Updates
# v1.0.0
Expand Down
3 changes: 1 addition & 2 deletions Kemp.sln
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@

Microsoft Visual Studio Solution File, Format Version 12.00
Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 17
VisualStudioVersion = 17.11.35222.181
MinimumVisualStudioVersion = 10.0.40219.1
Expand Down
255 changes: 131 additions & 124 deletions Kemp/Jobs/Inventory.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,126 +1,133 @@
using System;
using System.IO;
using System.Linq;
using System.Xml.Serialization;
using Keyfactor.Extensions.Orchestrator.Kemp.Client;
using Keyfactor.Extensions.Orchestrator.Kemp.Client.Models;
using Keyfactor.Logging;
using Keyfactor.Orchestrators.Common.Enums;
using Keyfactor.Orchestrators.Extensions;
using Microsoft.Extensions.Logging;
using Newtonsoft.Json;

namespace Keyfactor.Extensions.Orchestrator.Kemp.Jobs
{
public class Inventory : IInventoryJobExtension
{
private readonly ILogger<Inventory> _logger;

public Inventory(ILogger<Inventory> logger)
{
_logger = logger;
}

public string ExtensionName => "Kemp";

public JobResult ProcessJob(InventoryJobConfiguration jobConfiguration,
SubmitInventoryUpdate submitInventoryUpdate)
{
try
{
_logger.MethodEntry();
return PerformInventory(jobConfiguration, submitInventoryUpdate);
}
catch (Exception e)
{
_logger.LogError($"Error occured in Inventory.ProcessJob: {LogHandler.FlattenException(e)}");
throw;
}
}

private JobResult PerformInventory(InventoryJobConfiguration config, SubmitInventoryUpdate submitInventory)
{
try
{
_logger.MethodEntry(LogLevel.Debug);
_logger.LogTrace($"Inventory Config {JsonConvert.SerializeObject(config)}");
_logger.LogTrace(
$"Client Machine: {config.CertificateStoreDetails.ClientMachine} ApiKey: {config.ServerPassword}");

var client = new KempClient(config);

var certificatesResult = client.GetCertificates().Result;
var intermediateCertificates = client.GetIntermediateCertificates().Result;

//Debug Write Certificate List Response from Palo Alto
var listWriter = new StringWriter();
var listSerializer = new XmlSerializer(typeof(CertListResponse));
listSerializer.Serialize(listWriter, certificatesResult);
_logger.LogTrace($"Certificate List Result {listWriter}");

//Debug Write Intermediate Certificate List Response from Palo Alto
var intListWriter = new StringWriter();
var intListSerializer = new XmlSerializer(typeof(CertListResponse));
intListSerializer.Serialize(intListWriter, intermediateCertificates);
_logger.LogTrace($"Intermediate List Result {intListWriter}");

var inventoryItems = (from cert in certificatesResult?.Success?.Data?.Certs
let certPem = client.GetCertificate(cert.Name).Result
select BuildInventoryItem(cert.Name, certPem.Success.Data.Certificate, true)).ToList();
inventoryItems.AddRange(from cert in intermediateCertificates?.Success?.Data?.Certs
let certPem = client.GetIntermediateCertificate(cert.Name).Result
select BuildInventoryItem(cert.Name, certPem.Success.Data.Certificate, false));

_logger.LogTrace("Submitting Inventory To Keyfactor via submitInventory.Invoke");
submitInventory.Invoke(inventoryItems);
_logger.LogTrace("Submitted Inventory To Keyfactor via submitInventory.Invoke");

_logger.MethodExit(LogLevel.Debug);

_logger.LogTrace("Return Success");
return new JobResult
{
Result = OrchestratorJobStatusJobResult.Success,
JobHistoryId = config.JobHistoryId,
FailureMessage = ""
};
}
catch (Exception e)
using Keyfactor.Extensions.Orchestrator.Kemp.Client;
using Keyfactor.Extensions.Orchestrator.Kemp.Client.Models;
using Keyfactor.Logging;
using Keyfactor.Orchestrators.Common.Enums;
using Keyfactor.Orchestrators.Extensions;
using Keyfactor.Orchestrators.Extensions.Interfaces;
using Microsoft.Extensions.Logging;
using Newtonsoft.Json;
using System;
using System.IO;
using System.Linq;
using System.Xml.Linq;
using System.Xml.Serialization;
using static Org.BouncyCastle.Math.EC.ECCurve;

namespace Keyfactor.Extensions.Orchestrator.Kemp.Jobs
{
public class Inventory : IInventoryJobExtension
{
public IPAMSecretResolver _resolver;
public string ExtensionName => "Kemp";
private ILogger _logger;

public Inventory(IPAMSecretResolver resolver)
{
_resolver = resolver;
}

public JobResult ProcessJob(InventoryJobConfiguration jobConfiguration, SubmitInventoryUpdate submitInventoryUpdate)
{
_logger = LogHandler.GetClassLogger(this.GetType());
_logger.MethodEntry();

try
{
return new JobResult
{
Result = OrchestratorJobStatusJobResult.Failure,
JobHistoryId = config.JobHistoryId,
FailureMessage = LogHandler.FlattenException(e)
};
}
}

protected virtual CurrentInventoryItem BuildInventoryItem(string alias, string certPem, bool privateKey)
{
try
{
_logger.MethodEntry();
_logger.LogTrace($"Alias: {alias} Pem: {certPem} PrivateKey: {privateKey}");


var acsi = new CurrentInventoryItem
{
Alias = alias,
Certificates = new[] {certPem},
ItemStatus = OrchestratorInventoryItemStatus.Unknown,
PrivateKeyEntry = privateKey,
UseChainLevel = false
};

_logger.MethodExit();
return acsi;
}
catch (Exception e)
{
_logger.LogError($"Error Occurred in Inventory.BuildInventoryItem: {LogHandler.FlattenException(e)}");
throw;
}
}
}
string password = PAMUtilities.ResolvePAMField(_resolver, _logger, "Kemp ApiKey", jobConfiguration.ServerPassword);
jobConfiguration.ServerPassword = password;

return PerformInventory(jobConfiguration, submitInventoryUpdate);
}
catch (Exception e)
{
_logger.LogError($"Error occured in Inventory.ProcessJob: {LogHandler.FlattenException(e)}");
throw;
}
}

private JobResult PerformInventory(InventoryJobConfiguration config, SubmitInventoryUpdate submitInventory)
{
try
{
_logger.MethodEntry(LogLevel.Debug);

_logger.LogTrace(
$"Client Machine: {config.CertificateStoreDetails.ClientMachine} ApiKey: *********");

var client = new KempClient(config);

var certificatesResult = client.GetCertificates().Result;
var intermediateCertificates = client.GetIntermediateCertificates().Result;

//Debug Write Certificate List Response from Palo Alto
var listWriter = new StringWriter();
var listSerializer = new XmlSerializer(typeof(CertListResponse));
listSerializer.Serialize(listWriter, certificatesResult);
_logger.LogTrace($"Certificate List Result {listWriter}");

//Debug Write Intermediate Certificate List Response from Palo Alto
var intListWriter = new StringWriter();
var intListSerializer = new XmlSerializer(typeof(CertListResponse));
intListSerializer.Serialize(intListWriter, intermediateCertificates);
_logger.LogTrace($"Intermediate List Result {intListWriter}");

var inventoryItems = (from cert in certificatesResult?.Success?.Data?.Certs
let certPem = client.GetCertificate(cert.Name).Result
select BuildInventoryItem(cert.Name, certPem.Success.Data.Certificate, true)).ToList();
inventoryItems.AddRange(from cert in intermediateCertificates?.Success?.Data?.Certs
let certPem = client.GetIntermediateCertificate(cert.Name).Result
select BuildInventoryItem(cert.Name, certPem.Success.Data.Certificate, false));

_logger.LogTrace("Submitting Inventory To Keyfactor via submitInventory.Invoke");
submitInventory.Invoke(inventoryItems);
_logger.LogTrace("Submitted Inventory To Keyfactor via submitInventory.Invoke");

_logger.MethodExit(LogLevel.Debug);

_logger.LogTrace("Return Success");
return new JobResult
{
Result = OrchestratorJobStatusJobResult.Success,
JobHistoryId = config.JobHistoryId,
FailureMessage = ""
};
}
catch (Exception e)
{
return new JobResult
{
Result = OrchestratorJobStatusJobResult.Failure,
JobHistoryId = config.JobHistoryId,
FailureMessage = LogHandler.FlattenException(e)
};
}
}

protected virtual CurrentInventoryItem BuildInventoryItem(string alias, string certPem, bool privateKey)
{
try
{
_logger.MethodEntry();
_logger.LogTrace($"Alias: {alias} Pem: {certPem} PrivateKey: *******");


var acsi = new CurrentInventoryItem
{
Alias = alias,
Certificates = new[] {certPem},
ItemStatus = OrchestratorInventoryItemStatus.Unknown,
PrivateKeyEntry = privateKey,
UseChainLevel = false
};

_logger.MethodExit();
return acsi;
}
catch (Exception e)
{
_logger.LogError($"Error Occurred in Inventory.BuildInventoryItem: {LogHandler.FlattenException(e)}");
throw;
}
}
}
}
42 changes: 21 additions & 21 deletions Kemp/Jobs/Management.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,17 +1,18 @@
using System;
using System.IO;
using System.Linq;
using System.Text;
using Keyfactor.Extensions.Orchestrator.Kemp.Client;
using Keyfactor.Extensions.Orchestrator.Kemp.Client;
using Keyfactor.Extensions.Orchestrator.Kemp.Client.Models;
using Keyfactor.Logging;
using Keyfactor.Orchestrators.Common.Enums;
using Keyfactor.Orchestrators.Extensions;
using Keyfactor.Orchestrators.Extensions.Interfaces;
using Microsoft.Extensions.Logging;
using Newtonsoft.Json;
using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.OpenSsl;
using Org.BouncyCastle.Pkcs;
using System;
using System.IO;
using System.Linq;
using System.Text;

namespace Keyfactor.Extensions.Orchestrator.Kemp.Jobs
{
Expand All @@ -23,23 +24,27 @@ public class Management : IManagementJobExtension
private static readonly Func<string, string> Pemify = ss =>
ss.Length <= 64 ? ss : ss.Substring(0, 64) + "\n" + Pemify(ss.Substring(64));

private readonly ILogger<Management> _logger;
public IPAMSecretResolver _resolver;
public string ExtensionName => "Kemp";
private ILogger _logger;

public Management(ILogger<Management> logger)
public Management(IPAMSecretResolver resolver)
{
_logger = logger;
_resolver = resolver;
}

protected internal virtual AsymmetricKeyEntry KeyEntry { get; set; }

public string ExtensionName => "Kemp";


public JobResult ProcessJob(ManagementJobConfiguration jobConfiguration)
{
_logger = LogHandler.GetClassLogger(this.GetType());
_logger.MethodEntry();

try
{
_logger.MethodEntry();
string password = PAMUtilities.ResolvePAMField(_resolver, _logger, "Kemp ApiKey", jobConfiguration.ServerPassword);
jobConfiguration.ServerPassword = password;

_logger.MethodExit();
Comment thread
irby marked this conversation as resolved.
return PerformManagement(jobConfiguration);
}
Expand All @@ -66,13 +71,11 @@ private JobResult PerformManagement(ManagementJobConfiguration config)
if (config.OperationType.ToString() == "Add")
{
_logger.LogTrace("Adding...");
_logger.LogTrace($"Add Config Json {JsonConvert.SerializeObject(config)}");
complete = PerformAddition(config);
}
else if (config.OperationType.ToString() == "Remove")
{
_logger.LogTrace("Removing...");
_logger.LogTrace($"Remove Config Json {JsonConvert.SerializeObject(config)}");
complete = PerformRemoval(config);
}

Expand All @@ -94,7 +97,7 @@ private JobResult PerformRemoval(ManagementJobConfiguration config)
_logger.MethodEntry();

_logger.LogTrace(
$"Credentials JSON: Url: {config.CertificateStoreDetails.ClientMachine} Password: {config.ServerPassword}");
$"Credentials JSON: Url: {config.CertificateStoreDetails.ClientMachine} Password: **********");


var client = new KempClient(config);
Expand Down Expand Up @@ -132,7 +135,7 @@ private JobResult PerformAddition(ManagementJobConfiguration config)
{
_logger.MethodEntry();
_logger.LogTrace(
$"Credentials JSON: Url: {config.CertificateStoreDetails.ClientMachine} Password: {config.ServerPassword}");
$"Credentials JSON: Url: {config.CertificateStoreDetails.ClientMachine} Password: *********");


var client = new KempClient(config);
Expand All @@ -148,7 +151,7 @@ private JobResult PerformAddition(ManagementJobConfiguration config)
_logger.LogTrace("Either not a duplicate or overwrite was chosen....");
if (hasPrivateKey) // This is a PFX Entry
{
_logger.LogTrace($"Found Private Key {config.JobCertificate.PrivateKeyPassword}");
_logger.LogTrace($"Found Private Key *******");

if (string.IsNullOrWhiteSpace(config.JobCertificate.Alias))
_logger.LogTrace("No Alias Found");
Expand Down Expand Up @@ -178,20 +181,17 @@ private JobResult PerformAddition(ManagementJobConfiguration config)
alias = p.Aliases.Cast<string>().SingleOrDefault(a => p.IsKeyEntry(a));
_logger.LogTrace($"Alias = {alias}");
var publicKey = p.GetCertificate(alias).Certificate.GetPublicKey();
_logger.LogTrace($"publicKey = {publicKey}");
KeyEntry = p.GetKey(alias);
_logger.LogTrace($"KeyEntry = {KeyEntry}");
if (KeyEntry == null) throw new Exception("Unable to retrieve private key");

var privateKey = KeyEntry.Key;
_logger.LogTrace($"privateKey = {privateKey}");
var keyPair = new AsymmetricCipherKeyPair(publicKey, privateKey);

pemWriter.WriteObject(keyPair.Private);
streamWriter.Flush();
privateKeyString = Encoding.ASCII.GetString(memoryStream.GetBuffer()).Trim()
.Replace("\r", "").Replace("\0", "");
_logger.LogTrace($"Got Private Key String {privateKeyString}");
_logger.LogTrace($"Got Private Key String *******");
memoryStream.Close();
streamWriter.Close();
_logger.LogTrace("Finished Extracting Private Key...");
Expand Down
Loading
Loading