AzureLocal.LocalIdentity.AdminSetup

PowerShell module for managing local (AD-less) identity and PKU2U certificate-based
admin accounts on Azure Local (Azure Stack HCI) workgroup clusters.

This module enables full lifecycle management of local cluster administrators on
workgroup-joined Azure Local nodes that do not have access to Active Directory.
It configures the host for cross-machine local-account remoting (WinRM, CredSSP,
TrustedHosts, firewall, LocalAccountTokenFilterPolicy, and credential-delegation
group policy), enables PKU2U via registry, provisions PKU2U authority and user
certificates into the correct stores with private-key ACLs for required services,
and creates / removes local admin accounts either directly on the current node
or cluster-wide across an Azure Local deployment.

Exported functions:

 Set-AzureLocalRemotingConfiguration
     Configures the local machine for workgroup cluster remoting: WinRM,
     TrustedHosts, firewall rules, CredSSP (client + server), WSMan certificate
     auth, PKU2U registry settings, local group policy for credential delegation,
     and restarts the WinRM service.

 New-AzureLocalAdminWithCertificates
     Creates a local admin user on the current node and installs the supplied
     PKU2U authority (root CA) and user PFX certificate files into the correct
     certificate stores. Use this when you already have the PFX files on disk.

 New-AzureLocalAdminFromKeyVault
     Downloads the PKU2U authority and user certificates from an Azure Key Vault,
     re-exports them as password-protected PFX files on disk, then creates the
     local admin user and installs the certificates for PKU2U authentication.

 New-AzureLocalAdminFromKeyVaultInMemory
     Same as New-AzureLocalAdminFromKeyVault but never writes the
     certificate material to disk. Certificates are downloaded as raw bytes
     and imported directly into the certificate stores.

 New-AzureLocalLocalAdminAccount
     Cluster-wide creation of a local admin account on an Azure Local
     deployment. Provisions the account, certificates, and remoting
     configuration consistently on every node in the cluster. The PKU2U
     authority name is derived from the account name by appending "AU".

 Remove-AzureLocalLocalAdminAccount
     Cluster-wide removal of one or more local admin accounts from every node
     in an Azure Local deployment.

 Remove-AzureLocalExpiredLocalAdminAccounts
     Cluster-wide cleanup of expired local admin accounts from every node in
     an Azure Local deployment.

Usage examples:

 # 1. Prepare the local node for workgroup-cluster remoting (trust two nodes)
 Set-AzureLocalRemotingConfiguration -TrustedHosts 'node1,node2'

 # 2. Create a local cluster admin from PFX files already on disk
 $pwd = Read-Host -AsSecureString 'Local user password'
 New-AzureLocalAdminWithCertificates `
     -Username 'ClusterAdmin' -UserPassword $pwd `
     -UserCertName 'C:\Certs\user.pfx' `
     -AuthorityCertName 'C:\Certs\root.pfx' `
     -CertPath 'C:\Certs' -Nodes @('node1','node2')

 # 3. Create a local cluster admin from certificates in Azure Key Vault
 New-AzureLocalAdminFromKeyVault `
     -VaultName 'MyVault' -Username 'ClusterAdmin' -UserPassword $pwd `
     -UserCertName 'pku2u-user' -AuthorityCertName 'pku2u-root' `
     -CertPath 'C:\Certs' -ClusterName 'MyCluster'

 # 4. Same as #3 but never write the PFX files to disk
 New-AzureLocalAdminFromKeyVaultInMemory `
     -VaultName 'MyVault' -Username 'ClusterAdmin' -UserPassword $pwd `
     -UserCertName 'pku2u-user' -AuthorityCertName 'pku2u-root' `
     -ClusterName 'MyCluster'

 # 5. Cluster-wide account lifecycle to be ran on an Azure Local node
 New-AzureLocalLocalAdminAccount -AccountName 'ops1'
 Remove-AzureLocalLocalAdminAccount -AccountNames @('ops1','ops2')
 Remove-AzureLocalExpiredLocalAdminAccounts