Backends/Set-VaultPassword.ps1
|
# Example Custom-backend handler script for Posh-SecretRotation. # # customHandler.scriptPath in the config points at a file like this one; customHandler.functionName # names the function below. Invoke-SecretRotationCustomHandler dot-sources this file and calls that # function with a fixed contract - copy this file, rename the function, and replace the body with # whatever your real backend needs (a REST call, a CLI tool, a database update, etc.). # # Contract: # -Identifier the account identity on your backend (target.backendConfig.identity) # -Password SecureString or String, per this target's 'passwordRepresentation' config # -BackendConfig the target's full merged backendConfig hashtable (identity plus anything else # you added, e.g. an API endpoint or vault path) # Signal success by returning normally; signal failure by throwing. No status/boolean return # value is inspected. function Set-VaultAccountPassword { [CmdletBinding()] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingPlainTextForPassword', 'Password', Justification = 'Type is deliberately declared by this target''s passwordRepresentation config, not fixed here''s "Password representation per backend" table.')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '', Justification = 'This is a placeholder template (throws unconditionally) - a real implementation performing an actual state change should add ShouldProcess support when replacing this body.')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', '', Justification = 'Placeholder template body only throws; a real implementation replacing this body is expected to use $Password and $BackendConfig to actually set the password on the backend.')] param( [Parameter(Mandatory)] [string] $Identifier, [Parameter(Mandatory)] [AllowNull()] $Password, [Parameter(Mandatory)] [hashtable] $BackendConfig ) throw "Set-VaultAccountPassword is a template, not a working handler - replace this function body with a real call to your backend (e.g. a vault API), keyed on `$Identifier and `$BackendConfig, before using the 'Custom' backend against target '$Identifier'." } |