Private/Backend/Set-SecretRotationBackendPassword.ps1
|
function Set-SecretRotationBackendPassword { <# .SYNOPSIS Dispatches a password change to the right backend-specific implementation. .DESCRIPTION Single entry point Update-SecretRotationAccountPassword calls regardless of which backend a target uses - keeps the core cmdlet's try/catch simple (any backend failure reaches it the same way: this function throws). .PARAMETER Backend The target's 'backend' value: 'ActiveDirectory', 'EntraID', or 'Custom'. .PARAMETER Identifier The account identity on that backend (target.backendConfig.identity, post -BackendParameter merge). .PARAMETER Password The new password, as SecureString or String per the target's passwordRepresentation. .PARAMETER BackendConfig The target's full merged backendConfig hashtable. .PARAMETER CustomHandler Required only when Backend is 'Custom': the target's 'customHandler' section (an object with 'scriptPath' and 'functionName'). Ignored for every other backend. .PARAMETER ConfigDirectory Required only when Backend is 'Custom': the directory the live config file lives in, so customHandler.scriptPath can be resolved relative to it. Ignored for every other backend. .EXAMPLE Set-SecretRotationBackendPassword -Backend 'ActiveDirectory' -Identifier 'svc1' -Password $securePassword -BackendConfig @{ forest = 'corp.local' } .EXAMPLE Set-SecretRotationBackendPassword -Backend 'Custom' -Identifier 'vault-secret-1' -Password $securePassword -BackendConfig @{} -CustomHandler $target.customHandler -ConfigDirectory 'C:\Users\alice\Posh-SecretRotation' #> [CmdletBinding()] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '', Justification = 'ShouldProcess confirmation happens once at the public cmdlet boundary (Update-SecretRotationAccountPassword); this private dispatcher is only ever called after that confirmation already succeeded and must not prompt again.')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingPlainTextForPassword', 'Password', Justification = 'Deliberately untyped: passed through as-is to whichever backend-specific function is dispatched to, some of which require a plaintext string per passwordRepresentations')] param( [Parameter(Mandatory)] [string] $Backend, [Parameter(Mandatory)] [string] $Identifier, [Parameter(Mandatory)] [AllowNull()] $Password, [Parameter(Mandatory)] [hashtable] $BackendConfig, [Parameter()] [PSCustomObject] $CustomHandler, [Parameter()] [string] $ConfigDirectory ) switch ($Backend) { 'ActiveDirectory' { Set-SecretRotationADPassword -Identifier $Identifier -Password $Password -BackendConfig $BackendConfig } 'EntraID' { Set-SecretRotationEntraPassword -Identifier $Identifier -Password $Password -BackendConfig $BackendConfig } 'Custom' { if (-not $CustomHandler) { throw "Target backend 'Custom' requires a 'customHandler' section (scriptPath + functionName) in its config." } Invoke-SecretRotationCustomHandler -Identifier $Identifier -Password $Password -BackendConfig $BackendConfig ` -CustomHandler $CustomHandler -ConfigDirectory $ConfigDirectory } default { throw "Unknown backend '$Backend'. Supported backends: ActiveDirectory, EntraID, Custom." } } } |