Logging fix

.github/workflows/keyfactor-starter-workflow.yml

@@ -11,10 +11,17 @@ on:
 
 jobs:
   call-starter-workflow:
-    uses: keyfactor/actions/.github/workflows/starter.yml@v3 
+    uses: keyfactor/actions/.github/workflows/starter.yml@v4
+    with:
+      command_token_url: ${{ vars.COMMAND_TOKEN_URL }} # Only required for doctool generated screenshots
+      command_hostname: ${{ vars.COMMAND_HOSTNAME }} # Only required for doctool generated screenshots
+      command_base_api_path: ${{ vars.COMMAND_API_PATH }} # Only required for doctool generated screenshots
     secrets:
-      token: ${{ secrets.V2BUILDTOKEN}}
-      APPROVE_README_PUSH: ${{ secrets.APPROVE_README_PUSH}}
-      gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }}
-      gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }}
-      scan_token: ${{ secrets.SAST_TOKEN }}
+      token: ${{ secrets.V2BUILDTOKEN}} # REQUIRED
+      gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }} # Only required for golang builds
+      gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }} # Only required for golang builds
+      scan_token: ${{ secrets.SAST_TOKEN }} # REQUIRED
+      entra_username: ${{ secrets.DOCTOOL_ENTRA_USERNAME }} # Only required for doctool generated screenshots
+      entra_password: ${{ secrets.DOCTOOL_ENTRA_PASSWD }} # Only required for doctool generated screenshots
+      command_client_id: ${{ secrets.COMMAND_CLIENT_ID }} # Only required for doctool generated screenshots
+      command_client_secret: ${{ secrets.COMMAND_CLIENT_SECRET }} # Only required for doctool generated screenshots

AzureEnterpriseApplicationOrchestrator.Tests/AzureEnterpriseApplicationOrchestrator.Tests.csproj

@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
     <TargetFramework>net8.0</TargetFramework>
@@ -10,6 +10,7 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.Logging" Version="8.0.0" />
+    <PackageReference Include="Microsoft.Graph" Version="5.54.0" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.1.0" />
     <PackageReference Include="NLog.Extensions.Logging" Version="5.3.8" />
     <PackageReference Include="xunit" Version="2.4.1" />

AzureEnterpriseApplicationOrchestrator.Tests/MockPAMSecretResolver.cs

@@ -24,7 +24,7 @@ public MockPAMSecretResolver(Dictionary<string, string> predefinedSecrets)
         public string Resolve(string instanceInfo)
         {
             // For testing, if we have a predefined secret, return it
-            if (_secrets.ContainsKey(instanceInfo))
+            if (instanceInfo != null && _secrets.ContainsKey(instanceInfo))
             {
                 return _secrets[instanceInfo];
             }

AzureEnterpriseApplicationOrchestrator/AzureEnterpriseApplicationOrchestrator.csproj

@@ -5,21 +5,35 @@
       <TargetFrameworks>net6.0;net8.0;net10.0</TargetFrameworks>
       <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
       <ImplicitUsings>disable</ImplicitUsings>
+      <NoWarn>$(NoWarn);SYSLIB0057</NoWarn>
     </PropertyGroup>
 
     <ItemGroup>
+      <!-- Update Azure packages to latest stable versions -->
       <PackageReference Include="Azure.Core" Version="1.51.1" />
       <PackageReference Include="Azure.Identity" Version="1.17.1" />
       <PackageReference Include="Azure.ResourceManager" Version="1.12.0" />
+
       <PackageReference Include="coverlet.collector" Version="6.0.2">
         <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
         <PrivateAssets>all</PrivateAssets>
       </PackageReference>
-      <PackageReference Include="Keyfactor.Logging" Version="1.1.1" />
-      <PackageReference Include="Keyfactor.Orchestrators.IOrchestratorJobExtensions" Version="0.7.0" />
-      <PackageReference Include="Microsoft.Graph" Version="5.54.0" />
+
+      <PackageReference Include="Keyfactor.Logging" Version="1.1.0" Condition="'$(TargetFramework)' == 'net6.0'"/>
+      <PackageReference Include="Keyfactor.Logging" Version="1.3.0" Condition="'$(TargetFramework)' == 'net8.0'"/>
+      <PackageReference Include="Keyfactor.Logging" Version="1.3.0" Condition="'$(TargetFramework)' == 'net10.0'"/>
+
+      <PackageReference Include="Keyfactor.Orchestrators.Common" Version="3.4.0" />
+      <PackageReference Include="Keyfactor.Orchestrators.IOrchestratorJobExtensions" Version="1.0.0" />
+
+      <!-- REMOVED: Microsoft.Graph - Not used in codebase -->
+      <!-- <PackageReference Include="Microsoft.Graph" Version="5.54.0" /> -->
+
+      <!-- Update Newtonsoft.Json to latest version -->
       <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
-      <PackageReference Include="System.Drawing.Common" Version="6.0.0" />
+
+      <!-- Update System.Drawing.Common to address compatibility issues -->
+      <PackageReference Include="System.Drawing.Common" Version="9.0.0" />
     </ItemGroup>
 
     <ItemGroup>

AzureEnterpriseApplicationOrchestrator/Client/GraphClient.cs

@@ -1,4 +1,4 @@
-// Copyright 2024 Keyfactor
+// Copyright 2026 Keyfactor
 // 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -24,8 +24,8 @@
 using Keyfactor.Orchestrators.Common.Enums;
 using Keyfactor.Orchestrators.Extensions;
 using Microsoft.Extensions.Logging;
 using Microsoft.Graph;
 using Microsoft.Graph.Models;
 
 namespace AzureEnterpriseApplicationOrchestrator.Client;
 
@@ -35,7 +35,7 @@
     private ILogger _logger { get; set; }
     private TokenCredential _credential { get; set; }
     private string _tenantId { get; set; }
     private GraphServiceClient _graphClient { get; set; }
     private string _targetObjectId { get; set; }
 
     // The Client can only be constructed by the Builder method
@@ -242,15 +242,13 @@
             throw new Exception("Could not calculate thumbprint for certificate");
 
         // Calculate the SHA256 hash of the certificate's thumbprint
-        byte[] customKeyId = Encoding.UTF8.GetBytes(certificate.Thumbprint)[..32];
+        byte[] customKeyId = certificate.GetCertHash();
 
-        _logger.LogDebug($"Adding certificate called \"{certificateName}\" to Object ID \"{_targetObjectId}\" (custom key ID {Encoding.UTF8.GetString(customKeyId)})");
+        _logger.LogDebug($"Adding certificate called \"{certificateName}\" to Object ID \"{_targetObjectId}\" (custom key ID {Convert.ToHexString(customKeyId)})");
 
         // Get the application object
         Application application = GetApplication();
 
-        char[] certPem = PemEncoding.Write("CERTIFICATE", certificate.RawData);
-
         // Update the application object
         _logger.LogDebug($"Updating application object for Object ID \"{_targetObjectId}\"");
         try
@@ -267,7 +265,7 @@
                         StartDateTime = DateTimeOffset.Parse(certificate.GetEffectiveDateString()),
                         EndDateTime = DateTimeOffset.Parse(certificate.GetExpirationDateString()),
                         KeyId = Guid.NewGuid(),
-                        Key = System.Text.Encoding.UTF8.GetBytes(certPem)
+                        Key = certificate.Export(X509ContentType.Cert),
                     }
                 }
             }).Wait();
@@ -332,6 +330,7 @@
 
     public void AddServicePrincipalCertificate(string certificateName, string certificateData, string certificatePassword)
     {
+
         // certificateData is a base64 encoded PFX certificate
         X509Certificate2 certificate = SerializeCertificate(certificateData, certificatePassword);
         if (certificate.Thumbprint == null)
@@ -772,7 +771,7 @@
         return result;
     }
 
     private OperationResult<IEnumerable<CurrentInventoryItem>> InventoryFromKeyCredentials(List<KeyCredential> keyCredentials)
     {
         Dictionary<string, CurrentInventoryItem> inventoryItems = new();
         OperationResult<IEnumerable<CurrentInventoryItem>> result = new(inventoryItems.Values);
@@ -801,7 +800,7 @@
 
         foreach (KeyCredential keyCredential in keyCredentials)
         {
-            string customKeyIdentifier = Encoding.UTF8.GetString(keyCredential.CustomKeyIdentifier);
+            string customKeyIdentifier = Convert.ToHexString(keyCredential.CustomKeyIdentifier);
 
             if (!string.IsNullOrWhiteSpace(keyCredential.Usage) && keyCredential.Usage.Equals("Sign", StringComparison.OrdinalIgnoreCase))
             {
@@ -872,7 +871,7 @@
         return result;
     }
 
     protected Application GetApplication()
     {
         _logger.LogDebug($"Retrieving application for Object ID \"{_targetObjectId}\"");
 
@@ -896,7 +895,7 @@
         return app;
     }
 
     protected ServicePrincipal GetServicePrincipal()
     {
         _logger.LogDebug($"Retrieving service principal for Object ID \"{_targetObjectId}\"");
 
@@ -918,7 +917,7 @@
         return sp;
     }
 
     protected List<KeyCredential> DeepCopyKeyList(List<KeyCredential> keyCredentials)
     {
         List<KeyCredential> deepKeyList;
         if (keyCredentials == null)
@@ -941,7 +940,7 @@
         return deepKeyList;
     }
 
     protected IEnumerable<PasswordCredential> DeepCopyPasswordList(List<PasswordCredential> passwordList)
     {
         // Deep copy the password list
         List<PasswordCredential> deepPasswordList;
@@ -989,8 +988,9 @@
         return certificate;
     }
 
-    protected static X509Certificate2 SerializeCertificate(string certificateData, string password)
+    private X509Certificate2 SerializeCertificate(string certificateData, string password)
     {
+        _logger.LogDebug($"Certificate Base64: {certificateData}");
         byte[] rawData = Convert.FromBase64String(certificateData);
         return new X509Certificate2(rawData, password, X509KeyStorageFlags.Exportable);
     }

AzureEnterpriseApplicationOrchestrator/GraphJobClientBuilder.cs

@@ -17,7 +17,7 @@
 using Keyfactor.Orchestrators.Extensions;
 using Keyfactor.Orchestrators.Extensions.Interfaces;
 using Microsoft.Extensions.Logging;
 using Microsoft.Graph.Models.ExternalConnectors;
 using Newtonsoft.Json;
 using System;
 using System.Security.Cryptography;
@@ -139,7 +139,7 @@
         if (!string.IsNullOrEmpty(serverPassword))
         {
             _logger.LogDebug("Client certificate not present - Using Client Secret authentication");
-            _logger.LogTrace($"Builder - ServerPassword            => ClientSecret:                 {properties.ServerPassword}");
+            _logger.LogTrace($"Builder - ServerPassword            => ClientSecret:                 ******");
             _builder.WithClientSecret(serverPassword);
         }
         else if (!string.IsNullOrEmpty(properties.ClientCertificate))

CHANGELOG.md

@@ -2,6 +2,12 @@
   - Added PAM Support for Azure App Registrations and Service Principals.
   - Updated logging to remove sensitive information.
 
+- 4.1.3
+    - Added .Net 10 support
+- 4.1.2
+    - Updated Keyfactor.Orchestrators.Common to eliminate an issue with a revoked certificate.
+    - Updated Keyfactor.Orchestrators.IOrchestratorJobExtensions to 1.0.0.
+    - Updated Keyfactor.Logging to 1.3.0 for .Net8 version.
 - 4.1.1
   - Updated the following packages to eliminate vulnerabilities:
     - Azure.Core