81018 adding jea support by rcpokorny · Pull Request #185 · Keyfactor/iis-orchestrator

rcpokorny · 2026-05-11T22:15:35Z

No description provided.

…or/iis-orchestrator into 81018-Adding_JEA_Support

…from PW

Copilot

Pull request overview

This PR introduces JEA (Just Enough Administration) support for WinRM-based remote execution by refactoring the extension’s PowerShell surface into installable modules/role capabilities, wiring a new JEAEndpointName job property through the orchestrator, and updating tests/docs to cover the new behavior.

Changes:

Add JEAEndpointName support end-to-end (job properties → PSHelper session creation → integration/unit tests).
Replace monolithic WinCertScripts.ps1 script injection with modular PowerShell (Keyfactor.WinCert.Common/IIS/SQL) plus JEA .psrc role capability files and a .pssc session configuration template.
Update documentation (README + docsource) and integration tests to reflect JEA setup and connection selection.

Reviewed changes

Copilot reviewed 67 out of 68 changed files in this pull request and generated 17 comments.

Show a summary per file

File	Description
WindowsCertStore.UnitTests/WindowsCertStore.UnitTests.csproj	Adds Moq/Newtonsoft.Json; sets xUnit VS runner PrivateAssets metadata.
WindowsCertStore.UnitTests/PSHelperUnitTests.cs	Updates script folder name lookup from `PowerShellScripts` to `PowerShell`.
WindowsCertStore.UnitTests/PSHelperConfigTests.cs	Adds unit tests for PSHelper constructors, script directory discovery, and LocalMachine+JEA guard behavior.
WindowsCertStore.UnitTests/JobPropertiesTests.cs	Adds unit tests validating `JobProperties` defaulting + legacy field tolerance.
WindowsCertStore.IntegrationTests/WinSQLIntegrationTests.cs	Adds Integration trait; passes `JEAEndpointName`; uses SQL-only connection data source.
WindowsCertStore.IntegrationTests/WinIISIntegrationTests.cs	Adds Integration trait; passes `JEAEndpointName`; uses IIS-only connection data source.
WindowsCertStore.IntegrationTests/WinCertIntegrationTests.cs	New WinCert E2E integration tests (Add/Inventory/Remove and renewal flow) with JEA support.
WindowsCertStore.IntegrationTests/servers.json	Expands server definitions with StoreType + JEA endpoint name.
WindowsCertStore.IntegrationTests/Factories/ConnectionFactory.cs	Refactors connection loading, adds store-type filtering and env/appsettings credential sourcing.
WindowsCertStore.IntegrationTests/ClientConnection.cs	Adds `StoreType` and `JEAEndpointName` to connection model.
README.md	Adds detailed JEA documentation and updates WinRM port references (5985/5986).
docsource/content.md	Adds detailed JEA documentation for generated docs; notes module install requirements for JEA.
IISU/WindowsCertStore.csproj	Updates packaging to include new `PowerShell\` module tree + `.pssc` and legacy scripts.
IISU/RemoteSettings.cs	Adds `JEAEndpointName` to remote settings model.
IISU/PSHelper.cs	Adds JEA endpoint support (WinRM ConfigurationName), blocks LocalMachine+JEA, changes script loading strategy, improves Information stream handling.
IISU/Properties/AssemblyInfo.cs	Exposes internals to unit/integration test assemblies.
IISU/PowerShellScripts/WinCertScripts.ps1	Removes legacy monolithic script.
IISU/PowerShell/WinADFSScripts.ps1	Adjusts logging to use Information stream “[VERBOSE] …” convention.
IISU/PowerShell/Keyfactor.WinCert.SQL/RoleCapabilities/Keyfactor.WinCert.SQL.psrc	New SQL JEA role capability definition.
IISU/PowerShell/Keyfactor.WinCert.SQL/Public/Remove-KeyfactorSQLCertificate.ps1	New SQL unbind function.
IISU/PowerShell/Keyfactor.WinCert.SQL/Public/New-KeyfactorSQLBinding.ps1	New SQL bind function wrapper.
IISU/PowerShell/Keyfactor.WinCert.SQL/Public/Get-KeyfactorSQLInventory.ps1	New SQL inventory function.
IISU/PowerShell/Keyfactor.WinCert.SQL/Private/Set-KeyfactorSQLCertificateBinding.ps1	New SQL bind implementation (registry + ACL + optional restart).
IISU/PowerShell/Keyfactor.WinCert.SQL/Private/Get-KeyfactorSQLServiceUser.ps1	New helper to read SQL service user.
IISU/PowerShell/Keyfactor.WinCert.SQL/Private/Get-KeyfactorSQLServiceName.ps1	New helper to compute SQL service name.
IISU/PowerShell/Keyfactor.WinCert.SQL/Keyfactor.WinCert.SQL.psm1	New SQL module entry point with explicit dot-sourcing + exports.
IISU/PowerShell/Keyfactor.WinCert.IIS/RoleCapabilities/Keyfactor.WinCert.IIS.psrc	New IIS JEA role capability definition.
IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Remove-KeyfactorIISSiteBinding.ps1	New IIS binding removal function with IIS drive autodetect.
IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Remove-KeyfactorIISCertificateIfUnused.ps1	New IIS certificate cleanup helper.
IISU/PowerShell/Keyfactor.WinCert.IIS/Public/New-KeyfactorIISSiteBinding.ps1	New IIS binding creation with SSL flags handling and appcmd fallback.
IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Get-KeyfactorIISBoundCertificates.ps1	New IIS inventory function.
IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Test-ValidSslFlags.ps1	New SSL flag validation helper.
IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Test-IISDrive.ps1	New IIS:\ drive availability helper.
IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Get-ValidSslFlagsForSystem.ps1	New OS-build-based SSL flag support helper.
IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Get-IISManagementInfo.ps1	New IIS management mode detection helper.
IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Add-IISBindingWithSSL.ps1	New IIS binding add + SSL attach helper.
IISU/PowerShell/Keyfactor.WinCert.IIS/Keyfactor.WinCert.IIS.psm1	New IIS module entry point with explicit dot-sourcing + exports.
IISU/PowerShell/Keyfactor.WinCert.Common/RoleCapabilities/Keyfactor.WinCert.Common.psrc	New common JEA role capability definition.
IISU/PowerShell/Keyfactor.WinCert.Common/Public/Remove-KeyfactorCertificate.ps1	New common remove-from-store implementation.
IISU/PowerShell/Keyfactor.WinCert.Common/Public/New-KeyfactorResult.ps1	New common structured result helper.
IISU/PowerShell/Keyfactor.WinCert.Common/Public/New-KeyfactorODKGEnrollment.ps1	New ODKG CSR generation function.
IISU/PowerShell/Keyfactor.WinCert.Common/Public/Import-KeyfactorSignedCertificate.ps1	New signed cert import helper.
IISU/PowerShell/Keyfactor.WinCert.Common/Public/Get-KeyfactorCertificates.ps1	New common inventory function.
IISU/PowerShell/Keyfactor.WinCert.Common/Public/Add-KeyfactorCertificate.ps1	New common add-to-store implementation.
IISU/PowerShell/Keyfactor.WinCert.Common/Private/Validate-CryptoProvider.ps1	New provider validation helper.
IISU/PowerShell/Keyfactor.WinCert.Common/Private/Test-CryptoServiceProvider.ps1	New provider existence helper.
IISU/PowerShell/Keyfactor.WinCert.Common/Private/Get-CryptoProviders.ps1	New CSP discovery helper using certutil.
IISU/PowerShell/Keyfactor.WinCert.Common/Private/Get-CertificateSAN.ps1	New SAN extraction helper.
IISU/PowerShell/Keyfactor.WinCert.Common/Private/Get-CertificateCSP.ps1	New CSP/KSP detection helper (CAPI + CNG).
IISU/PowerShell/Keyfactor.WinCert.Common/Private/Convert-DNSSubject.ps1	New DN subject parsing helper.
IISU/PowerShell/Keyfactor.WinCert.Common/Keyfactor.WinCert.Common.psm1	New Common module entry point with explicit dot-sourcing + exports.
IISU/PowerShell/Build/KeyfactorWinCert.pssc	New JEA session configuration template (`RestrictedRemoteServer` + transcripts + role mapping).
IISU/Models/JobProperties.cs	Adds `JEAEndpointName` job property.
IISU/ImplementedStoreTypes/WinSQL/WinSqlBinding.cs	Switches to new SQL module function names.
IISU/ImplementedStoreTypes/WinSQL/Management.cs	Wires `JEAEndpointName`; switches to new module function names.
IISU/ImplementedStoreTypes/WinSQL/Inventory.cs	Wires `JEAEndpointName`; switches to new inventory function name and signature.
IISU/ImplementedStoreTypes/WinIIS/WinIISBinding.cs	Switches to new IIS module function names; updates unbind parameter shape and result parsing.
IISU/ImplementedStoreTypes/WinIIS/Management.cs	Wires `JEAEndpointName`; switches to new module function names.
IISU/ImplementedStoreTypes/WinIIS/Inventory.cs	Wires `JEAEndpointName`; switches to new IIS inventory function name.
IISU/ImplementedStoreTypes/WinADFS/Inventory.cs	Removes SAN field propagation for ADFS inventory parameters.
IISU/ImplementedStoreTypes/Win/WinInventory.cs	Marks unused class obsolete.
IISU/ImplementedStoreTypes/Win/WinCertCertificateInfo.cs	Removes SAN field from WinCert cert info model.
IISU/ImplementedStoreTypes/Win/Management.cs	Wires `JEAEndpointName`; switches to new module function names.
IISU/ImplementedStoreTypes/Win/Inventory.cs	Wires `JEAEndpointName`; switches to new inventory function name; removes SAN parameter propagation.
IISU/ClientPSCertStoreReEnrollment.cs	Wires `JEAEndpointName`; switches to new ODKG/import function names; updates log strings.
CHANGELOG.md	Adds 4.0.0 entry documenting SAN removal and JEA support.
.vscode/launch.json	Adds VS Code launch configuration for PowerShell.
.gitignore	Ignores `local.runsettings` to avoid committing local credentials.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+                var config = new ConfigurationBuilder()
+                    .SetBasePath(Directory.GetCurrentDirectory())
+                    .AddJsonFile("appsettings.json", optional: true)
+                    .Build();

-            // 3. Retrieve connection details from configuration
+                var vault = new VaultHelper(config);
+                return (vault.GetSecret("Username"), vault.GetSecret("Password"));
+            }


+                    // Pre-flight: verify Keyfactor modules are installed on the JEA endpoint.
+                    PS.AddCommand("Invoke-Command")
+                        .AddParameter("Session", _PSSession)
+                        .AddParameter("ScriptBlock", ScriptBlock.Create("[bool](Get-Command 'New-KeyfactorResult' -ErrorAction SilentlyContinue)"));
+                    var preFlightResults = PS.Invoke();
+                    PS.Commands.Clear();
+
+                    bool modulesInstalled = preFlightResults != null &&
+                        preFlightResults.Count > 0 &&
+                        preFlightResults[0]?.BaseObject is bool preFlightBool &&
+                        preFlightBool;
+
+                    if (!modulesInstalled)
+                    {
+                        throw new Exception(
+                            $"JEA endpoint '{jeaEndpoint}' is reachable but Keyfactor modules are not installed. " +
+                            "Install Keyfactor.WinCert.Common (and any required store-type modules) under " +
+                            "'C:\\Program Files\\WindowsPowerShell\\Modules\\' on the target machine, " +
+                            "re-register the JEA session configuration, and restart WinRM.");
+                    }


+
+    try {
+        Write-Information "Entering PowerShell Script Add-KeyfactorCertificateToStore"
+        Write-Information "[VERBOSE] Add-KeyfactorCertificateToStore - Received: StoreName: '$StoreName', CryptoServiceProvider: '$CryptoServiceProvider', Base64Cert: '$Base64Cert'"


+                Write-Information "[VERBOSE] Running certutil with arguments: $argLine"
+


+    if ($serviceUser) {
+        return $serviceUser
+    } else {
+        Write-Error "SQL Server instance '$SQLInstanceName' not found or no service user associated."
+        return $null
+    }


@@ -1,3 +1,7 @@
+4.0.0
+* As of this version of the extension, SANs will be handled through the ODKG Enrollment page in Command and will no longer use the SAN Entry Parameter. This version, we are removing all support for the SAN Entry Parameter. If you are still using the SAN Entry Parameter, you will need to remove it from your store types and re-run inventory to remove it from your database.
+* Adding JEA Support for local PowerShell execution.  This will allow for more secure execution of the extension when running in a local PowerShell Runspace.  To utilize this feature, you will need to create a JEA endpoint on the target server and specify the endpoint name as a new parameter in the specific Cert Store definition.  Refer to the README for more details.


+                Write-Information "[VERBOSE] Instance: $instance"
+                Write-Information "[VERBOSE] Full Instance: $fullInstance"
+                Write-Information "[VERBOSE] Registry Location: $regLocation"
+                Write-Information "[VERBOSE] Current Thumbprint: $currentThumbprint"
+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue
+


-                _results = _psHelper.ExecutePowerShell("Add-KFCertificateToStore", parameters);
+                _results = _psHelper.ExecutePowerShell("Add-KeyfactorCertificate", parameters);
                _logger.LogTrace("Returned from executing PS function (Add-KFCertificateToStore)");



-                _results = _psHelper.ExecutePowerShell("Add-KFCertificateToStore", parameters);
-                _logger.LogTrace("Returned from executing PS function (Add-KFCertificateToStore)");
+                _results = _psHelper.ExecutePowerShell("Add-KeyfactorCertificate", parameters);
+                _logger.LogTrace("Returned from executing PS function (Add-KeyfactorCertificate)");


-                    _logger.LogTrace("Returned from executing PS function (Add-KFCertificateToStore)");
+                    _results = _psHelper.ExecutePowerShell("Add-KeyfactorCertificate", parameters);
+                    _logger.LogTrace("Returned from executing PS function (Add-KeyfactorCertificate)");



Copilot

Pull request overview

Copilot reviewed 72 out of 145 changed files in this pull request and generated 11 comments.

+        [string]$StorePath,
+
+        [parameter(ParameterSetName = $false)]
+        [switch]$IsAlias
+    )


+        Set-Location -Path "Cert:\LocalMachine\$StoreName"
+
+        $importResult = Import-Certificate -FilePath $cerFilename


+                Write-Information "[VERBOSE] Instance: $instance"
+                Write-Information "[VERBOSE] Full Instance: $fullInstance"
+                Write-Information "[VERBOSE] Registry Location: $regLocation"
+                Write-Information "[VERBOSE] Current Thumbprint: $currentThumbprint"
+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue
+
+                if ($RenewalThumbprint -and $RenewalThumbprint -contains $currentThumbprint) {
+                    Write-Information "Renewal thumbprint matches for instance: $fullInstance"


+                if ($RenewalThumbprint -and $RenewalThumbprint -contains $currentThumbprint) {
+                    Write-Information "Renewal thumbprint matches for instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                } elseif (-not $RenewalThumbprint) {
+                    Write-Information "No renewal thumbprint provided. Binding certificate to instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                }
+
+                if (-not $result) {
+                    Write-Error "Failed to bind certificate for instance: $instance"
+                    $bindingSuccess = $false
+                }


+        return $serviceUser
+    } else {
+        Write-Error "SQL Server instance '$SQLInstanceName' not found or no service user associated."
+        return $null
+    }


+            var (username, password) = GetCredentials();
+            if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password))
+                yield break;
+


+                _results = _psHelper.ExecutePowerShell("Add-KeyfactorCertificate", parameters);
                _logger.LogTrace("Returned from executing PS function (Add-KFCertificateToStore)");



                                                case "Skipped":
                                                    psResult = OrchestratorJobStatusJobResult.Failure;
-                                                    failureMessage = ($"PowerShell function New-KFIISSiteBinding failed on step: {step} - message:\n {errorMessage}");
+                                                    failureMessage = ($"PowerShell function New-KeyfactorIISSiteBinding failed on step: {step} - message:\n {errorMessage}");
                                                    _logger.LogDebug(failureMessage);
                                                    break;


+Write-Host "Creating store type: WinCert"
+kfutil store-types create WinCert



+#!/bin/bash
+# Store Type creation script using kfutil
+# Generated by Doctool

-# Creates all 4 store types using kfutil.
-# kfutil reads definitions from the Keyfactor integration catalog.
-#
-# Auth environment variables (first matching method is used):
-#   OAuth access token:   KEYFACTOR_AUTH_ACCESS_TOKEN
-#   OAuth client creds:   KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET
-#                         + KEYFACTOR_AUTH_TOKEN_URL
-#   Basic auth (AD):      KEYFACTOR_HOSTNAME + KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD
-#                         + KEYFACTOR_DOMAIN
-#
-# Auto-generated by doctool generate-store-type-scripts — do not edit by hand.
+set -e

-if ! command -v kfutil &> /dev/null; then
-    echo "kfutil could not be found. Please install kfutil"
-    echo "See https://github.com/Keyfactor/kfutil#quickstart"
-    exit 1
-fi
+echo "Creating store type: WinCert"
+kfutil store-types create WinCert


Copilot

Pull request overview

Copilot reviewed 72 out of 145 changed files in this pull request and generated 12 comments.

+    $serviceUser = (Get-CimInstance -ClassName Win32_Service -Filter "Name='$SQLServiceName'").StartName
+
+    if ($serviceUser) {
+        return $serviceUser
+    } else {
+        Write-Error "SQL Server instance '$SQLInstanceName' not found or no service user associated."
+        return $null


+                Write-Information "[VERBOSE] Full Instance: $fullInstance"
+                Write-Information "[VERBOSE] Registry Location: $regLocation"
+                Write-Information "[VERBOSE] Current Thumbprint: $currentThumbprint"
+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue
+
+                if ($RenewalThumbprint -and $RenewalThumbprint -contains $currentThumbprint) {


+    Write-Information "Entering PowerShell Script: New-KFIISSiteBinding" -InformationAction SilentlyContinue
+    Write-Information "[VERBOSE] Parameters: $(($PSBoundParameters.GetEnumerator() | ForEach-Object { "$($_.Key): '$($_.Value)'" }) -join ', ')"
+


+    catch {
+        $errorMessage = "Unexpected error in New-KFIISSiteBinding: $($_.Exception.Message)"
+        Write-Error $errorMessage
+        return New-KeyfactorResult -Status Error -Code 999 -Step UnexpectedError -ErrorMessage $errorMessage
+    }


+    if ($build -ge 20348) {
+        # Windows Server 2022+ (IIS 10.0.20348+)
+        Write-Information "[VERBOSE] Detected Windows Server 2022 or later (Build: $build)"
+        return @(1, 4, 8, 16, 32, 64)  # Include unknowns for testing
+    }


+
+        [parameter(ParameterSetName = $false)]
+        [switch]$IsAlias
+    )


+        Set-Location -Path "Cert:\LocalMachine\$StoreName"
+
+        $importResult = Import-Certificate -FilePath $cerFilename


+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "{SQL-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "" },
+  { "Machine": "{SQL-JEA-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "" },


+#!/bin/bash
+# Store Type creation script using kfutil
+# Generated by Doctool

-# Creates all 4 store types using kfutil.
-# kfutil reads definitions from the Keyfactor integration catalog.
-#
-# Auth environment variables (first matching method is used):
-#   OAuth access token:   KEYFACTOR_AUTH_ACCESS_TOKEN
-#   OAuth client creds:   KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET
-#                         + KEYFACTOR_AUTH_TOKEN_URL
-#   Basic auth (AD):      KEYFACTOR_HOSTNAME + KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD
-#                         + KEYFACTOR_DOMAIN
-#
-# Auto-generated by doctool generate-store-type-scripts — do not edit by hand.
+set -e

-if ! command -v kfutil &> /dev/null; then
-    echo "kfutil could not be found. Please install kfutil"
-    echo "See https://github.com/Keyfactor/kfutil#quickstart"
-    exit 1
-fi
+echo "Creating store type: WinCert"
+kfutil store-types create WinCert


+# Store Type creation script using kfutil
+# Generated by Doctool

-# Uncomment if kfutil is not in your PATH
-# Set-Alias -Name kfutil -Value 'C:\Program Files\Keyfactor\kfutil\kfutil.exe'
+Write-Host "Creating store type: WinCert"
+kfutil store-types create WinCert

-if ($null -eq (Get-Command "kfutil" -ErrorAction SilentlyContinue)) {
-    Write-Host "kfutil could not be found. Please install kfutil"
-    Write-Host "See https://github.com/Keyfactor/kfutil#quickstart"
-    exit 1
-}
+Write-Host "Creating store type: IISU"
+kfutil store-types create IISU


Copilot

Pull request overview

Copilot reviewed 81 out of 161 changed files in this pull request and generated 13 comments.

+using Keyfactor.Extensions.Orchestrator.WindowsCertStore;
+
+namespace WindowsCertStore.UnitTests


+using Keyfactor.Extensions.Orchestrator.WindowsCertStore;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Serialization;
+
+namespace WindowsCertStore.UnitTests


            // Assert
-            Assert.Equal("dns=legacy.example.com&dns=old.example.com", result);
+            //Assert.Equal(legacySan, result);
+
+            // Assert


+
+        [parameter(ParameterSetName = $false)]
+        [switch]$IsAlias
+    )


+        if ($cert) {
+            # Remove the certificate from the store
+            Write-Information "Attempting to remove certificate from store '$StorePath' with the thumbprint: $Thumbprint"
+            $store.Remove($cert)
+            Write-Information "Certificate removed successfully from store '$StorePath'"
+
+            # Mark success
+            $isSuccessful = $true
+        } else {


+#!/bin/bash
+# Store Type creation script using kfutil
+# Generated by Doctool

-# Creates all 4 store types using kfutil.
-# kfutil reads definitions from the Keyfactor integration catalog.
-#
-# Auth environment variables (first matching method is used):
-#   OAuth access token:   KEYFACTOR_AUTH_ACCESS_TOKEN
-#   OAuth client creds:   KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET
-#                         + KEYFACTOR_AUTH_TOKEN_URL
-#   Basic auth (AD):      KEYFACTOR_HOSTNAME + KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD
-#                         + KEYFACTOR_DOMAIN
-#
-# Auto-generated by doctool generate-store-type-scripts — do not edit by hand.
+set -e



+# Store Type creation script using kfutil
+# Generated by Doctool



+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "{SQL-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "" },
+  { "Machine": "{SQL-JEA-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "keyfactor.wincert" }


+        # Step 4: Import the certificate into the specified store
+        Write-Verbose "Importing the certificate to the store: Cert:\LocalMachine\$StoreName"
+        Set-Location -Path "Cert:\LocalMachine\$StoreName"
+
+        $importResult = Import-Certificate -FilePath $cerFilename
+        if ($importResult) {


+    # Path to temporary INF file
+    $infFile = [System.IO.Path]::GetTempFileName() + ".inf"
+    $csrOutputFile = [System.IO.Path]::GetTempFileName() + ".csr"
+
+    Set-Content -Path $infFile -Value $infContent
+    Write-Information "Generated INF file at: $infFile"


Copilot

Pull request overview

Copilot reviewed 81 out of 161 changed files in this pull request and generated 11 comments.

 using Microsoft.Extensions.Configuration;
 using Newtonsoft.Json;
 using System;
 using System.Collections.Generic;
+using System.IO;
 using System.Linq;
-using System.Text;
-using System.Threading.Tasks;



+            var (username, password) = GetCredentials();
+            if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password))
+                yield break;


+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "{SQL-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "" },
+  { "Machine": "{SQL-JEA-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "keyfactor.wincert" }


+                Write-Information "[VERBOSE] Instance: $instance"
+                Write-Information "[VERBOSE] Full Instance: $fullInstance"
+                Write-Information "[VERBOSE] Registry Location: $regLocation"
+                Write-Information "[VERBOSE] Current Thumbprint: $currentThumbprint"
+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue
+
+                if ($RenewalThumbprint -and $RenewalThumbprint -contains $currentThumbprint) {
+                    Write-Information "Renewal thumbprint matches for instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                } elseif (-not $RenewalThumbprint) {
+                    Write-Information "No renewal thumbprint provided. Binding certificate to instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                }
+
+                if (-not $result) {
+                    Write-Error "Failed to bind certificate for instance: $instance"
+                    $bindingSuccess = $false
+                }


+            $sqlSettingsDict = @{
+                InstanceName = $instanceNames
+                ProviderName = $cert.PrivateKey.CspKeyContainerInfo.ProviderName
+            }


+    if ($build -ge 20348) {
+        # Windows Server 2022+ (IIS 10.0.20348+)
+        Write-Information "[VERBOSE] Detected Windows Server 2022 or later (Build: $build)"
+        return @(1, 4, 8, 16, 32, 64)  # Include unknowns for testing
+    }


+# Store Type creation script using kfutil
+# Generated by Doctool

-# Uncomment if kfutil is not in your PATH
-# Set-Alias -Name kfutil -Value 'C:\Program Files\Keyfactor\kfutil\kfutil.exe'
+Write-Host "Creating store type: WinCert"
+kfutil store-types create WinCert



+#!/bin/bash
+# Store Type creation script using kfutil
+# Generated by Doctool

-# Creates all 4 store types using kfutil.
-# kfutil reads definitions from the Keyfactor integration catalog.
-#
-# Auth environment variables (first matching method is used):
-#   OAuth access token:   KEYFACTOR_AUTH_ACCESS_TOKEN
-#   OAuth client creds:   KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET
-#                         + KEYFACTOR_AUTH_TOKEN_URL
-#   Basic auth (AD):      KEYFACTOR_HOSTNAME + KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD
-#                         + KEYFACTOR_DOMAIN
-#
-# Auto-generated by doctool generate-store-type-scripts — do not edit by hand.
+set -e

-if ! command -v kfutil &> /dev/null; then
-    echo "kfutil could not be found. Please install kfutil"
-    echo "See https://github.com/Keyfactor/kfutil#quickstart"
-    exit 1
-fi
+echo "Creating store type: WinCert"
+kfutil store-types create WinCert



+        [InlineData("dns=legacy.example.com&dns=old.example.com")]
+        [InlineData("")]
+        [InlineData(null)]
+        public void ResolveSanString_UsesLegacySAN_WhenConfigSANsMissing(string legacySan)


            // Assert
-            Assert.Equal("dns=legacy.example.com&dns=old.example.com", result);
+            //Assert.Equal(legacySan, result);
+
+            // Assert
+            if (legacySan == null)
+            {
+                Assert.Equal(string.Empty, result);
+            }
+            else if (legacySan == string.Empty)
+            {
+                Assert.Equal(string.Empty, result);
+            }
+            else
+            {
+                Assert.Equal(legacySan, result);
+            }


…upport for JEA (Just Enough Administration) environments. Added a new documentation file for setting up an SSH development environment.

Copilot

Pull request overview

Copilot reviewed 82 out of 162 changed files in this pull request and generated 14 comments.

+                Write-Information "[VERBOSE] Instance: $instance"
+                Write-Information "[VERBOSE] Full Instance: $fullInstance"
+                Write-Information "[VERBOSE] Registry Location: $regLocation"
+                Write-Information "[VERBOSE] Current Thumbprint: $currentThumbprint"
+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue
+
+                if ($RenewalThumbprint -and $RenewalThumbprint -contains $currentThumbprint) {
+                    Write-Information "Renewal thumbprint matches for instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                } elseif (-not $RenewalThumbprint) {
+                    Write-Information "No renewal thumbprint provided. Binding certificate to instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                }
+
+                if (-not $result) {
+                    Write-Error "Failed to bind certificate for instance: $instance"
+                    $bindingSuccess = $false
+                }


+                # Resolve full instance name from registry
+                $fullInstance = Get-ItemPropertyValue "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL" -Name $instance
+                $regPath = "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\$fullInstance\MSSQLServer\SuperSocketNetLib"


+                    # Instead of deleting, set to an empty string to prevent SQL startup issues
+                    Set-ItemProperty -Path $regPath -Name "Certificate" -Value ""
+
+                    Write-Information "Successfully unbound certificate from SQL Server instance: $instance."
+                } else {
+                    Write-Warning "No certificate bound to SQL Server instance: $instance."
+                }
+
+                # Restart service if required
+                if ($RestartService) {
+                    $serviceName = Get-KeyfactorSQLServiceName -InstanceName $instance
+                    Write-Information "Restarting SQL Server service: $serviceName..."
+                    Restart-Service -Name $serviceName -Force
+                    Write-Information "SQL Server service restarted successfully."
+                }


+
+        [parameter(ParameterSetName = $false)]
+        [switch]$IsAlias
+    )


+        if ($cert) {
+            # Remove the certificate from the store
+            Write-Information "Attempting to remove certificate from store '$StorePath' with the thumbprint: $Thumbprint"
+            $store.Remove($cert)
+            Write-Information "Certificate removed successfully from store '$StorePath'"
+
+            # Mark success
+            $isSuccessful = $true
+        } else {


+#!/bin/bash
+# Store Type creation script using kfutil
+# Generated by Doctool

-# Creates all 4 store types using kfutil.
-# kfutil reads definitions from the Keyfactor integration catalog.
-#
-# Auth environment variables (first matching method is used):
-#   OAuth access token:   KEYFACTOR_AUTH_ACCESS_TOKEN
-#   OAuth client creds:   KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET
-#                         + KEYFACTOR_AUTH_TOKEN_URL
-#   Basic auth (AD):      KEYFACTOR_HOSTNAME + KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD
-#                         + KEYFACTOR_DOMAIN
-#
-# Auto-generated by doctool generate-store-type-scripts — do not edit by hand.
+set -e

-if ! command -v kfutil &> /dev/null; then
-    echo "kfutil could not be found. Please install kfutil"
-    echo "See https://github.com/Keyfactor/kfutil#quickstart"
-    exit 1
-fi
+echo "Creating store type: WinCert"
+kfutil store-types create WinCert


+# Store Type creation script using kfutil
+# Generated by Doctool

-# Uncomment if kfutil is not in your PATH
-# Set-Alias -Name kfutil -Value 'C:\Program Files\Keyfactor\kfutil\kfutil.exe'
+Write-Host "Creating store type: WinCert"
+kfutil store-types create WinCert



+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "{SQL-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "" },
+  { "Machine": "{SQL-JEA-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "keyfactor.wincert" }


+            catch (Exception)
            {
                throw;
            }


                    _logger.LogTrace($"Attempting to read bound SQL Server certificates from cert store: {storePath}");
-                    inventoryItems = QuerySQLCertificates(settings, storePath);
+                    inventoryItems = QuerySQLCertificates(settings);



Copilot

Pull request overview

Copilot reviewed 82 out of 162 changed files in this pull request and generated 10 comments.

+                Write-Information "[VERBOSE] Instance: $instance"
+                Write-Information "[VERBOSE] Full Instance: $fullInstance"
+                Write-Information "[VERBOSE] Registry Location: $regLocation"
+                Write-Information "[VERBOSE] Current Thumbprint: $currentThumbprint"
+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue
+
+                if ($RenewalThumbprint -and $RenewalThumbprint -contains $currentThumbprint) {
+                    Write-Information "Renewal thumbprint matches for instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                } elseif (-not $RenewalThumbprint) {
+                    Write-Information "No renewal thumbprint provided. Binding certificate to instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                }


+            $sqlSettingsDict = @{
+                InstanceName = $instanceNames
+                ProviderName = $cert.PrivateKey.CspKeyContainerInfo.ProviderName
+            }


+        if (Test-Path -LiteralPath $regPath) {
+            $cspInfoList = @(
+                Get-ChildItem -LiteralPath $regPath -ErrorAction Stop |
+                    Select-Object -ExpandProperty PSChildName
+            )
+        }


+        [string]$Thumbprint,
+        [string]$StorePath,
+
+        [parameter(ParameterSetName = $false)]


+            # Remove the certificate from the store
+            Write-Information "Attempting to remove certificate from store '$StorePath' with the thumbprint: $Thumbprint"
+            $store.Remove($cert)
+            Write-Information "Certificate removed successfully from store '$StorePath'"


+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "{SQL-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "" },
+  { "Machine": "{SQL-JEA-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "keyfactor.wincert" }


+Write-Host "Creating store type: WinCert"
+kfutil store-types create WinCert

-if ($null -eq (Get-Command "kfutil" -ErrorAction SilentlyContinue)) {
-    Write-Host "kfutil could not be found. Please install kfutil"
-    Write-Host "See https://github.com/Keyfactor/kfutil#quickstart"
-    exit 1
-}
+Write-Host "Creating store type: IISU"
+kfutil store-types create IISU


+set -e

-if ! command -v kfutil &> /dev/null; then
-    echo "kfutil could not be found. Please install kfutil"
-    echo "See https://github.com/Keyfactor/kfutil#quickstart"
-    exit 1
-fi
+echo "Creating store type: WinCert"
+kfutil store-types create WinCert

-if [ -z "$KEYFACTOR_HOSTNAME" ]; then
-    echo "KEYFACTOR_HOSTNAME not set — launching kfutil login"
-    kfutil login
-fi
+echo "Creating store type: IISU"
+kfutil store-types create IISU



            // Assert
-            Assert.Equal("dns=legacy.example.com&dns=old.example.com", result);
+            //Assert.Equal(legacySan, result);
+
+            // Assert
+            if (legacySan == null)
+            {
+                Assert.Equal(string.Empty, result);
+            }
+            else if (legacySan == string.Empty)
+            {
+                Assert.Equal(string.Empty, result);
+            }
+            else
+            {
+                Assert.Equal(legacySan, result);
+            }


+    if ($build -ge 20348) {
+        # Windows Server 2022+ (IIS 10.0.20348+)
+        Write-Information "[VERBOSE] Detected Windows Server 2022 or later (Build: $build)"
+        return @(1, 4, 8, 16, 32, 64)  # Include unknowns for testing
+    }


modified: IISU/ImplementedStoreTypes/WinIIS/Management.cs modified: IISU/PowerShell/Keyfactor.WinCert.Common/Keyfactor.WinCert.Common.psm1 new file: IISU/PowerShell/Keyfactor.WinCert.Common/Private/Test-KeyfactorAdminRights.ps1 modified: IISU/PowerShell/Keyfactor.WinCert.Common/Public/New-KeyfactorResult.ps1 modified: IISU/PowerShell/Keyfactor.WinCert.Common/RoleCapabilities/Keyfactor.WinCert.Common.psrc modified: IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Get-KeyfactorIISBoundCertificates.ps1 modified: IISU/PowerShell/Keyfactor.WinCert.IIS/Public/New-KeyfactorIISSiteBinding.ps1 modified: IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Remove-KeyfactorIISCertificateIfUnused.ps1 modified: IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Remove-KeyfactorIISSiteBinding.ps1

Copilot

Pull request overview

Copilot reviewed 83 out of 163 changed files in this pull request and generated 6 comments.

+        [string]$StorePath,
+
+        [parameter(ParameterSetName = $false)]
+        [switch]$IsAlias


+                Write-Information "[VERBOSE] Instance: $instance"
+                Write-Information "[VERBOSE] Full Instance: $fullInstance"
+                Write-Information "[VERBOSE] Registry Location: $regLocation"
+                Write-Information "[VERBOSE] Current Thumbprint: $currentThumbprint"
+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue
+
+                if ($RenewalThumbprint -and $RenewalThumbprint -contains $currentThumbprint) {
+                    Write-Information "Renewal thumbprint matches for instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                } elseif (-not $RenewalThumbprint) {
+                    Write-Information "No renewal thumbprint provided. Binding certificate to instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                }
+
+                if (-not $result) {
+                    Write-Error "Failed to bind certificate for instance: $instance"
+                    $bindingSuccess = $false
+                }


+        # Step 4: Import the certificate into the specified store
+        Write-Verbose "Importing the certificate to the store: Cert:\LocalMachine\$StoreName"
+        Set-Location -Path "Cert:\LocalMachine\$StoreName"
+
+        $importResult = Import-Certificate -FilePath $cerFilename


+# Store Type creation script using kfutil
+# Generated by Doctool

-# Uncomment if kfutil is not in your PATH
-# Set-Alias -Name kfutil -Value 'C:\Program Files\Keyfactor\kfutil\kfutil.exe'
+Write-Host "Creating store type: WinCert"
+kfutil store-types create WinCert

-if ($null -eq (Get-Command "kfutil" -ErrorAction SilentlyContinue)) {
-    Write-Host "kfutil could not be found. Please install kfutil"
-    Write-Host "See https://github.com/Keyfactor/kfutil#quickstart"
-    exit 1
-}
+Write-Host "Creating store type: IISU"
+kfutil store-types create IISU


+#!/bin/bash
+# Store Type creation script using kfutil
+# Generated by Doctool

-# Creates all 4 store types using kfutil.
-# kfutil reads definitions from the Keyfactor integration catalog.
-#
-# Auth environment variables (first matching method is used):
-#   OAuth access token:   KEYFACTOR_AUTH_ACCESS_TOKEN
-#   OAuth client creds:   KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET
-#                         + KEYFACTOR_AUTH_TOKEN_URL
-#   Basic auth (AD):      KEYFACTOR_HOSTNAME + KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD
-#                         + KEYFACTOR_DOMAIN
-#
-# Auto-generated by doctool generate-store-type-scripts — do not edit by hand.
+set -e

-if ! command -v kfutil &> /dev/null; then
-    echo "kfutil could not be found. Please install kfutil"
-    echo "See https://github.com/Keyfactor/kfutil#quickstart"
-    exit 1
-fi
+echo "Creating store type: WinCert"
+kfutil store-types create WinCert


+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "{SQL-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "" },
+  { "Machine": "{SQL-JEA-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "keyfactor.wincert" }


…s when running IIS jobs.

Copilot

Pull request overview

Copilot reviewed 83 out of 163 changed files in this pull request and generated 7 comments.

Fixed tempfile left behind when using ssh

Copilot

Pull request overview

Copilot reviewed 83 out of 163 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (5)

IISU/PowerShell/Keyfactor.WinCert.SQL/Public/New-KeyfactorSQLBinding.ps1:41

$currentThumbprint is logged before it’s assigned, and the renewal check uses -contains against a string. This makes the renewal path always evaluate false and can incorrectly mark binding as failed when RenewalThumbprint is provided.
IISU/PowerShell/Keyfactor.WinCert.Common/Public/Remove-KeyfactorCertificate.ps1:8
[parameter(ParameterSetName = $false)] is not a valid attribute value (ParameterSetName must be a string). This will cause a parse error when importing the module.
WindowsCertStore.IntegrationTests/servers.json:7
servers.json now contains a hard-coded private IP (192.168.230.139). This is environment-specific and can leak internal network details; it also makes the sample file less reusable for other environments. Prefer placeholders or documentation-reserved example IPs.
scripts/store_types/bash/kfutil_create_store_types.sh:17
The script no longer checks whether kfutil is installed or whether the user is logged in; it will now fail with a less actionable error when prerequisites aren’t met. Also, #!/bin/bash is less portable than #!/usr/bin/env bash.
scripts/store_types/powershell/kfutil_create_store_types.ps1:14
The script no longer checks whether kfutil is installed or whether the user is logged in. Without these guards, failures are harder to diagnose in automation.

Bob Pokorny and others added 17 commits April 24, 2026 13:21

Initial JEA for WinCert

4c4f900

Update generated docs

c45ef24

Helper updates

585fd7f

Merge branch '81018-Adding_JEA_Support' of https://github.com/Keyfact…

aa2e660

…or/iis-orchestrator into 81018-Adding_JEA_Support

Updated spelling of PowerShell script and fixed Information Messages …

3d8180a

…from PW

Added JEA support for IIS

59d239f

Fixed and updated IIS Components

d3a92d4

Completed SQL Module and updated test projects

355c3ac

Testing

c38621d

Removed WinCertScripts from extension.

0643435

changed way LocalHost and JEA are configured.

a9cd833

Fixed ODKG missing file error

0c432a9

Updated KF Import of Signed Certificates PowerShell Script

eca4c19

Fixed missing PowerShell script not being found.

f9bd02b

Fix missing path

df9ddcf

Updated documentation to include JEA information.

8ad923c

Update generated docs

4094f15

Copilot AI review requested due to automatic review settings May 11, 2026 22:15

Copilot started reviewing on behalf of rcpokorny May 11, 2026 22:16 View session

Copilot AI reviewed May 11, 2026

View reviewed changes

spbsoluble and others added 2 commits May 12, 2026 09:12

chore(ci): Update build workflow to v5

9e102ea

docs: auto-generate README and documentation [skip ci]

2158f3c

Copilot AI review requested due to automatic review settings May 12, 2026 16:12

Copilot started reviewing on behalf of indrora May 12, 2026 16:13 View session

Copilot AI reviewed May 12, 2026

View reviewed changes

spbsoluble and others added 2 commits May 12, 2026 09:33

Update generated docs

f85f910

docs: auto-generate README and documentation [skip ci]

fb4031a

Copilot AI review requested due to automatic review settings May 12, 2026 16:34

Copilot AI reviewed May 12, 2026

View reviewed changes

docs: auto-generate README and documentation [skip ci]

d9fbee8

Updated error reporting when bad CSP

bc07ae8

Copilot AI review requested due to automatic review settings July 6, 2026 20:40

Updated PS scripts to get CSPs from registry not certutil.

e38da14

Copilot started reviewing on behalf of rcpokorny July 6, 2026 20:41 View session

docs: auto-generate README and documentation [skip ci]

7250263

Copilot AI reviewed Jul 6, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 6, 2026 20:46

Copilot started reviewing on behalf of rcpokorny July 6, 2026 20:46 View session

Copilot AI reviewed Jul 6, 2026

View reviewed changes

Bob Pokorny added 2 commits July 6, 2026 15:57

Fixed formatting issue in CHANGELOG

db4b068

Updated the Get-KeyfactorIISBoundCertificates.ps1 script to include s…

895719a

…upport for JEA (Just Enough Administration) environments. Added a new documentation file for setting up an SSH development environment.

Copilot AI review requested due to automatic review settings July 14, 2026 23:17

Copilot started reviewing on behalf of rcpokorny July 14, 2026 23:17 View session

docs: auto-generate README and documentation [skip ci]

226dcb3

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 14, 2026 23:23

Copilot started reviewing on behalf of rcpokorny July 14, 2026 23:23 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 15, 2026 15:55

Copilot started reviewing on behalf of rcpokorny July 15, 2026 15:55 View session

Copilot AI reviewed Jul 15, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 16, 2026 20:43

Updated PowerShell initialization to check for appropriate permission…

8405f5e

…s when running IIS jobs.

Copilot started reviewing on behalf of rcpokorny July 16, 2026 20:44 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 20, 2026 23:53

Fixed null error when testing for admin

c1f1649

Fixed tempfile left behind when using ssh

Copilot started reviewing on behalf of rcpokorny July 20, 2026 23:54 View session

Copilot AI reviewed Jul 20, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

81018 adding jea support#185

81018 adding jea support#185
rcpokorny wants to merge 53 commits into
release-4.0from
81018-Adding_JEA_Support

rcpokorny commented May 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

		Write-Information "[VERBOSE] Running certutil with arguments: $argLine"

		Set-Location -Path "Cert:\LocalMachine\$StoreName"

		$importResult = Import-Certificate -FilePath $cerFilename

		_results = _psHelper.ExecutePowerShell("Add-KeyfactorCertificate", parameters);
		_logger.LogTrace("Returned from executing PS function (Add-KFCertificateToStore)");

		Write-Host "Creating store type: WinCert"
		kfutil store-types create WinCert

		Write-Information "Entering PowerShell Script: New-KFIISSiteBinding" -InformationAction SilentlyContinue
		Write-Information "[VERBOSE] Parameters: $(($PSBoundParameters.GetEnumerator() \| ForEach-Object { "$($_.Key): '$($_.Value)'" }) -join ', ')"

		using Keyfactor.Extensions.Orchestrator.WindowsCertStore;

		namespace WindowsCertStore.UnitTests

		# Store Type creation script using kfutil
		# Generated by Doctool

Uh oh!

Conversation

rcpokorny commented May 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Milestone