85863 add pam support

.github/workflows/keyfactor-starter-workflow.yml

@@ -11,10 +11,9 @@ on:
 
 jobs:
   call-starter-workflow:
-    uses: keyfactor/actions/.github/workflows/starter.yml@3.2.0
+    uses: keyfactor/actions/.github/workflows/starter.yml@v5
     secrets:
-      token: ${{ secrets.V2BUILDTOKEN}}
-      APPROVE_README_PUSH: ${{ secrets.APPROVE_README_PUSH}}
-      gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }}
-      gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }}
-      scan_token: ${{ secrets.SAST_TOKEN }}
+      token: ${{ secrets.V2BUILDTOKEN}} # REQUIRED
+      gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }} # Only required for golang builds
+      gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }} # Only required for golang builds
+      scan_token: ${{ secrets.SAST_TOKEN }} # REQUIRED

AzureAppGatewayOrchestrator.Tests/AzureAppGW.cs

@@ -1,16 +1,10 @@
-// Copyright 2024 Keyfactor
-// 
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-// 
-//     http://www.apache.org/licenses/LICENSE-2.0
-// 
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+
+//  Copyright 2026 Keyfactor
+//  Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+//  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions
+//  and limitations under the License.
 
 using System.Security.Cryptography.X509Certificates;
 using Azure.ResourceManager.Network.Models;
@@ -103,7 +97,7 @@
         JobResult result = inventory.ProcessJob(config, (inventoryItems) =>
                 {
                 // Assert
                 Assert.Equal(1, inventoryItems.Count());
                 Assert.Equal("test", inventoryItems.First().Alias);
 
                 _logger.LogInformation("AzureAppGw_Inventory_ProcessJob_ValidClient_ReturnSuccess - Success");
@@ -146,7 +140,7 @@
             callbackCalled = true;
 
             // Assert
             Assert.True(false, "Callback should not be called");
             return true;
         });
 
@@ -223,7 +217,7 @@
         JobResult result = discovery.ProcessJob(config, (discoveredAppGateways) =>
         {
             // Assert
             Assert.Equal(1, discoveredAppGateways.Count());
             Assert.Equal("test", discoveredAppGateways.First());
 
             _logger.LogInformation("Discovery_ProcessJob_ValidClient_ReturnSuccess - Success");
@@ -268,7 +262,7 @@
             callbackCalled = true;
 
             // Assert
             Assert.True(false, "Callback should not be called");
             return true;
         });
 

AzureAppGatewayOrchestrator.Tests/AzureAppGatewayOrchestrator.Tests.csproj

@@ -1,35 +1,36 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <TargetFramework>net8.0</TargetFramework>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <Nullable>enable</Nullable>
-
-    <IsPackable>false</IsPackable>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <PackageReference Include="Azure.ResourceManager.Network" Version="1.7.0" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.1.0" />
-    <PackageReference Include="Moq" Version="4.20.70" />
-    <PackageReference Include="NLog.Extensions.Logging" Version="5.3.8" />
-    <PackageReference Include="xunit" Version="2.4.1" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.4.3">
-      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
-      <PrivateAssets>all</PrivateAssets>
-    </PackageReference>
-    <PackageReference Include="coverlet.collector" Version="3.1.2">
-      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
-      <PrivateAssets>all</PrivateAssets>
-    </PackageReference>
-  </ItemGroup>
-
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Azure.ResourceManager.Network" Version="1.9.0" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.6.0" />
+    <PackageReference Include="Moq" Version="4.20.70" />
+    <PackageReference Include="NLog.Extensions.Logging" Version="6.1.3" />
+    <PackageReference Include="FluentAssertions" Version="7.2.0" />
+    <PackageReference Include="xunit" Version="2.7.0" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.0">
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      <PrivateAssets>all</PrivateAssets>
+    </PackageReference>
+    <PackageReference Include="coverlet.collector" Version="3.1.2">
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      <PrivateAssets>all</PrivateAssets>
+    </PackageReference>
+  </ItemGroup>
+
   <ItemGroup>
     <ProjectReference Include="..\AzureAppGatewayOrchestrator\AzureAppGatewayOrchestrator.csproj" />
-  </ItemGroup>
+  </ItemGroup>
 
   <ItemGroup>
     <Content Include="xunit.runner.json" CopyToOutputDirectory="PreserveNewest" />
   </ItemGroup>
-
-</Project>
+
+</Project>

AzureAppGatewayOrchestrator.Tests/AzureAppGwBin.cs

@@ -1,16 +1,10 @@
-// Copyright 2024 Keyfactor
-// 
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-// 
-//     http://www.apache.org/licenses/LICENSE-2.0
-// 
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+
+//  Copyright 2026 Keyfactor
+//  Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+//  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions
+//  and limitations under the License.
 
 using System.Security.Cryptography.X509Certificates;
 using Azure.ResourceManager.Network.Models;
@@ -104,7 +98,7 @@
         JobResult result = inventory.ProcessJob(config, (inventoryItems) =>
                 {
                 // Assert
                 Assert.Equal(1, inventoryItems.Count());
                 Assert.Equal("fake-http-listener", inventoryItems.First().Alias);
 
                 _logger.LogInformation("AzureAppGwBin_Inventory_ProcessJob_ValidClientOneBoundHttpsListener_ReturnSuccess - Success");
@@ -146,7 +140,7 @@
         JobResult result = discovery.ProcessJob(config, (discoveredAppGateways) =>
         {
             // Assert
             Assert.Equal(1, discoveredAppGateways.Count());
             Assert.Equal("test", discoveredAppGateways.First());
 
             _logger.LogInformation("Discovery_ProcessJob_ValidClient_ReturnSuccess - Success");
@@ -191,7 +185,7 @@
             callbackCalled = true;
 
             // Assert
             Assert.True(false, "Callback should not be called");
             return true;
         });
 

AzureAppGatewayOrchestrator.Tests/Client.cs

@@ -1,16 +1,10 @@
-// Copyright 2024 Keyfactor
-// 
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-// 
-//     http://www.apache.org/licenses/LICENSE-2.0
-// 
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+
+//  Copyright 2026 Keyfactor
+//  Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+//  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions
+//  and limitations under the License.
 
 using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;

AzureAppGatewayOrchestrator.Tests/FakeClient.cs

@@ -1,16 +1,10 @@
-// Copyright 2024 Keyfactor
-// 
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-// 
-//     http://www.apache.org/licenses/LICENSE-2.0
-// 
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+
+//  Copyright 2026 Keyfactor
+//  Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+//  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions
+//  and limitations under the License.
 
 using System.Security.Cryptography.X509Certificates;
 using Azure.ResourceManager.Network.Models;

AzureAppGatewayOrchestrator.Tests/IntegrationTestingFact.cs

@@ -1,16 +1,10 @@
-// Copyright 2024 Keyfactor
-// 
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-// 
-//     http://www.apache.org/licenses/LICENSE-2.0
-// 
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+
+//  Copyright 2026 Keyfactor
+//  Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+//  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions
+//  and limitations under the License.
 
 namespace AzureAppGatewayOrchestrator.Tests;
 

AzureAppGatewayOrchestrator.Tests/JobClientBuilder.cs

@@ -1,16 +1,10 @@
-// Copyright 2024 Keyfactor
-// 
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-// 
-//     http://www.apache.org/licenses/LICENSE-2.0
-// 
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+
+//  Copyright 2026 Keyfactor
+//  Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+//  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions
+//  and limitations under the License.
 
 using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
@@ -20,7 +14,9 @@
 using AzureApplicationGatewayOrchestratorExtension.Client;
 using Keyfactor.Logging;
 using Keyfactor.Orchestrators.Extensions;
+using Keyfactor.Orchestrators.Extensions.Interfaces;
 using Microsoft.Extensions.Logging;
+using Moq;
 using NLog.Extensions.Logging;
 
 public class JobClientBuilder
@@ -142,6 +138,70 @@ public void AppGatewayJobClientBuilder_ValidCertificateStoreConfigClientCertific
         _logger.LogInformation("AppGatewayJobClientBuilder_ValidCertificateStoreConfigClientCertificate_BuildValidClient - Success");
     }
 
+    [Fact]
+    public void AppGatewayJobClientBuilder_WithPAMResolver_CertificateStoreDetails_ResolvesCredentials()
+    {
+        // Arrange
+        var mockResolver = new Mock<IPAMSecretResolver>();
+        mockResolver.Setup(r => r.Resolve("pam-key-for-username")).Returns("resolved-azure-application-id");
+        mockResolver.Setup(r => r.Resolve("pam-key-for-password")).Returns("resolved-azure-client-secret");
+
+        AppGatewayJobClientBuilder<FakeClient.FakeBuilder> jobClientBuilderWithFakeBuilder = new();
+        jobClientBuilderWithFakeBuilder.resolver = mockResolver.Object;
+
+        CertificateStore fakeCertificateStoreDetails = new()
+        {
+            ClientMachine = "fake-tenant-id",
+            StorePath = "fake-azure-resource-id",
+            Properties = "{\"ServerUsername\":\"pam-key-for-username\",\"ServerPassword\":\"pam-key-for-password\",\"AzureCloud\":\"fake-azure-cloud\"}"
+        };
+
+        // Act
+        jobClientBuilderWithFakeBuilder
+            .WithCertificateStoreDetails(fakeCertificateStoreDetails)
+            .Build();
+
+        // Assert
+        Assert.Equal("resolved-azure-application-id", jobClientBuilderWithFakeBuilder._builder._applicationId);
+        Assert.Equal("resolved-azure-client-secret", jobClientBuilderWithFakeBuilder._builder._clientSecret);
+        mockResolver.Verify(r => r.Resolve("pam-key-for-username"), Times.Once);
+        mockResolver.Verify(r => r.Resolve("pam-key-for-password"), Times.Once);
+
+        _logger.LogInformation("AppGatewayJobClientBuilder_WithPAMResolver_CertificateStoreDetails_ResolvesCredentials - Success");
+    }
+
+    [Fact]
+    public void AppGatewayJobClientBuilder_WithPAMResolver_DiscoveryJobConfiguration_ResolvesCredentials()
+    {
+        // Arrange
+        var mockResolver = new Mock<IPAMSecretResolver>();
+        mockResolver.Setup(r => r.Resolve("pam-key-for-username")).Returns("resolved-azure-application-id");
+        mockResolver.Setup(r => r.Resolve("pam-key-for-password")).Returns("resolved-azure-client-secret");
+
+        AppGatewayJobClientBuilder<FakeClient.FakeBuilder> jobClientBuilderWithFakeBuilder = new();
+        jobClientBuilderWithFakeBuilder.resolver = mockResolver.Object;
+
+        DiscoveryJobConfiguration config = new()
+        {
+            ClientMachine = "fake-tenant-id",
+            ServerUsername = "pam-key-for-username",
+            ServerPassword = "pam-key-for-password"
+        };
+
+        // Act
+        jobClientBuilderWithFakeBuilder
+            .WithDiscoveryJobConfiguration(config, "fake-tenant-id")
+            .Build();
+
+        // Assert
+        Assert.Equal("resolved-azure-application-id", jobClientBuilderWithFakeBuilder._builder._applicationId);
+        Assert.Equal("resolved-azure-client-secret", jobClientBuilderWithFakeBuilder._builder._clientSecret);
+        mockResolver.Verify(r => r.Resolve("pam-key-for-username"), Times.Once);
+        mockResolver.Verify(r => r.Resolve("pam-key-for-password"), Times.Once);
+
+        _logger.LogInformation("AppGatewayJobClientBuilder_WithPAMResolver_DiscoveryJobConfiguration_ResolvesCredentials - Success");
+    }
+
     static void ConfigureLogging()
     {
         var config = new NLog.Config.LoggingConfiguration();