Auth support for all auth methods.

.github/workflows/keyfactor-bootstrap-workflow-v3.yml

@@ -11,10 +11,9 @@ on:
 
 jobs:
   call-starter-workflow:
-    uses: keyfactor/actions/.github/workflows/starter.yml@v3.1.2
+    uses: keyfactor/actions/.github/workflows/starter.yml@v5
     secrets:
-      token: ${{ secrets.V2BUILDTOKEN}}
-      APPROVE_README_PUSH: ${{ secrets.APPROVE_README_PUSH}}
-      gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }}
-      gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }}
-      scan_token: ${{ secrets.SAST_TOKEN }}
+      token: ${{ secrets.V2BUILDTOKEN}} # REQUIRED
+      gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }} # Only required for golang builds
+      gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }} # Only required for golang builds
+      scan_token: ${{ secrets.SAST_TOKEN }} # REQUIRED

CHANGELOG.md

@@ -1,3 +1,7 @@
+v.1.0.2
+
+- Added support for all auth methods currently supported by the Keyfactor AWS library. 
+
 v.1.0.1
 
 - Added support for the AWS Code Signing Template

aws-pca-caplugin/AWSPCACAPlugin.cs

@@ -28,7 +28,7 @@
     private readonly ILogger Logger;
     private ICertificateDataReader _certificateDataReader;
 
     public AWSPCACAPlugin()
     {
         Logger = LogHandler.GetClassLogger<AWSPCACAPlugin>();
     }
@@ -95,8 +95,8 @@
         CancellationToken cancelToken)
     {
         Logger.MethodEntry();
-        Logger.LogTrace(
-            $"Synchronize started. fullSync={fullSync}, lastSync={lastSync?.ToUniversalTime().ToString("O") ?? "null"}");
+        Logger.LogInformation(
+            $"AWS PCA Synchronize started. fullSync={fullSync}, lastSync={lastSync?.ToUniversalTime().ToString("O") ?? "(none)"}");
 
         try
         {
@@ -105,7 +105,8 @@
                 throw new Exception($"AWS audit report failed: {report.RegistrationError.Description}");
 
             var items = report?.Result ?? new List<ACMPCACertificate>();
-            Logger.LogDebug($"Sync found {items.Count} audit records.");
+            Logger.LogInformation($"AWS PCA Synchronize: retrieved {items.Count} audit record(s) from the CA.");
+            int emitted = 0;
 
             foreach (var audit in items)
             {
@@ -252,6 +253,7 @@
                                 Status = (int)EndEntityStatus.INPROCESS,
                                 ProductID = certResp.CertificateType
                             }, cancelToken);
+                            emitted++;
 
                             continue;
                         }
@@ -287,16 +289,19 @@
                 {
                     CARequestID = caRequestId,
                     // For REVOKED: this will now be populated when ARN exists + GetCertificate succeeds; otherwise null (status-only).
                     Certificate = GetEndEntityCertificate(certPayload),
                     Status = newStatus,
                     ProductID = productId
                 };
 
                 // Emit to buffer as AnyGateway expects.
                 blockingBuffer.Add(finalsubmit, cancelToken);
+                emitted++;
             }
 
             blockingBuffer.CompleteAdding();
+            Logger.LogInformation(
+                $"AWS PCA Synchronize complete: scanned {items.Count} audit record(s), emitted {emitted} certificate(s) to Keyfactor (added/updated/status-changed). fullSync={fullSync}.");
             Logger.MethodExit();
         }
         catch (Exception e)
@@ -341,14 +346,14 @@
                 return (int)EndEntityStatus.FAILED;
             }
 
-            // Prefer the normalized numeric status from the client response if present.
-            if (resp != null && resp.Status > 0)
-                return resp.Status;
-
-            // Fallback if Status wasn't implemented on response
-            return resp?.RevokeSuccess == true
-                ? (int)EndEntityStatus.REVOKED
-                : (int)EndEntityStatus.FAILED;
+            // Prefer the normalized numeric status from the client response if present;
+            // otherwise fall back to RevokeSuccess.
+            var revokedStatus = (resp != null && resp.Status > 0)
+                ? resp.Status
+                : (resp?.RevokeSuccess == true ? (int)EndEntityStatus.REVOKED : (int)EndEntityStatus.FAILED);
+            Logger.LogInformation(
+                $"AWS PCA Revoke completed: serial={serial}, reason={awsReason}, resultStatus={revokedStatus}.");
+            return revokedStatus;
         }
         catch (Exception ex)
         {
@@ -440,59 +445,35 @@
                     string priorRequestId;
                     try
                     {
-                        return await IssueAndFetchAsync(
-                                csr,
-                                productInfo.ProductID,
-                                days,
-                                signingAlgorithm,
-                                "Certificate Issued")
+                        priorRequestId = await _certificateDataReader
+                            .GetRequestIDBySerialNumber(priorSn)
                             .ConfigureAwait(false);
                     }
-
-                case EnrollmentType.RenewOrReissue:
+                    catch (Exception ex)
                     {
-                        if (productInfo.ProductParameters == null ||
-                            !TryGetProductParam(productInfo.ProductParameters, "PriorCertSN", out var priorSn) ||
-                            string.IsNullOrWhiteSpace(priorSn))
-                            return new EnrollmentResult
-                            {
-                                Status = (int)EndEntityStatus.FAILED,
-                                StatusMessage =
-                                    "Renew/Reissue requires ProductParameters['PriorCertSN'] (hex serial number)."
-                            };
-
-                        string priorRequestId;
-                        try
-                        {
-                            priorRequestId = await _certificateDataReader
-                                .GetRequestIDBySerialNumber(priorSn)
-                                .ConfigureAwait(false);
-                        }
-                        catch (Exception ex)
+                        return new EnrollmentResult
                         {
-                            return new EnrollmentResult
-                            {
-                                Status = (int)EndEntityStatus.FAILED,
-                                StatusMessage = $"Could not resolve PriorCertSN to request id: {ex.Message}"
-                            };
-                        }
+                            Status = (int)EndEntityStatus.FAILED,
+                            StatusMessage = $"Could not resolve PriorCertSN to request id: {ex.Message}"
+                        };
+                    }
 
-                        var expiration = _certificateDataReader.GetExpirationDateByRequestId(priorRequestId);
-                        var isRenewal = expiration.HasValue && expiration.Value.ToUniversalTime() <= DateTime.UtcNow;
+                    var expiration = _certificateDataReader.GetExpirationDateByRequestId(priorRequestId);
+                    var isRenewal = expiration.HasValue && expiration.Value.ToUniversalTime() <= DateTime.UtcNow;
 
-                        var msg = isRenewal ? "Certificate Renewed" : "Certificate Reissued";
-                        var token = BuildIdempotencyToken(isRenewal ? "renew" : "reissue", priorRequestId, csr);
+                    var msg = isRenewal ? "Certificate Renewed" : "Certificate Reissued";
+                    var token = BuildIdempotencyToken(isRenewal ? "renew" : "reissue", priorRequestId, csr);
 
-                        // Still "IssueCertificate" under the hood; PCA doesn't have first-class renew/reissue.
-                        return await IssueAndFetchAsync(
-                                csr,
-                                productInfo.ProductID,
-                                days,
-                                msg,
-                                // Optional: stable-ish idempotency (helps avoid duplicates if caller retries quickly)
-                                token)
-                            .ConfigureAwait(false);
-                    }
+                    // Still "IssueCertificate" under the hood; PCA doesn't have first-class renew/reissue.
+                    return await IssueAndFetchAsync(
+                            csr,
+                            productInfo.ProductID,
+                            days,
+                            msg,
+                            // Optional: stable-ish idempotency (helps avoid duplicates if caller retries quickly)
+                            token)
+                        .ConfigureAwait(false);
+                }
 
                 default:
                     return new EnrollmentResult
@@ -529,8 +510,9 @@
         }
         try
         {
-            Logger.LogInformation("Ping request received");
+            Logger.LogInformation("AWS PCA Ping request received; contacting AWS...");
             await AwsClient.PingAsync().ConfigureAwait(false);
+            Logger.LogInformation("AWS PCA Ping succeeded (AWS reachable).");
         }
         catch (Exception e)
         {
@@ -769,16 +751,23 @@
             IdempotencyToken = idempotencyToken ?? Guid.NewGuid().ToString("N")
         };
 
+        Logger.LogInformation(
+            $"AWS PCA IssueCertificate requested: productId={productId}, validityDays={validityDays}, signingAlgorithm={signingAlgorithm ?? "(auto)"}.");
+
         var issueResp = await AwsClient.SubmitIssueCertificateAsync(issueReq).ConfigureAwait(false);
 
         if (issueResp?.RegistrationError != null ||
             issueResp?.Result == null ||
             string.IsNullOrWhiteSpace(issueResp.Result.CertificateArn))
+        {
+            var failMsg = issueResp?.RegistrationError?.Description ?? "AWS PCA IssueCertificate failed.";
+            Logger.LogError($"AWS PCA IssueCertificate failed (productId={productId}): {failMsg}");
             return new EnrollmentResult
             {
                 Status = (int)EndEntityStatus.FAILED,
-                StatusMessage = issueResp?.RegistrationError?.Description ?? "AWS PCA IssueCertificate failed."
+                StatusMessage = failMsg
             };
+        }
 
         var certArn = issueResp.Result.CertificateArn;
         var caRequestId = issueResp.Result.CertificateId ?? SafeRequestIdFromArn(certArn) ?? certArn;
@@ -811,6 +800,8 @@
                 StatusMessage = "AWS PCA returned an empty certificate."
             };
 
+        Logger.LogInformation(
+            $"AWS PCA enrollment succeeded ({statusMessageOnSuccess}): productId={productId}, caRequestId={caRequestId}, certificateArn={certArn}, validityDays={validityDays}, status={certResp.Status}.");
         return new EnrollmentResult
         {
             CARequestID = caRequestId,

aws-pca-caplugin/AWSPCACAPlugin.csproj

@@ -12,31 +12,35 @@
 	</PropertyGroup>
 
 
-	<Target Name="CustomPostBuild" AfterTargets="PostBuildEvent">
-		<Exec Condition="'$(Configuration)'=='DebugAndPush'" Command="PowerShell -ExecutionPolicy Bypass -File &quot;C:\Users\mkachkaev\source\scripts\SyncScriptAWS_GT.ps1&quot;&#xA;" />
+	<!--
+		DebugAndPush post-build: runs a local push/deploy script after building. The script path is
+		supplied per-developer via the $(PushScript) property (set it in AWSPCACAPlugin.csproj.user,
+		which is gitignored) or as an MSBuild/CI property, so no personal path is committed. When
+		$(PushScript) is unset or the file is missing (e.g. a fresh clone, or another developer's
+		machine), the step is skipped and the build still succeeds. See AWSPCACAPlugin.csproj.user.example.
+	-->
+	<Target Name="CustomPostBuild" AfterTargets="PostBuildEvent"
+			Condition="'$(Configuration)'=='DebugAndPush' and '$(PushScript)'!='' and Exists('$(PushScript)')">
+		<Exec Command="PowerShell -ExecutionPolicy Bypass -File &quot;$(PushScript)&quot;" />
 	</Target>
 
 
-
-
 	<ItemGroup>
 		<None Update="manifest.json">
 			<CopyToOutputDirectory>Always</CopyToOutputDirectory>
 		</None>
 	</ItemGroup>
 
 
-
 	<ItemGroup>
-		<PackageReference Include="Keyfactor.AnyGateway.IAnyCAPlugin" Version="3.2.0" />
+		<PackageReference Include="Keyfactor.AnyGateway.IAnyCAPlugin" Version="3.3.0" />
 		<PackageReference Include="Keyfactor.PKI" Version="8.3.1" />
 		<PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
-		<PackageReference Include="AWSSDK.ACMPCA" Version="4.0.4.9" />
-		<PackageReference Include="AWSSDK.S3" Version="4.0.25" />
+		<PackageReference Include="AWSSDK.ACMPCA" Version="4.0.100.7" />
+		<PackageReference Include="AWSSDK.S3" Version="4.0.101.6" />
 		<PackageReference Include="Keyfactor.Common" Version="2.11.0" />
 		<PackageReference Include="Keyfactor.Extensions.Aws.Auth" Version="0.5.2" />
 		<PackageReference Include="Keyfactor.Logging" Version="1.3.0" />
-	</ItemGroup>		
-
+	</ItemGroup>
 
 </Project>

aws-pca-caplugin/AWSPCACAPlugin.csproj.user.example

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Template for a local, developer-specific MSBuild override.
+
+  The "DebugAndPush" build configuration runs a post-build push/deploy script whose path is NOT
+  committed to the repo. To use it:
+
+    1. Copy this file to  AWSPCACAPlugin.csproj.user  (same folder).
+       (*.user is gitignored, so your personal path stays out of source control.)
+    2. Set <PushScript> below to the full path of your local push script.
+    3. Build the "DebugAndPush" configuration in Visual Studio (or `dotnet build -c DebugAndPush`);
+       Visual Studio auto-imports the .user file, so the script runs after the build.
+
+  If <PushScript> is unset or the file doesn't exist, the DebugAndPush build simply skips the push
+  step and still succeeds. You can also supply the value without this file, e.g.:
+       dotnet build -c DebugAndPush -p:PushScript="C:\path\to\your\push.ps1"
+-->
+<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup>
+    <PushScript>C:\path\to\your\push-script.ps1</PushScript>
+  </PropertyGroup>
+</Project>

aws-pca-caplugin/Client/ACMPCAClient.cs

@@ -53,7 +53,7 @@
     private string? _caKeyAlgorithmName;
     private IAmazonS3? S3Client;
 
     public AwsPcaClient(IAnyCAPluginConfigProvider configProvider)
     {
         Logger = LogHandler.GetClassLogger<AwsPcaClient>();
 
@@ -453,14 +453,37 @@
     {
         var s3 = await GetOrCreateS3ClientAsync(cancellationToken).ConfigureAwait(false);
 
-        using var response = await s3.GetObjectAsync(new GetObjectRequest
+        // ACM PCA audit-report generation is asynchronous: CreateCertificateAuthorityAuditReport
+        // returns the S3 key before AWS has finished writing the object. Downloading immediately
+        // races the report generation and fails with NoSuchKey ("The specified key does not
+        // exist"). Poll for the object with backoff until it appears (or we time out).
+        var deadline = DateTime.UtcNow.AddMinutes(3);
+        var delay = TimeSpan.FromSeconds(2);
+        while (true)
         {
-            BucketName = bucket,
-            Key = key
-        }, cancellationToken).ConfigureAwait(false);
+            cancellationToken.ThrowIfCancellationRequested();
+            try
+            {
+                using var response = await s3.GetObjectAsync(new GetObjectRequest
+                {
+                    BucketName = bucket,
+                    Key = key
+                }, cancellationToken).ConfigureAwait(false);
 
-        using var reader = new StreamReader(response.ResponseStream);
-        return await reader.ReadToEndAsync().ConfigureAwait(false);
+                using var reader = new StreamReader(response.ResponseStream);
+                return await reader.ReadToEndAsync().ConfigureAwait(false);
+            }
+            catch (AmazonS3Exception ex) when (
+                (ex.ErrorCode == "NoSuchKey" || ex.StatusCode == System.Net.HttpStatusCode.NotFound)
+                && DateTime.UtcNow < deadline)
+            {
+                Logger.LogDebug(
+                    $"Audit report not yet available in S3 (bucket={bucket}, key={key}); " +
+                    $"retrying in {delay.TotalSeconds:0}s.");
+                await Task.Delay(delay, cancellationToken).ConfigureAwait(false);
+                delay = TimeSpan.FromSeconds(Math.Min(delay.TotalSeconds * 1.5, 15));
+            }
+        }
     }
 
     private async Task<IAmazonS3> GetOrCreateS3ClientAsync(CancellationToken cancellationToken)
@@ -660,7 +683,7 @@
                 _caKeyAlgorithmName = val.Trim();
                 return (_caKeyAlgorithmName, null);
             }
             catch (Exception ex)
             {
                 return (null,
                     new RegistrationError
@@ -781,4 +804,4 @@
         public const string Region = "Region";
         public const string S3Bucket = "S3Bucket";
     }
-}
+}