Initial Release by spbsoluble · Pull Request #1 · Keyfactor/akeyless-pam

spbsoluble · 2025-11-11T19:33:33Z

Summary

This PR delivers the initial implementation of the Akeyless PAM Provider for Keyfactor Command and Universal Orchestrator.

What's included

Core provider (akeyless-pam/)

AkeylessPam.cs — IPAMProvider implementation; entry point is GetPassword(), which authenticates to Akeyless and returns the requested secret value
AkeylessApiClient.cs / IAkeylessApiClient.cs — thin wrapper around the akeyless NuGet SDK (V2Api) for authentication and secret retrieval
AkeylessConfiguration.cs — configuration model with parameter key constants, validation attributes, and supported secret types
Constants.cs — default values for auth type (access_key) and API URL (https://api.akeyless.io)
manifest.json — Universal Orchestrator provider descriptor

Supported secret types

Type	Behavior
`static_text`	Returns raw string value
`static_kv`	Parses `key=value` lines; extracts field named by `StaticSecretFieldName`
`static_json`	Deserializes JSON; optionally extracts field named by `StaticSecretFieldName`

Tests

Unit tests (tests/AkeylessPam.Unit.Tests/) — no external dependencies, always runnable
Integration tests (tests/AkeylessPam.Integration.Tests/) — skip automatically when Akeyless credentials are absent
GitHub Actions workflow (tests.yml) — runs unit and integration tests on push and PRs

Tooling & docs

Makefile — common targets: build, test, test-unit, test-integration, console
README.md — full installation and configuration guide
CHANGELOG.md — v1.0.0 feature list
Updated keyfactor-starter-workflow.yml to use dotnet10-support branch for .NET 10 build support

Test plan

Unit tests pass: dotnet test tests/AkeylessPam.Unit.Tests/
Integration tests pass with valid credentials (or skip gracefully without them): dotnet test tests/AkeylessPam.Integration.Tests/
GitHub Actions Tests workflow passes on this PR
Release workflow builds and signs the provider artifact successfully

Copilot

Pull Request Overview

This PR introduces the initial implementation of an Akeyless PAM (Privileged Access Management) Provider for Keyfactor, enabling retrieval of stored account credentials from Akeyless secrets.

Key Changes:

Implements the IPAMProvider interface with support for access key authentication
Adds support for three static secret types: static_text, static_json, and static_kv
Includes comprehensive documentation, configuration examples, and test console application

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
docsource/overview.md	Provides high-level overview of the Akeyless PAM Provider functionality
docsource/akeyless.md	Contains detailed documentation including authentication methods, secret types, configuration examples, and architecture diagrams
akeyless-pam/manifest.json	Defines the extension configuration for integrating the PAM provider with Keyfactor Platform
akeyless-pam/Models/AkeylessConfiguration.cs	Implements configuration model with validation for connection parameters and secret retrieval settings
akeyless-pam/Constants.cs	Defines constants for default authentication methods and API URLs
akeyless-pam/AkeylessPam.cs	Core implementation of the PAM provider including authentication, secret retrieval, and parsing logic
TestConsole/Program.cs	Test application demonstrating usage of all supported secret types
TestConsole/Dockerfile	Docker container configuration for running the test console

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull Request Overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 10 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull Request Overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 6 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

# Conflicts: # akeyless-pam/akeyless-pam.csproj

…ent abstraction - Introduce IAkeylessApiClient interface and AkeylessApiClient adapter to decouple V2Api SDK from AkeylessPam, enabling unit testing via Moq - Add internal constructor on AkeylessPam accepting a client factory - Call Validator.TryValidateObject after building AkeylessConfiguration, making IValidatableObject.Validate() active in production code - Fix AkeylessConfiguration.Validate() bug: StaticSecretFieldName was incorrectly required for static_json (optional per docs); now only required for static_kv - Add InternalsVisibleTo for both test assemblies and DynamicProxyGenAssembly2 - Add AkeylessPam.Unit.Tests (27 tests, xUnit + Moq, 86% line coverage) - Add AkeylessPam.Integration.Tests (15 tests, skip when credentials absent, DotEnvLoader reads .env for local dev) - Fix docs/docsource: wrong TypeFullName (Pam → AkeylessPam), inaccurate secret type descriptions, broken sequence diagram text, grammar fixes - Add CLAUDE.md and docsource/testing.md

…alise log levels - Remove Value from ParseKvSecret debug log (was logging actual secret values) - Replace malformed KV line content log with line index only - Fix warning message that incorrectly said 'defaulting to implicit' when code actually defaults to access_key - Fix GetAkeylessSecretAsync debug message that said 'fetch access token' instead of 'connecting to Akeyless' - Add AccessId (not key) to auth success/failure log entries for audit trail - Add structured success log after secret retrieval completes - Remove emoji from all log messages - Demote noisy Info logs to Debug: format detection, validation steps, config build steps, server config valid message - Add URL and auth type to configuration debug log for traceability - Add inline comments explaining intentional omissions of sensitive values

- Add net10.0 to TargetFrameworks alongside net8.0 - Add conditional Keyfactor.Logging reference for net10.0 - Update global.json SDK version to 10.0 (latestFeature rollforward) - Update CI workflows to use .NET 10 SDK - Fix integration-manifest.json schema URL and Url field description

- Add README.md to unit and integration test projects documenting all test cases with descriptions - Remove TestConsole project and solution reference (replaced by the integration test suite)

- Add class-level XML doc comments to InvalidClientConfigurationException and InvalidSecretConfigurationException - Replace ContainsKey+indexer with TryGetValue in ValidateRequiredParameter - Fix 'a Akeyless' -> 'an Akeyless' in overview.md and README.md - Fix 'Priviledged' -> 'Privileged' in README.md (x2) - Fix 'Creates a' -> 'Creates an' in BuildAkeylessConfiguration XML doc - Remove unused DefaultAuthMethodReadOnly from AkeylessConstants; update unit test to use DefaultAuthMethod

…9 SDK

…flow

…type

The Keyfactor Command UI can send a space character instead of an empty string for optional fields. Trim StaticSecretFieldName on assignment so whitespace-only values behave identically to empty (no field extraction).

- Replace temporary debug/print tests with proper assertions for the k8s-orchestrator secret (no secret values printed in output) - Add note to docsource/docs that the Command portal may show StaticSecretFieldName as required; enter a space to return the full JSON blob

- akeyless-pam/manifest.json: fix TypeFullName to AkeylessPam (was Pam) - integration-manifest.json: remove trailing comma from StaticSecretFieldName entry

- docsource/akeyless.md: add 'Granting an Auth Method Access to a Secret (CLI)' subsection with full akeyless CLI setup (create auth method, role, association, and access rule) - Makefile: copy manifest.json into each net*/ build output dir after build and build-release targets - .gitignore: ignore manifest.json copies produced in bin/ directories

- Log only instanceParameters key names (not values) at Trace level to prevent future credential-bearing keys from being auto-logged - Remove ex.Message from ApiException re-throw — SDK error bodies may echo back auth request content including access_key; use HTTP status code only - Remove Console.WriteLine calls in Debug_K8sOrchestratorSecret test that printed raw live secret values to stdout (visible in CI logs) - Remove raw secret value from assertion failure message in integration test to prevent exposure in test runner output Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

feat: Initial provider code

36af5bd

Copilot AI review requested due to automatic review settings November 11, 2025 19:33

Copilot started reviewing on behalf of spbsoluble November 11, 2025 19:34 View session

Copilot finished reviewing on behalf of spbsoluble November 11, 2025 19:35

Copilot AI reviewed Nov 11, 2025

View reviewed changes

spbsoluble added 2 commits November 11, 2025 11:43

chore: Reformat and cleanup

c44645e

chore(docs): Force docs gen

32bc8c5

Copilot AI review requested due to automatic review settings November 11, 2025 20:00

Copilot started reviewing on behalf of spbsoluble November 11, 2025 20:00 View session

Update generated docs

f781ed5

Copilot finished reviewing on behalf of spbsoluble November 11, 2025 20:01

Copilot AI reviewed Nov 11, 2025

View reviewed changes

chore: Remove .net6 build target

0b61ecb

spbsoluble changed the title ~~feat: Initial provider code~~ Initial Rlease Nov 11, 2025

spbsoluble changed the title ~~Initial Rlease~~ Initial Release Nov 11, 2025

chore(docs): Force C# primary language

29df34c

Copilot AI review requested due to automatic review settings November 11, 2025 20:42

Copilot started reviewing on behalf of spbsoluble November 11, 2025 20:42 View session

Copilot finished reviewing on behalf of spbsoluble November 11, 2025 20:44

chore: Force build workflow

877267c

Copilot AI reviewed Nov 11, 2025

View reviewed changes

Comment thread TestConsole/Dockerfile Outdated

Comment thread README.md

Comment thread akeyless-pam/Models/AkeylessConfiguration.cs Outdated

Comment thread docs/akeyless.md Outdated

Comment thread README.md Outdated

Comment thread README.md

spbsoluble added 9 commits November 11, 2025 12:48

chore: Conditionally include debug symbols

9bbd385

Merge remote-tracking branch 'origin/ab#39213' into ab#39213

9634481

# Conflicts: # akeyless-pam/akeyless-pam.csproj

ci: add unit and integration test workflow

4fa9893

fix: initialise SecretName in AkeylessConfiguration constructor (CS8618)

dce444f

docs: expand v1.0.0 changelog entry

fddc55e

docs: add README for each test project; remove TestConsole

4121038

- Add README.md to unit and integration test projects documenting all test cases with descriptions - Remove TestConsole project and solution reference (replaced by the integration test suite)

spbsoluble added 10 commits March 24, 2026 10:34

fix: handle empty string env vars for secret paths in API client tests

17de64c

fix: use latestMajor rollforward so bootstrap runner works with .NET …

b3a8727

…9 SDK

chore: test dotnet10-support branch of keyfactor/actions

a4e980d

chore: remove nuget.config; use dotnet nuget add source in tests work…

b9ff676

…flow

docs: add per-type descriptions with examples for each static secret …

5de78aa

…type

fix: treat whitespace-only StaticSecretFieldName as empty

89ebe95

The Keyfactor Command UI can send a space character instead of an empty string for optional fields. Trim StaticSecretFieldName on assignment so whitespace-only values behave identically to empty (no field extraction).

fix: correct TypeFullName and integration-manifest trailing comma

8215349

- akeyless-pam/manifest.json: fix TypeFullName to AkeylessPam (was Pam) - integration-manifest.json: remove trailing comma from StaticSecretFieldName entry

chore: add Makefile and document make targets in test READMEs

9456f25

spbsoluble force-pushed the ab#39213 branch from e2d764d to 9456f25 Compare March 25, 2026 16:59

spbsoluble and others added 18 commits March 25, 2026 11:16

fix(ci): Revert to v4 starter workflow

7be9c37

chore: Ignore claude

92bc121

fix(ci): use fix/chromedriver-version-lookup branch of keyfactor/actions

b7cebf0

ci: trigger workflow to test chromedriver fix

d2bb747

Update generated docs

84869d9

chore(docs): Update docs

426f9c8

Update generated docs

2b08064

chore(ci): Revert to latest stable starter wofklow.

346e0ff

chore(ci): Revert to latest stable starter wofklow.

bd33c4b

chore: Update integration manifest to update catalog and link github.

1658b96

chore(ci): Update to v5 starter.

07239a0

docs: auto-generate README and documentation [skip ci]

1f824b2

chore(ci): revert to "old" doctool

2c87ff6

Update generated docs

887e5f4

fix: rename AccessKeyId to AccessId on integration-manifest.json

821f255

Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>

Update generated docs

8c41018

indrora merged commit 9cb244e into release-1.0 Apr 22, 2026

Conversation

spbsoluble commented Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What's included

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

spbsoluble commented Nov 11, 2025 •

edited

Loading