CustomerSecrets

Resolves the account passwords a customer config needs, at config-GENERATION time, out of the process environment - which the operator hydrates from NETSetup.kdbx before running the generator (see scripts/Generate-CustomerConfig.ps1).

Note

Exists because the customer .cs files used to carry "changeme" literals for every domain and client administrator. That is worse than it looks: the literal is committed, it is WRONG (a bind against the DC with it returns false), and nothing complains - the config generates happily and the failure only shows up hours later as a domain join that fails with 1355 on a node nobody is watching.

So this throws rather than substituting anything. A config that cannot resolve a password does not get built, which is strictly safer than one built with a password that does not work. The exception names the exact KeePass title to add and the command that unlocks it, so the fix is mechanical.

NOTHING here talks to KeePass directly - no dependency, no wrapping of the library. The KeePass CLI exports into the environment; this only reads it. Secrets therefore never enter the repository, and a generator run on a machine without the store fails loudly instead of emitting a bad config.

public static class CustomerSecrets

1. Methods

1.1. PasswordFor(string)

Password for username, as a SecretString ready for a User. Throws when the environment does not carry it.

public static SecretString PasswordFor(string username)

Table 1. Parameters
Name	Type	Description
username	string	Account name, e.g. `aoser`. Case is preserved in the lookup key.

Returns: SecretString — The resolved password.