dsccommunity / dsccommunity/SqlServerDsc

SqlRSSslCertificateBinding: New resource proposal

Open
#2,419 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement help wanted resource proposal
Dominant language
PowerShell
Stars
385
Forks
224
No merged PRs in 30d

Description

Resource proposal

Manages SSL/TLS certificate bindings for Reporting Services applications. Enables secure HTTPS connections. SSL certificate management is complex and independent enough to warrant its own resource. It also manages the UseSsl (SecureConnectionLevel) setting.

Parent Issue: #2415

Features
  • Configures SSL certificate bindings for ReportServerWebService and ReportServerWebApp applications
  • Supports multiple SSL bindings per application (different IPs, ports, certificates)
  • Supports both replacement pattern (set exact bindings) and include/exclude pattern (add/remove specific bindings)
  • Manages the UseSsl (SecureConnectionLevel) setting
  • Supports both SQL Server Reporting Services (SSRS) and Power BI Report Server (PBIRS)
  • SQL Server 2019+ only
Commands Used
Method Commands
Get Get-SqlDscRSSslCertificateBinding, Get-SqlDscRSConfiguration (SecureConnectionLevel)
Test Compare bindings and SSL settings
Set Add-SqlDscRSSslCertificateBinding, Remove-SqlDscRSSslCertificateBinding, Set-SqlDscRSSslCertificateBinding, Enable-SqlDscRsSecureConnection, Disable-SqlDscRsSecureConnection, Restart-SqlDscRSService

Proposed properties

Property Type qualifier Data type Description Default value Allowed values
InstanceName Key String The RS instance name (SSRS or PBIRS) None None
Application Key String The application to configure None ReportServerWebService, ReportServerWebApp
Binding Write CIM Instance[] The exact SSL bindings to set (replaces all existing). Mutually exclusive with ToInclude/ToExclude. None None
BindingToInclude Write CIM Instance[] SSL bindings to add if not present None None
BindingToExclude Write CIM Instance[] SSL bindings to remove if present None None
Lcid Write UInt32 Language code identifier None None
UseSsl Write Boolean Enable secure connection requirement None None
RestartTimeout Write UInt32 Seconds to wait after service restart None None
SuppressServiceRestart Write Boolean Suppress automatic service restart $false None
Binding CIM Instance Properties
Property Type Description Default value
CertificateHash String Certificate thumbprint None
IPAddress String IP address for binding 0.0.0.0
Port UInt16 Port number 443

Special considerations or limitations

  1. Proposed File: source/Classes/020.SqlRSSslCertificateBinding.ps1

  2. Inheritance: Inherits from ResourceBase (from DscResource.Base module), not SqlResourceBase.

  3. Mutually exclusive properties: Binding is mutually exclusive with BindingToInclude and BindingToExclude. When using Binding, all existing SSL bindings are replaced with the specified list. When using BindingToInclude and/or BindingToExclude, existing SSL bindings are preserved and only the specified changes are made.

  4. CIM Instance class: A new CIM class MSFT_SqlRSSslBinding needs to be created with properties CertificateHash, IPAddress, and Port.

  5. Certificate requirements: The certificate must be installed in the Local Machine certificate store before it can be bound.

  6. Recommended usage order: This resource should be used after SqlRSDatabase has initialized the report server.

  7. Integration tests: Should follow the patterns in Integration_Test_Commands_BIReportServer_Secure stage.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the proposed source/Classes/020.SqlRSSslCertificateBinding.ps1 and review the ResourceBase inheritance and the MSFT_SqlRSSslBinding properties. Then follow the Integration_Test_Commands_BIReportServer_Secure stage. Done means the resource supports the listed SSRS and PBIRS bindings, SSL settings, mutually exclusive binding modes, and restart behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell
Domain
infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.