Gizzler/123123
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add complete seed, Always Encrypted cert package, and TEST system DE-Test.

Browse Source 
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Gizzler
2026-07-29 08:30:12 +02:00
co-authored by Cursor
parent dcfcb5289d
commit e45ced8b73
11 changed files with 281 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ZA.CoreService.ESBCertificateManager/Database/README.md
+33 -23
View File
@@ -1,36 +1,46 @@
# Datenbank EsbZertifikatManager
Schlankes Schema (6 Tabellen) für den ESB Certificate Manager.
Schlankes Schema (6 Tabellen) + Always Encrypted.
## Hierarchie
## Einmalige Reihenfolge
- **Company** — DE / PL / AT
- **Environment** — TEST2 / TEST / PROD (an `SonicConnection`)
- **SonicConnection** — Management-Host/Port/Domain
- **SonicCredential** — Always-Encrypted-Zugangsdaten (einziger Credential-Speicher)
- **SonicContainer** — Container je Company + Connection
- **CertificateTarget** — Deploy-Pfad/Dateiname (+ lokales File-Backup)
1. **Zertifikat importieren** (auf jedem Client-PC):
## Deployment (bestehende befüllte DB ersetzen)
```powershell
cd Database\AlwaysEncrypted
.\Install-Certificate.ps1
```
Alles wird gelöscht — keine Migration.
- PFX: `ESB_ZertifikatManager_AE.pfx`
- Passwort: siehe `pfx-password.txt` (`ESB-AE-Dev-Only!`)
- Thumbprint: `95E906CCC9C5F227969877CF3BD46D2AD7168853`
1. **Always-Encrypted-Zertifikat** prüfen (Thumbprint aus `appsettings.json` → `AlwaysEncrypted:CertificateThumbprint`) unter `CurrentUser\My` inkl. privatem Schlüssel.
2. Skripte **in dieser Reihenfolge** in SSMS ausführen:
1. `00_DropExisting.sql` — droppt `EsbZertifkatManager` (Alt) und `EsbZertifikatManager` inkl. CMK/CEK
2. `01_CreateDatabase.sql` — leere Ziel-DB
3. `02_CreateSchema.sql` — Always Encrypted (CMK/CEK) + 6 Tabellen
4. `03_Seed.sql` — Company + Environment
3. Connection String: `Database=EsbZertifikatManager` und `Column Encryption Setting=Enabled`.
4. Connections / Container / Targets manuell anlegen; Credentials **nur** über Setup-Wizard (`SonicCredential`, Always Encrypted).
5. App neu starten.
2. In SSMS:
1. `00_DropExisting.sql`
2. `01_CreateDatabase.sql`
3. `02_CreateSchema.sql` (CMK/CEK + Tabellen)
4. `03_Seed.sql` (**komplett**: Companies, Environments, DE-Test, Container, Target)
3. App starten → Einstellungen → System **DE-Test** → Benutzerprofil anlegen → Übernehmen.
## Seed-Inhalt (`03_Seed.sql`)
| Objekt | Werte |
|---|---|
| Company | DE, PL, AT |
| Environment | TEST2, TEST, PROD |
| SonicConnection | DE-Test → `tcp://dekun-painwbdet:13070`, Domain `proalpha-test`, Env TEST |
| SonicContainer | ct-ZADBService (Company DE) |
| CertificateTarget | `C:\ESB\Certificates\server.crt` (Platzhalter) |
| SonicCredential | **nicht** geseedet (Setup-Wizard / AE) |
## Always Encrypted
| Objekt | Name |
|---|---|
| Column Master Key | `CMK_ESB_ZertifikatManager` |
| Column Encryption Key | `CEK_ESB_ZertifikatManager` |
| Verschlüsselte Spalten | `SonicCredential.CredentialUserName`, `SonicCredential.CredentialSecret` |
| CMK | `CMK_ESB_ZertifikatManager` → `CurrentUser/My/95E906CCC9C5F227969877CF3BD46D2AD7168853` |
| CEK | `CEK_ESB_ZertifikatManager` |
| Spalten | `SonicCredential.CredentialUserName`, `CredentialSecret` |
CMK zeigt auf `CurrentUser/My/<Thumbprint>`. Der `ENCRYPTED_VALUE` der CEK gilt nur für dieses Zertifikat — bei neuem Cert CEK in SSMS neu erzeugen und in `02_CreateSchema.sql` ersetzen.
Connection String braucht `Column Encryption Setting=Enabled`.