Added Microsoft ADCS connector

frontend/src/hooks/api/appConnections/enums.ts

@@ -7,6 +7,7 @@ export enum AppConnection {
   AzureAppConfiguration = "azure-app-configuration",
   AzureClientSecrets = "azure-client-secrets",
   AzureDevOps = "azure-devops",
+  AzureADCS = "azure-adcs",
   Databricks = "databricks",
   Humanitec = "humanitec",
   TerraformCloud = "terraform-cloud",

frontend/src/hooks/api/appConnections/queries.tsx

@@ -54,13 +54,13 @@ export const useAppConnectionOptions = (
 export const useGetAppConnectionOption = <T extends AppConnection>(app: T) => {
   const { data: options = [], isPending } = useAppConnectionOptions();
 
-  return useMemo(
-    () => ({
-      option: (options.find((opt) => opt.app === app) as TAppConnectionOptionMap[T]) ?? {},
+  return useMemo(() => {
+    const foundOption = options.find((opt) => opt.app === app);
+    return {
+      option: (foundOption as TAppConnectionOptionMap[T]) ?? {},
       isLoading: isPending
-    }),
-    [options, app, isPending]
-  );
+    };
+  }, [options, app, isPending]);
 };
 
 export const useListAppConnections = (

frontend/src/hooks/api/appConnections/types/app-options.ts

@@ -32,7 +32,7 @@ export type TAzureKeyVaultConnectionOption = TAppConnectionOptionBase & {
 };
 
 export type TAzureAppConfigurationConnectionOption = TAppConnectionOptionBase & {
-  app: AppConnection.AzureKeyVault;
+  app: AppConnection.AzureAppConfiguration;
   oauthClientId?: string;
 };
 
@@ -164,9 +164,14 @@ export type TOktaConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.Okta;
 };
 
+export type TAzureAdCsConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.AzureADCS;
+};
+
 export type TAppConnectionOption =
   | TAwsConnectionOption
   | TGitHubConnectionOption
+  | TGitHubRadarConnectionOption
   | TGcpConnectionOption
   | TAzureAppConfigurationConnectionOption
   | TAzureKeyVaultConnectionOption
@@ -184,6 +189,7 @@ export type TAppConnectionOption =
   | TWindmillConnectionOption
   | TAuth0ConnectionOption
   | THCVaultConnectionOption
+  | TLdapConnectionOption
   | TTeamCityConnectionOption
   | TOCIConnectionOption
   | TOnePassConnectionOption
@@ -196,6 +202,7 @@ export type TAppConnectionOption =
   | TZabbixConnectionOption
   | TRailwayConnectionOption
   | TChecklyConnectionOption
+  | TSupabaseConnectionOption
   | TDigitalOceanConnectionOption
   | TNetlifyConnectionOption
   | TOktaConnectionOption;
@@ -238,4 +245,5 @@ export type TAppConnectionOptionMap = {
   [AppConnection.DigitalOcean]: TDigitalOceanConnectionOption;
   [AppConnection.Netlify]: TNetlifyConnectionOption;
   [AppConnection.Okta]: TOktaConnectionOption;
+  [AppConnection.AzureADCS]: TAzureAdCsConnectionOption;
 };

frontend/src/hooks/api/appConnections/types/azure-adcs-connection.ts

@@ -0,0 +1,25 @@
+import { z } from "zod";
+
+import { AppConnection } from "../enums";
+import { TRootAppConnection } from "./root-connection";
+
+export enum AzureADCSConnectionMethod {
+  UsernamePassword = "username-password"
+}
+
+export const CreateAzureADCSConnectionSchema = z.object({
+  adcsUrl: z.string().url().min(1, "ADCS URL is required"),
+  username: z.string().min(1, "Username is required"),
+  password: z.string().min(1, "Password is required")
+});
+
+export type TCreateAzureADCSConnection = z.infer<typeof CreateAzureADCSConnectionSchema>;
+
+export type TAzureADCSConnection = TRootAppConnection & { app: AppConnection.AzureADCS } & {
+  method: AzureADCSConnectionMethod.UsernamePassword;
+  credentials: {
+    username: string;
+    password: string;
+    adcsUrl: string;
+  };
+};

frontend/src/hooks/api/appConnections/types/index.ts

@@ -3,6 +3,7 @@ import { TOnePassConnection } from "./1password-connection";
 import { TAppConnectionOption } from "./app-options";
 import { TAuth0Connection } from "./auth0-connection";
 import { TAwsConnection } from "./aws-connection";
+import { TAzureADCSConnection } from "./azure-adcs-connection";
 import { TAzureAppConfigurationConnection } from "./azure-app-configuration-connection";
 import { TAzureClientSecretsConnection } from "./azure-client-secrets-connection";
 import { TAzureDevOpsConnection } from "./azure-devops-connection";
@@ -41,6 +42,7 @@ import { TZabbixConnection } from "./zabbix-connection";
 export * from "./1password-connection";
 export * from "./auth0-connection";
 export * from "./aws-connection";
+export * from "./azure-adcs-connection";
 export * from "./azure-app-configuration-connection";
 export * from "./azure-client-secrets-connection";
 export * from "./azure-devops-connection";
@@ -83,6 +85,7 @@ export type TAppConnection =
   | TAzureAppConfigurationConnection
   | TAzureClientSecretsConnection
   | TAzureDevOpsConnection
+  | TAzureADCSConnection
   | TDatabricksConnection
   | THumanitecConnection
   | TTerraformCloudConnection
@@ -156,6 +159,7 @@ export type TAppConnectionMap = {
   [AppConnection.AzureAppConfiguration]: TAzureAppConfigurationConnection;
   [AppConnection.AzureClientSecrets]: TAzureClientSecretsConnection;
   [AppConnection.AzureDevOps]: TAzureDevOpsConnection;
+  [AppConnection.AzureADCS]: TAzureADCSConnection;
   [AppConnection.Databricks]: TDatabricksConnection;
   [AppConnection.Humanitec]: THumanitecConnection;
   [AppConnection.TerraformCloud]: TTerraformCloudConnection;

frontend/src/hooks/api/ca/constants.tsx

@@ -1,7 +1,15 @@
 import { AppConnection } from "../appConnections/enums";
 import { SshCaStatus } from "../sshCa";
 import { SshCertTemplateStatus } from "../sshCertificateTemplates";
-import { AcmeDnsProvider, CaStatus, InternalCaType } from "./enums";
+import {
+  AcmeDnsProvider,
+  AzureAdCsAuthMethod,
+  AzureAdCsTemplateType,
+  CaCapability,
+  CaStatus,
+  CaType,
+  InternalCaType
+} from "./enums";
 
 export const caTypeToNameMap: { [K in InternalCaType]: string } = {
   [InternalCaType.ROOT]: "Root",
@@ -24,6 +32,45 @@ export const ACME_DNS_PROVIDER_APP_CONNECTION_MAP: Record<AcmeDnsProvider, AppCo
   [AcmeDnsProvider.Cloudflare]: AppConnection.Cloudflare
 };
 
+export const AZURE_AD_CS_TEMPLATE_NAME_MAP: Record<AzureAdCsTemplateType, string> = {
+  [AzureAdCsTemplateType.WEB_SERVER]: "Web Server",
+  [AzureAdCsTemplateType.COMPUTER]: "Computer",
+  [AzureAdCsTemplateType.USER]: "User",
+  [AzureAdCsTemplateType.DOMAIN_CONTROLLER]: "Domain Controller",
+  [AzureAdCsTemplateType.SUBORDINATE_CA]: "Subordinate CA"
+};
+
+export const AZURE_AD_CS_AUTH_METHOD_NAME_MAP: Record<AzureAdCsAuthMethod, string> = {
+  [AzureAdCsAuthMethod.CLIENT_CERTIFICATE]: "Client Certificate",
+  [AzureAdCsAuthMethod.KERBEROS]: "Kerberos"
+};
+
+export const CA_TYPE_CAPABILITIES_MAP: Record<CaType, CaCapability[]> = {
+  [CaType.INTERNAL]: [
+    CaCapability.ISSUE_CERTIFICATES,
+    CaCapability.REVOKE_CERTIFICATES,
+    CaCapability.RENEW_CERTIFICATES
+  ],
+  [CaType.ACME]: [
+    CaCapability.ISSUE_CERTIFICATES,
+    CaCapability.REVOKE_CERTIFICATES,
+    CaCapability.RENEW_CERTIFICATES
+  ],
+  [CaType.AZURE_AD_CS]: [
+    CaCapability.ISSUE_CERTIFICATES,
+    CaCapability.RENEW_CERTIFICATES
+    // Note: REVOKE_CERTIFICATES intentionally omitted - not supported by ADCS connector
+  ]
+};
+
+/**
+ * Check if a certificate authority type supports a specific capability
+ */
+export const caSupportsCapability = (caType: CaType, capability: CaCapability): boolean => {
+  const capabilities = CA_TYPE_CAPABILITIES_MAP[caType] || [];
+  return capabilities.includes(capability);
+};
+
 export const getCaStatusBadgeVariant = (status: CaStatus | SshCaStatus | SshCertTemplateStatus) => {
   switch (status) {
     case CaStatus.ACTIVE:

frontend/src/hooks/api/ca/enums.tsx

@@ -1,6 +1,7 @@
 export enum CaType {
   INTERNAL = "internal",
-  ACME = "acme"
+  ACME = "acme",
+  AZURE_AD_CS = "azure-ad-cs"
 }
 
 export enum InternalCaType {
@@ -22,3 +23,22 @@ export enum AcmeDnsProvider {
   ROUTE53 = "route53",
   Cloudflare = "cloudflare"
 }
+
+export enum AzureAdCsTemplateType {
+  WEB_SERVER = "WebServer",
+  COMPUTER = "Computer",
+  USER = "User",
+  DOMAIN_CONTROLLER = "DomainController",
+  SUBORDINATE_CA = "SubordinateCA"
+}
+
+export enum AzureAdCsAuthMethod {
+  CLIENT_CERTIFICATE = "client-certificate",
+  KERBEROS = "kerberos"
+}
+
+export enum CaCapability {
+  ISSUE_CERTIFICATES = "issue-certificates",
+  REVOKE_CERTIFICATES = "revoke-certificates",
+  RENEW_CERTIFICATES = "renew-certificates"
+}

frontend/src/hooks/api/ca/index.tsx

@@ -1,4 +1,12 @@
-export { AcmeDnsProvider, CaRenewalType, CaStatus, CaType, InternalCaType } from "./enums";
+export {
+  AcmeDnsProvider,
+  AzureAdCsAuthMethod,
+  AzureAdCsTemplateType,
+  CaRenewalType,
+  CaStatus,
+  CaType,
+  InternalCaType
+} from "./enums";
 export {
   useCreateCa,
   useCreateCertificate,
@@ -9,6 +17,7 @@ export {
   useUpdateCa
 } from "./mutations";
 export {
+  useGetAzureAdcsTemplates,
   useGetCa,
   useGetCaById,
   useGetCaCert,
@@ -17,5 +26,6 @@ export {
   useGetCaCrls,
   useGetCaCsr,
   useListCasByProjectId,
-  useListCasByTypeAndProjectId
+  useListCasByTypeAndProjectId,
+  useListExternalCasByProjectId
 } from "./queries";

frontend/src/hooks/api/ca/mutations.tsx

@@ -39,6 +39,10 @@ export const useUpdateCa = () => {
       queryClient.invalidateQueries({
         queryKey: caKeys.getCaByNameAndProjectId(caName, projectId)
       });
+      // Invalidate external CAs list
+      queryClient.invalidateQueries({
+        queryKey: [`external-cas-${projectId}`]
+      });
     }
   });
 };
@@ -57,6 +61,10 @@ export const useCreateCa = () => {
       queryClient.invalidateQueries({
         queryKey: caKeys.listCasByTypeAndProjectId(type, projectId)
       });
+      // Invalidate external CAs list
+      queryClient.invalidateQueries({
+        queryKey: [`external-cas-${projectId}`]
+      });
     }
   });
 };
@@ -79,6 +87,10 @@ export const useDeleteCa = () => {
       queryClient.invalidateQueries({
         queryKey: caKeys.listCasByTypeAndProjectId(type, projectId)
       });
+      // Invalidate external CAs list
+      queryClient.invalidateQueries({
+        queryKey: [`external-cas-${projectId}`]
+      });
     }
   });
 };

frontend/src/hooks/api/ca/queries.tsx

@@ -17,7 +17,11 @@ export const caKeys = {
   getCaCsr: (caId: string) => [{ caId }, "ca-csr"],
   getCaCrl: (caId: string) => [{ caId }, "ca-crl"],
   getCaCertTemplates: (caId: string) => [{ caId }, "ca-cert-templates"],
-  getCaEstConfig: (caId: string) => [{ caId }, "ca-est-config"]
+  getCaEstConfig: (caId: string) => [{ caId }, "ca-est-config"],
+  getAzureAdcsTemplates: (caId: string, projectId: string) => [
+    { caId, projectId },
+    "azure-adcs-templates"
+  ]
 };
 
 export const useGetCa = ({
@@ -67,6 +71,34 @@ export const useListCasByProjectId = (projectId: string) => {
   });
 };
 
+export const useListExternalCasByProjectId = (projectId: string) => {
+  return useQuery({
+    queryKey: [`external-cas-${projectId}`],
+    queryFn: async () => {
+      const [acmeResponse, azureAdCsResponse] = await Promise.allSettled([
+        apiRequest.get<TUnifiedCertificateAuthority[]>(
+          `/api/v1/pki/ca/${CaType.ACME}?projectId=${projectId}`
+        ),
+        apiRequest.get<TUnifiedCertificateAuthority[]>(
+          `/api/v1/pki/ca/${CaType.AZURE_AD_CS}?projectId=${projectId}`
+        )
+      ]);
+
+      const allCas: TUnifiedCertificateAuthority[] = [];
+
+      if (acmeResponse.status === "fulfilled") {
+        allCas.push(...acmeResponse.value.data);
+      }
+
+      if (azureAdCsResponse.status === "fulfilled") {
+        allCas.push(...azureAdCsResponse.value.data);
+      }
+
+      return allCas;
+    }
+  });
+};
+
 export const useGetCaById = (caId: string) => {
   return useQuery({
     queryKey: caKeys.getCaById(caId),
@@ -156,3 +188,22 @@ export const useGetCaCertTemplates = (caId: string) => {
     enabled: Boolean(caId)
   });
 };
+
+export const useGetAzureAdcsTemplates = ({
+  caId,
+  projectId
+}: {
+  caId: string;
+  projectId: string;
+}) => {
+  return useQuery({
+    queryKey: caKeys.getAzureAdcsTemplates(caId, projectId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{
+        templates: { id: string; name: string; description?: string }[];
+      }>(`/api/v1/pki/ca/azure-ad-cs/${caId}/templates?projectId=${projectId}`);
+      return data;
+    },
+    enabled: Boolean(caId && projectId)
+  });
+};

frontend/src/hooks/api/ca/types.ts

@@ -1,5 +1,13 @@
 import { CertExtendedKeyUsage, CertKeyAlgorithm, CertKeyUsage } from "../certificates/enums";
-import { AcmeDnsProvider, CaRenewalType, CaStatus, CaType, InternalCaType } from "./enums";
+import {
+  AcmeDnsProvider,
+  AzureAdCsAuthMethod,
+  AzureAdCsTemplateType,
+  CaRenewalType,
+  CaStatus,
+  CaType,
+  InternalCaType
+} from "./enums";
 
 export type TAcmeCertificateAuthority = {
   id: string;
@@ -19,6 +27,20 @@ export type TAcmeCertificateAuthority = {
   };
 };
 
+export type TAzureAdCsCertificateAuthority = {
+  id: string;
+  projectId: string;
+  type: CaType.AZURE_AD_CS;
+  status: CaStatus;
+  name: string;
+  enableDirectIssuance: boolean;
+  configuration: {
+    azureAdcsConnectionId: string;
+    templateName: AzureAdCsTemplateType;
+    authMethod: AzureAdCsAuthMethod;
+  };
+};
+
 export type TInternalCertificateAuthority = {
   id: string;
   projectId: string;
@@ -48,6 +70,7 @@ export type TInternalCertificateAuthority = {
 
 export type TUnifiedCertificateAuthority =
   | TAcmeCertificateAuthority
+  | TAzureAdCsCertificateAuthority
   | TInternalCertificateAuthority;
 
 export type TCreateCertificateAuthorityDTO = Omit<TUnifiedCertificateAuthority, "id">;

frontend/src/hooks/api/pkiSubscriber/types.ts

@@ -10,6 +10,16 @@ export enum SubscriberOperationStatus {
   FAILED = "failed"
 }
 
+export type TPkiSubscriberProperties = {
+  azureTemplateType?: string;
+  organization?: string;
+  organizationalUnit?: string;
+  country?: string;
+  state?: string;
+  locality?: string;
+  emailAddress?: string;
+};
+
 export type TPkiSubscriber = {
   id: string;
   projectId: string;
@@ -27,6 +37,7 @@ export type TPkiSubscriber = {
   lastOperationStatus?: SubscriberOperationStatus;
   lastOperationMessage?: string;
   lastOperationAt?: string;
+  properties?: TPkiSubscriberProperties;
 };
 
 export type TCreatePkiSubscriberDTO = {
@@ -40,6 +51,7 @@ export type TCreatePkiSubscriberDTO = {
   extendedKeyUsages: CertExtendedKeyUsage[];
   enableAutoRenewal?: boolean;
   autoRenewalPeriodInDays?: number;
+  properties?: TPkiSubscriberProperties;
 };
 
 export type TUpdatePkiSubscriberDTO = {
@@ -55,6 +67,7 @@ export type TUpdatePkiSubscriberDTO = {
   extendedKeyUsages?: CertExtendedKeyUsage[];
   enableAutoRenewal?: boolean;
   autoRenewalPeriodInDays?: number;
+  properties?: TPkiSubscriberProperties;
 };
 
 export type TDeletePkiSubscriberDTO = {