From c5957366d79273caf7c726db91bd230af19f2a5c Mon Sep 17 00:00:00 2001 From: Jeffrey Stuhr <110697945+fadwen@users.noreply.github.com> Date: Mon, 14 Sep 2026 12:23:35 -0700 Subject: [PATCH] release: 1.3.0 Cuts the Unreleased section as 1.3.0: the PingOne provider; Test-, Repair- and Compare-TestEnvironment; one seed population with shared names, tiers and hash-sampled membership; one report shape, one credential record, one HTTP call; the Entra licence probe; parallel Authentik and batched FreeIPA seeding; and the Active Directory fixes the first 5.1 CI run and the live cycles found. Minor rather than major, deliberately: the report shapes changed, but the old Entra -Format and -Path still bind as aliases and every provider's -PassThru object is documented; the release notes say so plainly. --- CHANGELOG.md | 4 ++++ TestEnvironment.psd1 | 50 +++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 53 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d81b717..d18bbe9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,10 @@ All notable changes to this module are recorded here. Format follows ## [Unreleased] +Nothing yet. + +## [1.3.0] - 2026-09-14 + ### Added - **A PingOne SSO provider.** Seeds the directory and application objects of one PingOne diff --git a/TestEnvironment.psd1 b/TestEnvironment.psd1 index 6c9d807..63c782a 100644 --- a/TestEnvironment.psd1 +++ b/TestEnvironment.psd1 @@ -1,7 +1,7 @@ @{ # Module manifest for TestEnvironment RootModule = 'TestEnvironment.psm1' - ModuleVersion = '1.2.0' + ModuleVersion = '1.3.0' GUID = 'c4e91b7d-5a63-4f28-9d10-8b2e6f3a71c5' Author = 'Jeffrey Stuhr' CompanyName = 'Jeffrey Stuhr' @@ -158,6 +158,54 @@ # with 'IconUrl cannot be empty', so Publish-PSResource fails before it ever # reaches the Gallery. The same applies to HelpInfoURI below. ReleaseNotes = @' +1.3.0 - A sixth provider, and the seed learns to check its own work. + +PingOne joins Entra ID, Active Directory, Okta, Authentik and FreeIPA: five custom user +attributes, four populations, 319 users, eleven groups, two resources and six applications, +seeded through the management API as a worker application, reported on, and removed again by +proving ownership first. No seeded population is ever the environment's default and no public +client is created without PKCE, and neither has a parameter. + +Three commands close the loop a seed used to leave open. Test-TestEnvironment compares what the +connected provider holds with the seed data - every object present the way teardown would find +it, nothing of the module's that the data does not describe, every name equal by codepoint, every +listed membership in place - and returns one object for all six providers. Repair-TestEnvironment +re-runs only the seed steps that own what verification found missing, and removes nothing. +Compare-TestEnvironment matches the people two connected providers hold, by login and then by +name folded for case and Unicode normalisation, the way a hybrid identity tool would, and reports +the names that differ on the wire. + +The seed data is one population. The shared people's names live in one file every generator +reads, each of them exists once in every provider rather than twice under two logins, -Tier Core +and -Tier Bulk mean the same people everywhere, and bulk group membership is sampled by hash so +adding one person no longer rewrites every provider's memberships. Every provider's report takes +the same three parameters and writes JSON, CSV and HTML through one UTF-8 writer; every stored +credential answers to -UseStoredCredential; every HTTP call goes through one function that sends +UTF-8 bytes and decodes raw bytes, the two things Windows PowerShell 5.1 gets wrong on its own. +The Entra connect reads the tenant's licences once and skips the two steps a tenant cannot hold +with one message. Authentik seeds and tears down on a runspace pool and FreeIPA sends its objects +fifty to a request; both measured on the lab instances, both faster, the FreeIPA one modestly. + +Report shapes changed: -Format Object is gone from the Entra report in favour of -PassThru, a +file format needs -OutputPath, the Active Directory report's -PassThru object uses the shared +property names, and the Okta CSV export is one file per section. -Format and -Path still bind as +aliases. + +Fixes, found by running the suite on Windows PowerShell 5.1 in CI for the first time and by +verifying every provider live: + +- The Active Directory group step searched the whole domain for members and added twelve real + accounts, Administrator among them, to seeded groups on the lab domain. Every lookup in the seed + steps is now scoped to the seed's own OU, and a test fails on any that is not. +- Its membership count was inflated by duplicates, its manager count undercounted by the same + job-list fault 1.2.0 fixed for users and devices, its teardown total left out three object types, + -PassThru carried no detail for four steps, and a group of one member counted as empty on 5.1. +- The forest DNS partition was searched under the domain's root rather than the forest's, which + only a child domain would have noticed. +- The deny-logon policy ran after the service accounts it names had failed, and under -WhatIf. +- Three PingOne teardown tests waited for a human at a real terminal; three credential tests + passed only in one file order. CI now runs the suite shuffled and prints the seed. + 1.2.0 - Seed data that can find string bugs, and four defects the live runs turned up. Every provider's people were accented Latin and nothing else, so the only string bugs this