# keyfactor/iis-orchestrator architecture

> Architecture diagram of the GitHub repository keyfactor/iis-orchestrator, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/keyfactor/iis-orchestrator
- Repository: https://github.com/keyfactor/iis-orchestrator

## Overview

This is a Keyfactor Universal Orchestrator extension for inventorying and managing Windows certificates, plus reenrolling certificates for supported store types. The principal workflow is a configured UO job that reaches a Windows certificate store, performs a store-specific operation, and reports results. ADFS has a distinct farm-rotation capability. The README documents supported store types and remote connection modes; sampled source confirms shared PowerShell and reenrollment calls. Several inventory and management implementations are unsampled, so their internal call paths are not asserted.

Main entry points: [`IISU/ClientPSCertStoreReEnrollment.cs`](https://github.com/keyfactor/iis-orchestrator/blob/main/IISU/ClientPSCertStoreReEnrollment.cs) (Reenrollment jobs), [`IISU/ImplementedStoreTypes`](https://github.com/keyfactor/iis-orchestrator/tree/main/IISU/ImplementedStoreTypes) (Inventory jobs), [`IISU/ImplementedStoreTypes/WinAdfs/AdfsCertificateRotationManager.cs`](https://github.com/keyfactor/iis-orchestrator/blob/main/IISU/ImplementedStoreTypes/WinAdfs/AdfsCertificateRotationManager.cs) (ADFS rotation), [`IISU/Models/InventoryJobLogger.cs`](https://github.com/keyfactor/iis-orchestrator/blob/main/IISU/Models/InventoryJobLogger.cs) (Job reporting)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_jobs["Job handling"]
  node_parser["Job configuration"]
  node_inventory["Inventory jobs"]
  node_management["Management jobs"]
  node_reenroll["Reenrollment jobs"]
  node_reporting["Job reporting"]
end

subgraph group_shared["Shared runtime"]
  node_powershell["PowerShell sessions<br/>[PSHelper.cs]"]
  node_certdata["Certificate data<br/>[Certificate.cs]"]
end

subgraph group_stores["Certificate stores"]
  node_win_store["Local machine store"]
  node_iis["IIS bindings"]
  node_sql["SQL bindings"]
  node_ldap["LDAPS bindings"]
  node_netsh["HTTP.sys bindings"]
  node_adfs["ADFS rotation"]
end

subgraph group_remote["Remote targets"]
  node_target["Windows servers"]
  node_keyfactor["Keyfactor services"]
end

node_operator(("UO job"))

node_operator -.->|"provides config"| node_parser
node_operator -->|"requests inventory"| node_inventory
node_operator -->|"requests management"| node_management
node_operator -->|"requests reenrollment"| node_reenroll
node_inventory -.->|"reports inventory"| node_reporting
node_management -.->|"reports results"| node_reporting
node_reenroll -->|"initializes session"| node_powershell
node_reenroll -->|"uses certificate data"| node_certdata
node_reenroll -->|"binds certificates"| node_iis
node_reenroll -->|"binds certificates"| node_sql
node_reenroll -->|"binds certificates"| node_ldap
node_reenroll -->|"binds certificates"| node_netsh
node_adfs -->|"invokes remote functions"| node_powershell
node_inventory -.->|"connects remotely"| node_target
node_management -.->|"manages stores"| node_target
node_reenroll -.->|"connects remotely"| node_target
node_adfs -->|"rotates farm certificates"| node_target
node_operator -.->|"submits enrollment"| node_keyfactor

click node_parser "https://github.com/keyfactor/iis-orchestrator/blob/main/IISU/JobConfigurationParser.cs"
click node_inventory "https://github.com/keyfactor/iis-orchestrator/tree/main/IISU/ImplementedStoreTypes"
click node_management "https://github.com/keyfactor/iis-orchestrator/tree/main/IISU/ImplementedStoreTypes"
click node_reenroll "https://github.com/keyfactor/iis-orchestrator/blob/main/IISU/ClientPSCertStoreReEnrollment.cs"
click node_reporting "https://github.com/keyfactor/iis-orchestrator/blob/main/IISU/Models/InventoryJobLogger.cs"
click node_powershell "https://github.com/keyfactor/iis-orchestrator/blob/main/IISU/PSHelper.cs"
click node_certdata "https://github.com/keyfactor/iis-orchestrator/blob/main/IISU/Certificate.cs"
click node_win_store "https://github.com/keyfactor/iis-orchestrator/tree/main/IISU/ImplementedStoreTypes/Win"
click node_iis "https://github.com/keyfactor/iis-orchestrator/tree/main/IISU/ImplementedStoreTypes/WinIIS"
click node_sql "https://github.com/keyfactor/iis-orchestrator/tree/main/IISU/ImplementedStoreTypes/WinSQL"
click node_ldap "https://github.com/keyfactor/iis-orchestrator/tree/main/IISU/ImplementedStoreTypes/WinLDAP"
click node_netsh "https://github.com/keyfactor/iis-orchestrator/tree/main/IISU/ImplementedStoreTypes/WinNetSH"
click node_adfs "https://github.com/keyfactor/iis-orchestrator/blob/main/IISU/ImplementedStoreTypes/WinAdfs/AdfsCertificateRotationManager.cs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_parser,node_inventory,node_management,node_reenroll,node_reporting toneBlue
class node_powershell,node_certdata toneAmber
class node_win_store,node_iis,node_sql,node_ldap,node_netsh,node_adfs toneMint
class node_target,node_keyfactor toneRose
class node_operator toneIndigo
```

## Components

### Job handling

- [Job configuration](https://github.com/keyfactor/iis-orchestrator/blob/main/IISU/JobConfigurationParser.cs): `IISU/JobConfigurationParser.cs`
- [Inventory jobs](https://github.com/keyfactor/iis-orchestrator/tree/main/IISU/ImplementedStoreTypes): `IISU/ImplementedStoreTypes`
- [Management jobs](https://github.com/keyfactor/iis-orchestrator/tree/main/IISU/ImplementedStoreTypes): `IISU/ImplementedStoreTypes`
- [Reenrollment jobs](https://github.com/keyfactor/iis-orchestrator/blob/main/IISU/ClientPSCertStoreReEnrollment.cs): `IISU/ClientPSCertStoreReEnrollment.cs`
- [Job reporting](https://github.com/keyfactor/iis-orchestrator/blob/main/IISU/Models/InventoryJobLogger.cs): `IISU/Models/InventoryJobLogger.cs`

### Shared runtime

- [PowerShell sessions](https://github.com/keyfactor/iis-orchestrator/blob/main/IISU/PSHelper.cs): `IISU/PSHelper.cs`
- [Certificate data](https://github.com/keyfactor/iis-orchestrator/blob/main/IISU/Certificate.cs): `IISU/Certificate.cs`

### Certificate stores

- [Local machine store](https://github.com/keyfactor/iis-orchestrator/tree/main/IISU/ImplementedStoreTypes/Win): `IISU/ImplementedStoreTypes/Win`
- [IIS bindings](https://github.com/keyfactor/iis-orchestrator/tree/main/IISU/ImplementedStoreTypes/WinIIS): `IISU/ImplementedStoreTypes/WinIIS`
- [SQL bindings](https://github.com/keyfactor/iis-orchestrator/tree/main/IISU/ImplementedStoreTypes/WinSQL): `IISU/ImplementedStoreTypes/WinSQL`
- [LDAPS bindings](https://github.com/keyfactor/iis-orchestrator/tree/main/IISU/ImplementedStoreTypes/WinLDAP): `IISU/ImplementedStoreTypes/WinLDAP`
- [HTTP.sys bindings](https://github.com/keyfactor/iis-orchestrator/tree/main/IISU/ImplementedStoreTypes/WinNetSH): `IISU/ImplementedStoreTypes/WinNetSH`
- [ADFS rotation](https://github.com/keyfactor/iis-orchestrator/blob/main/IISU/ImplementedStoreTypes/WinAdfs/AdfsCertificateRotationManager.cs): `IISU/ImplementedStoreTypes/WinAdfs/AdfsCertificateRotationManager.cs`

### Remote targets

- **Windows servers**
- **Keyfactor services**

### Other components

- **UO job**

## Connections

- UO job → Job configuration: provides config (evidence: `IISU/JobConfigurationParser.cs`)
- UO job → Inventory jobs: requests inventory
- UO job → Management jobs: requests management
- UO job → Reenrollment jobs: requests reenrollment
- Inventory jobs → Job reporting: reports inventory
- Management jobs → Job reporting: reports results
- Reenrollment jobs → PowerShell sessions: initializes session (evidence: `IISU/ClientPSCertStoreReEnrollment.cs`)
- Reenrollment jobs → Certificate data: uses certificate data (evidence: `IISU/ClientPSCertStoreReEnrollment.cs`)
- Reenrollment jobs → IIS bindings: binds certificates (evidence: `IISU/ClientPSCertStoreReEnrollment.cs`)
- Reenrollment jobs → SQL bindings: binds certificates (evidence: `IISU/ClientPSCertStoreReEnrollment.cs`)
- Reenrollment jobs → LDAPS bindings: binds certificates (evidence: `IISU/ClientPSCertStoreReEnrollment.cs`)
- Reenrollment jobs → HTTP.sys bindings: binds certificates (evidence: `IISU/ClientPSCertStoreReEnrollment.cs`)
- ADFS rotation → PowerShell sessions: invokes remote functions (evidence: `IISU/ImplementedStoreTypes/WinAdfs/AdfsCertificateRotationManager.cs`)
- Inventory jobs → Windows servers: connects remotely
- Management jobs → Windows servers: manages stores
- Reenrollment jobs → Windows servers: connects remotely
- ADFS rotation → Windows servers: rotates farm certificates
- UO job → Keyfactor services: submits enrollment