Skip to content

Commit

Permalink
Update generated docs
Browse files Browse the repository at this point in the history
  • Loading branch information
Keyfactor committed Dec 16, 2024
1 parent 5e6174c commit 4fca821
Showing 1 changed file with 104 additions and 37 deletions.
141 changes: 104 additions & 37 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -37,12 +37,6 @@ The IBM DataPower Orchestrator allows for the management of certificates in the



### FortiWeb
TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info


TODO Overview is a required section

## Compatibility

This integration is compatible with Keyfactor Universal Orchestrator version 10.4 and later.
Expand All @@ -59,41 +53,31 @@ Before installing the DataPower Universal Orchestrator extension, we recommend t

The IBM DataPower Orchestrator allows for the management of certificates in the IBM Datapower platform. Inventory, Add and Remove functions are supported. This integration can add/replace certificates in any domain\directory combination. For example default\pubcert

### FortiWeb Requirements
TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info


TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info




## Create the FortiWeb Certificate Store Type

To use the DataPower Universal Orchestrator extension, you **must** create the FortiWeb Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance.
## Create the DataPower Certificate Store Type

To use the DataPower Universal Orchestrator extension, you **must** create the DataPower Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance.

TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info


* **Create FortiWeb using kfutil**:
* **Create DataPower using kfutil**:

```shell
# FortiWeb
kfutil store-types create FortiWeb
# IBM Data Power
kfutil store-types create DataPower
```

* **Create FortiWeb manually in the Command UI**:
<details><summary>Create FortiWeb manually in the Command UI</summary>
* **Create DataPower manually in the Command UI**:
<details><summary>Create DataPower manually in the Command UI</summary>

Create a store type called `FortiWeb` with the attributes in the tables below:
Create a store type called `DataPower` with the attributes in the tables below:

#### Basic Tab
| Attribute | Value | Description |
| --------- | ----- | ----- |
| Name | FortiWeb | Display name for the store type (may be customized) |
| Short Name | FortiWeb | Short display name for the store type |
| Capability | FortiWeb | Store type name orchestrator will register with. Check the box to allow entry of value |
| Name | IBM Data Power | Display name for the store type (may be customized) |
| Short Name | DataPower | Short display name for the store type |
| Capability | DataPower | Store type name orchestrator will register with. Check the box to allow entry of value |
| Supports Add | ✅ Checked | Check the box. Indicates that the Store Type supports Management Add |
| Supports Remove | 🔲 Unchecked | Indicates that the Store Type supports Management Remove |
| Supports Discovery | 🔲 Unchecked | Indicates that the Store Type supports Discovery |
Expand All @@ -107,7 +91,7 @@ TODO Global Store Type Section is an optional section. If this section doesn't s

The Basic tab should look like this:

![FortiWeb Basic Tab](docsource/images/FortiWeb-basic-store-type-dialog.png)
![DataPower Basic Tab](docsource/images/DataPower-basic-store-type-dialog.png)

#### Advanced Tab
| Attribute | Value | Description |
Expand All @@ -118,7 +102,7 @@ TODO Global Store Type Section is an optional section. If this section doesn't s

The Advanced tab should look like this:

![FortiWeb Advanced Tab](docsource/images/FortiWeb-advanced-store-type-dialog.png)
![DataPower Advanced Tab](docsource/images/DataPower-advanced-store-type-dialog.png)

#### Custom Fields Tab
Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type:
Expand All @@ -135,7 +119,7 @@ TODO Global Store Type Section is an optional section. If this section doesn't s

The Custom Fields tab should look like this:

![FortiWeb Custom Fields Tab](docsource/images/FortiWeb-custom-fields-store-type-dialog.png)
![DataPower Custom Fields Tab](docsource/images/DataPower-custom-fields-store-type-dialog.png)



Expand Down Expand Up @@ -189,22 +173,105 @@ TODO Global Store Type Section is an optional section. If this section doesn't s
## Defining Certificate Stores
TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
TODO Certificate Store Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
* **Manually with the Command UI**
<details><summary>Create Certificate Stores manually in the UI</summary>
1. **Navigate to the _Certificate Stores_ page in Keyfactor Command.**
> The content in this section can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store).
Log into Keyfactor Command, toggle the _Locations_ dropdown, and click _Certificate Stores_.
2. **Add a Certificate Store.**
Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form.
| Attribute | Description |
| --------- | ----------- |
| Category | Select "IBM Data Power" or the customized certificate store name from the previous step. |
| Container | Optional container to associate certificate store with. |
| Client Machine | The Client Machine field should contain the IP or Domain name and Port Needed for REST API Access. For SSH Access, Port 22 will be used. |
| Store Path | The Store Path field should always be / unless we later determine there are alternate locations needed. |
| Orchestrator | Select an approved orchestrator capable of managing `DataPower` certificates. Specifically, one with the `DataPower` capability. |
| ServerUsername | Api UserName for DataPower. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
| ServerPassword | A password for DataPower API access. Used for inventory.(or valid PAM key if the password is stored in a KF Command configured PAM integration). |
| ServerUseSsl | Should be true, http is not supported. |
| InventoryBlackList | Comma seperated list of alias values you do not want to inventory from DataPower. |
| Protocol | Comma seperated list of alias values you do not want to inventory from DataPower. |
| PublicCertStoreName | This probably will remain pubcert unless someone changed the default name in DataPower. |
| InventoryPageSize | This determines the page size during the inventory calls. (100 should be fine). |
## Discovering Certificate Stores with the Discovery Job
<details><summary>Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator</summary>
### FortiWeb Discovery Job
TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_.
| Attribute | Description |
| --------- | ----------- |
| ServerUsername | Api UserName for DataPower. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
| ServerPassword | A password for DataPower API access. Used for inventory.(or valid PAM key if the password is stored in a KF Command configured PAM integration). |
Please refer to the **Universal Orchestrator (remote)** usage section ([PAM providers on the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam)) for your selected PAM provider for instructions on how to load attributes orchestrator-side.
> Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself.
</details>
</details>
* **Using kfutil**
<details><summary>Create Certificate Stores with kfutil</summary>
1. **Generate a CSV template for the DataPower certificate store**
```shell
kfutil stores import generate-template --store-type-name DataPower --outpath DataPower.csv
```
2. **Populate the generated CSV file**
Open the CSV file, and reference the table below to populate parameters for each **Attribute**.
| Attribute | Description |
| --------- | ----------- |
| Category | Select "IBM Data Power" or the customized certificate store name from the previous step. |
| Container | Optional container to associate certificate store with. |
| Client Machine | The Client Machine field should contain the IP or Domain name and Port Needed for REST API Access. For SSH Access, Port 22 will be used. |
| Store Path | The Store Path field should always be / unless we later determine there are alternate locations needed. |
| Orchestrator | Select an approved orchestrator capable of managing `DataPower` certificates. Specifically, one with the `DataPower` capability. |
| ServerUsername | Api UserName for DataPower. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
| ServerPassword | A password for DataPower API access. Used for inventory.(or valid PAM key if the password is stored in a KF Command configured PAM integration). |
| ServerUseSsl | Should be true, http is not supported. |
| InventoryBlackList | Comma seperated list of alias values you do not want to inventory from DataPower. |
| Protocol | Comma seperated list of alias values you do not want to inventory from DataPower. |
| PublicCertStoreName | This probably will remain pubcert unless someone changed the default name in DataPower. |
| InventoryPageSize | This determines the page size during the inventory calls. (100 should be fine). |
<details><summary>Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator</summary>
If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_.
| Attribute | Description |
| --------- | ----------- |
| ServerUsername | Api UserName for DataPower. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
| ServerPassword | A password for DataPower API access. Used for inventory.(or valid PAM key if the password is stored in a KF Command configured PAM integration). |
> Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself.
</details>
3. **Import the CSV file to create the certificate stores**
```shell
kfutil stores import csv --store-type-name DataPower --file DataPower.csv
```
</details>
> The content in this section can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store).
TODO Discovery Job Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
Expand Down

0 comments on commit 4fca821

Please sign in to comment.