diff --git a/README.md b/README.md index 59333ac..87633b2 100644 --- a/README.md +++ b/README.md @@ -37,12 +37,6 @@ The IBM DataPower Orchestrator allows for the management of certificates in the -### FortiWeb -TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info - - -TODO Overview is a required section - ## Compatibility This integration is compatible with Keyfactor Universal Orchestrator version 10.4 and later. @@ -59,41 +53,31 @@ Before installing the DataPower Universal Orchestrator extension, we recommend t The IBM DataPower Orchestrator allows for the management of certificates in the IBM Datapower platform. Inventory, Add and Remove functions are supported. This integration can add/replace certificates in any domain\directory combination. For example default\pubcert -### FortiWeb Requirements -TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info - - -TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info - - - - -## Create the FortiWeb Certificate Store Type -To use the DataPower Universal Orchestrator extension, you **must** create the FortiWeb Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance. +## Create the DataPower Certificate Store Type +To use the DataPower Universal Orchestrator extension, you **must** create the DataPower Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance. -TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info -* **Create FortiWeb using kfutil**: +* **Create DataPower using kfutil**: ```shell - # FortiWeb - kfutil store-types create FortiWeb + # IBM Data Power + kfutil store-types create DataPower ``` -* **Create FortiWeb manually in the Command UI**: -
Create FortiWeb manually in the Command UI +* **Create DataPower manually in the Command UI**: +
Create DataPower manually in the Command UI - Create a store type called `FortiWeb` with the attributes in the tables below: + Create a store type called `DataPower` with the attributes in the tables below: #### Basic Tab | Attribute | Value | Description | | --------- | ----- | ----- | - | Name | FortiWeb | Display name for the store type (may be customized) | - | Short Name | FortiWeb | Short display name for the store type | - | Capability | FortiWeb | Store type name orchestrator will register with. Check the box to allow entry of value | + | Name | IBM Data Power | Display name for the store type (may be customized) | + | Short Name | DataPower | Short display name for the store type | + | Capability | DataPower | Store type name orchestrator will register with. Check the box to allow entry of value | | Supports Add | ✅ Checked | Check the box. Indicates that the Store Type supports Management Add | | Supports Remove | 🔲 Unchecked | Indicates that the Store Type supports Management Remove | | Supports Discovery | 🔲 Unchecked | Indicates that the Store Type supports Discovery | @@ -107,7 +91,7 @@ TODO Global Store Type Section is an optional section. If this section doesn't s The Basic tab should look like this: - ![FortiWeb Basic Tab](docsource/images/FortiWeb-basic-store-type-dialog.png) + ![DataPower Basic Tab](docsource/images/DataPower-basic-store-type-dialog.png) #### Advanced Tab | Attribute | Value | Description | @@ -118,7 +102,7 @@ TODO Global Store Type Section is an optional section. If this section doesn't s The Advanced tab should look like this: - ![FortiWeb Advanced Tab](docsource/images/FortiWeb-advanced-store-type-dialog.png) + ![DataPower Advanced Tab](docsource/images/DataPower-advanced-store-type-dialog.png) #### Custom Fields Tab Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type: @@ -135,7 +119,7 @@ TODO Global Store Type Section is an optional section. If this section doesn't s The Custom Fields tab should look like this: - ![FortiWeb Custom Fields Tab](docsource/images/FortiWeb-custom-fields-store-type-dialog.png) + ![DataPower Custom Fields Tab](docsource/images/DataPower-custom-fields-store-type-dialog.png) @@ -189,22 +173,105 @@ TODO Global Store Type Section is an optional section. If this section doesn't s ## Defining Certificate Stores -TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info -TODO Certificate Store Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info +* **Manually with the Command UI** +
Create Certificate Stores manually in the UI + 1. **Navigate to the _Certificate Stores_ page in Keyfactor Command.** -> The content in this section can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store). + Log into Keyfactor Command, toggle the _Locations_ dropdown, and click _Certificate Stores_. + + 2. **Add a Certificate Store.** + + Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form. + | Attribute | Description | + | --------- | ----------- | + | Category | Select "IBM Data Power" or the customized certificate store name from the previous step. | + | Container | Optional container to associate certificate store with. | + | Client Machine | The Client Machine field should contain the IP or Domain name and Port Needed for REST API Access. For SSH Access, Port 22 will be used. | + | Store Path | The Store Path field should always be / unless we later determine there are alternate locations needed. | + | Orchestrator | Select an approved orchestrator capable of managing `DataPower` certificates. Specifically, one with the `DataPower` capability. | + | ServerUsername | Api UserName for DataPower. (or valid PAM key if the username is stored in a KF Command configured PAM integration). | + | ServerPassword | A password for DataPower API access. Used for inventory.(or valid PAM key if the password is stored in a KF Command configured PAM integration). | + | ServerUseSsl | Should be true, http is not supported. | + | InventoryBlackList | Comma seperated list of alias values you do not want to inventory from DataPower. | + | Protocol | Comma seperated list of alias values you do not want to inventory from DataPower. | + | PublicCertStoreName | This probably will remain pubcert unless someone changed the default name in DataPower. | + | InventoryPageSize | This determines the page size during the inventory calls. (100 should be fine). | -## Discovering Certificate Stores with the Discovery Job + + +
Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator -### FortiWeb Discovery Job -TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info + If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_. + | Attribute | Description | + | --------- | ----------- | + | ServerUsername | Api UserName for DataPower. (or valid PAM key if the username is stored in a KF Command configured PAM integration). | + | ServerPassword | A password for DataPower API access. Used for inventory.(or valid PAM key if the password is stored in a KF Command configured PAM integration). | + + + Please refer to the **Universal Orchestrator (remote)** usage section ([PAM providers on the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam)) for your selected PAM provider for instructions on how to load attributes orchestrator-side. + + > Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself. +
+ +
+ +* **Using kfutil** + +
Create Certificate Stores with kfutil + + 1. **Generate a CSV template for the DataPower certificate store** + + ```shell + kfutil stores import generate-template --store-type-name DataPower --outpath DataPower.csv + ``` + 2. **Populate the generated CSV file** + + Open the CSV file, and reference the table below to populate parameters for each **Attribute**. + | Attribute | Description | + | --------- | ----------- | + | Category | Select "IBM Data Power" or the customized certificate store name from the previous step. | + | Container | Optional container to associate certificate store with. | + | Client Machine | The Client Machine field should contain the IP or Domain name and Port Needed for REST API Access. For SSH Access, Port 22 will be used. | + | Store Path | The Store Path field should always be / unless we later determine there are alternate locations needed. | + | Orchestrator | Select an approved orchestrator capable of managing `DataPower` certificates. Specifically, one with the `DataPower` capability. | + | ServerUsername | Api UserName for DataPower. (or valid PAM key if the username is stored in a KF Command configured PAM integration). | + | ServerPassword | A password for DataPower API access. Used for inventory.(or valid PAM key if the password is stored in a KF Command configured PAM integration). | + | ServerUseSsl | Should be true, http is not supported. | + | InventoryBlackList | Comma seperated list of alias values you do not want to inventory from DataPower. | + | Protocol | Comma seperated list of alias values you do not want to inventory from DataPower. | + | PublicCertStoreName | This probably will remain pubcert unless someone changed the default name in DataPower. | + | InventoryPageSize | This determines the page size during the inventory calls. (100 should be fine). | + + + + +
Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator + + If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_. + | Attribute | Description | + | --------- | ----------- | + | ServerUsername | Api UserName for DataPower. (or valid PAM key if the username is stored in a KF Command configured PAM integration). | + | ServerPassword | A password for DataPower API access. Used for inventory.(or valid PAM key if the password is stored in a KF Command configured PAM integration). | + + + > Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself. +
+ + + 3. **Import the CSV file to create the certificate stores** + + ```shell + kfutil stores import csv --store-type-name DataPower --file DataPower.csv + ``` +
+ +> The content in this section can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store). -TODO Discovery Job Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info