Skip to content

Latest commit

 

History

History
208 lines (173 loc) · 8.94 KB

README.md

File metadata and controls

208 lines (173 loc) · 8.94 KB
Raw

keyfactor-auth-client-go

Client library for authenticating to Keyfactor Command.

Environment Variables

Global

Name Description Default
KEYFACTOR_HOSTNAME Keyfactor Command hostname without protocol and port
KEYFACTOR_PORT Keyfactor Command port 443
KEYFACTOR_API_PATH Keyfactor Command API Path KeyfactorAPI
KEYFACTOR_SKIP_VERIFY Skip TLS verification when connecting to Keyfactor Command false
KEYFACTOR_CA_CERT Either a file path or PEM encoded string to a CA certificate to trust when communicating with Keyfactor Command
KEYFACTOR_CLIENT_TIMEOUT Timeout for HTTP client requests to Keyfactor Command 60s
KEYFACTOR_AUTH_CONFIG_FILE Path to a JSON file containing the authentication configuration $HOME/.keyfactor/command_config.json
KEYFACTOR_AUTH_CONFIG_PROFILE Profile to use from the authentication configuration file default

Basic Auth

Currently Basic Authentication via Active Directory is the ONLY supported method of Basic Authentication.

Name Description Default
KEYFACTOR_USERNAME Active Directory username to authenticate to Keyfactor Command API
KEYFACTOR_PASSWORD Password associated with Active Directory username to authenticate to Keyfactor Command API
KEYFACTOR_DOMAIN Active Directory domain of user. Can be implied from username if it contains @ or \\

oAuth Client Credentials

Name Description Default
KEYFACTOR_AUTH_CLIENT_ID Keyfactor Auth Client ID
KEYFACTOR_AUTH_CLIENT_SECRET Keyfactor Auth Client Secret
KEYFACTOR_AUTH_TOKEN_URL URL to request an access token from Keyfactor Auth
KEYFACTOR_AUTH_SCOPES Scopes to request when authenticating to Keyfactor Command API. Each scope MUST be separated by , openid
KEYFACTOR_AUTH_AUDIENCE Audience to request when authenticating to Keyfactor Command API
KEYFACTOR_AUTH_ACCESS_TOKEN Access token to use to authenticate to Keyfactor Command API. This can be supplied directly or generated via client credentials
KEYFACTOR_AUTH_CA_CERT Either a file path or PEM encoded string to a CA certificate to use when connecting to Keyfactor Auth

Test Environment Variables

These environment variables are used to run go tests. They are not used in the actual client library.

Name Description Default
TEST_KEYFACTOR_AD_AUTH Set to true to test Active Directory authentication false
TEST_KEYFACTOR_KC_AUTH Set to true to test Keycloak authentication false

Configuration File

A JSON or YAML file can be used to store authentication configuration. A configuration file can contain references to multiple Keyfactor Command environments and can be referenced by a profile name. The default profile will be used when no profile is specified. Keyfactor tools will look for a config file located at $HOME/.keyfactor/command_config.json by default. The config file should be structured as follows:

Basic Auth

JSON

{
  "servers": {
    "default": {
      "host": "keyfactor.command.kfdelivery.com",
      "username": "keyfactor",
      "password": "password",
      "domain": "command",
      "api_path": "KeyfactorAPI"
    },
    "server2": {
      "host": "keyfactor2.command.kfdelivery.com",
      "username": "keyfactor2",
      "password": "password2",
      "domain": "command",
      "api_path": "Keyfactor/API"
    }
  }
}

YAML

servers:
  default:
    host: keyfactor.command.kfdelivery.com
    username: keyfactor
    password: password
    domain: command
    api_path: KeyfactorAPI
  server2:
    host: keyfactor2.command.kfdelivery.com
    username: keyfactor2
    password: password2
    domain: command
    api_path: Keyfactor/API

oAuth Client Credentials

JSON

{
  "servers": {
    "default": {
      "host": "keyfactor.command.kfdelivery.com",
      "token_url": "https://idp.keyfactor.command.kfdelivery.com/oauth2/token",
      "client_id": "client-id",
      "client_secret": "client-secret",
      "audience": "https://keyfactor.command.kfdelivery.com",
      "scopes": [
        "openid",
        "profile",
        "email"
      ],
      "api_path": "KeyfactorAPI"
    },
    "server2": {
      "host": "keyfactor.command.kfdelivery.com",
      "token_url": "https://idp.keyfactor.command.kfdelivery.com/oauth2/token",
      "client_id": "client-id",
      "client_secret": "client-secret",
      "api_path": "KeyfactorAPI"
    }
  }
}

YAML

servers:
  default:
    host: keyfactor.command.kfdelivery.com
    token_url: https://idp.keyfactor.command.kfdelivery.com/oauth2/token
    client_id: client-id
    client_secret: client-secret
    api_path: KeyfactorAPI
    audience: https://keyfactor.command.kfdelivery.com
    scopes:
      - openid
      - profile
      - email
  server2:
    host: keyfactor.command.kfdelivery.com
    token_url: https://idp.keyfactor.command.kfdelivery.com/oauth2/token
    client_id: client-id
    client_secret: client-secret
    api_path: KeyfactorAPI

Configuration File Providers

Below are a list of configuration file providers that can be used to load configuration from a file if loading from disk is not desired.

Azure Key Vault

To use Azure Key Vault as a configuration file provider, the code must either be running in an Azure environment or the environment configured with az login. The following environment variables can be used and will take precedence over any configuration file. NOTE that the secret must be formatted as specified in the example configuration files above.

Name Description Default
AZURE_KEYVAULT_NAME The name of the Azure KeyVault
AZURE_SECRET_NAME The name of the Azure KeyVault secret

JSON

Below is an example of a configuration file that uses Azure Key Vault as a configuration file provider. NOTE that the secret must be formatted as specified in the example configuration files above.

{
  "servers": {
    "default": {
      "auth_provider": {
        "type": "azid",
        "profile": "default",
        "parameters": {
          "secret_name": "<akv_secret_name>",
          "vault_name": "<akv_vault_name>"
        }
      }
    }
  }
}

YAML

Below is an example of a configuration file that uses Azure Key Vault as a configuration file provider. NOTE that the secret must be formatted as specified in the example configuration files above.

servers:
  default:
    auth_provider:
      type: azid
      profile: default
      parameters:
        secret_name: <akv_secret_name>
        vault_name: <akv_vault_name>