Skip to content

Commit

Permalink
Update generated README
Browse files Browse the repository at this point in the history
  • Loading branch information
Keyfactor committed Jul 2, 2024
1 parent 42d8657 commit 7d73521
Showing 1 changed file with 46 additions and 56 deletions.
102 changes: 46 additions & 56 deletions README.md
View file
Original file line number Diff line number Diff line change
@@ -1,9 +1,10 @@
# DataPower Orchestrator

The IBM DataPower Orchestrator allows for the management of certificates in the IBM Datapower platform. Inventory, Add and Remove functions are supported. This integration can add/replace certificates in any domain\directory combination.
The IBM DataPower Orchestrator allows for the management of certificates in the IBM Datapower platform. Inventory, Add and Remove functions are supported. This integration can add/replace certificates in any domain\directory combination.

#### Integration status: Production - Ready for use in production environments.


## About the Keyfactor Universal Orchestrator Extension

This repository contains a Universal Orchestrator Extension which is a plugin to the Keyfactor Universal Orchestrator. Within the Keyfactor Platform, Orchestrators are used to manage “certificate stores” — collections of certificates and roots of trust that are found within and used by various applications.
Expand All @@ -13,6 +14,11 @@ The Universal Orchestrator is part of the Keyfactor software distribution and is
The Universal Orchestrator is the successor to the Windows Orchestrator. This Orchestrator Extension plugin only works with the Universal Orchestrator and does not work with the Windows Orchestrator.


## Support for DataPower Orchestrator

DataPower Orchestrator is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com

###### To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab.


---
Expand All @@ -29,12 +35,12 @@ The minimum version of the Keyfactor Universal Orchestrator Framework needed to
The Keyfactor Universal Orchestrator may be installed on either Windows or Linux based platforms. The certificate operations supported by a capability may vary based what platform the capability is installed on. The table below indicates what capabilities are supported based on which platform the encompassing Universal Orchestrator is running.
| Operation | Win | Linux |
|-----|-----|------|
|Supports Management Add|✓ |✓ |
|Supports Management Remove|✓ |✓ |
|Supports Management Add|✓ | |
|Supports Management Remove|✓ | |
|Supports Create Store| | |
|Supports Discovery| | |
|Supports Renrollment| | |
|Supports Inventory|✓ |✓ |
|Supports Inventory|✓ | |


## PAM Integration
Expand All @@ -53,6 +59,11 @@ It is not necessary to use a PAM Provider for all of the secrets available above

If a PAM Provider will be used for one of the fields above, start by referencing the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam). The GitHub repo for the PAM Provider to be used contains important information such as the format of the `json` needed. What follows is an example but does not reflect the `json` values for all PAM Providers as they have different "instance" and "initialization" parameter names and values.

<details><summary>General PAM Provider Configuration</summary>
<p>



### Example PAM Provider Setup

To use a PAM Provider to resolve a field, in this example the __Server Password__ will be resolved by the `Hashicorp-Vault` provider, first install the PAM Provider extension from the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) on the Universal Orchestrator.
Expand All @@ -79,73 +90,55 @@ To have the __Server Password__ field resolved by the `Hashicorp-Vault` provider
~~~

This text would be entered in as the value for the __Server Password__, instead of entering in the actual password. The Orchestrator will attempt to use the PAM Provider to retrieve the __Server Password__. If PAM should not be used, just directly enter in the value for the field.

</p>
</details>




---


**IBM Datapower**

**Overview**

The IBM DataPower Orchestrator allows for the management of certificates in the IBM Datapower platform. Inventory, Add and Remove functions are supported. This integration can add/replace certificates in any domain\directory combination. For example default\pubcert

---

**1) Create the new Certificate store Type for the New DataPower AnyAgent**
## CERT STORE SETUP AND GENERAL PERMISSIONS
<details>
<summary>Cert Store Type Configuration</summary>

In Keyfactor Command create a new Certificate Store Type similar to the one below:

#### STORE TYPE CONFIGURATION
SETTING TAB | CONFIG ELEMENT | DESCRIPTION
------|-----------|------------------
Basic |Name |Descriptive name for the Store Type. IBM Data Power Universal can be used.
Basic |Short Name |The short name that identifies the registered functionality of the orchestrator. Must be DataPower.
Basic |Custom Capability|Unchecked
Basic |Short Name |The short name that identifies the registered functionality of the orchestrator. Must be DataPower
Basic |Custom Capability|You can leave this unchecked and use the default.
Basic |Job Types |Inventory, Add, and Remove are the supported job types.
Basic |Needs Server |Must be checked
Basic |Blueprint Allowed |checked
Basic |Blueprint Allowed |Checked
Basic |Requires Store Password |Determines if a store password is required when configuring an individual store. This must be unchecked.
Basic |Supports Entry Password |Determined if an individual entry within a store can have a password. This must be unchecked.
Advanced |Store Path Type| Determines how the user will enter the store path when setting up the cert store. Freeform
Advanced |Supports Custom Alias |Determines if an individual entry within a store can have a custom Alias. Optional (if left blank, alias will be a GUID)
Advanced |Supports Custom Alias |Determines if an individual entry within a store can have a custom Alias. This must be Required
Advanced |Private Key Handling |Determines how the orchestrator deals with private keys. Optional
Advanced |PFX Password Style |Determines password style for the PFX Password. Default
Custom Fields|Inventory Page Size|Name:InventoryPageSize Display Name:Inventory Page Size Type:String Default Value:100 Required:True. This determines the page size during the inventory calls. (100 should be fine)
Custom Fields|Public Cert Store Name|Name:PublicCertStoreName Display Name:Public Cert Store Name:String Default Value:pubcert Required:True. This probably will remain pubcert unless someone changed the default name in DataPower.
Custom Fields|Protocol|Name:Protocol Display Name:Protocol Name:String Default Value:https Required:True. This should always be https in production, may need to change in test to http.
Custom Fields|Inventory Black List|Name:InventoryBlackList Display Name:Inventory Black List Name:String Default Value:Leave Blank Required:False. Comma seperated list of alias values you do not want to inventory from DataPower.
Custom Fields|Server Username|Api UserName for DataPower
Custom Fields|Server Password|Api Password for UserName Described Above
Custom Fields|Use SSL|Set this to true
Entry Parameters|N/A| There are no Entry Parameters

![image.png](/images/CertStoreType-Basic.gif)

![image.png](/images/CertStoreType-Advanced.gif)

![image.png](/images/CertStoreType-CustomFields.gif)


#### STORE CONFIGURATION
CONFIG ELEMENT |DESCRIPTION
----------------|---------------
Category |The type of certificate store to be configured. Select category based on the display name configured above "IBM Data Power Universal".
Container |This is a logical grouping of like stores. This configuration is optional and does not impact the functionality of the store.
Client Machine | The server and port the DataPower API runs on. This is typically port 5554 for the API.
Store Path |This will the domain\path combination to enroll and inventory to. If it is the default domain just put the path.
Inventory Page Size|This determines the page size during the inventory calls. (100 should be fine).
Public Cert Store Name| This probably will remain pubcert unless someone changed the default name in DataPower.
Protocol| This should always be https in production, may need to change in test to http.
Inventory Black List| Comma seperated list of alias values you do not want to inventory from DataPower.
Orchestrator |This is the orchestrator server registered with the appropriate capabilities to manage this certificate store type.
Inventory Schedule |The interval that the system will use to report on what certificates are currently in the store.
Use SSL |This should be checked.
User |The Data Power user that has access to the API and enroll and inventory functions in DataPower.
Password |Password for the user mentioned above.

![image.png](/images/CertStore.gif)

#### CUSTOM FIELDS FOR STORE TYPE
NAME | DISPLAY NAME | TYPE | DEFAULT VALUE | DEPENDS ON | REQUIRED |DESCRIPTION
--------------|-----------------|-------|--------------|-------------|---------|--------------
ServerUsername|Server Username |Secret | |Unchecked |Yes |Palo Alto Api User Name
ServerPassword|Server Password |Secret | |Unchecked |Yes |Palo Alto Api Password
ServerUseSsl |Use SSL |Bool |True |Unchecked |Yes |Requires SSL Connection
InventoryPageSize |Inventory Page Size |String |100|Unchecked|Yes|This will determine the paging level during the inventory process.
PublicCertStoreName |Public Cert Store Name |String |pubcert|Unchecked|Yes|Name of the public cert store location on DataPower.
Protocol |Protocol Name |String |https|Unchecked|Yes|Prototcol should always be https in production. Might need http in test environment.
InventoryBlackList |Inventory Black List |String | |Unchecked|No|Comma seperated list of alias values you do not want to inventory from DataPower

#### ENTRY PARAMETERS FOR STORE TYPE
There are no entry parameters used in this integration.


## Test Cases
<details>
<summary>Data Power Test Cases</summary>

***

Expand Down Expand Up @@ -184,8 +177,5 @@ Case Number|Case Name|Case Description|Overwrite Flag|Alias Name|Expected Result
4c|Remove Private Key and Cert From *testdomain\cert* path with PAM Credentials|Remove Private Key and Cert From *testdomain\cert* path using credentials stored in a PAM Provider|False|cryptoobjs|Crypto Certificate, Crypto Key and Pem/Crt are removed from Data Power *testdomain\cert* path|True

***

### License
[Apache](https://apache.org/licenses/LICENSE-2.0)

</details>

0 comments on commit 7d73521

Please sign in to comment.