diff --git a/CHANGELOG.md b/CHANGELOG.md index a839e50..1cd1612 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,6 @@ +1.1.1 +* Add support statement to readme + 1.1.0 * Convert to Universal Orchestrator Framework * Added Support for .cer files during inventory diff --git a/README.md b/README.md index 42037ab..0894741 100644 --- a/README.md +++ b/README.md @@ -1,9 +1,10 @@ # DataPower Orchestrator -The IBM DataPower Orchestrator allows for the management of certificates in the IBM Datapower platform. Inventory, Add and Remove functions are supported. This integration can add/replace certificates in any domain\directory combination. +The IBM DataPower Orchestrator allows for the management of certificates in the IBM Datapower platform. Inventory, Add and Remove functions are supported. This integration can add/replace certificates in any domain\directory combination. #### Integration status: Production - Ready for use in production environments. + ## About the Keyfactor Universal Orchestrator Extension This repository contains a Universal Orchestrator Extension which is a plugin to the Keyfactor Universal Orchestrator. Within the Keyfactor Platform, Orchestrators are used to manage “certificate stores” — collections of certificates and roots of trust that are found within and used by various applications. @@ -13,6 +14,11 @@ The Universal Orchestrator is part of the Keyfactor software distribution and is The Universal Orchestrator is the successor to the Windows Orchestrator. This Orchestrator Extension plugin only works with the Universal Orchestrator and does not work with the Windows Orchestrator. +## Support for DataPower Orchestrator + +DataPower Orchestrator is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com + +###### To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab. --- @@ -29,12 +35,12 @@ The minimum version of the Keyfactor Universal Orchestrator Framework needed to The Keyfactor Universal Orchestrator may be installed on either Windows or Linux based platforms. The certificate operations supported by a capability may vary based what platform the capability is installed on. The table below indicates what capabilities are supported based on which platform the encompassing Universal Orchestrator is running. | Operation | Win | Linux | |-----|-----|------| -|Supports Management Add|✓ |✓ | -|Supports Management Remove|✓ |✓ | +|Supports Management Add|✓ | | +|Supports Management Remove|✓ | | |Supports Create Store| | | |Supports Discovery| | | |Supports Renrollment| | | -|Supports Inventory|✓ |✓ | +|Supports Inventory|✓ | | ## PAM Integration @@ -53,6 +59,11 @@ It is not necessary to use a PAM Provider for all of the secrets available above If a PAM Provider will be used for one of the fields above, start by referencing the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam). The GitHub repo for the PAM Provider to be used contains important information such as the format of the `json` needed. What follows is an example but does not reflect the `json` values for all PAM Providers as they have different "instance" and "initialization" parameter names and values. +
General PAM Provider Configuration +

+ + + ### Example PAM Provider Setup To use a PAM Provider to resolve a field, in this example the __Server Password__ will be resolved by the `Hashicorp-Vault` provider, first install the PAM Provider extension from the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) on the Universal Orchestrator. @@ -79,7 +90,8 @@ To have the __Server Password__ field resolved by the `Hashicorp-Vault` provider ~~~ This text would be entered in as the value for the __Server Password__, instead of entering in the actual password. The Orchestrator will attempt to use the PAM Provider to retrieve the __Server Password__. If PAM should not be used, just directly enter in the value for the field. - +

+
@@ -87,65 +99,66 @@ This text would be entered in as the value for the __Server Password__, instead --- -**IBM Datapower** - -**Overview** - -The IBM DataPower Orchestrator allows for the management of certificates in the IBM Datapower platform. Inventory, Add and Remove functions are supported. This integration can add/replace certificates in any domain\directory combination. For example default\pubcert - ---- - -**1) Create the new Certificate store Type for the New DataPower AnyAgent** +## CERT STORE SETUP AND GENERAL PERMISSIONS +
+ Cert Store Type Configuration + +In Keyfactor Command create a new Certificate Store Type similar to the one below: #### STORE TYPE CONFIGURATION SETTING TAB | CONFIG ELEMENT | DESCRIPTION ------|-----------|------------------ Basic |Name |Descriptive name for the Store Type. IBM Data Power Universal can be used. -Basic |Short Name |The short name that identifies the registered functionality of the orchestrator. Must be DataPower. -Basic |Custom Capability|Unchecked +Basic |Short Name |The short name that identifies the registered functionality of the orchestrator. Must be DataPower +Basic |Custom Capability|You can leave this unchecked and use the default. Basic |Job Types |Inventory, Add, and Remove are the supported job types. Basic |Needs Server |Must be checked -Basic |Blueprint Allowed |checked +Basic |Blueprint Allowed |Checked Basic |Requires Store Password |Determines if a store password is required when configuring an individual store. This must be unchecked. Basic |Supports Entry Password |Determined if an individual entry within a store can have a password. This must be unchecked. Advanced |Store Path Type| Determines how the user will enter the store path when setting up the cert store. Freeform -Advanced |Supports Custom Alias |Determines if an individual entry within a store can have a custom Alias. Optional (if left blank, alias will be a GUID) +Advanced |Supports Custom Alias |Determines if an individual entry within a store can have a custom Alias. This must be Required Advanced |Private Key Handling |Determines how the orchestrator deals with private keys. Optional Advanced |PFX Password Style |Determines password style for the PFX Password. Default -Custom Fields|Inventory Page Size|Name:InventoryPageSize Display Name:Inventory Page Size Type:String Default Value:100 Required:True. This determines the page size during the inventory calls. (100 should be fine) -Custom Fields|Public Cert Store Name|Name:PublicCertStoreName Display Name:Public Cert Store Name:String Default Value:pubcert Required:True. This probably will remain pubcert unless someone changed the default name in DataPower. -Custom Fields|Protocol|Name:Protocol Display Name:Protocol Name:String Default Value:https Required:True. This should always be https in production, may need to change in test to http. -Custom Fields|Inventory Black List|Name:InventoryBlackList Display Name:Inventory Black List Name:String Default Value:Leave Blank Required:False. Comma seperated list of alias values you do not want to inventory from DataPower. -Custom Fields|Server Username|Api UserName for DataPower -Custom Fields|Server Password|Api Password for UserName Described Above -Custom Fields|Use SSL|Set this to true -Entry Parameters|N/A| There are no Entry Parameters - -![image.png](/images/CertStoreType-Basic.gif) - -![image.png](/images/CertStoreType-Advanced.gif) -![image.png](/images/CertStoreType-CustomFields.gif) +#### CUSTOM FIELDS FOR STORE TYPE +NAME | DISPLAY NAME | TYPE | DEFAULT VALUE | DEPENDS ON | REQUIRED |DESCRIPTION +--------------|-----------------|-------|--------------|-------------|---------|-------------- +ServerUsername|Server Username |Secret | |Unchecked |Yes |Data Power Api User Name +ServerPassword|Server Password |Secret | |Unchecked |Yes |Data Power Api Password +ServerUseSsl |Use SSL |Bool |True |Unchecked |Yes |Requires SSL Connection +InventoryPageSize |Inventory Page Size |String |100|Unchecked|Yes|This will determine the paging level during the inventory process. +PublicCertStoreName |Public Cert Store Name |String |pubcert|Unchecked|Yes|Name of the public cert store location on DataPower. +Protocol |Protocol Name |String |https|Unchecked|Yes|Prototcol should always be https in production. Might need http in test environment. +InventoryBlackList |Inventory Black List |String | |Unchecked|No|Comma seperated list of alias values you do not want to inventory from DataPower + +#### ENTRY PARAMETERS FOR STORE TYPE +There are no entry parameters used in this integration. +
+ +
+IBM DataPower Certificate Store +In Keyfactor Command, navigate to Certificate Stores from the Locations Menu. Click the Add button to create a new Certificate Store using the settings defined below. - #### STORE CONFIGURATION CONFIG ELEMENT |DESCRIPTION ----------------|--------------- -Category |The type of certificate store to be configured. Select category based on the display name configured above "IBM Data Power Universal". +Category |The type of certificate store to be configured. Select category based on the display name configured above "DataPower". Container |This is a logical grouping of like stores. This configuration is optional and does not impact the functionality of the store. -Client Machine | The server and port the DataPower API runs on. This is typically port 5554 for the API. -Store Path |This will the domain\path combination to enroll and inventory to. If it is the default domain just put the path. -Inventory Page Size|This determines the page size during the inventory calls. (100 should be fine). -Public Cert Store Name| This probably will remain pubcert unless someone changed the default name in DataPower. -Protocol| This should always be https in production, may need to change in test to http. -Inventory Black List| Comma seperated list of alias values you do not want to inventory from DataPower. +Client Machine |The hostname of the Panorama or Firewall. Sample is "dp.cloudapp.azure.com". +Store Path | This will the domain\path combination to enroll and inventory to. If it is the default domain just put the path. Orchestrator |This is the orchestrator server registered with the appropriate capabilities to manage this certificate store type. Inventory Schedule |The interval that the system will use to report on what certificates are currently in the store. Use SSL |This should be checked. User |The Data Power user that has access to the API and enroll and inventory functions in DataPower. -Password |Password for the user mentioned above. +Password |Api Password Setup for the user above -![image.png](/images/CertStore.gif) +
+ + +## Test Cases +
+Data Power Test Cases *** @@ -184,8 +197,5 @@ Case Number|Case Name|Case Description|Overwrite Flag|Alias Name|Expected Result 4c|Remove Private Key and Cert From *testdomain\cert* path with PAM Credentials|Remove Private Key and Cert From *testdomain\cert* path using credentials stored in a PAM Provider|False|cryptoobjs|Crypto Certificate, Crypto Key and Pem/Crt are removed from Data Power *testdomain\cert* path|True *** - -### License -[Apache](https://apache.org/licenses/LICENSE-2.0) - +
diff --git a/integration-manifest.json b/integration-manifest.json index 5ebafdf..c385883 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -1,33 +1,123 @@ { - "$schema": "https://keyfactor.github.io/integration-manifest-schema.json", - "integration_type": "orchestrator", - "name": "DataPower Orchestrator", - "status": "production", - "description": "The IBM DataPower Orchestrator allows for the management of certificates in the IBM Datapower platform. Inventory, Add and Remove functions are supported. This integration can add/replace certificates in any domain\\directory combination. ", - "link_github": false, - "update_catalog": false, - "about": { - "orchestrator": { - "UOFramework": "10.1", - "pam_support": true, - "win": { - "supportsCreateStore": false, - "supportsDiscovery": false, - "supportsManagementAdd": true, - "supportsManagementRemove": true, - "supportsReenrollment": false, - "supportsInventory": true, - "platformSupport": "Unused" - }, - "linux": { - "supportsCreateStore": false, - "supportsDiscovery": false, - "supportsManagementAdd": true, - "supportsManagementRemove": true, - "supportsReenrollment": false, - "supportsInventory": true, - "platformSupport": "Unused" - } - } - } +"$schema": "https://keyfactor.github.io/integration-manifest-schema.json", +"integration_type": "orchestrator", +"name": "DataPower Orchestrator", +"status": "production", +"update_catalog": true, +"link_github": true, +"support_level": "kf-supported", +"release_dir": "PaloAlto/bin/Release/netcoreapp3.1", +"description": "The IBM DataPower Orchestrator allows for the management of certificates in the IBM Datapower platform. Inventory, Add and Remove functions are supported. This integration can add/replace certificates in any domain\\directory combination.", +"about": { +"orchestrator": { +"UOFramework": "10.1", +"keyfactor_platform_version": "9.10", +"pam_support": true, +"win": { +"supportsCreateStore": false, +"supportsDiscovery": false, +"supportsManagementAdd": true, +"supportsManagementRemove": true, +"supportsReenrollment": false, +"supportsInventory": true, +"platformSupport": "Unused" +}, +"linux": { +"supportsCreateStore": false, +"supportsDiscovery": false, +"supportsManagementAdd": false, +"supportsManagementRemove": false, +"supportsReenrollment": false, +"supportsInventory": false, +"platformSupport": "Unused" +}, +"store_types": [ +{ +"Name": "IBM DataPower Universal", +"ShortName": "DataPower", +"Capability": "", +"LocalStore": false, +"SupportedOperations": { +"Add": true, +"Create": false, +"Discovery": false, +"Enrollment": false, +"Remove": true +}, +"Properties": [ +{ +"Name": "ServerUsername", +"DisplayName": "Server Username", +"Type": "Secret", +"DependsOn": null, +"DefaultValue": null, +"Required": false +}, +{ +"Name": "ServerPassword", +"DisplayName": "Server Password", +"Type": "Secret", +"DependsOn": null, +"DefaultValue": null, +"Required": false +}, +{ +"Name": "ServerUseSsl", +"DisplayName": "Use SSL", +"Type": "Bool", +"DependsOn": null, +"DefaultValue": "true", +"Required": true +}, +{ +"Name": "InventoryPageSize", +"DisplayName": "Inventory Page Size", +"Type": "String", +"DependsOn": null, +"DefaultValue": "100", +"Required": true +}, +{ +"Name": "PublicCertStoreName", +"DisplayName": "Public Cert Store Name", +"Type": "String", +"DependsOn": null, +"DefaultValue": "pubcert", +"Required": true +}, +{ +"Name": "Protocol", +"DisplayName": "Protocol Name", +"Type": "String", +"DependsOn": null, +"DefaultValue": "https", +"Required": true +}, +{ +"Name": "InventoryBlackList", +"DisplayName": "Inventory Black List", +"Type": "String", +"DependsOn": null, +"DefaultValue": "", +"Required": false +} +], +"EntryParameters": [ +], +"PasswordOptions": { +"EntrySupported": false, +"StoreRequired": false, +"Style": "Default" +}, +"PrivateKeyAllowed": "Optional", +"JobProperties": [ +], +"ServerRequired": true, +"PowerShell": false, +"BlueprintAllowed": true, +"CustomAliasAllowed": "Required" +} +] +} } +} \ No newline at end of file diff --git a/readme_source.md b/readme_source.md index b8ceafa..e8d394c 100644 --- a/readme_source.md +++ b/readme_source.md @@ -1,62 +1,63 @@ -**IBM Datapower** - -**Overview** - -The IBM DataPower Orchestrator allows for the management of certificates in the IBM Datapower platform. Inventory, Add and Remove functions are supported. This integration can add/replace certificates in any domain\directory combination. For example default\pubcert - ---- - -**1) Create the new Certificate store Type for the New DataPower AnyAgent** +## CERT STORE SETUP AND GENERAL PERMISSIONS +
+ Cert Store Type Configuration + +In Keyfactor Command create a new Certificate Store Type similar to the one below: #### STORE TYPE CONFIGURATION SETTING TAB | CONFIG ELEMENT | DESCRIPTION ------|-----------|------------------ Basic |Name |Descriptive name for the Store Type. IBM Data Power Universal can be used. -Basic |Short Name |The short name that identifies the registered functionality of the orchestrator. Must be DataPower. -Basic |Custom Capability|Unchecked +Basic |Short Name |The short name that identifies the registered functionality of the orchestrator. Must be DataPower +Basic |Custom Capability|You can leave this unchecked and use the default. Basic |Job Types |Inventory, Add, and Remove are the supported job types. Basic |Needs Server |Must be checked -Basic |Blueprint Allowed |checked +Basic |Blueprint Allowed |Checked Basic |Requires Store Password |Determines if a store password is required when configuring an individual store. This must be unchecked. Basic |Supports Entry Password |Determined if an individual entry within a store can have a password. This must be unchecked. Advanced |Store Path Type| Determines how the user will enter the store path when setting up the cert store. Freeform -Advanced |Supports Custom Alias |Determines if an individual entry within a store can have a custom Alias. Optional (if left blank, alias will be a GUID) +Advanced |Supports Custom Alias |Determines if an individual entry within a store can have a custom Alias. This must be Required Advanced |Private Key Handling |Determines how the orchestrator deals with private keys. Optional Advanced |PFX Password Style |Determines password style for the PFX Password. Default -Custom Fields|Inventory Page Size|Name:InventoryPageSize Display Name:Inventory Page Size Type:String Default Value:100 Required:True. This determines the page size during the inventory calls. (100 should be fine) -Custom Fields|Public Cert Store Name|Name:PublicCertStoreName Display Name:Public Cert Store Name:String Default Value:pubcert Required:True. This probably will remain pubcert unless someone changed the default name in DataPower. -Custom Fields|Protocol|Name:Protocol Display Name:Protocol Name:String Default Value:https Required:True. This should always be https in production, may need to change in test to http. -Custom Fields|Inventory Black List|Name:InventoryBlackList Display Name:Inventory Black List Name:String Default Value:Leave Blank Required:False. Comma seperated list of alias values you do not want to inventory from DataPower. -Custom Fields|Server Username|Api UserName for DataPower -Custom Fields|Server Password|Api Password for UserName Described Above -Custom Fields|Use SSL|Set this to true -Entry Parameters|N/A| There are no Entry Parameters - -![image.png](/images/CertStoreType-Basic.gif) -![image.png](/images/CertStoreType-Advanced.gif) +#### CUSTOM FIELDS FOR STORE TYPE +NAME | DISPLAY NAME | TYPE | DEFAULT VALUE | DEPENDS ON | REQUIRED |DESCRIPTION +--------------|-----------------|-------|--------------|-------------|---------|-------------- +ServerUsername|Server Username |Secret | |Unchecked |Yes |Data Power Api User Name +ServerPassword|Server Password |Secret | |Unchecked |Yes |Data Power Api Password +ServerUseSsl |Use SSL |Bool |True |Unchecked |Yes |Requires SSL Connection +InventoryPageSize |Inventory Page Size |String |100|Unchecked|Yes|This will determine the paging level during the inventory process. +PublicCertStoreName |Public Cert Store Name |String |pubcert|Unchecked|Yes|Name of the public cert store location on DataPower. +Protocol |Protocol Name |String |https|Unchecked|Yes|Prototcol should always be https in production. Might need http in test environment. +InventoryBlackList |Inventory Black List |String | |Unchecked|No|Comma seperated list of alias values you do not want to inventory from DataPower + +#### ENTRY PARAMETERS FOR STORE TYPE +There are no entry parameters used in this integration. +
+ +
+IBM DataPower Certificate Store +In Keyfactor Command, navigate to Certificate Stores from the Locations Menu. Click the Add button to create a new Certificate Store using the settings defined below. -![image.png](/images/CertStoreType-CustomFields.gif) - - #### STORE CONFIGURATION CONFIG ELEMENT |DESCRIPTION ----------------|--------------- -Category |The type of certificate store to be configured. Select category based on the display name configured above "IBM Data Power Universal". +Category |The type of certificate store to be configured. Select category based on the display name configured above "DataPower". Container |This is a logical grouping of like stores. This configuration is optional and does not impact the functionality of the store. -Client Machine | The server and port the DataPower API runs on. This is typically port 5554 for the API. -Store Path |This will the domain\path combination to enroll and inventory to. If it is the default domain just put the path. -Inventory Page Size|This determines the page size during the inventory calls. (100 should be fine). -Public Cert Store Name| This probably will remain pubcert unless someone changed the default name in DataPower. -Protocol| This should always be https in production, may need to change in test to http. -Inventory Black List| Comma seperated list of alias values you do not want to inventory from DataPower. +Client Machine |The hostname of the Panorama or Firewall. Sample is "dp.cloudapp.azure.com". +Store Path | This will the domain\path combination to enroll and inventory to. If it is the default domain just put the path. Orchestrator |This is the orchestrator server registered with the appropriate capabilities to manage this certificate store type. Inventory Schedule |The interval that the system will use to report on what certificates are currently in the store. Use SSL |This should be checked. User |The Data Power user that has access to the API and enroll and inventory functions in DataPower. -Password |Password for the user mentioned above. +Password |Api Password Setup for the user above + +
+ -![image.png](/images/CertStore.gif) +## Test Cases +
+Data Power Test Cases *** @@ -95,7 +96,4 @@ Case Number|Case Name|Case Description|Overwrite Flag|Alias Name|Expected Result 4c|Remove Private Key and Cert From *testdomain\cert* path with PAM Credentials|Remove Private Key and Cert From *testdomain\cert* path using credentials stored in a PAM Provider|False|cryptoobjs|Crypto Certificate, Crypto Key and Pem/Crt are removed from Data Power *testdomain\cert* path|True *** - -### License -[Apache](https://apache.org/licenses/LICENSE-2.0) - +
\ No newline at end of file