You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Kv sub path support (#12)
* updated to support 2 store types. HCVKV and HCV.
* Updated to distinguish between multiple supported store types.
* updated doc to reflect multiple store type configs.
* removed sensitive info from tracelog.
* Removed KEY_SECRET from PutCertificate Task
* Modified PutCertificate to include ---BEGIN ----END banners (for key+cert)
* Allows Cert Stores to be allow a boolean value for SubfolderInventory. Allows inventory to be done on a root storepath and all of the component/subdirectories. Included documentation update to README.md
* Adding InputValidation for KeyValue secrets
* Update generated README
* Include pem chain (#17)
* Fixed store path and mount point mapping
* Fixed issue with path not being resolved before attempting to write cert.
* Allows for Recursive subfolder inventory
* Update readme to call out cert store limits
* Adding InputValidation for KeyValue secrets
* including certificate chain when enrolling via platform.
* added flag on store type to indicate whether to include cert chain
* fixed issue when checking for revocation time for inventory.
* Combine chain certs (#19)
* updated documentation to store Vault token as a secret instead of plain string.
* Updated property names. now including full chain in ca_chain field.
* fixed issue with revocation time check.
* updated fields. the full chain is now stored in certificate if selected.
* Fixed issue where improperly formatted secrets would cause inventory to bail.
* Update changelog version info
* updated integration manifest
* Update generated README
* Create keyfactor-merge-store-types.yml
---------
Co-authored-by: Joe VanWanzeele <[email protected]>
Co-authored-by: Keyfactor <[email protected]>
Co-authored-by: Michael Henderson <[email protected]>
Co-authored-by: JoeKF <[email protected]>
* Updated documentation to specify storing the token as a secret.
5
+
* Added inventory job support for the Hashicorp PKI secrets engine
6
+
* Added inventory job support for the Keyfactor secrets engine
7
+
8
+
***Breaking Change**: the properties have been renamed from:
9
+
*`PUBLIC_KEY` to `certificate`
10
+
*`PRIVATE_KEY` to `private_key`
11
+
*`PUBLIC_KEY_<n>` has been removed. Now the chain is stored in `certificate` if the option is selected.
12
+
13
+
***Breaking Change**: Added a flag on the Keyfactor Certificate store definition to indicate whether to store the full CA chain along with the certificate
14
+
15
+
16
+
***Breaking Change**: the cert store types are now:
17
+
***HCVPKI** for the PKI and Keyfactor secrets engine
The Hashicorp Vault Orchestrator extension allows you store certificates in Hashicorp Vault KeyValue secrets engine.
3
+
The Hashicorp Vault Orchestrator extension allows you to manage certificates in Hashicorp Vault KeyValue secrets engine and perform inventory on certificates stored in the PKI or Keyfactor secrets engines.
4
4
5
5
#### Integration status: Production - Ready for use in production environments.
6
6
7
-
## About the Keyfactor Universal Orchestrator Capability
8
7
9
-
This repository contains a Universal Orchestrator Capability which is a plugin to the Keyfactor Universal Orchestrator. Within the Keyfactor Platform, Orchestrators are used to manage “certificate stores” — collections of certificates and roots of trust that are found within and used by various applications.
8
+
## About the Keyfactor Universal Orchestrator Extension
10
9
11
-
The Universal Orchestrator is part of the Keyfactor software distribution and is available via the Keyfactor customer portal. For general instructions on installing Capabilities, see the “Keyfactor Command Orchestrator Installation and Configuration Guide” section of the Keyfactor documentation. For configuration details of this specific Capability, see below in this readme.
10
+
This repository contains a Universal Orchestrator Extension which is a plugin to the Keyfactor Universal Orchestrator. Within the Keyfactor Platform, Orchestrators are used to manage “certificate stores” — collections of certificates and roots of trust that are found within and used by various applications.
12
11
13
-
The Universal Orchestrator is the successor to the Windows Orchestrator. This Capability plugin only works with the Universal Orchestrator and does not work with the Windows Orchestrator.
12
+
The Universal Orchestrator is part of the Keyfactor software distribution and is available via the Keyfactor customer portal. For general instructions on installing Extensions, see the “Keyfactor Command Orchestrator Installation and Configuration Guide” section of the Keyfactor documentation. For configuration details of this specific Extension see below in this readme.
14
13
14
+
The Universal Orchestrator is the successor to the Windows Orchestrator. This Orchestrator Extension plugin only works with the Universal Orchestrator and does not work with the Windows Orchestrator.
15
+
16
+
17
+
18
+
19
+
## Support for Orchestrator Extension for Hashicorp Vault
20
+
21
+
Orchestrator Extension for Hashicorp Vault is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket with your Keyfactor representative.
22
+
23
+
###### To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab.
15
24
16
25
17
26
18
27
---
19
28
20
29
21
30
31
+
32
+
## Keyfactor Version Supported
33
+
34
+
The minimum version of the Keyfactor Universal Orchestrator Framework needed to run this version of the extension is 10.1
35
+
22
36
## Platform Specific Notes
23
37
24
38
The Keyfactor Universal Orchestrator may be installed on either Windows or Linux based platforms. The certificate operations supported by a capability may vary based what platform the capability is installed on. The table below indicates what capabilities are supported based on which platform the encompassing Universal Orchestrator is running.
@@ -33,58 +47,71 @@ The Keyfactor Universal Orchestrator may be installed on either Windows or Linux
33
47
34
48
35
49
50
+
51
+
36
52
---
37
53
38
54
39
55
<!-- add integration specific information below -->
40
56
41
-
This integration for the Keyfactor Universal Orchestrator has been tested against Hashicorp Vault 1.10. It utilizes the *Key/Value* secrets engine to store certificates issues via Keyfactor Command.
57
+
This integration for the Keyfactor Universal Orchestrator has been tested against Hashicorp Vault 1.10. It utilizes the **Key/Value** secrets engine to store certificates issues via Keyfactor Command.
42
58
43
59
## Use Cases
44
60
45
-
The Hashicorp Vault Orchestrator Integration implements the following capabilities:
61
+
This integration supports 3 Hashicorp Secrets Engines; PKI, Key-Value store, and the Keyfactor Hashicorp Plugin (Keyfactor Secrets Engine).
62
+
63
+
### The Key-Value secrets engine
64
+
65
+
The Following operations are supported by this integration **only** for the Key-Value secrets engine.
46
66
47
67
1. Discovery - Discover all sub-paths containing certificate.
48
68
1. Inventory - Return all certificates stored in a path.
49
69
1. Management (Add) - Add a certificate to a defined certificate store.
50
70
1. Management (Remove) - Remove a certificate from a defined certificate store.
51
71
72
+
### The Hashicorp PKI and Keyfactor Plugin secrets engines
73
+
74
+
Both the Hashicorp PKI and Keyfactor plugin are designed to allow managing certifications directly on the Hashicorp Vault instance.
75
+
This integration does support the following in order to view your certificates from the platform:
76
+
77
+
1. Inventory - Return all certificates stored in a path.
78
+
79
+
[View the repository on Github](https://github.com/Keyfactor/hashicorp-vault-secretsengine) for more information about the Hashicorp Vault Keyfactor Secrets Engine plugin.
80
+
52
81
## Versioning
53
82
54
83
The version number of a the Hashicorp Vault Orchestrator Extension can be verified by right clicking on the `Keyfactor.Extensions.Orchestrator.HCV.dll` file in the extensions installation folder, selecting Properties, and then clicking on the Details tab.
55
84
56
85
## Keyfactor Version Supported
57
86
58
-
This integration was built on the .NET Core 3.1 target framework and are compatible for use with the Keyfactor Universal Orchestrator.
87
+
This integration was built on the .NET Core 3.1 target framework and are compatible for use with the Keyfactor Universal Orchestrator and the latest version of the Keyfactor platform.
59
88
60
89
## Security Considerations
61
90
62
91
1. It is not necessary to use the Vault root token when creating a Certificate Store for HashicorpVault. We recommend creating a token with policies that reflect the minimum permissions necessary to perform the intended operations.
63
-
1. The certificates are stored in 3 fields in the Key Value store.
64
-
65
-
-`PUBLIC_KEY` - The certificate public key
66
-
-`PRIVATE_KEY` - The certificate private key
67
-
-`KEY_SECRET` - The certificate private key password
68
-
69
-
## Extension Configuration
70
92
71
-
### On the Orchestrator Agent Machine
93
+
1. For the Key-Value secrets engine, the certificates are stored as an entry with these fields.
72
94
73
-
1. Stop the Orchestrator service.
95
+
-`certificate` - The PEM formatted certificate and intermediate CA chain (if selected)
96
+
-`private_key` - The certificate private key
74
97
75
-
- The service will be called "KeyfactorOrchestrator-Default" by default.
98
+
**Note**: Key/Value secrets that do not include the keys `certificate` and `private_key`will be ignored during inventory scans.
76
99
77
-
1. Navigate to the "extensions" sub-folder of your Orchestrator installation directory
- Click the "Custom Fields" tab to add the following custom fields:
105
136
-**MountPoint** - type: *string*
106
137
-**VaultServerUrl** - type: *string*, *required*
107
-
-**VaultToken** - type: *string*, *required*
138
+
-**VaultToken** - type: *secret*, *required*
139
+
-**SubfolderInventory** - type: *bool* (By default, this is set to false. Not a required field)
140
+
-**IncludeCertChain** - type: *bool* (If true, the available intermediate certificates will also be written to Vault during enrollment)
108
141
109
142
110
143
111
144
- Click **Save** to save the new Store Type.
112
145
113
-
1. Add the Hashicorp Vault Certificate Store
146
+
####Add the Hashicorp Vault Certificate Store - **Key-Value Secrets Engine**
114
147
115
148
- Navigate to **Locations** > **Certificate Stores** from the main menu
116
149
- Click **ADD** to open the new Certificate Store Dialog
117
150
118
-
151
+
119
152
120
-
In Keyfactor Command create a new Certificate Store Type similar to the one below:
153
+
In Keyfactor Command create a new Certificate Store that resembles the one below:
121
154
122
-
155
+
123
156
124
157
-**Client Machine** - Enter the URL for the Vault host machine
125
158
-**Store Path** - This is the path after mount point where the certs will be stored.
@@ -128,11 +161,65 @@ In Keyfactor Command create a new Certificate Store Type similar to the one belo
128
161
- If left blank, will default to "kv-v2".
129
162
-**Vault Token** - This is the access token that will be used by the orchestrator for requests to Vault.
130
163
-**Vault Server Url** - the full url and port of the Vault server instance
164
+
-**Subfolder Inventory** - Set to 'True' if it is a requirement to inventory secrets at the subfolder/component level. The default, 'False' will inventory secrets stored at the root of the "Store Path", but will not look at secrets in subfolders. **Note** that there is a limit on the number of certificates that can be in a certificate store. In certain environments enabling Subfolder Inventory may exceed this limit and cause inventory job failure. Inventory job results are currently submitted to the Command platform as a single HTTP POST. There is not a specific limit on the number of certificates in a store, rather the limit is based on the size of the actual certificates and the HTTP POST size limit configured on the Command web server.
165
+
166
+
### For the Keyfactor and PKI plugins
131
167
132
-
## Testing
168
+
- Add a new Certificate Store Type
169
+
- Log into Keyfactor as Administrator or a user with permissions to add certificate store types.
170
+
- Click on the gear icon in the top right and then navigate to the "Certificate Store Types"
171
+
- Click "Add" and enter the following information on the first tab:
172
+
173
+
174
+
175
+
-**Name:** "Hashicorp Vault PKI" (or another preferred name)
176
+
-**Short Name:** "HCVPKI"
177
+
-**Supported Job Types:** "Inventory"
178
+
179
+
180
+
181
+
- Set the following values on the "Advanced" tab:
182
+
-**Supports Custom Alias** - "Optional"
183
+
-**Private Key Handling** - "Optional"
184
+
185
+
186
+
187
+
- Click the "Custom Fields" tab to add the following custom fields:
188
+
-**MountPoint** - type: *string*
189
+
-**VaultServerUrl** - type: *string*, *required*
190
+
-**VaultToken** - type: *secret*, *required*
191
+
192
+
193
+
194
+
- Click **Save** to save the new Store Type.
195
+
196
+
1. Add the Hashicorp Vault Certificate Store
197
+
198
+
- Navigate to **Locations** > **Certificate Stores** from the main menu
199
+
- Click **ADD** to open the new Certificate Store Dialog
200
+
201
+
In Keyfactor Command create a new Certificate Store similar to the one below:
202
+
203
+
204
+
205
+
-**Client Machine** - Enter the URL for the Vault host machine
206
+
-**Store Path** - "/"
207
+
-**Mount Point** - This is the mount point name for the instance of the PKI or Keyfactor secrets engine plugin.
208
+
- If using the PKI plugin, the default in Hashicorp is pki. If using the Keyfactor plugin, it should correspond to the mount point given when the plugin was enabled.
209
+
- It is possible to have multiple instances of the Keyfactor plugin running simultaneously, so be sure this corresponds to the one you would like to manage.
210
+
211
+
-**Vault Token** - This is the access token that will be used by the orchestrator for requests to Vault.
212
+
-**Vault Server Url** - the full url and port of the Vault server instance
213
+
214
+
At this point, the certificate store should be created and ready to peform inventory on your certificates stored via the Keyfactor or PKI secrets engine plugin for Hashicorp Vault.
215
+
216
+
## Testing the Key-Value store
133
217
134
218
### PFX Enrollment into Vault
135
219
220
+
**Note**
221
+
Enrollment via the platform is only supported by the Key-Value store type
222
+
136
223
At this point you should be able to enroll a certificate and store it in Vault using the plugin.
137
224
138
225
1. Navigate to `Enrollment > PFX Enrollment` from the main menu.
@@ -153,7 +240,7 @@ At this point you should be able to enroll a certificate and store it in Vault u
153
240
154
241
- Make sure the vault is unsealed first
155
242
156
-
1. Type `vault kv list kv/cert-store` (where "kv/cert-store" is <mountpoint>/<storepath>)
243
+
1. Type `vault kv list kv/cert-store` (where "kv/cert-store" is `<mount point>/<store path>`)
157
244
158
245
- You should see the alias of the newly enrolled certificate
159
246
@@ -168,6 +255,5 @@ At this point you should be able to enroll a certificate and store it in Vault u
168
255
169
256
## Notes / Future Enhancements
170
257
171
-
- Currently we only operate on a single version of the Key Value secret (no versioning capabilities through the Orchesterator Extension / Keyfactor).
172
-
- Creating a new certificate store is done implicitly by adding a **store path** value that doesn't currently exist.
258
+
- For the Key-Value stores we operate on a single version of the Key Value secret (no versioning capabilities through the Orchesterator Extension / Keyfactor).
0 commit comments