|
| 1 | +# Enabling API Access for Keyfactor on Kemp LoadMaster |
| 2 | + |
| 3 | +This guide explains how to enable API access for a specific user on a Kemp LoadMaster appliance to allow Keyfactor Orchestrator integrations for certificate management and inventory operations. |
| 4 | + |
| 5 | +--- |
| 6 | + |
| 7 | +## 🧩 Step-by-Step: Enabling API Access for a User |
| 8 | + |
| 9 | +### 1. Log in to the Kemp Web UI |
| 10 | +- In your browser, go to: |
| 11 | + ``` |
| 12 | + https://<loadmaster-hostname-or-ip>:8443 |
| 13 | + ``` |
| 14 | +- Log in as an administrator account that can manage users. |
| 15 | + |
| 16 | +--- |
| 17 | + |
| 18 | +### 2. Edit the User Permissions |
| 19 | +1. In the left-hand menu, navigate to: |
| 20 | + ``` |
| 21 | + System Configuration → System Administration → User Management |
| 22 | + ``` |
| 23 | +2. Locate the user account that will be used by the Keyfactor Orchestrator (for example: `bhill`). |
| 24 | +3. Click **Modify** next to that user to open the **Permissions for User** screen. |
| 25 | +4. Under **Rules**, enable the following options: |
| 26 | + - ✅ **Certificate Creation** |
| 27 | + - ✅ **Intermediate Certificates** |
| 28 | +5. Click **Set Permissions** to apply the changes. |
| 29 | + |
| 30 | +These permissions allow the orchestrator to create and manage intermediate and server certificates. |
| 31 | + |
| 32 | +--- |
| 33 | + |
| 34 | +### 3. Generate and Record the API Key |
| 35 | +1. Scroll down to the **API Keys** section. |
| 36 | +2. Click **Generate New APIKey** to create a new key for API authentication. |
| 37 | +3. Copy and securely store this key — it will be used in your Keyfactor orchestrator configuration as the **ServerPassword** or **API Key**. |
| 38 | +4. You can later use **Delete** to revoke it if needed. |
| 39 | + |
| 40 | +--- |
| 41 | + |
| 42 | +### 4. Verify API Access |
| 43 | +Use a command line or PowerShell session to verify connectivity: |
| 44 | + |
| 45 | +#### Using curl: |
| 46 | +```bash |
| 47 | +curl -k -H "Authorization: <API_KEY>" https://<loadmaster-ip>:8443/access/list |
| 48 | +``` |
| 49 | + |
| 50 | +#### Using PowerShell: |
| 51 | +```powershell |
| 52 | +Invoke-RestMethod -Uri "https://<loadmaster-ip>:8443/access/list" -Headers @{ Authorization = "<API_KEY>" } -SkipCertificateCheck |
| 53 | +``` |
| 54 | + |
| 55 | +If you receive a JSON response, API access is successfully configured. |
| 56 | + |
| 57 | +### ✅ Summary of Required Settings |
| 58 | + |
| 59 | +| Setting | Location | Value | |
| 60 | +|----------|-----------|--------| |
| 61 | +| Certificate Creation | User Permissions | Enabled | |
| 62 | +| Intermediate Certificates | User Permissions | Enabled | |
| 63 | +| API Key | User Management (Modify user) | Generated | |
| 64 | +| Allow Web Administrative Access | Remote Access | Enabled | |
| 65 | +| Enable API Interface | Remote Access | Enabled | |
| 66 | +| Port | Remote Access | 8443 | |
| 67 | +| Authentication Method | Remote Access | Password Only (default) | |
| 68 | + |
| 69 | +--- |
| 70 | + |
| 71 | +## Kemp LoadMaster Orchestrator – Behavior Summary |
| 72 | + |
| 73 | +This document summarizes the observed behaviors of the **Kemp LoadMaster Orchestrator** integration during SSL and Intermediate Certificate management operations. |
| 74 | +It details how the orchestrator interacts with the LoadMaster API, handles overwrite logic, manages bindings, and synchronizes data with Keyfactor Command. |
| 75 | + |
| 76 | +--- |
| 77 | + |
| 78 | +### 🧩 Overall Integration Behavior |
| 79 | + |
| 80 | +- The orchestrator communicates with the **Kemp LoadMaster REST API** using the configured **ServerUsername**, **API Key**, and **SSL (HTTPS)** over port 8443. |
| 81 | +- Operations are driven by the **Overwrite flag** and **Alias Name** supplied in the job parameters. |
| 82 | +- Certificates are managed in two categories: |
| 83 | + - **SSL Certificates** – used by virtual services (may be bound/unbound). |
| 84 | + - **Intermediate Certificates** – uploaded supporting CA chain files. |
| 85 | +- The orchestrator validates overwrite rules, binding constraints, and synchronization with Keyfactor Command for each operation. |
| 86 | + |
| 87 | +--- |
| 88 | + |
| 89 | +### 🧪 Test Case Behavior Summary |
| 90 | + |
| 91 | +| # | Case Name | Behavior Summary | Outcome | |
| 92 | +|---|------------|------------------|----------| |
| 93 | +| **1** | **New Add New Alias SSL Certificates** | When a new alias (`TC1`) is provided and the certificate does not exist, the orchestrator successfully uploads a new SSL certificate to the LoadMaster and registers it in Keyfactor. | ✅ New certificate created successfully. | |
| 94 | +| **2** | **Replace Alias SSL Certificates** | The orchestrator detects an existing alias (`TC1`) and, with **Overwrite=True**, replaces the existing SSL certificate. The old certificate file is overwritten. | ✅ Replacement successful. | |
| 95 | +| **3** | **Replace Alias SSL Certificates (No Overwrite)** | Attempting to replace an existing alias without the overwrite flag causes the orchestrator to abort the operation and return an error indicating the flag is required. | ✅ Expected error: “Overwrite flag should be used.” | |
| 96 | +| **4** | **Replace Alias Bound SSL Certificates** | When a certificate bound to a virtual service is replaced with **Overwrite=True**, the orchestrator updates the certificate file while maintaining the existing service binding. | ✅ Bound certificate replaced in place. | |
| 97 | +| **5** | **Remove Bound SSL Certificate** | The orchestrator prevents removal of any certificate that is currently bound to a virtual service, returning an error message. | ✅ Error handled correctly (“cannot remove bound certificates”). | |
| 98 | +| **6** | **Remove Unbound SSL Certificate** | The orchestrator removes an SSL certificate only if it is unbound, confirming removal through the LoadMaster API. | ✅ Certificate removed successfully. | |
| 99 | +| **7** | **New Add New Alias Intermediate Certificates** | A new intermediate certificate (`TC8b`) is uploaded since no alias conflict exists. It appears under the Intermediate Certificates list. | ✅ Intermediate certificate created. | |
| 100 | +| **8** | **Replace Alias Intermediate Certificates** | Kemp does not support overwriting intermediate certificates. The orchestrator logs and returns the expected API error (`Filename already exists`). | ✅ Expected failure recorded. | |
| 101 | +| **9** | **Remove Intermediate Certificates** | The orchestrator deletes the intermediate certificate (`TC8b`) from the LoadMaster and synchronizes removal from Keyfactor Command. | ✅ Certificate removed successfully. | |
| 102 | +| **10** | **Inventory Intermediate Certificates** | Performs an inventory scan of all intermediate certificates on the LoadMaster, importing them into Keyfactor Command. | ✅ Inventory successful. | |
| 103 | +| **11** | **Inventory SSL Certificates** | Enumerates all SSL certificates (bound and unbound) on the LoadMaster and updates Keyfactor’s inventory accordingly. | ✅ Inventory successful. | |
| 104 | + |
| 105 | +--- |
| 106 | + |
| 107 | +### ⚙️ Functional Insights |
| 108 | + |
| 109 | +- **Overwrite Logic:** SSL certificates respect the `Overwrite` flag. Intermediate certificates cannot be overwritten. |
| 110 | +- **Binding Awareness:** The orchestrator checks for bound services before delete or replace operations. |
| 111 | +- **Error Handling:** Clear API error messages are surfaced in Keyfactor job logs. |
| 112 | +- **Synchronization:** Add/Remove/Inventory maintain consistent state between Keyfactor and LoadMaster. |
| 113 | +- **Security:** All operations occur over HTTPS using API Key authentication. |
| 114 | + |
| 115 | +--- |
| 116 | + |
| 117 | +### ✅ Operation Coverage Summary |
| 118 | + |
| 119 | +| Operation | Certificate Type | Supported | Notes | |
| 120 | +|------------|------------------|------------|--------| |
| 121 | +| Add | SSL | ✅ | Creates new alias or replaces with overwrite flag | |
| 122 | +| Replace | SSL | ✅ | Requires `Overwrite=True` | |
| 123 | +| Replace | Intermediate | ❌ | Unsupported – API rejects | |
| 124 | +| Remove | SSL | ✅ | Allowed only if unbound | |
| 125 | +| Remove | Intermediate | ✅ | Fully supported | |
| 126 | +| Inventory | SSL | ✅ | Returns all SSL certificates | |
| 127 | +| Inventory | Intermediate | ✅ | Returns all intermediate certificates | |
| 128 | + |
| 129 | +--- |
| 130 | + |
| 131 | +## TEST CASES |
| 132 | +Case Number|Case Name|Case Description|Overwrite Flag|Alias Name|Expected Results|Passed|Screenshots |
| 133 | +------------|---------|----------------|--------------|----------|----------------|--------------|------------ |
| 134 | +1|New Add New Alias SSL Certificates|Will Create a new SSL Certificate|False|TC1|New SSL Certificate with Alias TC1 Created On Kemp LoadMaster|True| |
| 135 | +2|Replace Alias SSL Certificates|Will Replace SSL Certificate|True|TC1|SSL Certificate with Alias TC1 Replaced On Kemp LoadMaster|True| |
| 136 | +3|Replace Alias SSL Certificates no Overwrite|Will Replace SSL Certificate|False|TC1|Error should occur stating Overwrite flag should be used|True| |
| 137 | +4|Replace Alias Bound SSL Certificates|Will Replace Bound SSL Certificate|True|TC1|Bound Certificate should be replaced|True| |
| 138 | +5|Remove Bound SSL Certificate|Should fail as you cannot remove Bound Certificates|N/A|TC1|Error Occurs stating you cannot remove bound certificates.|True| |
| 139 | +6|Remove UnBound SSL Certificate|Try to remove SSL Certificate that is UnBound|N/A|TC8a|Unbound Certificate Is Removed from LoadMaster.|True| |
| 140 | +7|New Add New Alias Intermediate Certificates|Will Create a new Intermediate Certificate|False|TC8b|New Intermediate Certificate with Alias TC8b Created On Kemp LoadMaster|True| |
| 141 | +8|Replace Alias Intermediate Certificates|You cannot replace intermediate certificates|True|TC8b|Command Failed: Filename already exists|True| |
| 142 | +9|Remove Intermediate Certificates|Intermediate Certificate Will Be Removed|N/A|TC8b|Intermediate Certificate Is Removed From Keyfactor and the LoadMaster|True| |
| 143 | +10|Inventory Intermediate Certificates|Intermediate Certificate Will Be Inventoried|N/A|N/A|Intermediate Certificate Is Inventoried to Keyfactor|True| |
| 144 | +11|Inventory SSL Certificates|SSL Certificate Will Be Inventoried|N/A|N/A|SSL Certificate Is Inventoried to Keyfactor|True| |
| 145 | + |
| 146 | +## Overview |
| 147 | + |
| 148 | +TODO Overview is a required section |
| 149 | + |
0 commit comments