Skip to content

Commit d463a68

Browse files
author
Lee Fine
committed
2 parents cf47ceb + a160410 commit d463a68

14 files changed

+56
-47
lines changed

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
v2.12.0
22
- Added config.json setting and its override store level custom field - AllowShellCommands. If "N" (default "Y"), SFTP will be used to create stores and move files on Linux-based certificate store servers. No Linux shell commands will be used in the integration.
33

4+
v2.11.5
5+
- Bug Fix: Rare race condition loading config settings when multiple RemoteFile jobs are running simultaneously on the same orchestrator
6+
- Documentation update to better list out what Linux commands get executed under what situations in Requirements & Prerequisites section
7+
48
v2.11.4
59
- Bug Fix: Handle condition where a certificate store definition that contains an invalid value for `FileTransferProtocol`
610
would return empty inventory. If no value is set or an invalid value is set, the default value of `Both` will be used

‎README.md‎

Lines changed: 25 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -90,26 +90,34 @@ Before installing the Remote File Universal Orchestrator extension, we recommend
9090
<summary><b>Certificate stores hosted on Linux servers:</b></summary>
9191

9292
1. The Remote File Orchestrator Extension makes use of a few common Linux commands when managing stores on Linux
93-
servers. If the credentials you will be connecting with need elevated access to run these commands or to access the
93+
servers as well as some specialized CLI commands for certain store types. If the credentials you will be connecting with
94+
need elevated access to run these commands or to access the
9495
certificate store files these commands operate against, you must set up the user id as a sudoer with no password
9596
necessary and set the config.json `UseSudo` value to `Y`. When `RemoteFile` is using orchestration, managing local or
9697
external certificate stores using `SSH` or `WinRM`, the security context is determined by the user id entered into the
9798
Keyfactor Command certificate store or discovery job screens. When RemoteFile is running as an agent, managing local
9899
stores only, the security context is the user id running the Keyfactor Command Universal Orchestrator service
99-
account. The full list of these commands is below:
100-
101-
| Shell Command | Used For |
102-
|----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
103-
| `echo` | Used to append a newline and terminate all commands sent. |
104-
| `find` | Used by Discovery jobs to locate potential certificate stores on the file system. |
105-
| `cp` | Used by Inventory and Management Add/Remove/Create jobs to determine if certificate store file exists. |
106-
| `ls` | Used by Management Add/Remove jobs to copy the certificate store file to a temporary file (only when an alternate download folder has been configured). |
107-
| `chown` | Used by the Inventory and Management Add/Remove jobs to set the permissions on the temporary file (only when an alternate download folder has been configured). |
108-
| `tee` | Used by Management Add/Remove jobs to copy the temporary uploaded certificate file to the certificate store file (only when an alternate upload folder has been configured). |
109-
| `rm` | Used by Inventory and Management Add/Remove jobs to remove temporary files (only when an alternate upload/download folder has been configured). |
110-
| `install` | Used by the Management Create Store job when initializing a certificate store file. |
111-
| `orapki` | Oracle Wallet CLI utility used by Inventory and Management Add/Remove jobs to manipulate an Oracle Wallet certificate store. Used for the RFORA store type only. |
112-
| `gskcapicmd` | IBM Key Database CLI utility used by Inventory and Management Add/Remove jobs to manipulate an IBM Key Database certificate store. Used for the RFKDB store type only. |
100+
account. The full list of these commands and when they are used is illustrated below:
101+
102+
| Shell Command | Discovery | Inventory | Management-Add | Management-Delete | Management-Create |
103+
|----------------|-----------|-----------|----------------|-------------------|-------------------|
104+
| `echo` | X | X | X | X | X |
105+
| `find` | X | | | | |
106+
| `cp` | | X(a) | X(a) | X(a) | |
107+
| `ls` | | | X | X | X |
108+
| `chown` | | X(b) | X(b) | X(b) | |
109+
| `tee` | | X(c) | X(a) | X(a) | |
110+
| `rm` | | X(d) | X(d) | X(d) | |
111+
| `install` | | | | | X |
112+
| `orapki` | | X(e) | X(e) | X(e) | |
113+
| `gskcapicmd` | | X(f) | X(f) | X(f) | |
114+
115+
(a) - Only used if [config.json](#post-installation) setting SeparateUploadFilePath is used (non empty value)
116+
(b) - Only used if [config.json](#post-installation) setting SeparateUploadFilePath is used (non empty value) AND the [config.json](#post-installation) or certificate store setting SudoImpersonatedUser is not used (empty value)
117+
(c) - Only used if store type is RFKDB or RFORA AND [config.json](#post-installation) setting SeparateUploadFilePath is used (non empty value)
118+
(d) - Only used if using store type is either RFKDB or RFORA OR any store type and the [config.json](#post-installation) setting SeparateUploadFilePath is used (non empty value)
119+
(e) - RFORA store type only
120+
(f) - RFKDB store type only
113121

114122
2. When orchestrating management of local or external certificate stores, the Remote File Orchestrator Extension makes
115123
use of SFTP and/or SCP to transfer files to and from the orchestrated server. `SFTP/SCP` cannot make use of `sudo`, so
@@ -912,7 +920,7 @@ the Keyfactor Command Portal
912920

913921
## Post Installation
914922

915-
The Remote File Orchestrator Extension uses a JSON configuration file. It is located in the `{Keyfactor Orchestrator Installation Folder}\Extensions\RemoteFile`. None of the values are required, and a description of each follows below:
923+
The Remote File Orchestrator Extension uses a JSON configuration file. It is located at `{Keyfactor Orchestrator Installation Folder}\Extensions\RemoteFile\config.json`. None of the values are required, and a description of each follows below:
916924

917925
```json
918926
{
@@ -1640,7 +1648,7 @@ will substitute SFTP commands for certain specific Linux shell commands. The fo
16401648
using RemoteFile in this mode:
16411649
1. The config.json option SeparateUploadFilePath must NOT be used (option missing from the config.json file or set to empty) for shell
16421650
commands to be suppressed for all use cases.
1643-
2. The config.json and custom field options SeparateUploadFilePath, DefaultLinuxPermissionsOnStoreCreation, DefaultOwnerOnStoreCreation,
1651+
2. The config.json and custom field options DefaultLinuxPermissionsOnStoreCreation, DefaultOwnerOnStoreCreation,
16441652
LinuxFilePermissionsOnStoreCreation, and LinuxFileOwnerOnStoreCreation are not supported and will be ignored. As a result, file
16451653
permissions and ownership when creating certificate stores will be based on the user assigned to the Command certificate store and
16461654
other Linux environmental settings.

‎RemoteFile.UnitTests/ApplicationSettingsTests.cs‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,12 @@ public class ApplicationSettingsTests
88
[Fact]
99
public void FileTransferProtocol_WhenPopulatedWithValidValue_ReturnsValue()
1010
{
11-
var path = Path.Combine(Directory.GetCurrentDirectory(), "fixtures", "config", "valid", "config.json");
12-
ApplicationSettings.Initialize(path);
1311
Assert.Equal(ApplicationSettings.FileTransferProtocolEnum.SCP, ApplicationSettings.FileTransferProtocol);
1412
}
1513

1614
[Fact]
1715
public void FileTransferProtocol_WhenAllThreePopulated_DefaultsToBoth()
1816
{
19-
var path = Path.Combine(Directory.GetCurrentDirectory(), "fixtures", "config", "file_transfer_protocol_all_three", "config.json");
20-
ApplicationSettings.Initialize(path);
2117
Assert.Equal(ApplicationSettings.FileTransferProtocolEnum.Both, ApplicationSettings.FileTransferProtocol);
2218
}
2319
}

‎RemoteFile/ApplicationSettings.cs‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
using Newtonsoft.Json;
1313
using Microsoft.Extensions.Logging;
1414
using Keyfactor.Logging;
15+
using System.Reflection;
1516

1617

1718
namespace Keyfactor.Extensions.Orchestrator.RemoteFile
@@ -89,13 +90,13 @@ public static FileTransferProtocolEnum FileTransferProtocol
8990
}
9091
}
9192

92-
public static void Initialize(string configLocation)
93+
static ApplicationSettings()
9394
{
9495
ILogger logger = LogHandler.GetClassLogger<ApplicationSettings>();
9596
logger.MethodEntry(LogLevel.Debug);
9697

9798
configuration = new Dictionary<string, string>();
98-
configLocation = $"{Path.GetDirectoryName(configLocation)}{Path.DirectorySeparatorChar}config.json";
99+
string configLocation = $"{Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location)}{Path.DirectorySeparatorChar}config.json";
99100
string configContents = string.Empty;
100101

101102
if (!File.Exists(configLocation))

‎RemoteFile/Discovery.cs‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,6 @@ public JobResult ProcessJob(DiscoveryJobConfiguration config, SubmitDiscoveryUpd
5656
string userName = PAMUtilities.ResolvePAMField(_resolver, logger, "Server User Name", config.ServerUsername);
5757
string userPassword = PAMUtilities.ResolvePAMField(_resolver, logger, "Server Password", config.ServerPassword);
5858

59-
ApplicationSettings.Initialize(this.GetType().Assembly.Location);
60-
6159
certificateStore = new RemoteCertificateStore(config.ClientMachine, userName, userPassword, directoriesToSearch[0].Substring(0, 1) == "/" ? RemoteCertificateStore.ServerTypeEnum.Linux : RemoteCertificateStore.ServerTypeEnum.Windows, ApplicationSettings.SSHPort);
6260
certificateStore.Initialize(ApplicationSettings.DefaultSudoImpersonatedUser, true);
6361

‎RemoteFile/InventoryBase.cs‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,6 @@ public JobResult ProcessJob(InventoryJobConfiguration config, SubmitInventoryUpd
3535

3636
try
3737
{
38-
ApplicationSettings.Initialize(this.GetType().Assembly.Location);
39-
4038
SetJobProperties(config, config.CertificateStoreDetails, logger);
4139

4240
certificateStore = new RemoteCertificateStore(config.CertificateStoreDetails.ClientMachine, UserName, UserPassword, config.CertificateStoreDetails.StorePath, StorePassword, FileTransferProtocol, SSHPort, IncludePortInSPN);

‎RemoteFile/ManagementBase.cs‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,6 @@ public JobResult ProcessJob(ManagementJobConfiguration config)
3333

3434
try
3535
{
36-
ApplicationSettings.Initialize(this.GetType().Assembly.Location);
37-
3836
SetJobProperties(config, config.CertificateStoreDetails, logger);
3937

4038
certificateStore = new RemoteCertificateStore(config.CertificateStoreDetails.ClientMachine, UserName, UserPassword, config.CertificateStoreDetails.StorePath, StorePassword, FileTransferProtocol, SSHPort, IncludePortInSPN);

‎RemoteFile/ReenrollmentBase.cs‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,6 @@ public JobResult ProcessJobToDo(ReenrollmentJobConfiguration config, SubmitReenr
5050

5151
try
5252
{
53-
ApplicationSettings.Initialize(this.GetType().Assembly.Location);
54-
5553
SetJobProperties(config, config.CertificateStoreDetails, logger);
5654

5755
string alias = "abcd";

‎docsource/content.md‎

Lines changed: 24 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -32,26 +32,34 @@ certificates and certificate store files.
3232
<summary><b>Certificate stores hosted on Linux servers:</b></summary>
3333

3434
1. The Remote File Orchestrator Extension makes use of a few common Linux commands when managing stores on Linux
35-
servers. If the credentials you will be connecting with need elevated access to run these commands or to access the
35+
servers as well as some specialized CLI commands for certain store types. If the credentials you will be connecting with
36+
need elevated access to run these commands or to access the
3637
certificate store files these commands operate against, you must set up the user id as a sudoer with no password
3738
necessary and set the config.json `UseSudo` value to `Y`. When `RemoteFile` is using orchestration, managing local or
3839
external certificate stores using `SSH` or `WinRM`, the security context is determined by the user id entered into the
3940
Keyfactor Command certificate store or discovery job screens. When RemoteFile is running as an agent, managing local
4041
stores only, the security context is the user id running the Keyfactor Command Universal Orchestrator service
41-
account. The full list of these commands is below:
42-
43-
| Shell Command | Used For |
44-
|----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
45-
| `echo` | Used to append a newline and terminate all commands sent. |
46-
| `find` | Used by Discovery jobs to locate potential certificate stores on the file system. |
47-
| `cp` | Used by Inventory and Management Add/Remove/Create jobs to determine if certificate store file exists. |
48-
| `ls` | Used by Management Add/Remove jobs to copy the certificate store file to a temporary file (only when an alternate download folder has been configured). |
49-
| `chown` | Used by the Inventory and Management Add/Remove jobs to set the permissions on the temporary file (only when an alternate download folder has been configured). |
50-
| `tee` | Used by Management Add/Remove jobs to copy the temporary uploaded certificate file to the certificate store file (only when an alternate upload folder has been configured). |
51-
| `rm` | Used by Inventory and Management Add/Remove jobs to remove temporary files (only when an alternate upload/download folder has been configured). |
52-
| `install` | Used by the Management Create Store job when initializing a certificate store file. |
53-
| `orapki` | Oracle Wallet CLI utility used by Inventory and Management Add/Remove jobs to manipulate an Oracle Wallet certificate store. Used for the RFORA store type only. |
54-
| `gskcapicmd` | IBM Key Database CLI utility used by Inventory and Management Add/Remove jobs to manipulate an IBM Key Database certificate store. Used for the RFKDB store type only. |
42+
account. The full list of these commands and when they are used is illustrated below:
43+
44+
| Shell Command | Discovery | Inventory | Management-Add | Management-Delete | Management-Create |
45+
|----------------|-----------|-----------|----------------|-------------------|-------------------|
46+
| `echo` | X | X | X | X | X |
47+
| `find` | X | | | | |
48+
| `cp` | | X(a) | X(a) | X(a) | |
49+
| `ls` | | | X | X | X |
50+
| `chown` | | X(b) | X(b) | X(b) | |
51+
| `tee` | | X(c) | X(a) | X(a) | |
52+
| `rm` | | X(d) | X(d) | X(d) | |
53+
| `install` | | | | | X |
54+
| `orapki` | | X(e) | X(e) | X(e) | |
55+
| `gskcapicmd` | | X(f) | X(f) | X(f) | |
56+
57+
(a) - Only used if [config.json](#post-installation) setting SeparateUploadFilePath is used (non empty value)
58+
(b) - Only used if [config.json](#post-installation) setting SeparateUploadFilePath is used (non empty value) AND the [config.json](#post-installation) or certificate store setting SudoImpersonatedUser is not used (empty value)
59+
(c) - Only used if store type is RFKDB or RFORA AND [config.json](#post-installation) setting SeparateUploadFilePath is used (non empty value)
60+
(d) - Only used if using store type is either RFKDB or RFORA OR any store type and the [config.json](#post-installation) setting SeparateUploadFilePath is used (non empty value)
61+
(e) - RFORA store type only
62+
(f) - RFKDB store type only
5563

5664
2. When orchestrating management of local or external certificate stores, the Remote File Orchestrator Extension makes
5765
use of SFTP and/or SCP to transfer files to and from the orchestrated server. `SFTP/SCP` cannot make use of `sudo`, so
@@ -99,7 +107,7 @@ Please consult with your system administrator for more information on configurin
99107

100108
## Post Installation
101109

102-
The Remote File Orchestrator Extension uses a JSON configuration file. It is located in the `{Keyfactor Orchestrator Installation Folder}\Extensions\RemoteFile`. None of the values are required, and a description of each follows below:
110+
The Remote File Orchestrator Extension uses a JSON configuration file. It is located at `{Keyfactor Orchestrator Installation Folder}\Extensions\RemoteFile\config.json`. None of the values are required, and a description of each follows below:
103111

104112
```json
105113
{

‎docsource/images/RFDER-basic-store-type-dialog.png‎

2 Bytes
Loading

0 commit comments

Comments
 (0)