Skip to content

Commit 494741e

Browse files
author
Keyfactor
committed
Update generated docs
1 parent 1cb29d2 commit 494741e

5 files changed

Lines changed: 324 additions & 11 deletions

File tree

‎README.md‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -247,14 +247,12 @@ the Keyfactor Command Portal
247247

248248
| Universal Orchestrator Version | Latest .NET version installed on the Universal Orchestrator server | `rollForward` condition in `Orchestrator.runtimeconfig.json` | `axis-ipcamera-orchestrator` .NET version to download |
249249
| --------- | ----------- | ----------- | ----------- |
250-
| Older than `11.0.0` | | | `net6.0` |
251-
| Between `11.0.0` and `11.5.1` (inclusive) | `net6.0` | | `net6.0` |
252-
| Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `Disable` | `net6.0` || Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` |
250+
| Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` |
253251
| `11.6` _and_ newer | `net8.0` | | `net8.0` |
254252

255253
Unzip the archive containing extension assemblies to a known location.
256254

257-
> **Note** If you don't see an asset with a corresponding .NET version, you should always assume that it was compiled for `net6.0`.
255+
> **Note** If you don't see an asset with a corresponding .NET version, you should always assume that it was compiled for `net8.0`.
258256
259257
2. **Locate the Universal Orchestrator extensions directory.**
260258

@@ -435,23 +433,31 @@ There are five (5) possible options:
435433
> [!NOTE]
436434
> A Reenrollment (ODKG) job will not allow enrollment of certificates with **Trust** assigned as the \`Certificate Usage\`.
437435
> Trust CA certificates can be added to the camera via a Management - Add job.
436+
> These CA certificates establish trust for TLS connections initiated by the camera.
438437
439438
> [!NOTE]
440-
> For a Reenrollment (ODKG) job, where the \`Certificate Usage\` assigned is **HTTPS**, IP and DNS are added as SANS
441-
> to the enrolled certificate.
439+
> As of Keyfactor Command v25.4, SANs can be provided for a Reenrollment (ODKG) job.
440+
> You must also have installed, at minimum, the Keyfactor Universal Orchestator v25.1
441+
> in order for the SANs to be sent to the orchestrator.
442442
>
443-
> IP = Client Machine configured for the certificate store (excluding any port)
443+
> The Axis IP Camera API *only* supports the addition of DNS and IP SANs. If you add other SAN types to the ODKG job, these will be ignored and not added to the certificate.
444444
>
445-
> DNS = CN set in the Subject DN
445+
> * If SANs are NOT provided and the \`Certificate Usage\` assigned is **HTTPS**, IP and DNS will be automatically added as SANs to an enrolled certificate associated with a NEW alias.
446+
>
447+
> * IP = Client Machine configured for the certificate store (excluding any port)
448+
>
449+
> * DNS = CN set in the Subject DN
446450
447451
448452
449453
## Caveats
450454
451455
> [!NOTE]
452-
> Reenrollment jobs will not replace or remove a client-server certificate with the same alias. They will also not remove
453-
> the original certificate if a particular \`Certificate Usage\` had an associated cert. Since the camera has limited storage,
454-
> it will be up to the user to remove any unused client-server certificates via the AXIS Network Camera GUI.
456+
> v1.1.0 - A Reenrollment job will now replace the certificate contents for an existing alias on the camera, therefore, not requiring
457+
> a new alias be supplied for every new certificate enrollment.
458+
>
459+
> If a new alias is supplied, a Reenrollment job will not remove the original certificate associated with the \`Certificate Usage\`.
460+
> Since the camera has limited storage, it will be up to the user to remove any unused certificates via the AXIS Network Camera GUI.
455461
456462
457463
## License

‎scripts/store_types/bash/curl_create_store_types.sh‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
#!/usr/bin/env bash
2+
3+
# Creates all 1 store types via the Keyfactor Command REST API using curl.
4+
#
5+
# Authentication (first matching method is used):
6+
# OAuth access token: KEYFACTOR_AUTH_ACCESS_TOKEN
7+
# OAuth client creds: KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET
8+
# + KEYFACTOR_AUTH_TOKEN_URL
9+
# Basic auth (AD): KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD + KEYFACTOR_DOMAIN
10+
#
11+
# Always required:
12+
# KEYFACTOR_HOSTNAME Command hostname (e.g. my-command.example.com)
13+
#
14+
# Auto-generated by doctool generate-store-type-scripts — do not edit by hand.
15+
16+
if [ -z "${KEYFACTOR_HOSTNAME}" ]; then
17+
echo "ERROR: KEYFACTOR_HOSTNAME is required"
18+
exit 1
19+
fi
20+
21+
BASE_URL="https://${KEYFACTOR_HOSTNAME}/keyfactorapi"
22+
23+
# ---------------------------------------------------------------------------
24+
# Resolve auth
25+
# ---------------------------------------------------------------------------
26+
if [ -n "${KEYFACTOR_AUTH_ACCESS_TOKEN}" ]; then
27+
BEARER_TOKEN="${KEYFACTOR_AUTH_ACCESS_TOKEN}"
28+
elif [ -n "${KEYFACTOR_AUTH_CLIENT_ID}" ] && [ -n "${KEYFACTOR_AUTH_CLIENT_SECRET}" ] && [ -n "${KEYFACTOR_AUTH_TOKEN_URL}" ]; then
29+
echo "Fetching OAuth token..."
30+
BEARER_TOKEN=$(curl -s -X POST "${KEYFACTOR_AUTH_TOKEN_URL}" \
31+
-H "Content-Type: application/x-www-form-urlencoded" \
32+
--data-urlencode "grant_type=client_credentials" \
33+
--data-urlencode "client_id=${KEYFACTOR_AUTH_CLIENT_ID}" \
34+
--data-urlencode "client_secret=${KEYFACTOR_AUTH_CLIENT_SECRET}" | jq -r '.access_token')
35+
if [ -z "${BEARER_TOKEN}" ] || [ "${BEARER_TOKEN}" = "null" ]; then
36+
echo "ERROR: Failed to fetch OAuth token from ${KEYFACTOR_AUTH_TOKEN_URL}"
37+
exit 1
38+
fi
39+
elif [ -n "${KEYFACTOR_USERNAME}" ] && [ -n "${KEYFACTOR_PASSWORD}" ] && [ -n "${KEYFACTOR_DOMAIN}" ]; then
40+
BEARER_TOKEN=""
41+
else
42+
echo "ERROR: Authentication required. Set one of:"
43+
echo " KEYFACTOR_AUTH_ACCESS_TOKEN"
44+
echo " KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET + KEYFACTOR_AUTH_TOKEN_URL"
45+
echo " KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD + KEYFACTOR_DOMAIN"
46+
exit 1
47+
fi
48+
49+
if [ -n "${BEARER_TOKEN}" ]; then
50+
CURL_AUTH=("-H" "Authorization: Bearer ${BEARER_TOKEN}")
51+
else
52+
CURL_AUTH=("-u" "${KEYFACTOR_USERNAME}@${KEYFACTOR_DOMAIN}:${KEYFACTOR_PASSWORD}")
53+
fi
54+
55+
create_store_type() {
56+
local name="$1"
57+
local body="$2"
58+
echo "Creating ${name} store type..."
59+
response=$(curl -s -o /dev/null -w "%{http_code}" \
60+
-X POST "${BASE_URL}/certificatestoretypes" \
61+
-H "Content-Type: application/json" \
62+
-H "x-keyfactor-requested-with: APIClient" \
63+
"${CURL_AUTH[@]}" \
64+
-d "${body}")
65+
if [ "$response" = "200" ] || [ "$response" = "201" ]; then
66+
echo " OK (HTTP ${response})"
67+
else
68+
echo " FAILED (HTTP ${response})"
69+
fi
70+
}
71+
72+
# ---------------------------------------------------------------------------
73+
# AxisIPCamera — The IP address of the Camera. Sample is "192.167.231.174:44444". Include the port if necessary.
74+
# ---------------------------------------------------------------------------
75+
create_store_type "AxisIPCamera" '{
76+
"Name": "Axis IP Camera",
77+
"ShortName": "AxisIPCamera",
78+
"Capability": "AxisIPCamera",
79+
"ServerRequired": true,
80+
"BlueprintAllowed": false,
81+
"PowerShell": false,
82+
"CustomAliasAllowed": "Required",
83+
"PrivateKeyAllowed": "Forbidden",
84+
"SupportedOperations": {
85+
"Add": true,
86+
"Create": false,
87+
"Discovery": false,
88+
"Enrollment": true,
89+
"Remove": true
90+
},
91+
"PasswordOptions": {
92+
"EntrySupported": false,
93+
"StoreRequired": false,
94+
"Style": "Default"
95+
},
96+
"Properties": [
97+
{
98+
"Name": "ServerUseSsl",
99+
"DisplayName": "Use SSL",
100+
"Type": "Bool",
101+
"DependsOn": "",
102+
"DefaultValue": "true",
103+
"Required": true
104+
}
105+
],
106+
"EntryParameters": [
107+
{
108+
"Name": "CertUsage",
109+
"DisplayName": "Certificate Usage",
110+
"Type": "MultipleChoice",
111+
"RequiredWhen": {
112+
"HasPrivateKey": false,
113+
"OnAdd": true,
114+
"OnRemove": false,
115+
"OnReenrollment": true
116+
},
117+
"Options": "HTTPS,IEEE802.X,MQTT,Trust,Other",
118+
"Description": "The Certificate Usage to assign to the cert after enrollment. Can be left 'Other' to be assigned later."
119+
}
120+
],
121+
"StorePathDescription": "Enter the Serial Number of the camera e.g. `0b7c3d2f9e8a`",
122+
"StorePathType": "",
123+
"StorePathValue": "",
124+
"JobProperties": []
125+
}'
126+
127+
128+
echo "Completed."

‎scripts/store_types/bash/kfutil_create_store_types.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/usr/bin/env bash
2+
3+
# Creates all 1 store types using kfutil.
4+
# kfutil reads definitions from the Keyfactor integration catalog.
5+
#
6+
# Auth environment variables (first matching method is used):
7+
# OAuth access token: KEYFACTOR_AUTH_ACCESS_TOKEN
8+
# OAuth client creds: KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET
9+
# + KEYFACTOR_AUTH_TOKEN_URL
10+
# Basic auth (AD): KEYFACTOR_HOSTNAME + KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD
11+
# + KEYFACTOR_DOMAIN
12+
#
13+
# Auto-generated by doctool generate-store-type-scripts — do not edit by hand.
14+
15+
if ! command -v kfutil &> /dev/null; then
16+
echo "kfutil could not be found. Please install kfutil"
17+
echo "See https://github.com/Keyfactor/kfutil#quickstart"
18+
exit 1
19+
fi
20+
21+
if [ -z "$KEYFACTOR_HOSTNAME" ]; then
22+
echo "KEYFACTOR_HOSTNAME not set — launching kfutil login"
23+
kfutil login
24+
fi
25+
26+
kfutil store-types create --name "AxisIPCamera"
27+
28+
echo "Done. All store types created."

‎scripts/store_types/powershell/kfutil_create_store_types.ps1‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Creates all 1 store types using kfutil.
2+
# kfutil reads definitions from the Keyfactor integration catalog.
3+
#
4+
# Auth environment variables (first matching method is used):
5+
# OAuth access token: KEYFACTOR_AUTH_ACCESS_TOKEN
6+
# OAuth client creds: KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET
7+
# + KEYFACTOR_AUTH_TOKEN_URL
8+
# Basic auth (AD): KEYFACTOR_HOSTNAME + KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD
9+
# + KEYFACTOR_DOMAIN
10+
#
11+
# Auto-generated by doctool generate-store-type-scripts — do not edit by hand.
12+
13+
# Uncomment if kfutil is not in your PATH
14+
# Set-Alias -Name kfutil -Value 'C:\Program Files\Keyfactor\kfutil\kfutil.exe'
15+
16+
if ($null -eq (Get-Command "kfutil" -ErrorAction SilentlyContinue)) {
17+
Write-Host "kfutil could not be found. Please install kfutil"
18+
Write-Host "See https://github.com/Keyfactor/kfutil#quickstart"
19+
exit 1
20+
}
21+
22+
if (-not $env:KEYFACTOR_HOSTNAME) {
23+
Write-Host "KEYFACTOR_HOSTNAME not set — launching kfutil login"
24+
& kfutil login
25+
}
26+
27+
& kfutil store-types create --name "AxisIPCamera"
28+
29+
Write-Host "Done. All store types created."

‎scripts/store_types/powershell/restmethod_create_store_types.ps1‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
# Creates all 1 store types via the Keyfactor Command REST API
2+
# using PowerShell Invoke-RestMethod.
3+
#
4+
# Authentication (first matching method is used):
5+
# OAuth access token: KEYFACTOR_AUTH_ACCESS_TOKEN
6+
# OAuth client creds: KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET
7+
# + KEYFACTOR_AUTH_TOKEN_URL
8+
# Basic auth (AD): KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD + KEYFACTOR_DOMAIN
9+
#
10+
# Always required:
11+
# KEYFACTOR_HOSTNAME Command hostname (e.g. my-command.example.com)
12+
#
13+
# Auto-generated by doctool generate-store-type-scripts — do not edit by hand.
14+
15+
if (-not $env:KEYFACTOR_HOSTNAME) {
16+
Write-Error "KEYFACTOR_HOSTNAME is required"
17+
exit 1
18+
}
19+
20+
$uri = "https://$($env:KEYFACTOR_HOSTNAME)/keyfactorapi/certificatestoretypes"
21+
$headers = @{
22+
'Content-Type' = "application/json"
23+
'x-keyfactor-requested-with' = "APIClient"
24+
}
25+
26+
# ---------------------------------------------------------------------------
27+
# Resolve auth
28+
# ---------------------------------------------------------------------------
29+
if ($env:KEYFACTOR_AUTH_ACCESS_TOKEN) {
30+
$headers['Authorization'] = "Bearer $($env:KEYFACTOR_AUTH_ACCESS_TOKEN)"
31+
} elseif ($env:KEYFACTOR_AUTH_CLIENT_ID -and $env:KEYFACTOR_AUTH_CLIENT_SECRET -and $env:KEYFACTOR_AUTH_TOKEN_URL) {
32+
Write-Host "Fetching OAuth token..."
33+
$tokenBody = @{
34+
grant_type = 'client_credentials'
35+
client_id = $env:KEYFACTOR_AUTH_CLIENT_ID
36+
client_secret = $env:KEYFACTOR_AUTH_CLIENT_SECRET
37+
}
38+
$tokenResp = Invoke-RestMethod -Method Post -Uri $env:KEYFACTOR_AUTH_TOKEN_URL -Body $tokenBody
39+
$headers['Authorization'] = "Bearer $($tokenResp.access_token)"
40+
} elseif ($env:KEYFACTOR_USERNAME -and $env:KEYFACTOR_PASSWORD -and $env:KEYFACTOR_DOMAIN) {
41+
$cred = [System.Convert]::ToBase64String(
42+
[System.Text.Encoding]::ASCII.GetBytes(
43+
"$($env:KEYFACTOR_USERNAME)@$($env:KEYFACTOR_DOMAIN):$($env:KEYFACTOR_PASSWORD)"))
44+
$headers['Authorization'] = "Basic $cred"
45+
} else {
46+
Write-Error ("Authentication required. Set one of:`n" +
47+
" KEYFACTOR_AUTH_ACCESS_TOKEN`n" +
48+
" KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET + KEYFACTOR_AUTH_TOKEN_URL`n" +
49+
" KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD + KEYFACTOR_DOMAIN")
50+
exit 1
51+
}
52+
53+
function New-StoreType {
54+
param([string]$Name, [string]$Body)
55+
Write-Host "Creating $Name store type..."
56+
try {
57+
Invoke-RestMethod -Method Post -Uri $uri -Headers $headers -Body $Body -ContentType "application/json" | Out-Null
58+
Write-Host " OK"
59+
} catch {
60+
Write-Warning " FAILED: $($_.Exception.Message)"
61+
}
62+
}
63+
64+
# ---------------------------------------------------------------------------
65+
# AxisIPCamera — The IP address of the Camera. Sample is "192.167.231.174:44444". Include the port if necessary.
66+
# ---------------------------------------------------------------------------
67+
New-StoreType "AxisIPCamera" @'
68+
{
69+
"Name": "Axis IP Camera",
70+
"ShortName": "AxisIPCamera",
71+
"Capability": "AxisIPCamera",
72+
"ServerRequired": true,
73+
"BlueprintAllowed": false,
74+
"PowerShell": false,
75+
"CustomAliasAllowed": "Required",
76+
"PrivateKeyAllowed": "Forbidden",
77+
"SupportedOperations": {
78+
"Add": true,
79+
"Create": false,
80+
"Discovery": false,
81+
"Enrollment": true,
82+
"Remove": true
83+
},
84+
"PasswordOptions": {
85+
"EntrySupported": false,
86+
"StoreRequired": false,
87+
"Style": "Default"
88+
},
89+
"Properties": [
90+
{
91+
"Name": "ServerUseSsl",
92+
"DisplayName": "Use SSL",
93+
"Type": "Bool",
94+
"DependsOn": "",
95+
"DefaultValue": "true",
96+
"Required": true
97+
}
98+
],
99+
"EntryParameters": [
100+
{
101+
"Name": "CertUsage",
102+
"DisplayName": "Certificate Usage",
103+
"Type": "MultipleChoice",
104+
"RequiredWhen": {
105+
"HasPrivateKey": false,
106+
"OnAdd": true,
107+
"OnRemove": false,
108+
"OnReenrollment": true
109+
},
110+
"Options": "HTTPS,IEEE802.X,MQTT,Trust,Other",
111+
"Description": "The Certificate Usage to assign to the cert after enrollment. Can be left 'Other' to be assigned later."
112+
}
113+
],
114+
"StorePathDescription": "Enter the Serial Number of the camera e.g. `0b7c3d2f9e8a`",
115+
"StorePathType": "",
116+
"StorePathValue": "",
117+
"JobProperties": []
118+
}
119+
'@
120+
121+
122+
Write-Host "Completed."

0 commit comments

Comments
 (0)