Skip to content

Commit 8f78eb4

Browse files
committed
Merge branch 'ab#81980' of https://github.com/Keyfactor/axis-ipcamera-orchestrator into ab#81980
2 parents f51f97d + 6390905 commit 8f78eb4

13 files changed

Lines changed: 593 additions & 257 deletions

README.md

Lines changed: 28 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -53,13 +53,12 @@ The Axis IP Camera Orchestrator extension DOES NOT support the following use cas
5353

5454
\* Currently supported certificate usages include: **HTTPS**, **IEEE802.X**, **MQTT**, **Other**
5555

56-
57-
5856
## Compatibility
5957

6058
This integration is compatible with Keyfactor Universal Orchestrator version 10.1 and later.
6159

6260
## Support
61+
6362
The AXIS IP Camera Universal Orchestrator extension is supported by Keyfactor. If you require support for any issues or have feature request, please open a support ticket by either contacting your Keyfactor representative or via the Keyfactor Support Portal at https://support.keyfactor.com.
6463

6564
> If you want to contribute bug fixes or additional enhancements, use the **[Pull requests](../../pulls)** tab.
@@ -68,52 +67,44 @@ The AXIS IP Camera Universal Orchestrator extension is supported by Keyfactor. I
6867

6968
Before installing the AXIS IP Camera Universal Orchestrator extension, we recommend that you install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command.
7069

71-
7270
1. Out of the box, an AXIS IP Network Camera will typically have configured an **Administrator** account. It is
7371
recommended to create a new account specifically for executing API calls. This account will need \'Administrator\'
7472
privileges since the orchestrator extension is capable of making configuration changes, such as installing and removing certificates.
7573
2. Currently supports AXIS M2035-LE Bullet Camera, AXIS OS version 12.2.62. Has not been tested with any other firmware version.
7674

77-
7875
## AxisIPCamera Certificate Store Type
7976

8077
To use the AXIS IP Camera Universal Orchestrator extension, you **must** create the AxisIPCamera Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance.
8178

82-
83-
8479
The AXIS IP Camera certificate store type represents a certificate store on an AXIS network camera
8580
that maintains two separate collections of certificates:
8681
* Client-server certificates (certs with private keys)
8782
* CA certificates
8883

8984
It is expected that there be one (1) certificate store managed per AXIS network camera.
9085

91-
92-
93-
9486
#### Axis IP Camera Requirements
9587

9688
1. User Account with \'Administrator\' privileges and password to access the camera
9789
2. Camera serial number
9890
3. Camera IP address (and likely port number)
9991

100-
101-
10292
#### Supported Operations
10393

104-
| Operation | Is Supported |
105-
|--------------|------------------------------------------------------------------------------------------------------------------------|
106-
| Add | ✅ Checked |
107-
| Remove | ✅ Checked |
108-
| Discovery | 🔲 Unchecked |
94+
| Operation | Is Supported |
95+
|--------------|--------------|
96+
| Add | ✅ Checked |
97+
| Remove | ✅ Checked |
98+
| Discovery | 🔲 Unchecked |
10999
| Reenrollment | ✅ Checked |
110-
| Create | 🔲 Unchecked |
100+
| Create | 🔲 Unchecked |
111101

112102
#### Store Type Creation
113103

114104
##### Using kfutil:
115105
`kfutil` is a custom CLI for the Keyfactor Command API and can be used to create certificate store types.
116106
For more information on [kfutil](https://github.com/Keyfactor/kfutil) check out the [docs](https://github.com/Keyfactor/kfutil?tab=readme-ov-file#quickstart)
107+
117108
<details><summary>Click to expand AxisIPCamera kfutil details</summary>
118109

119110
##### Using online definition from GitHub:
@@ -132,10 +123,10 @@ For more information on [kfutil](https://github.com/Keyfactor/kfutil) check out
132123
```
133124
</details>
134125

135-
136126
#### Manual Creation
137127
Below are instructions on how to create the AxisIPCamera store type manually in
138128
the Keyfactor Command Portal
129+
139130
<details><summary>Click to expand manual AxisIPCamera details</summary>
140131

141132
Create a store type called `AxisIPCamera` with the attributes in the tables below:
@@ -146,11 +137,11 @@ the Keyfactor Command Portal
146137
| Name | Axis IP Camera | Display name for the store type (may be customized) |
147138
| Short Name | AxisIPCamera | Short display name for the store type |
148139
| Capability | AxisIPCamera | Store type name orchestrator will register with. Check the box to allow entry of value |
149-
| Supports Add | ✅ Checked | Check the box. Indicates that the Store Type supports Management Add |
150-
| Supports Remove | ✅ Checked | Check the box. Indicates that the Store Type supports Management Remove |
151-
| Supports Discovery | 🔲 Unchecked | Indicates that the Store Type supports Discovery |
152-
| Supports Reenrollment | ✅ Checked | Indicates that the Store Type supports Reenrollment |
153-
| Supports Create | 🔲 Unchecked | Indicates that the Store Type supports store creation |
140+
| Supports Add | ✅ Checked | Indicates that the Store Type supports Management Add |
141+
| Supports Remove | ✅ Checked | Indicates that the Store Type supports Management Remove |
142+
| Supports Discovery | 🔲 Unchecked | Indicates that the Store Type supports Discovery |
143+
| Supports Reenrollment | ✅ Checked | Indicates that the Store Type supports Reenrollment |
144+
| Supports Create | 🔲 Unchecked | Indicates that the Store Type supports store creation |
154145
| Needs Server | ✅ Checked | Determines if a target server name is required when creating store |
155146
| Blueprint Allowed | 🔲 Unchecked | Determines if store type may be included in an Orchestrator blueprint |
156147
| Uses PowerShell | 🔲 Unchecked | Determines if underlying implementation is PowerShell |
@@ -159,18 +150,18 @@ the Keyfactor Command Portal
159150

160151
The Basic tab should look like this:
161152

162-
![AxisIPCamera Basic Tab](docsource/images/AxisIPCamera-basic-store-type-dialog.png)
153+
![AxisIPCamera Basic Tab](docsource/images/AxisIPCamera-basic-store-type-dialog.svg)
163154

164155
##### Advanced Tab
165156
| Attribute | Value | Description |
166157
| --------- | ----- | ----- |
167158
| Supports Custom Alias | Required | Determines if an individual entry within a store can have a custom Alias. |
168-
| Private Key Handling | Forbidden | This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid. |
159+
| Private Key Handling | Forbidden | This determines if Keyfactor can send the private key associated with a certificate to the store. |
169160
| PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) |
170161

171162
The Advanced tab should look like this:
172163

173-
![AxisIPCamera Advanced Tab](docsource/images/AxisIPCamera-advanced-store-type-dialog.png)
164+
![AxisIPCamera Advanced Tab](docsource/images/AxisIPCamera-advanced-store-type-dialog.svg)
174165

175166
> For Keyfactor **Command versions 24.4 and later**, a Certificate Format dropdown is available with PFX and PEM options. Ensure that **PFX** is selected, as this determines the format of new and renewed certificates sent to the Orchestrator during a Management job. Currently, all Keyfactor-supported Orchestrator extensions support only PFX.
176167
@@ -185,8 +176,7 @@ the Keyfactor Command Portal
185176

186177
The Custom Fields tab should look like this:
187178

188-
![AxisIPCamera Custom Fields Tab](docsource/images/AxisIPCamera-custom-fields-store-type-dialog.png)
189-
179+
![AxisIPCamera Custom Fields Tab](docsource/images/AxisIPCamera-custom-fields-store-type-dialog.svg)
190180

191181
###### Server Username
192182
Enter the username of the configured "service" user on the camera
@@ -196,8 +186,6 @@ the Keyfactor Command Portal
196186
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
197187
198188

199-
200-
201189
###### Server Password
202190
Enter the password of the configured "service" user on the camera
203191

@@ -206,16 +194,11 @@ the Keyfactor Command Portal
206194
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
207195
208196

209-
210-
211197
###### Use SSL
212198
Select True or False depending on if SSL (HTTPS) should be used to communicate with the camera. This should always be "True"
213199

214-
![AxisIPCamera Custom Field - ServerUseSsl](docsource/images/AxisIPCamera-custom-field-ServerUseSsl-dialog.png)
215-
![AxisIPCamera Custom Field - ServerUseSsl](docsource/images/AxisIPCamera-custom-field-ServerUseSsl-validation-options-dialog.png)
216-
217-
218-
200+
![AxisIPCamera Custom Field - ServerUseSsl](docsource/images/AxisIPCamera-custom-field-ServerUseSsl-dialog.svg)
201+
![AxisIPCamera Custom Field - ServerUseSsl](docsource/images/AxisIPCamera-custom-field-ServerUseSsl-validation-options-dialog.svg)
219202

220203

221204
##### Entry Parameters Tab
@@ -226,15 +209,12 @@ the Keyfactor Command Portal
226209

227210
The Entry Parameters tab should look like this:
228211

229-
![AxisIPCamera Entry Parameters Tab](docsource/images/AxisIPCamera-entry-parameters-store-type-dialog.png)
230-
231-
212+
![AxisIPCamera Entry Parameters Tab](docsource/images/AxisIPCamera-entry-parameters-store-type-dialog.svg)
232213
##### Certificate Usage
233214
The Certificate Usage to assign to the cert after enrollment. Can be left 'Other' to be assigned later.
234215

235-
![AxisIPCamera Entry Parameter - CertUsage](docsource/images/AxisIPCamera-entry-parameters-store-type-dialog-CertUsage.png)
236-
![AxisIPCamera Entry Parameter - CertUsage](docsource/images/AxisIPCamera-entry-parameters-store-type-dialog-CertUsage-validation-options.png)
237-
216+
![AxisIPCamera Entry Parameter - CertUsage](docsource/images/AxisIPCamera-entry-parameters-store-type-dialog-CertUsage.svg)
217+
![AxisIPCamera Entry Parameter - CertUsage](docsource/images/AxisIPCamera-entry-parameters-store-type-dialog-CertUsage-validation-options.svg)
238218

239219

240220
</details>
@@ -243,12 +223,12 @@ the Keyfactor Command Portal
243223

244224
1. **Download the latest AXIS IP Camera Universal Orchestrator extension from GitHub.**
245225

246-
Navigate to the [AXIS IP Camera Universal Orchestrator extension GitHub version page](https://github.com/Keyfactor/axis-ipcamera-orchestrator/releases/latest). Refer to the compatibility matrix below to determine the asset should be downloaded. Then, click the corresponding asset to download the zip archive.
226+
Navigate to the [AXIS IP Camera Universal Orchestrator extension GitHub version page](https://github.com/Keyfactor/axis-ipcamera-orchestrator/releases/latest). Refer to the compatibility matrix below to determine which asset should be downloaded. Then, click the corresponding asset to download the zip archive.
247227

248228
| Universal Orchestrator Version | Latest .NET version installed on the Universal Orchestrator server | `rollForward` condition in `Orchestrator.runtimeconfig.json` | `axis-ipcamera-orchestrator` .NET version to download |
249229
| --------- | ----------- | ----------- | ----------- |
250230
| Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` |
251-
| `11.6` _and_ newer | `net8.0` | | `net8.0` |
231+
| `11.6` _and_ newer | `net8.0` | | `net8.0` |
252232

253233
Unzip the archive containing extension assemblies to a known location.
254234

@@ -270,17 +250,14 @@ the Keyfactor Command Portal
270250

271251
Refer to [Starting/Restarting the Universal Orchestrator service](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/StarttheService.htm).
272252

273-
274253
6. **(optional) PAM Integration**
275254

276255
The AXIS IP Camera Universal Orchestrator extension is compatible with all supported Keyfactor PAM extensions to resolve PAM-eligible secrets. PAM extensions running on Universal Orchestrators enable secure retrieval of secrets from a connected PAM provider.
277256

278257
To configure a PAM provider, [reference the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) to select an extension and follow the associated instructions to install it on the Universal Orchestrator (remote).
279258

280-
281259
> The above installation steps can be supplemented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions).
282260
283-
284261
## Post Installation
285262

286263
The AXIS IP Camera Orchestrator Extension *always* connects to an AXIS IP Network Camera via HTTPS, regardless
@@ -319,11 +296,8 @@ These values must match or the session will be denied.
319296
> Therefore, you will need to install the full CA chain - including root and intermediate certificates - into the orchestrator server's local
320297
> certificate store.
321298
322-
323299
## Defining Certificate Stores
324300

325-
326-
327301
### Store Creation
328302

329303
#### Manually with the Command UI
@@ -338,8 +312,8 @@ These values must match or the session will be denied.
338312

339313
Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form.
340314

341-
| Attribute | Description |
342-
| --------- |---------------------------------------------------------|
315+
| Attribute | Description |
316+
| --------- | ----------- |
343317
| Category | Select "Axis IP Camera" or the customized certificate store name from the previous step. |
344318
| Container | Optional container to associate certificate store with. |
345319
| Client Machine | The IP address of the Camera. Sample is "192.167.231.174:44444". Include the port if necessary. |
@@ -351,8 +325,6 @@ These values must match or the session will be denied.
351325

352326
</details>
353327

354-
355-
356328
#### Using kfutil CLI
357329

358330
<details><summary>Click to expand details</summary>
@@ -385,7 +357,6 @@ These values must match or the session will be denied.
385357

386358
</details>
387359

388-
389360
#### PAM Provider Eligible Fields
390361
<details><summary>Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator</summary>
391362

@@ -401,10 +372,8 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
401372

402373
</details>
403374

404-
405375
> The content in this section can be supplemented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store).
406376

407-
408377
### Certificate Usage
409378

410379
Every certificate inventoried will have an Entry Parameter called \`Certificate Usage\`.
@@ -449,7 +418,6 @@ There are five (5) possible options:
449418
> * DNS = CN set in the Subject DN
450419
451420
452-
453421
## Caveats
454422
455423
> [!NOTE]
@@ -459,11 +427,10 @@ There are five (5) possible options:
459427
> If a new alias is supplied, a Reenrollment job will not remove the original certificate associated with the \`Certificate Usage\`.
460428
> Since the camera has limited storage, it will be up to the user to remove any unused certificates via the AXIS Network Camera GUI.
461429
462-
463430
## License
464431
465432
Apache License 2.0, see [LICENSE](LICENSE).
466433
467434
## Related Integrations
468435
469-
See all [Keyfactor Universal Orchestrator extensions](https://github.com/orgs/Keyfactor/repositories?q=orchestrator).
436+
See all [Keyfactor Universal Orchestrator extensions](https://github.com/orgs/Keyfactor/repositories?q=orchestrator).
Lines changed: 67 additions & 0 deletions
Loading

0 commit comments

Comments
 (0)