Skip to content

Commit 555a73a

Browse files
author
Keyfactor
committed
Update generated README
1 parent cad1a18 commit 555a73a

1 file changed

Lines changed: 169 additions & 0 deletions

File tree

‎README.md‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
# <Gateway Name Here>
2+
3+
<Description Here>
4+
5+
#### Integration status: Prototype - Demonstration quality. Not for use in customer environments.
6+
7+
8+
## About the Keyfactor AnyGateway CA Connector
9+
10+
This repository contains an AnyGateway CA Connector, which is a plugin to the Keyfactor AnyGateway. AnyGateway CA Connectors allow Keyfactor Command to be used for inventory, issuance, and revocation of certificates from a third-party certificate authority.
11+
12+
13+
14+
15+
## Support for <Gateway Name Here>
16+
17+
<Gateway Name Here> is open source and community supported, meaning that there is **no SLA** applicable for these tools.
18+
19+
###### To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab.
20+
21+
22+
23+
---
24+
25+
26+
27+
28+
29+
30+
## Keyfactor AnyGateway Framework Supported
31+
32+
This gateway was compiled against version 10.x.x of the AnyGateway Framework. You will need at least this version of the AnyGateway Framework Installed. If you have a later AnyGateway Framework Installed you will probably need to add binding redirects in the CAProxyServer.exe.config file to make things work properly.
33+
34+
35+
36+
---
37+
38+
39+
# Introduction
40+
This AnyGateway plug-in enables issuance, revocation, and synchronization of certificates from <Company> <Product> offering.
41+
# Prerequisites
42+
43+
## Certificate Chain
44+
45+
In order to enroll for certificates the Keyfactor Command server must trust the trust chain. Once you create your Root and/or Subordinate CA, make sure to import the certificate chain into the AnyGateway and Command Server certificate store
46+
47+
48+
# Install
49+
* Download latest successful build from [GitHub Releases](../../releases/latest)
50+
51+
* Copy <GatewayDLL>.dll to the Program Files\Keyfactor\Keyfactor AnyGateway directory
52+
53+
* Update the CAProxyServer.config file
54+
* Update the CAConnection section to point at the DigiCertCAProxy class
55+
```xml
56+
<alias alias="CAConnector" type="Keyfactor.Extensions.AnyGateway.Company.Product.GatewayNameCAConnector, DLLName"/>
57+
```
58+
59+
# Configuration
60+
The following sections will breakdown the required configurations for the AnyGatewayConfig.json file that will be imported to configure the AnyGateway.
61+
62+
## Templates
63+
The Template section will map the CA's products to an AD template.
64+
* ```ProductID```
65+
This is the ID of the <Product> product to map to the specified template.
66+
67+
```json
68+
"Templates": {
69+
"WebServer": {
70+
"ProductID": "<productID>",
71+
"Parameters": {
72+
}
73+
}
74+
}
75+
```
76+
77+
## Security
78+
The security section does not change specifically for the <Product> CA Gateway. Refer to the AnyGateway Documentation for more detail.
79+
```json
80+
/*Grant permissions on the CA to users or groups in the local domain.
81+
READ: Enumerate and read contents of certificates.
82+
ENROLL: Request certificates from the CA.
83+
OFFICER: Perform certificate functions such as issuance and revocation. This is equivalent to "Issue and Manage" permission on the Microsoft CA.
84+
ADMINISTRATOR: Configure/reconfigure the gateway.
85+
Valid permission settings are "Allow", "None", and "Deny".*/
86+
"Security": {
87+
"Keyfactor\\Administrator": {
88+
"READ": "Allow",
89+
"ENROLL": "Allow",
90+
"OFFICER": "Allow",
91+
"ADMINISTRATOR": "Allow"
92+
},
93+
"Keyfactor\\gateway_test": {
94+
"READ": "Allow",
95+
"ENROLL": "Allow",
96+
"OFFICER": "Allow",
97+
"ADMINISTRATOR": "Allow"
98+
},
99+
"Keyfactor\\SVC_TimerService": {
100+
"READ": "Allow",
101+
"ENROLL": "Allow",
102+
"OFFICER": "Allow",
103+
"ADMINISTRATOR": "None"
104+
},
105+
"Keyfactor\\SVC_AppPool": {
106+
"READ": "Allow",
107+
"ENROLL": "Allow",
108+
"OFFICER": "Allow",
109+
"ADMINISTRATOR": "Allow"
110+
}
111+
}
112+
```
113+
## CerificateManagers
114+
The Certificate Managers section is optional.
115+
If configured, all users or groups granted OFFICER permissions under the Security section
116+
must be configured for at least one Template and one Requester.
117+
Uses "<All>" to specify all templates. Uses "Everyone" to specify all requesters.
118+
Valid permission values are "Allow" and "Deny".
119+
```json
120+
"CertificateManagers":{
121+
"DOMAIN\\Username":{
122+
"Templates":{
123+
"MyTemplateShortName":{
124+
"Requesters":{
125+
"Everyone":"Allow",
126+
"DOMAIN\\Groupname":"Deny"
127+
}
128+
},
129+
"<All>":{
130+
"Requesters":{
131+
"Everyone":"Allow"
132+
}
133+
}
134+
}
135+
}
136+
}
137+
```
138+
## CAConnection
139+
The CA Connection section will determine the API endpoint and configuration data used to connect to the <Product> API.
140+
141+
142+
```json
143+
"CAConnection": {
144+
145+
},
146+
```
147+
## GatewayRegistration
148+
There are no specific Changes for the GatewayRegistration section. Refer to the AnyGateway Documentation for more detail.
149+
```json
150+
"GatewayRegistration": {
151+
"LogicalName": "CASandbox",
152+
"GatewayCertificate": {
153+
"StoreName": "CA",
154+
"StoreLocation": "LocalMachine",
155+
"Thumbprint": "0123456789abcdef"
156+
}
157+
}
158+
```
159+
160+
## ServiceSettings
161+
There are no specific Changes for the ServiceSettings section. Refer to the AnyGateway Documentation for more detail.
162+
```json
163+
"ServiceSettings": {
164+
"ViewIdleMinutes": 8,
165+
"FullScanPeriodHours": 24,
166+
"PartialScanPeriodMinutes": 240
167+
}
168+
```
169+

0 commit comments

Comments
 (0)