Skip to content

Commit 6d701d4

Browse files
spbsolublespbsoluble
committed
docs: include PAM type parameters in store guides
1 parent 95419e1 commit 6d701d4

60 files changed

Lines changed: 980 additions & 81 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎docs/use-cases/Certificate Store Operations/Store Types/README.md‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<!-- Generated by tools/storetypedocs. -->
22
# Store Type Bulk Create And Update Guides
33

4-
These docs are generated from `cmd/store_types.json` and describe the CSV columns used by `kfutil stores import csv` for each embedded certificate store type.
4+
These docs are generated from `cmd/store_types.json` and `cmd/pam_types.json` and describe the CSV columns used by `kfutil stores import csv` for each embedded certificate store type.
55

66
Regenerate after store type metadata changes:
77

@@ -11,6 +11,22 @@ make store-type-docs
1111

1212
Use `kfutil stores import generate-template` against a live Command environment when you need a template that reflects deployed customizations.
1313

14+
## PAM Provider Parameter Columns
15+
16+
PAM-backed secret columns vary by PAM provider type. Provider-level parameters are configured on the PAM provider. Store CSV rows use the instance-level parameter names with the secret column prefix, for example `Properties.ServerPassword.Parameters.SecretId` or `Password.Parameters.SecretId`.
17+
18+
| PAM type | Provider-level parameters | Store CSV instance parameters |
19+
| --- | --- | --- |
20+
| `1Password-CLI` | Vault, Token | Item, Field |
21+
| `Azure-KeyVault` | KeyVaultUri, AuthorityHost | SecretId |
22+
| `Azure-KeyVault-ServicePrincipal` | KeyVaultUri, AuthorityHost, TenantId, ClientId, ClientSecret | SecretId |
23+
| `BeyondTrust-PasswordSafe` | Host, APIKey, Username, ClientCertificate | SystemId, AccountId |
24+
| `CyberArk-CentralCredentialProvider` | AppId, Host, Site | Safe, Folder, Object |
25+
| `CyberArk-SdkCredentialProvider` | AppId | Safe, Folder, Object |
26+
| `Delinea-SecretServer` | Host, Username, Password, ClientId, ClientSecret, GrantType | SecretId, SecretFieldName |
27+
| `GCP-SecretManager` | projectId | secretId |
28+
| `Hashicorp-Vault` | Host, Token, Path | Secret, Key |
29+
1430
## Store Types
1531

1632
| Store Type | Name | Store Password | Secret/PAM Columns |

‎docs/use-cases/Certificate Store Operations/Store Types/akamai.md‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -140,14 +140,28 @@ Properties.client_token
140140
Properties.client_secret
141141
```
142142

143-
PAM-backed property secrets use provider and parameter columns:
143+
PAM-backed property secrets use a provider column and provider-type-specific parameter columns. `Provider` identifies the configured PAM provider. `Parameters.*` must match the instance-level parameters for that provider type.
144144

145145
```csv
146146
Properties.access_token.Provider,Properties.access_token.Parameters.<ParameterName>
147147
Properties.client_token.Provider,Properties.client_token.Parameters.<ParameterName>
148148
Properties.client_secret.Provider,Properties.client_secret.Parameters.<ParameterName>
149149
```
150150

151+
Use the PAM parameter names in the table below, or check the provider type in Command if your environment uses custom PAM types.
152+
153+
| PAM type | Provider-level parameters | Store CSV instance parameters |
154+
| --- | --- | --- |
155+
| `1Password-CLI` | Vault, Token | Item, Field |
156+
| `Azure-KeyVault` | KeyVaultUri, AuthorityHost | SecretId |
157+
| `Azure-KeyVault-ServicePrincipal` | KeyVaultUri, AuthorityHost, TenantId, ClientId, ClientSecret | SecretId |
158+
| `BeyondTrust-PasswordSafe` | Host, APIKey, Username, ClientCertificate | SystemId, AccountId |
159+
| `CyberArk-CentralCredentialProvider` | AppId, Host, Site | Safe, Folder, Object |
160+
| `CyberArk-SdkCredentialProvider` | AppId | Safe, Folder, Object |
161+
| `Delinea-SecretServer` | Host, Username, Password, ClientId, ClientSecret, GrantType | SecretId, SecretFieldName |
162+
| `GCP-SecretManager` | projectId | secretId |
163+
| `Hashicorp-Vault` | Host, Token, Path | Secret, Key |
164+
151165
## References
152166

153167
- [Bulk Certificate Store Creation](../bulk-certificate-store-creation.md)

‎docs/use-cases/Certificate Store Operations/Store Types/appgwbin.md‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,14 +99,28 @@ Properties.ServerPassword
9999
Properties.ClientCertificate
100100
```
101101

102-
PAM-backed property secrets use provider and parameter columns:
102+
PAM-backed property secrets use a provider column and provider-type-specific parameter columns. `Provider` identifies the configured PAM provider. `Parameters.*` must match the instance-level parameters for that provider type.
103103

104104
```csv
105105
Properties.ServerUsername.Provider,Properties.ServerUsername.Parameters.<ParameterName>
106106
Properties.ServerPassword.Provider,Properties.ServerPassword.Parameters.<ParameterName>
107107
Properties.ClientCertificate.Provider,Properties.ClientCertificate.Parameters.<ParameterName>
108108
```
109109

110+
Use the PAM parameter names in the table below, or check the provider type in Command if your environment uses custom PAM types.
111+
112+
| PAM type | Provider-level parameters | Store CSV instance parameters |
113+
| --- | --- | --- |
114+
| `1Password-CLI` | Vault, Token | Item, Field |
115+
| `Azure-KeyVault` | KeyVaultUri, AuthorityHost | SecretId |
116+
| `Azure-KeyVault-ServicePrincipal` | KeyVaultUri, AuthorityHost, TenantId, ClientId, ClientSecret | SecretId |
117+
| `BeyondTrust-PasswordSafe` | Host, APIKey, Username, ClientCertificate | SystemId, AccountId |
118+
| `CyberArk-CentralCredentialProvider` | AppId, Host, Site | Safe, Folder, Object |
119+
| `CyberArk-SdkCredentialProvider` | AppId | Safe, Folder, Object |
120+
| `Delinea-SecretServer` | Host, Username, Password, ClientId, ClientSecret, GrantType | SecretId, SecretFieldName |
121+
| `GCP-SecretManager` | projectId | secretId |
122+
| `Hashicorp-Vault` | Host, Token, Path | Secret, Key |
123+
110124
## References
111125

112126
- [Bulk Certificate Store Creation](../bulk-certificate-store-creation.md)

‎docs/use-cases/Certificate Store Operations/Store Types/aruba.md‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,13 +106,27 @@ Properties.FileServerUsername
106106
Properties.FileServerPassword
107107
```
108108

109-
PAM-backed property secrets use provider and parameter columns:
109+
PAM-backed property secrets use a provider column and provider-type-specific parameter columns. `Provider` identifies the configured PAM provider. `Parameters.*` must match the instance-level parameters for that provider type.
110110

111111
```csv
112112
Properties.FileServerUsername.Provider,Properties.FileServerUsername.Parameters.<ParameterName>
113113
Properties.FileServerPassword.Provider,Properties.FileServerPassword.Parameters.<ParameterName>
114114
```
115115

116+
Use the PAM parameter names in the table below, or check the provider type in Command if your environment uses custom PAM types.
117+
118+
| PAM type | Provider-level parameters | Store CSV instance parameters |
119+
| --- | --- | --- |
120+
| `1Password-CLI` | Vault, Token | Item, Field |
121+
| `Azure-KeyVault` | KeyVaultUri, AuthorityHost | SecretId |
122+
| `Azure-KeyVault-ServicePrincipal` | KeyVaultUri, AuthorityHost, TenantId, ClientId, ClientSecret | SecretId |
123+
| `BeyondTrust-PasswordSafe` | Host, APIKey, Username, ClientCertificate | SystemId, AccountId |
124+
| `CyberArk-CentralCredentialProvider` | AppId, Host, Site | Safe, Folder, Object |
125+
| `CyberArk-SdkCredentialProvider` | AppId | Safe, Folder, Object |
126+
| `Delinea-SecretServer` | Host, Username, Password, ClientId, ClientSecret, GrantType | SecretId, SecretFieldName |
127+
| `GCP-SecretManager` | projectId | secretId |
128+
| `Hashicorp-Vault` | Host, Token, Path | Secret, Key |
129+
116130
## References
117131

118132
- [Bulk Certificate Store Creation](../bulk-certificate-store-creation.md)

‎docs/use-cases/Certificate Store Operations/Store Types/aws-acm-v3.md‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ Properties.IAMUserAccessKey
115115
Properties.IAMUserAccessSecret
116116
```
117117

118-
PAM-backed property secrets use provider and parameter columns:
118+
PAM-backed property secrets use a provider column and provider-type-specific parameter columns. `Provider` identifies the configured PAM provider. `Parameters.*` must match the instance-level parameters for that provider type.
119119

120120
```csv
121121
Properties.OAuthClientId.Provider,Properties.OAuthClientId.Parameters.<ParameterName>
@@ -124,6 +124,20 @@ Properties.IAMUserAccessKey.Provider,Properties.IAMUserAccessKey.Parameters.<Par
124124
Properties.IAMUserAccessSecret.Provider,Properties.IAMUserAccessSecret.Parameters.<ParameterName>
125125
```
126126

127+
Use the PAM parameter names in the table below, or check the provider type in Command if your environment uses custom PAM types.
128+
129+
| PAM type | Provider-level parameters | Store CSV instance parameters |
130+
| --- | --- | --- |
131+
| `1Password-CLI` | Vault, Token | Item, Field |
132+
| `Azure-KeyVault` | KeyVaultUri, AuthorityHost | SecretId |
133+
| `Azure-KeyVault-ServicePrincipal` | KeyVaultUri, AuthorityHost, TenantId, ClientId, ClientSecret | SecretId |
134+
| `BeyondTrust-PasswordSafe` | Host, APIKey, Username, ClientCertificate | SystemId, AccountId |
135+
| `CyberArk-CentralCredentialProvider` | AppId, Host, Site | Safe, Folder, Object |
136+
| `CyberArk-SdkCredentialProvider` | AppId | Safe, Folder, Object |
137+
| `Delinea-SecretServer` | Host, Username, Password, ClientId, ClientSecret, GrantType | SecretId, SecretFieldName |
138+
| `GCP-SecretManager` | projectId | secretId |
139+
| `Hashicorp-Vault` | Host, Token, Path | Secret, Key |
140+
127141
## References
128142

129143
- [Bulk Certificate Store Creation](../bulk-certificate-store-creation.md)

‎docs/use-cases/Certificate Store Operations/Store Types/aws-acm.md‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,13 +114,27 @@ Properties.ServerUsername
114114
Properties.ServerPassword
115115
```
116116

117-
PAM-backed property secrets use provider and parameter columns:
117+
PAM-backed property secrets use a provider column and provider-type-specific parameter columns. `Provider` identifies the configured PAM provider. `Parameters.*` must match the instance-level parameters for that provider type.
118118

119119
```csv
120120
Properties.ServerUsername.Provider,Properties.ServerUsername.Parameters.<ParameterName>
121121
Properties.ServerPassword.Provider,Properties.ServerPassword.Parameters.<ParameterName>
122122
```
123123

124+
Use the PAM parameter names in the table below, or check the provider type in Command if your environment uses custom PAM types.
125+
126+
| PAM type | Provider-level parameters | Store CSV instance parameters |
127+
| --- | --- | --- |
128+
| `1Password-CLI` | Vault, Token | Item, Field |
129+
| `Azure-KeyVault` | KeyVaultUri, AuthorityHost | SecretId |
130+
| `Azure-KeyVault-ServicePrincipal` | KeyVaultUri, AuthorityHost, TenantId, ClientId, ClientSecret | SecretId |
131+
| `BeyondTrust-PasswordSafe` | Host, APIKey, Username, ClientCertificate | SystemId, AccountId |
132+
| `CyberArk-CentralCredentialProvider` | AppId, Host, Site | Safe, Folder, Object |
133+
| `CyberArk-SdkCredentialProvider` | AppId | Safe, Folder, Object |
134+
| `Delinea-SecretServer` | Host, Username, Password, ClientId, ClientSecret, GrantType | SecretId, SecretFieldName |
135+
| `GCP-SecretManager` | projectId | secretId |
136+
| `Hashicorp-Vault` | Host, Token, Path | Secret, Key |
137+
124138
## References
125139

126140
- [Bulk Certificate Store Creation](../bulk-certificate-store-creation.md)

‎docs/use-cases/Certificate Store Operations/Store Types/axisipcamera.md‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,13 +104,27 @@ Properties.ServerUsername
104104
Properties.ServerPassword
105105
```
106106

107-
PAM-backed property secrets use provider and parameter columns:
107+
PAM-backed property secrets use a provider column and provider-type-specific parameter columns. `Provider` identifies the configured PAM provider. `Parameters.*` must match the instance-level parameters for that provider type.
108108

109109
```csv
110110
Properties.ServerUsername.Provider,Properties.ServerUsername.Parameters.<ParameterName>
111111
Properties.ServerPassword.Provider,Properties.ServerPassword.Parameters.<ParameterName>
112112
```
113113

114+
Use the PAM parameter names in the table below, or check the provider type in Command if your environment uses custom PAM types.
115+
116+
| PAM type | Provider-level parameters | Store CSV instance parameters |
117+
| --- | --- | --- |
118+
| `1Password-CLI` | Vault, Token | Item, Field |
119+
| `Azure-KeyVault` | KeyVaultUri, AuthorityHost | SecretId |
120+
| `Azure-KeyVault-ServicePrincipal` | KeyVaultUri, AuthorityHost, TenantId, ClientId, ClientSecret | SecretId |
121+
| `BeyondTrust-PasswordSafe` | Host, APIKey, Username, ClientCertificate | SystemId, AccountId |
122+
| `CyberArk-CentralCredentialProvider` | AppId, Host, Site | Safe, Folder, Object |
123+
| `CyberArk-SdkCredentialProvider` | AppId | Safe, Folder, Object |
124+
| `Delinea-SecretServer` | Host, Username, Password, ClientId, ClientSecret, GrantType | SecretId, SecretFieldName |
125+
| `GCP-SecretManager` | projectId | secretId |
126+
| `Hashicorp-Vault` | Host, Token, Path | Secret, Key |
127+
114128
## References
115129

116130
- [Bulk Certificate Store Creation](../bulk-certificate-store-creation.md)

‎docs/use-cases/Certificate Store Operations/Store Types/azureapp.md‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,14 +99,28 @@ Properties.ServerPassword
9999
Properties.ClientCertificate
100100
```
101101

102-
PAM-backed property secrets use provider and parameter columns:
102+
PAM-backed property secrets use a provider column and provider-type-specific parameter columns. `Provider` identifies the configured PAM provider. `Parameters.*` must match the instance-level parameters for that provider type.
103103

104104
```csv
105105
Properties.ServerUsername.Provider,Properties.ServerUsername.Parameters.<ParameterName>
106106
Properties.ServerPassword.Provider,Properties.ServerPassword.Parameters.<ParameterName>
107107
Properties.ClientCertificate.Provider,Properties.ClientCertificate.Parameters.<ParameterName>
108108
```
109109

110+
Use the PAM parameter names in the table below, or check the provider type in Command if your environment uses custom PAM types.
111+
112+
| PAM type | Provider-level parameters | Store CSV instance parameters |
113+
| --- | --- | --- |
114+
| `1Password-CLI` | Vault, Token | Item, Field |
115+
| `Azure-KeyVault` | KeyVaultUri, AuthorityHost | SecretId |
116+
| `Azure-KeyVault-ServicePrincipal` | KeyVaultUri, AuthorityHost, TenantId, ClientId, ClientSecret | SecretId |
117+
| `BeyondTrust-PasswordSafe` | Host, APIKey, Username, ClientCertificate | SystemId, AccountId |
118+
| `CyberArk-CentralCredentialProvider` | AppId, Host, Site | Safe, Folder, Object |
119+
| `CyberArk-SdkCredentialProvider` | AppId | Safe, Folder, Object |
120+
| `Delinea-SecretServer` | Host, Username, Password, ClientId, ClientSecret, GrantType | SecretId, SecretFieldName |
121+
| `GCP-SecretManager` | projectId | secretId |
122+
| `Hashicorp-Vault` | Host, Token, Path | Secret, Key |
123+
110124
## References
111125

112126
- [Bulk Certificate Store Creation](../bulk-certificate-store-creation.md)

‎docs/use-cases/Certificate Store Operations/Store Types/azureapp2.md‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ Properties.ClientCertificate
100100
Properties.ClientCertificatePassword
101101
```
102102

103-
PAM-backed property secrets use provider and parameter columns:
103+
PAM-backed property secrets use a provider column and provider-type-specific parameter columns. `Provider` identifies the configured PAM provider. `Parameters.*` must match the instance-level parameters for that provider type.
104104

105105
```csv
106106
Properties.ServerUsername.Provider,Properties.ServerUsername.Parameters.<ParameterName>
@@ -109,6 +109,20 @@ Properties.ClientCertificate.Provider,Properties.ClientCertificate.Parameters.<P
109109
Properties.ClientCertificatePassword.Provider,Properties.ClientCertificatePassword.Parameters.<ParameterName>
110110
```
111111

112+
Use the PAM parameter names in the table below, or check the provider type in Command if your environment uses custom PAM types.
113+
114+
| PAM type | Provider-level parameters | Store CSV instance parameters |
115+
| --- | --- | --- |
116+
| `1Password-CLI` | Vault, Token | Item, Field |
117+
| `Azure-KeyVault` | KeyVaultUri, AuthorityHost | SecretId |
118+
| `Azure-KeyVault-ServicePrincipal` | KeyVaultUri, AuthorityHost, TenantId, ClientId, ClientSecret | SecretId |
119+
| `BeyondTrust-PasswordSafe` | Host, APIKey, Username, ClientCertificate | SystemId, AccountId |
120+
| `CyberArk-CentralCredentialProvider` | AppId, Host, Site | Safe, Folder, Object |
121+
| `CyberArk-SdkCredentialProvider` | AppId | Safe, Folder, Object |
122+
| `Delinea-SecretServer` | Host, Username, Password, ClientId, ClientSecret, GrantType | SecretId, SecretFieldName |
123+
| `GCP-SecretManager` | projectId | secretId |
124+
| `Hashicorp-Vault` | Host, Token, Path | Secret, Key |
125+
112126
## References
113127

114128
- [Bulk Certificate Store Creation](../bulk-certificate-store-creation.md)

‎docs/use-cases/Certificate Store Operations/Store Types/azureappgw.md‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,14 +99,28 @@ Properties.ServerPassword
9999
Properties.ClientCertificate
100100
```
101101

102-
PAM-backed property secrets use provider and parameter columns:
102+
PAM-backed property secrets use a provider column and provider-type-specific parameter columns. `Provider` identifies the configured PAM provider. `Parameters.*` must match the instance-level parameters for that provider type.
103103

104104
```csv
105105
Properties.ServerUsername.Provider,Properties.ServerUsername.Parameters.<ParameterName>
106106
Properties.ServerPassword.Provider,Properties.ServerPassword.Parameters.<ParameterName>
107107
Properties.ClientCertificate.Provider,Properties.ClientCertificate.Parameters.<ParameterName>
108108
```
109109

110+
Use the PAM parameter names in the table below, or check the provider type in Command if your environment uses custom PAM types.
111+
112+
| PAM type | Provider-level parameters | Store CSV instance parameters |
113+
| --- | --- | --- |
114+
| `1Password-CLI` | Vault, Token | Item, Field |
115+
| `Azure-KeyVault` | KeyVaultUri, AuthorityHost | SecretId |
116+
| `Azure-KeyVault-ServicePrincipal` | KeyVaultUri, AuthorityHost, TenantId, ClientId, ClientSecret | SecretId |
117+
| `BeyondTrust-PasswordSafe` | Host, APIKey, Username, ClientCertificate | SystemId, AccountId |
118+
| `CyberArk-CentralCredentialProvider` | AppId, Host, Site | Safe, Folder, Object |
119+
| `CyberArk-SdkCredentialProvider` | AppId | Safe, Folder, Object |
120+
| `Delinea-SecretServer` | Host, Username, Password, ClientId, ClientSecret, GrantType | SecretId, SecretFieldName |
121+
| `GCP-SecretManager` | projectId | secretId |
122+
| `Hashicorp-Vault` | Host, Token, Path | Secret, Key |
123+
110124
## References
111125

112126
- [Bulk Certificate Store Creation](../bulk-certificate-store-creation.md)

0 commit comments

Comments
 (0)