Skip to content

Commit

Permalink
Update generated docs
Browse files Browse the repository at this point in the history
  • Loading branch information
Keyfactor committed Jan 9, 2025
1 parent 700f1b1 commit 4c2c62d
Showing 1 changed file with 88 additions and 23 deletions.
111 changes: 88 additions & 23 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -37,12 +37,6 @@ The Palo Alto Orchestrator Extension is an integration that can replace and inve



### PaloAlto
TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info


TODO Overview is a required section

## Compatibility

This integration is compatible with Keyfactor Universal Orchestrator version 10.4 and later.
Expand All @@ -59,22 +53,12 @@ Before installing the Palo Alto Universal Orchestrator extension, we recommend t



### PaloAlto Requirements
TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info


TODO Requirements is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info




## Create the PaloAlto Certificate Store Type

To use the Palo Alto Universal Orchestrator extension, you **must** create the PaloAlto Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance.


TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info


* **Create PaloAlto using kfutil**:

Expand Down Expand Up @@ -188,22 +172,103 @@ TODO Global Store Type Section is an optional section. If this section doesn't s
## Defining Certificate Stores
TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
TODO Certificate Store Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
* **Manually with the Command UI**
<details><summary>Create Certificate Stores manually in the UI</summary>
1. **Navigate to the _Certificate Stores_ page in Keyfactor Command.**
> The content in this section can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store).
Log into Keyfactor Command, toggle the _Locations_ dropdown, and click _Certificate Stores_.
2. **Add a Certificate Store.**
Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form.
| Attribute | Description |
| --------- | ----------- |
| Category | Select "PaloAlto" or the customized certificate store name from the previous step. |
| Container | Optional container to associate certificate store with. |
| Client Machine | Either the Panorama or Palo Alto Firewall URI or IP address. |
| Store Path | The Store Path field should be reviewed in the store path explanation section. It varies depending on configuration. |
| Orchestrator | Select an approved orchestrator capable of managing `PaloAlto` certificates. Specifically, one with the `PaloAlto` capability. |
| ServerUsername | Palo Alto or Panorama Api User. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
| ServerPassword | Palo Alto or Panorama Api Password. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
| ServerUseSsl | Should be true, http is not supported. |
| DeviceGroup | Device Group on Panorama that changes will be pushed to. |
| InventoryTrustedCerts | If false, will not inventory default trusted certs, saves time. |
| TemplateStack | Template stack used for device push of certificates via Template. |
## Discovering Certificate Stores with the Discovery Job
<details><summary>Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator</summary>
### PaloAlto Discovery Job
TODO Global Store Type Section is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_.
| Attribute | Description |
| --------- | ----------- |
| ServerUsername | Palo Alto or Panorama Api User. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
| ServerPassword | Palo Alto or Panorama Api Password. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
Please refer to the **Universal Orchestrator (remote)** usage section ([PAM providers on the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam)) for your selected PAM provider for instructions on how to load attributes orchestrator-side.
> Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself.
</details>
</details>
* **Using kfutil**
<details><summary>Create Certificate Stores with kfutil</summary>
1. **Generate a CSV template for the PaloAlto certificate store**
```shell
kfutil stores import generate-template --store-type-name PaloAlto --outpath PaloAlto.csv
```
2. **Populate the generated CSV file**
Open the CSV file, and reference the table below to populate parameters for each **Attribute**.
| Attribute | Description |
| --------- | ----------- |
| Category | Select "PaloAlto" or the customized certificate store name from the previous step. |
| Container | Optional container to associate certificate store with. |
| Client Machine | Either the Panorama or Palo Alto Firewall URI or IP address. |
| Store Path | The Store Path field should be reviewed in the store path explanation section. It varies depending on configuration. |
| Orchestrator | Select an approved orchestrator capable of managing `PaloAlto` certificates. Specifically, one with the `PaloAlto` capability. |
| ServerUsername | Palo Alto or Panorama Api User. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
| ServerPassword | Palo Alto or Panorama Api Password. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
| ServerUseSsl | Should be true, http is not supported. |
| DeviceGroup | Device Group on Panorama that changes will be pushed to. |
| InventoryTrustedCerts | If false, will not inventory default trusted certs, saves time. |
| TemplateStack | Template stack used for device push of certificates via Template. |
<details><summary>Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator</summary>
If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_.
| Attribute | Description |
| --------- | ----------- |
| ServerUsername | Palo Alto or Panorama Api User. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
| ServerPassword | Palo Alto or Panorama Api Password. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
> Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself.
</details>
3. **Import the CSV file to create the certificate stores**
```shell
kfutil stores import csv --store-type-name PaloAlto --file PaloAlto.csv
```
</details>
> The content in this section can be supplimented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store).
TODO Discovery Job Configuration is an optional section. If this section doesn't seem necessary on initial glance, please delete it. Refer to the docs on [Confluence](https://keyfactor.atlassian.net/wiki/x/SAAyHg) for more info
Expand Down

0 comments on commit 4c2c62d

Please sign in to comment.