diff --git a/cmd/store_types.json b/cmd/store_types.json index 42ae661..9ad3bb8 100644 --- a/cmd/store_types.json +++ b/cmd/store_types.json @@ -43,6 +43,19 @@ "OnRemove": false, "OnReenrollment": false } + }, + { + "Name": "PreserveChainOrder", + "DisplayName": "Preserve Chain Order", + "Description": "By default, Azure Key Vault reorders the certificate chain on import (forcing the leaf certificate to index 0). If true, this tells Azure Key Vault to preserve the exact chain order provided instead of applying its own default reordering.", + "Type": "Bool", + "DefaultValue": "False", + "RequiredWhen": { + "HasPrivateKey": false, + "OnAdd": false, + "OnRemove": false, + "OnReenrollment": false + } } ], "JobProperties": [], @@ -286,7 +299,7 @@ "SupportedOperations": { "Add": true, "Create": false, - "Discovery": false, + "Discovery": true, "Enrollment": false, "Remove": true }, @@ -410,6 +423,16 @@ "Required": false, "IsPAMEligible": false, "Description": "An optional parameter sts:ExternalId to pass with Assume Role calls" + }, + { + "Name": "DiscoveryRoleName", + "DisplayName": "Discovery Role Name", + "Type": "String", + "DependsOn": "", + "DefaultValue": "KeyfactorACMDiscoveryRole", + "Required": false, + "IsPAMEligible": false, + "Description": "The IAM role name that exists in each target account. Used during cross-account Discovery to construct the Role ARN for cross-account access (arn:aws:iam:::role/). During a Discovery job this is supplied via the 'File name patterns to match' dialog field; this store property documents and defaults the value." } ], "EntryParameters": [ @@ -437,7 +460,7 @@ "BlueprintAllowed": true, "CustomAliasAllowed": "Optional", "ClientMachineDescription": "This is a full AWS ARN specifying a Role. This is the Role that will be assumed in any Auth scenario performing Assume Role. This will dictate what certificates are usable by the orchestrator. A preceding [profile] name should be included if a Credential Profile is to be used in Default Sdk Auth.", - "StorePathDescription": "A single specified AWS Region the store will operate in. Additional regions should get their own store defined." + "StorePathDescription": "The AWS Region the store operates in (e.g. us-east-1). Stores created by cross-account Discovery instead use a self-contained path of the form '|' (e.g. 'arn:aws:iam::123456789012:role/KeyfactorACMDiscoveryRole|us-east-1') which carries both the Role ARN to assume and the Region; for those stores the Client Machine field is informational only. Additional regions should get their own store defined." }, { "Name": "AwsSecretsManager JKS", @@ -639,6 +662,16 @@ "IsPAMEligible": false, "Description": "When enabled, the certificate is stored as a JSON document with separate 'certificate' (PEM certificate and chain, leaf first) and 'private_key' (PEM) properties, rather than a single concatenated PEM string." }, + { + "Name": "IncludeChain", + "DisplayName": "Include certificate chain in PEM", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "IsPAMEligible": false, + "Description": "When enabled, the single concatenated PEM secret contains the leaf certificate, followed by the issuer chain (leaf first), followed by the private key. Only applies when 'Store as JSON with separate private key' is disabled; the JSON format always includes the chain." + }, { "Name": "UseDefaultSdkAuth", "DisplayName": "Use Default SDK Auth", @@ -1050,6 +1083,16 @@ "Required": true, "IsPAMEligible": false, "Description": "The Akamai client_secret for authentication." + }, + { + "Name": "ContractId", + "DisplayName": "Contract ID", + "Type": "String", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": false, + "Description": "The default Akamai Contract ID for the certificate store. When performing re-enrollment, the Contract ID entry parameter will take precedence." } ], "EntryParameters": [ @@ -1067,16 +1110,15 @@ }, { "Name": "ContractId", - "DisplayName": "Contract ID", + "DisplayName": "Contract ID Override", "Type": "String", "RequiredWhen": { "HasPrivateKey": false, "OnAdd": false, "OnRemove": false, - "OnReenrollment": true + "OnReenrollment": false }, - "DefaultValue": "SET-DEFAULT", - "Description": "The Contract ID of your account in Akamai." + "Description": "The Contract ID of your account in Akamai. If a Contract ID is defined on the certificate store, the value of this parameter will take precedence. If a Contract ID is not defined on the certificate store, a value is required for this parameter." }, { "Name": "Sans", @@ -1744,7 +1786,6 @@ "PrivateKeyAllowed": "Forbidden", "SupportedOperations": { "Add": true, - "Create": false, "Discovery": false, "Enrollment": true, "Remove": true @@ -2525,7 +2566,7 @@ "Add": true, "Create": false, "Discovery": false, - "Enrollment": false, + "Enrollment": true, "Remove": true }, "PasswordOptions": { @@ -2565,7 +2606,7 @@ "DependsOn": "", "DefaultValue": "false", "Required": false, - "Description": "Determines whether an attempt will be made to link the added certificate (via a Management-Add job) to its issuing CA certificate." + "Description": "Determines whether an attempt will be made to link the added certificate (via a Management-Add or Reenrollment job) to its issuing CA certificate." }, { "Name": "timeout", @@ -2575,6 +2616,15 @@ "DefaultValue": "3600", "Required": false, "Description": "Determines timeout in seconds for all Citrix ADC API calls." + }, + { + "Name": "removeOldFiles", + "DisplayName": "Remove Old Files", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "Description": "Delete previous certificate and key files after renewal/replace" } ], "EntryParameters": [ @@ -2582,7 +2632,7 @@ "Name": "virtualServerName", "DisplayName": "Virtual Server Name", "Type": "String", - "Description": "When adding a certificate, this can be a single VServer name or a comma separated list of VServers to bind to Note: must match the number of Virtual SNI Cert values.", + "Description": "When adding a certificate or reenrolling a new alias, this can be a single VServer name or a comma separated list of VServers to bind to Note: must match the number of Virtual SNI Cert values.", "RequiredWhen": { "HasPrivateKey": false, "OnAdd": false, @@ -2594,7 +2644,7 @@ "Name": "sniCert", "DisplayName": "SNI Cert", "Type": "String", - "Description": "When adding a certificate, this can be a single boolean value (true/false) or a comma separated list of boolean values to determine whether the binding should use server name indication. Note: must match the number of Virtual Server Name values.", + "Description": "When adding a certificate or reenrolling a new alias, this can be a single boolean value (true/false) or a comma separated list of boolean values to determine whether the binding should use server name indication. Note: must match the number of Virtual Server Name values.", "RequiredWhen": { "HasPrivateKey": false, "OnAdd": false, @@ -2743,6 +2793,8 @@ "PowerShell": false, "BlueprintAllowed": true, "CustomAliasAllowed": "Required", + "ClientMachineDescription": "The URL of the F5 device being managed. Example - https://my.f5.com.", + "StorePathDescription": "Enter the partition for the F5 device being managed (usually Common)", "SupportedOperations": { "Add": true, "Create": false, @@ -3645,7 +3697,17 @@ "StorePathType": "", "StorePathValue": "example: '/mycerts/certstore.jks?b64cert'", "PrivateKeyAllowed": "Optional", - "JobProperties": [], + "JobProperties": [ + { + "Name": "DiscoverySuffix", + "DisplayName": "Discovery Suffix", + "Type": "String", + "DependsOn": "", + "DefaultValue": "_jks", + "Required": false, + "Description": "The secret-key-name suffix Discovery jobs use to identify candidate JKS certificate secrets. Defaults to '_jks'." + } + ], "ServerRequired": true, "PowerShell": false, "BlueprintAllowed": false, @@ -3663,7 +3725,7 @@ "DisplayName": "Server Username", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", + "DefaultValue": "", "Required": true, "IsPAMEligible": true, "Description": "The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200" @@ -3673,10 +3735,75 @@ "DisplayName": "Server Password", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", - "Required": true, + "DefaultValue": "", + "Required": false, "IsPAMEligible": true, - "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance" + "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "UseOAuth", + "DisplayName": "Use OAuth 2.0 (Client Credentials)", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "Description": "Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token." + }, + { + "Name": "ClientId", + "DisplayName": "Client ID", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "ClientSecret", + "DisplayName": "Client Secret", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "OAuthUrl", + "DisplayName": "OAuth Token Endpoint", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "Scope", + "DisplayName": "OAuth Scope", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "VaultRoleName", + "DisplayName": "Vault Role Name", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "AuthMountPoint", + "DisplayName": "JWT Auth Mount Point", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "jwt/", + "Required": false, + "Description": "The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." }, { "Name": "IncludeCertChain", @@ -3727,7 +3854,17 @@ "StorePathType": "", "StorePathValue": "example: '/mycerts/certstore.p12?b64cert'", "PrivateKeyAllowed": "Optional", - "JobProperties": [], + "JobProperties": [ + { + "Name": "DiscoverySuffix", + "DisplayName": "Discovery Suffix", + "Type": "String", + "DependsOn": "", + "DefaultValue": "_p12", + "Required": false, + "Description": "The secret-key-name suffix Discovery jobs use to identify candidate PKCS12 certificate secrets. Defaults to '_p12'." + } + ], "ServerRequired": true, "PowerShell": false, "BlueprintAllowed": false, @@ -3745,7 +3882,7 @@ "DisplayName": "Server Username", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", + "DefaultValue": "", "Required": true, "IsPAMEligible": true, "Description": "The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200" @@ -3755,10 +3892,75 @@ "DisplayName": "Server Password", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", - "Required": true, + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "UseOAuth", + "DisplayName": "Use OAuth 2.0 (Client Credentials)", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "Description": "Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token." + }, + { + "Name": "ClientId", + "DisplayName": "Client ID", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "ClientSecret", + "DisplayName": "Client Secret", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, "IsPAMEligible": true, - "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance" + "Description": "The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "OAuthUrl", + "DisplayName": "OAuth Token Endpoint", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "Scope", + "DisplayName": "OAuth Scope", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "VaultRoleName", + "DisplayName": "Vault Role Name", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "AuthMountPoint", + "DisplayName": "JWT Auth Mount Point", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "jwt/", + "Required": false, + "Description": "The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." }, { "Name": "IncludeCertChain", @@ -3805,9 +4007,21 @@ "Capability": "HCVKVPEM", "LocalStore": false, "ClientMachineDescription": "This can be any value to help uniquely identify the store. It is not used by this integration.", - "StorePathDescription": "This is the path after mount point where the certificates will be stored.", + "StorePathDescription": "This is the path to the secret containing the certificate.", + "StorePathType": "", + "StorePathValue": "example: '/mycerts/mycert_pem?b64cert'", "PrivateKeyAllowed": "Optional", - "JobProperties": [], + "JobProperties": [ + { + "Name": "DiscoverySuffix", + "DisplayName": "Discovery Suffix", + "Type": "String", + "DependsOn": "", + "DefaultValue": "_pem", + "Required": false, + "Description": "The secret-key-name suffix Discovery jobs use to identify candidate PEM certificate secrets. Defaults to '_pem'." + } + ], "ServerRequired": true, "PowerShell": false, "BlueprintAllowed": false, @@ -3825,7 +4039,7 @@ "DisplayName": "Server Username", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", + "DefaultValue": "", "Required": true, "IsPAMEligible": true, "Description": "The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200" @@ -3835,19 +4049,75 @@ "DisplayName": "Server Password", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", - "Required": true, + "DefaultValue": "", + "Required": false, "IsPAMEligible": true, - "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance" + "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled." }, { - "Name": "SubfolderInventory", - "DisplayName": "Subfolder Inventory", - "Description": "Should certificates found in sub-paths be included when performing an inventory?", + "Name": "UseOAuth", + "DisplayName": "Use OAuth 2.0 (Client Credentials)", "Type": "Bool", "DependsOn": "", "DefaultValue": "false", - "Required": false + "Required": false, + "Description": "Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token." + }, + { + "Name": "ClientId", + "DisplayName": "Client ID", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "ClientSecret", + "DisplayName": "Client Secret", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "OAuthUrl", + "DisplayName": "OAuth Token Endpoint", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "Scope", + "DisplayName": "OAuth Scope", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "VaultRoleName", + "DisplayName": "Vault Role Name", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "AuthMountPoint", + "DisplayName": "JWT Auth Mount Point", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "jwt/", + "Required": false, + "Description": "The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." }, { "Name": "IncludeCertChain", @@ -3866,6 +4136,15 @@ "DependsOn": "", "DefaultValue": "", "Required": false + }, + { + "Name": "PrivateKeyPath", + "DisplayName": "Private Key Path", + "Type": "String", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "Description": "This is the path to the secret that contains the PEM-encoded private key. Optional \u2014 omit for CA trust chain / certificate-only PEM stores that have no private key. Unlike other Key-Value store types, no sibling-secret convention is assumed when this is omitted." } ], "EntryParameters": [], @@ -3889,7 +4168,17 @@ "StorePathType": "", "StorePathValue": "example: '/mycerts/certstore.pfx?b64cert'", "PrivateKeyAllowed": "Optional", - "JobProperties": [], + "JobProperties": [ + { + "Name": "DiscoverySuffix", + "DisplayName": "Discovery Suffix", + "Type": "String", + "DependsOn": "", + "DefaultValue": "_pfx", + "Required": false, + "Description": "The secret-key-name suffix Discovery jobs use to identify candidate PFX certificate secrets. Defaults to '_pfx'." + } + ], "ServerRequired": true, "PowerShell": false, "BlueprintAllowed": false, @@ -3907,7 +4196,7 @@ "DisplayName": "Server Username", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", + "DefaultValue": "", "Required": true, "IsPAMEligible": true, "Description": "The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200" @@ -3917,10 +4206,75 @@ "DisplayName": "Server Password", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", - "Required": true, + "DefaultValue": "", + "Required": false, "IsPAMEligible": true, - "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance" + "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "UseOAuth", + "DisplayName": "Use OAuth 2.0 (Client Credentials)", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "Description": "Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token." + }, + { + "Name": "ClientId", + "DisplayName": "Client ID", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "ClientSecret", + "DisplayName": "Client Secret", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "OAuthUrl", + "DisplayName": "OAuth Token Endpoint", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "Scope", + "DisplayName": "OAuth Scope", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "VaultRoleName", + "DisplayName": "Vault Role Name", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "AuthMountPoint", + "DisplayName": "JWT Auth Mount Point", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "jwt/", + "Required": false, + "Description": "The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." }, { "Name": "IncludeCertChain", @@ -3989,7 +4343,7 @@ "DisplayName": "Server Username", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", + "DefaultValue": "", "Required": true, "IsPAMEligible": true, "Description": "The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200" @@ -3999,10 +4353,75 @@ "DisplayName": "Server Password", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", - "Required": true, + "DefaultValue": "", + "Required": false, "IsPAMEligible": true, - "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance" + "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "UseOAuth", + "DisplayName": "Use OAuth 2.0 (Client Credentials)", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "Description": "Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token." + }, + { + "Name": "ClientId", + "DisplayName": "Client ID", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "ClientSecret", + "DisplayName": "Client Secret", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "OAuthUrl", + "DisplayName": "OAuth Token Endpoint", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "Scope", + "DisplayName": "OAuth Scope", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "VaultRoleName", + "DisplayName": "Vault Role Name", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "AuthMountPoint", + "DisplayName": "JWT Auth Mount Point", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "jwt/", + "Required": false, + "Description": "The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." }, { "Name": "MountPoint", @@ -4170,6 +4589,15 @@ "DefaultValue": "true", "Required": true, "Description": "Determine whether the server uses SSL or not (This field is automatically created)" + }, + { + "Name": "JEAEndpointName", + "DisplayName": "JEA End Point Name", + "Type": "String", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "Description": "Name of the JEA endpoint to use for the session (This field is automatically created)" } ], "EntryParameters": [ @@ -5279,7 +5707,17 @@ "DefaultValue": "", "Required": false, "IsPAMEligible": false, - "Description": "Template stack used for device push of certificates via Template." + "Description": "A semicolon delimited list of Template Stacks used for device push of certificates via Template (i.e. `Stack 1`, `Stack 1;Stack2`, or `Stack 1; Stack 2`, etc.)." + }, + { + "Name": "PushFailureBehavior", + "DisplayName": "Push Failure Behavior", + "Type": "MultipleChoice", + "DependsOn": "", + "DefaultValue": "Failure,Warning", + "Required": false, + "IsPAMEligible": false, + "Description": "Controls the job result when Panorama fails to commit to a device group, template, or template stack. 'Failure' will fail the management job and trigger a retry, while 'Warning' records the failure message but marks the job as completed." } ], "EntryParameters": [], @@ -5477,13 +5915,13 @@ "Description": "The LinuxFileOwnerOnStoreCreation field should contain a valid user ID recognized by the destination Linux server, optionally followed by a colon and a group ID if the group owner differs. Example: 'userID' or 'userID:groupID'. Overrides DefaultOwnerOnStoreCreation [config.json](#post-installation) setting." }, { - "Name": "SudoImpersonatingUser", + "Name": "SudoImpersonatedUser", "DisplayName": "Sudo Impersonating User", "Required": false, "DependsOn": "", "Type": "String", "DefaultValue": "", - "Description": "The SudoImpersonatingUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides [config.json](#post-installation) DefaultSudoImpersonatedUser setting." + "Description": "The SudoImpersonatedUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides [config.json](#post-installation) DefaultSudoImpersonatedUser setting." }, { "Name": "SeparatePrivateKeyFilePath", @@ -5512,6 +5950,15 @@ "DefaultValue": "False", "Description": "Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations." }, + { + "Name": "FileTransferProtocol", + "DisplayName": "File Transfer Protocol to Use", + "Required": false, + "DependsOn": "", + "Type": "MultipleChoice", + "DefaultValue": "SCP,SFTP,Both", + "Description": "Which protocol should be used when uploading/downloading files - SCP, SFTP, or Both (try one, and then if necessary, the other). Overrides FileTransferProtocol [config.json](#post-installation) setting." + }, { "Name": "SSHPort", "DisplayName": "SSH Port", @@ -5538,15 +5985,6 @@ "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFDER." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -5618,13 +6056,13 @@ "Description": "The LinuxFileOwnerOnStoreCreation field should contain a valid user ID recognized by the destination Linux server, optionally followed by a colon and a group ID if the group owner differs. Example: 'userID' or 'userID:groupID'. Overrides DefaultOwnerOnStoreCreation [config.json](#post-installation) setting." }, { - "Name": "SudoImpersonatingUser", + "Name": "SudoImpersonatedUser", "DisplayName": "Sudo Impersonating User", "Required": false, "DependsOn": "", "Type": "String", "DefaultValue": "", - "Description": "The SudoImpersonatingUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides DefaultSudoImpersonatedUser [config.json](#post-installation) setting." + "Description": "The SudoImpersonatedUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides DefaultSudoImpersonatedUser [config.json](#post-installation) setting." }, { "Name": "RemoveRootCertificate", @@ -5644,6 +6082,15 @@ "DefaultValue": "False", "Description": "Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations." }, + { + "Name": "FileTransferProtocol", + "DisplayName": "File Transfer Protocol to Use", + "Required": false, + "DependsOn": "", + "Type": "MultipleChoice", + "DefaultValue": "SCP,SFTP,Both", + "Description": "Which protocol should be used when uploading/downloading files - SCP, SFTP, or Both (try one, and then if necessary, the other). Overrides FileTransferProtocol [config.json](#post-installation) setting." + }, { "Name": "SSHPort", "DisplayName": "SSH Port", @@ -5670,15 +6117,6 @@ "Type": "MultipleChoice", "DefaultValue": "Apache Tomcat Restart,Jetty Restart", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -5731,6 +6169,16 @@ "IsPAMEligible": true, "Description": "A password (or valid PAM key if the password is stored in a KF Command configured PAM integration). The password can also be an SSH private key if connecting via SSH to a server using SSH private key authentication. If acting as an *agent* using local file access, just check *No Value*" }, + { + "Name": "CommandPath", + "DisplayName": "GSKCAPICMD installation folder path", + "Type": "String", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": false, + "Description": "The full folder path (not including the file name itself) where the GSKCAPCMD CLI located is installed." + }, { "Name": "LinuxFilePermissionsOnStoreCreation", "DisplayName": "Linux File Permissions on Store Creation", @@ -5750,13 +6198,13 @@ "Description": "The LinuxFileOwnerOnStoreCreation field should contain a valid user ID recognized by the destination Linux server, optionally followed by a colon and a group ID if the group owner differs. Example: 'userID' or 'userID:groupID'. Overrides DefaultOwnerOnStoreCreation [config.json](#post-installation) setting." }, { - "Name": "SudoImpersonatingUser", + "Name": "SudoImpersonatedUser", "DisplayName": "Sudo Impersonating User", "Required": false, "DependsOn": "", "Type": "String", "DefaultValue": "", - "Description": "The SudoImpersonatingUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides [config.json](#post-installation) DefaultSudoImpersonatedUser setting." + "Description": "The SudoImpersonatedUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides [config.json](#post-installation) DefaultSudoImpersonatedUser setting." }, { "Name": "RemoveRootCertificate", @@ -5776,6 +6224,15 @@ "DefaultValue": "False", "Description": "Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations." }, + { + "Name": "FileTransferProtocol", + "DisplayName": "File Transfer Protocol to Use", + "Required": false, + "DependsOn": "", + "Type": "MultipleChoice", + "DefaultValue": "SCP,SFTP,Both", + "Description": "Which protocol should be used when uploading/downloading files - SCP, SFTP, or Both (try one, and then if necessary, the other). Overrides FileTransferProtocol [config.json](#post-installation) setting." + }, { "Name": "SSHPort", "DisplayName": "SSH Port", @@ -5802,15 +6259,6 @@ "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFKDB." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -5882,13 +6330,13 @@ "Description": "The LinuxFileOwnerOnStoreCreation field should contain a valid user ID recognized by the destination Linux server, optionally followed by a colon and a group ID if the group owner differs. Example: 'userID' or 'userID:groupID'. Overrides DefaultOwnerOnStoreCreation [config.json](#post-installation) setting." }, { - "Name": "SudoImpersonatingUser", + "Name": "SudoImpersonatedUser", "DisplayName": "Sudo Impersonating User", "Required": false, "DependsOn": "", "Type": "String", "DefaultValue": "", - "Description": "The SudoImpersonatingUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides [config.json](#post-installation) DefaultSudoImpersonatedUser setting." + "Description": "The SudoImpersonatedUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides [config.json](#post-installation) DefaultSudoImpersonatedUser setting." }, { "Name": "RemoveRootCertificate", @@ -5908,6 +6356,15 @@ "DefaultValue": "False", "Description": "Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations." }, + { + "Name": "FileTransferProtocol", + "DisplayName": "File Transfer Protocol to Use", + "Required": false, + "DependsOn": "", + "Type": "MultipleChoice", + "DefaultValue": "SCP,SFTP,Both", + "Description": "Which protocol should be used when uploading/downloading files - SCP, SFTP, or Both (try one, and then if necessary, the other). Overrides FileTransferProtocol [config.json](#post-installation) setting." + }, { "Name": "SSHPort", "DisplayName": "SSH Port", @@ -5934,15 +6391,6 @@ "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFORA." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -6014,13 +6462,13 @@ "Description": "The LinuxFileOwnerOnStoreCreation field should contain a valid user ID recognized by the destination Linux server, optionally followed by a colon and a group ID if the group owner differs. Example: 'userID' or 'userID:groupID'. Overrides DefaultOwnerOnStoreCreation [config.json](#post-installation) setting." }, { - "Name": "SudoImpersonatingUser", + "Name": "SudoImpersonatedUser", "DisplayName": "Sudo Impersonating User", "Required": false, "DependsOn": "", "Type": "String", "DefaultValue": "", - "Description": "The SudoImpersonatingUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides [config.json](#post-installation) DefaultSudoImpersonatedUser setting.." + "Description": "The SudoImpersonatedUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides [config.json](#post-installation) DefaultSudoImpersonatedUser setting.." }, { "Name": "IsTrustStore", @@ -6076,6 +6524,15 @@ "DefaultValue": "False", "Description": "Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations." }, + { + "Name": "FileTransferProtocol", + "DisplayName": "File Transfer Protocol to Use", + "Required": false, + "DependsOn": "", + "Type": "MultipleChoice", + "DefaultValue": "SCP,SFTP,Both", + "Description": "Which protocol should be used when uploading/downloading files - SCP, SFTP, or Both (try one, and then if necessary, the other). Overrides FileTransferProtocol [config.json](#post-installation) setting." + }, { "Name": "SSHPort", "DisplayName": "SSH Port", @@ -6102,15 +6559,6 @@ "Type": "MultipleChoice", "DefaultValue": "Apache HTTPD Restart,NGNIX Restart,HAProxy Restart,Envoy Proxy Restart", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -6182,13 +6630,13 @@ "Description": "The LinuxFileOwnerOnStoreCreation field should contain a valid user ID recognized by the destination Linux server, optionally followed by a colon and a group ID if the group owner differs. Example: 'userID' or 'userID:groupID'. Overrides DefaultOwnerOnStoreCreation [config.json](#post-installation) setting." }, { - "Name": "SudoImpersonatingUser", + "Name": "SudoImpersonatedUser", "DisplayName": "Sudo Impersonating User", "Required": false, "DependsOn": "", "Type": "String", "DefaultValue": "", - "Description": "The SudoImpersonatingUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides DefaultSudoImpersonatedUser [config.json](#post-installation) setting." + "Description": "The SudoImpersonatedUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides DefaultSudoImpersonatedUser [config.json](#post-installation) setting." }, { "Name": "RemoveRootCertificate", @@ -6208,6 +6656,15 @@ "DefaultValue": "False", "Description": "Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations." }, + { + "Name": "FileTransferProtocol", + "DisplayName": "File Transfer Protocol to Use", + "Required": false, + "DependsOn": "", + "Type": "MultipleChoice", + "DefaultValue": "SCP,SFTP,Both", + "Description": "Which protocol should be used when uploading/downloading files - SCP, SFTP, or Both (try one, and then if necessary, the other). Overrides FileTransferProtocol [config.json](#post-installation) setting." + }, { "Name": "SSHPort", "DisplayName": "SSH Port", @@ -6234,15 +6691,6 @@ "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFPkcs12." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -6572,6 +7020,16 @@ "Required": true, "IsPAMEligible": false, "Description": "The API Version of Avi / NSX to target. A default is set for the version this was originally developed and tested against." + }, + { + "Name": "RetriesForFailedAuthentication", + "DisplayName": "Retries For Failed Authentication", + "Type": "String", + "DependsOn": "", + "DefaultValue": "0", + "Required": false, + "IsPAMEligible": false, + "Description": "The number of additional login attempts to make if NSX ALB rejects the configured credentials as invalid. NSX ALB can be configured to validate logins against an external identity provider (e.g. LDAP/AD); when that provider is momentarily overwhelmed or unreachable, NSX ALB returns the same generic 'Invalid credentials' error it would for an actually wrong password, even though the configured credentials are correct. Retrying with a short backoff gives that kind of transient identity-provider issue a chance to clear before the job fails outright. Defaults to 0 (no retries), which preserves the original behavior unless this is explicitly configured." } ], "EntryParameters": [], @@ -6792,6 +7250,15 @@ "DefaultValue": "true", "Required": true, "Description": "Determine whether the server uses SSL or not (This field is automatically created)" + }, + { + "Name": "JEAEndpointName", + "DisplayName": "JEA End Point Name", + "Type": "String", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "Description": "Name of the JEA endpoint to use for the session (This field is automatically created)" } ], "EntryParameters": [ @@ -6834,7 +7301,7 @@ "Add": true, "Create": false, "Discovery": false, - "Enrollment": false, + "Enrollment": true, "Remove": true }, "Properties": [ @@ -6900,6 +7367,15 @@ "DefaultValue": "false", "Required": true, "Description": "Boolean value (true or false) indicating whether to restart the SQL Server service after installing the certificate. Example: 'true' to enable service restart after installation." + }, + { + "Name": "JEAEndpointName", + "DisplayName": "JEA End Point Name", + "Type": "String", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "Description": "Name of the JEA endpoint to use for the session (This field is automatically created)" } ], "EntryParameters": [ diff --git a/store_types.json b/store_types.json index 42ae661..9ad3bb8 100644 --- a/store_types.json +++ b/store_types.json @@ -43,6 +43,19 @@ "OnRemove": false, "OnReenrollment": false } + }, + { + "Name": "PreserveChainOrder", + "DisplayName": "Preserve Chain Order", + "Description": "By default, Azure Key Vault reorders the certificate chain on import (forcing the leaf certificate to index 0). If true, this tells Azure Key Vault to preserve the exact chain order provided instead of applying its own default reordering.", + "Type": "Bool", + "DefaultValue": "False", + "RequiredWhen": { + "HasPrivateKey": false, + "OnAdd": false, + "OnRemove": false, + "OnReenrollment": false + } } ], "JobProperties": [], @@ -286,7 +299,7 @@ "SupportedOperations": { "Add": true, "Create": false, - "Discovery": false, + "Discovery": true, "Enrollment": false, "Remove": true }, @@ -410,6 +423,16 @@ "Required": false, "IsPAMEligible": false, "Description": "An optional parameter sts:ExternalId to pass with Assume Role calls" + }, + { + "Name": "DiscoveryRoleName", + "DisplayName": "Discovery Role Name", + "Type": "String", + "DependsOn": "", + "DefaultValue": "KeyfactorACMDiscoveryRole", + "Required": false, + "IsPAMEligible": false, + "Description": "The IAM role name that exists in each target account. Used during cross-account Discovery to construct the Role ARN for cross-account access (arn:aws:iam:::role/). During a Discovery job this is supplied via the 'File name patterns to match' dialog field; this store property documents and defaults the value." } ], "EntryParameters": [ @@ -437,7 +460,7 @@ "BlueprintAllowed": true, "CustomAliasAllowed": "Optional", "ClientMachineDescription": "This is a full AWS ARN specifying a Role. This is the Role that will be assumed in any Auth scenario performing Assume Role. This will dictate what certificates are usable by the orchestrator. A preceding [profile] name should be included if a Credential Profile is to be used in Default Sdk Auth.", - "StorePathDescription": "A single specified AWS Region the store will operate in. Additional regions should get their own store defined." + "StorePathDescription": "The AWS Region the store operates in (e.g. us-east-1). Stores created by cross-account Discovery instead use a self-contained path of the form '|' (e.g. 'arn:aws:iam::123456789012:role/KeyfactorACMDiscoveryRole|us-east-1') which carries both the Role ARN to assume and the Region; for those stores the Client Machine field is informational only. Additional regions should get their own store defined." }, { "Name": "AwsSecretsManager JKS", @@ -639,6 +662,16 @@ "IsPAMEligible": false, "Description": "When enabled, the certificate is stored as a JSON document with separate 'certificate' (PEM certificate and chain, leaf first) and 'private_key' (PEM) properties, rather than a single concatenated PEM string." }, + { + "Name": "IncludeChain", + "DisplayName": "Include certificate chain in PEM", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "IsPAMEligible": false, + "Description": "When enabled, the single concatenated PEM secret contains the leaf certificate, followed by the issuer chain (leaf first), followed by the private key. Only applies when 'Store as JSON with separate private key' is disabled; the JSON format always includes the chain." + }, { "Name": "UseDefaultSdkAuth", "DisplayName": "Use Default SDK Auth", @@ -1050,6 +1083,16 @@ "Required": true, "IsPAMEligible": false, "Description": "The Akamai client_secret for authentication." + }, + { + "Name": "ContractId", + "DisplayName": "Contract ID", + "Type": "String", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": false, + "Description": "The default Akamai Contract ID for the certificate store. When performing re-enrollment, the Contract ID entry parameter will take precedence." } ], "EntryParameters": [ @@ -1067,16 +1110,15 @@ }, { "Name": "ContractId", - "DisplayName": "Contract ID", + "DisplayName": "Contract ID Override", "Type": "String", "RequiredWhen": { "HasPrivateKey": false, "OnAdd": false, "OnRemove": false, - "OnReenrollment": true + "OnReenrollment": false }, - "DefaultValue": "SET-DEFAULT", - "Description": "The Contract ID of your account in Akamai." + "Description": "The Contract ID of your account in Akamai. If a Contract ID is defined on the certificate store, the value of this parameter will take precedence. If a Contract ID is not defined on the certificate store, a value is required for this parameter." }, { "Name": "Sans", @@ -1744,7 +1786,6 @@ "PrivateKeyAllowed": "Forbidden", "SupportedOperations": { "Add": true, - "Create": false, "Discovery": false, "Enrollment": true, "Remove": true @@ -2525,7 +2566,7 @@ "Add": true, "Create": false, "Discovery": false, - "Enrollment": false, + "Enrollment": true, "Remove": true }, "PasswordOptions": { @@ -2565,7 +2606,7 @@ "DependsOn": "", "DefaultValue": "false", "Required": false, - "Description": "Determines whether an attempt will be made to link the added certificate (via a Management-Add job) to its issuing CA certificate." + "Description": "Determines whether an attempt will be made to link the added certificate (via a Management-Add or Reenrollment job) to its issuing CA certificate." }, { "Name": "timeout", @@ -2575,6 +2616,15 @@ "DefaultValue": "3600", "Required": false, "Description": "Determines timeout in seconds for all Citrix ADC API calls." + }, + { + "Name": "removeOldFiles", + "DisplayName": "Remove Old Files", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "Description": "Delete previous certificate and key files after renewal/replace" } ], "EntryParameters": [ @@ -2582,7 +2632,7 @@ "Name": "virtualServerName", "DisplayName": "Virtual Server Name", "Type": "String", - "Description": "When adding a certificate, this can be a single VServer name or a comma separated list of VServers to bind to Note: must match the number of Virtual SNI Cert values.", + "Description": "When adding a certificate or reenrolling a new alias, this can be a single VServer name or a comma separated list of VServers to bind to Note: must match the number of Virtual SNI Cert values.", "RequiredWhen": { "HasPrivateKey": false, "OnAdd": false, @@ -2594,7 +2644,7 @@ "Name": "sniCert", "DisplayName": "SNI Cert", "Type": "String", - "Description": "When adding a certificate, this can be a single boolean value (true/false) or a comma separated list of boolean values to determine whether the binding should use server name indication. Note: must match the number of Virtual Server Name values.", + "Description": "When adding a certificate or reenrolling a new alias, this can be a single boolean value (true/false) or a comma separated list of boolean values to determine whether the binding should use server name indication. Note: must match the number of Virtual Server Name values.", "RequiredWhen": { "HasPrivateKey": false, "OnAdd": false, @@ -2743,6 +2793,8 @@ "PowerShell": false, "BlueprintAllowed": true, "CustomAliasAllowed": "Required", + "ClientMachineDescription": "The URL of the F5 device being managed. Example - https://my.f5.com.", + "StorePathDescription": "Enter the partition for the F5 device being managed (usually Common)", "SupportedOperations": { "Add": true, "Create": false, @@ -3645,7 +3697,17 @@ "StorePathType": "", "StorePathValue": "example: '/mycerts/certstore.jks?b64cert'", "PrivateKeyAllowed": "Optional", - "JobProperties": [], + "JobProperties": [ + { + "Name": "DiscoverySuffix", + "DisplayName": "Discovery Suffix", + "Type": "String", + "DependsOn": "", + "DefaultValue": "_jks", + "Required": false, + "Description": "The secret-key-name suffix Discovery jobs use to identify candidate JKS certificate secrets. Defaults to '_jks'." + } + ], "ServerRequired": true, "PowerShell": false, "BlueprintAllowed": false, @@ -3663,7 +3725,7 @@ "DisplayName": "Server Username", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", + "DefaultValue": "", "Required": true, "IsPAMEligible": true, "Description": "The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200" @@ -3673,10 +3735,75 @@ "DisplayName": "Server Password", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", - "Required": true, + "DefaultValue": "", + "Required": false, "IsPAMEligible": true, - "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance" + "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "UseOAuth", + "DisplayName": "Use OAuth 2.0 (Client Credentials)", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "Description": "Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token." + }, + { + "Name": "ClientId", + "DisplayName": "Client ID", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "ClientSecret", + "DisplayName": "Client Secret", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "OAuthUrl", + "DisplayName": "OAuth Token Endpoint", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "Scope", + "DisplayName": "OAuth Scope", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "VaultRoleName", + "DisplayName": "Vault Role Name", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "AuthMountPoint", + "DisplayName": "JWT Auth Mount Point", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "jwt/", + "Required": false, + "Description": "The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." }, { "Name": "IncludeCertChain", @@ -3727,7 +3854,17 @@ "StorePathType": "", "StorePathValue": "example: '/mycerts/certstore.p12?b64cert'", "PrivateKeyAllowed": "Optional", - "JobProperties": [], + "JobProperties": [ + { + "Name": "DiscoverySuffix", + "DisplayName": "Discovery Suffix", + "Type": "String", + "DependsOn": "", + "DefaultValue": "_p12", + "Required": false, + "Description": "The secret-key-name suffix Discovery jobs use to identify candidate PKCS12 certificate secrets. Defaults to '_p12'." + } + ], "ServerRequired": true, "PowerShell": false, "BlueprintAllowed": false, @@ -3745,7 +3882,7 @@ "DisplayName": "Server Username", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", + "DefaultValue": "", "Required": true, "IsPAMEligible": true, "Description": "The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200" @@ -3755,10 +3892,75 @@ "DisplayName": "Server Password", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", - "Required": true, + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "UseOAuth", + "DisplayName": "Use OAuth 2.0 (Client Credentials)", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "Description": "Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token." + }, + { + "Name": "ClientId", + "DisplayName": "Client ID", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "ClientSecret", + "DisplayName": "Client Secret", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, "IsPAMEligible": true, - "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance" + "Description": "The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "OAuthUrl", + "DisplayName": "OAuth Token Endpoint", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "Scope", + "DisplayName": "OAuth Scope", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "VaultRoleName", + "DisplayName": "Vault Role Name", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "AuthMountPoint", + "DisplayName": "JWT Auth Mount Point", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "jwt/", + "Required": false, + "Description": "The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." }, { "Name": "IncludeCertChain", @@ -3805,9 +4007,21 @@ "Capability": "HCVKVPEM", "LocalStore": false, "ClientMachineDescription": "This can be any value to help uniquely identify the store. It is not used by this integration.", - "StorePathDescription": "This is the path after mount point where the certificates will be stored.", + "StorePathDescription": "This is the path to the secret containing the certificate.", + "StorePathType": "", + "StorePathValue": "example: '/mycerts/mycert_pem?b64cert'", "PrivateKeyAllowed": "Optional", - "JobProperties": [], + "JobProperties": [ + { + "Name": "DiscoverySuffix", + "DisplayName": "Discovery Suffix", + "Type": "String", + "DependsOn": "", + "DefaultValue": "_pem", + "Required": false, + "Description": "The secret-key-name suffix Discovery jobs use to identify candidate PEM certificate secrets. Defaults to '_pem'." + } + ], "ServerRequired": true, "PowerShell": false, "BlueprintAllowed": false, @@ -3825,7 +4039,7 @@ "DisplayName": "Server Username", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", + "DefaultValue": "", "Required": true, "IsPAMEligible": true, "Description": "The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200" @@ -3835,19 +4049,75 @@ "DisplayName": "Server Password", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", - "Required": true, + "DefaultValue": "", + "Required": false, "IsPAMEligible": true, - "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance" + "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled." }, { - "Name": "SubfolderInventory", - "DisplayName": "Subfolder Inventory", - "Description": "Should certificates found in sub-paths be included when performing an inventory?", + "Name": "UseOAuth", + "DisplayName": "Use OAuth 2.0 (Client Credentials)", "Type": "Bool", "DependsOn": "", "DefaultValue": "false", - "Required": false + "Required": false, + "Description": "Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token." + }, + { + "Name": "ClientId", + "DisplayName": "Client ID", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "ClientSecret", + "DisplayName": "Client Secret", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "OAuthUrl", + "DisplayName": "OAuth Token Endpoint", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "Scope", + "DisplayName": "OAuth Scope", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "VaultRoleName", + "DisplayName": "Vault Role Name", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "AuthMountPoint", + "DisplayName": "JWT Auth Mount Point", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "jwt/", + "Required": false, + "Description": "The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." }, { "Name": "IncludeCertChain", @@ -3866,6 +4136,15 @@ "DependsOn": "", "DefaultValue": "", "Required": false + }, + { + "Name": "PrivateKeyPath", + "DisplayName": "Private Key Path", + "Type": "String", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "Description": "This is the path to the secret that contains the PEM-encoded private key. Optional \u2014 omit for CA trust chain / certificate-only PEM stores that have no private key. Unlike other Key-Value store types, no sibling-secret convention is assumed when this is omitted." } ], "EntryParameters": [], @@ -3889,7 +4168,17 @@ "StorePathType": "", "StorePathValue": "example: '/mycerts/certstore.pfx?b64cert'", "PrivateKeyAllowed": "Optional", - "JobProperties": [], + "JobProperties": [ + { + "Name": "DiscoverySuffix", + "DisplayName": "Discovery Suffix", + "Type": "String", + "DependsOn": "", + "DefaultValue": "_pfx", + "Required": false, + "Description": "The secret-key-name suffix Discovery jobs use to identify candidate PFX certificate secrets. Defaults to '_pfx'." + } + ], "ServerRequired": true, "PowerShell": false, "BlueprintAllowed": false, @@ -3907,7 +4196,7 @@ "DisplayName": "Server Username", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", + "DefaultValue": "", "Required": true, "IsPAMEligible": true, "Description": "The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200" @@ -3917,10 +4206,75 @@ "DisplayName": "Server Password", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", - "Required": true, + "DefaultValue": "", + "Required": false, "IsPAMEligible": true, - "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance" + "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "UseOAuth", + "DisplayName": "Use OAuth 2.0 (Client Credentials)", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "Description": "Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token." + }, + { + "Name": "ClientId", + "DisplayName": "Client ID", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "ClientSecret", + "DisplayName": "Client Secret", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "OAuthUrl", + "DisplayName": "OAuth Token Endpoint", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "Scope", + "DisplayName": "OAuth Scope", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "VaultRoleName", + "DisplayName": "Vault Role Name", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "AuthMountPoint", + "DisplayName": "JWT Auth Mount Point", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "jwt/", + "Required": false, + "Description": "The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." }, { "Name": "IncludeCertChain", @@ -3989,7 +4343,7 @@ "DisplayName": "Server Username", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", + "DefaultValue": "", "Required": true, "IsPAMEligible": true, "Description": "The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200" @@ -3999,10 +4353,75 @@ "DisplayName": "Server Password", "Type": "Secret", "DependsOn": "", - "DefaultValue": "", - "Required": true, + "DefaultValue": "", + "Required": false, "IsPAMEligible": true, - "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance" + "Description": "Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "UseOAuth", + "DisplayName": "Use OAuth 2.0 (Client Credentials)", + "Type": "Bool", + "DependsOn": "", + "DefaultValue": "false", + "Required": false, + "Description": "Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token." + }, + { + "Name": "ClientId", + "DisplayName": "Client ID", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "ClientSecret", + "DisplayName": "Client Secret", + "Type": "Secret", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": true, + "Description": "The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "OAuthUrl", + "DisplayName": "OAuth Token Endpoint", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "Scope", + "DisplayName": "OAuth Scope", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "VaultRoleName", + "DisplayName": "Vault Role Name", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "", + "Required": false, + "Description": "The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." + }, + { + "Name": "AuthMountPoint", + "DisplayName": "JWT Auth Mount Point", + "Type": "String", + "DependsOn": "UseOAuth", + "DefaultValue": "jwt/", + "Required": false, + "Description": "The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled." }, { "Name": "MountPoint", @@ -4170,6 +4589,15 @@ "DefaultValue": "true", "Required": true, "Description": "Determine whether the server uses SSL or not (This field is automatically created)" + }, + { + "Name": "JEAEndpointName", + "DisplayName": "JEA End Point Name", + "Type": "String", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "Description": "Name of the JEA endpoint to use for the session (This field is automatically created)" } ], "EntryParameters": [ @@ -5279,7 +5707,17 @@ "DefaultValue": "", "Required": false, "IsPAMEligible": false, - "Description": "Template stack used for device push of certificates via Template." + "Description": "A semicolon delimited list of Template Stacks used for device push of certificates via Template (i.e. `Stack 1`, `Stack 1;Stack2`, or `Stack 1; Stack 2`, etc.)." + }, + { + "Name": "PushFailureBehavior", + "DisplayName": "Push Failure Behavior", + "Type": "MultipleChoice", + "DependsOn": "", + "DefaultValue": "Failure,Warning", + "Required": false, + "IsPAMEligible": false, + "Description": "Controls the job result when Panorama fails to commit to a device group, template, or template stack. 'Failure' will fail the management job and trigger a retry, while 'Warning' records the failure message but marks the job as completed." } ], "EntryParameters": [], @@ -5477,13 +5915,13 @@ "Description": "The LinuxFileOwnerOnStoreCreation field should contain a valid user ID recognized by the destination Linux server, optionally followed by a colon and a group ID if the group owner differs. Example: 'userID' or 'userID:groupID'. Overrides DefaultOwnerOnStoreCreation [config.json](#post-installation) setting." }, { - "Name": "SudoImpersonatingUser", + "Name": "SudoImpersonatedUser", "DisplayName": "Sudo Impersonating User", "Required": false, "DependsOn": "", "Type": "String", "DefaultValue": "", - "Description": "The SudoImpersonatingUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides [config.json](#post-installation) DefaultSudoImpersonatedUser setting." + "Description": "The SudoImpersonatedUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides [config.json](#post-installation) DefaultSudoImpersonatedUser setting." }, { "Name": "SeparatePrivateKeyFilePath", @@ -5512,6 +5950,15 @@ "DefaultValue": "False", "Description": "Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations." }, + { + "Name": "FileTransferProtocol", + "DisplayName": "File Transfer Protocol to Use", + "Required": false, + "DependsOn": "", + "Type": "MultipleChoice", + "DefaultValue": "SCP,SFTP,Both", + "Description": "Which protocol should be used when uploading/downloading files - SCP, SFTP, or Both (try one, and then if necessary, the other). Overrides FileTransferProtocol [config.json](#post-installation) setting." + }, { "Name": "SSHPort", "DisplayName": "SSH Port", @@ -5538,15 +5985,6 @@ "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFDER." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -5618,13 +6056,13 @@ "Description": "The LinuxFileOwnerOnStoreCreation field should contain a valid user ID recognized by the destination Linux server, optionally followed by a colon and a group ID if the group owner differs. Example: 'userID' or 'userID:groupID'. Overrides DefaultOwnerOnStoreCreation [config.json](#post-installation) setting." }, { - "Name": "SudoImpersonatingUser", + "Name": "SudoImpersonatedUser", "DisplayName": "Sudo Impersonating User", "Required": false, "DependsOn": "", "Type": "String", "DefaultValue": "", - "Description": "The SudoImpersonatingUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides DefaultSudoImpersonatedUser [config.json](#post-installation) setting." + "Description": "The SudoImpersonatedUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides DefaultSudoImpersonatedUser [config.json](#post-installation) setting." }, { "Name": "RemoveRootCertificate", @@ -5644,6 +6082,15 @@ "DefaultValue": "False", "Description": "Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations." }, + { + "Name": "FileTransferProtocol", + "DisplayName": "File Transfer Protocol to Use", + "Required": false, + "DependsOn": "", + "Type": "MultipleChoice", + "DefaultValue": "SCP,SFTP,Both", + "Description": "Which protocol should be used when uploading/downloading files - SCP, SFTP, or Both (try one, and then if necessary, the other). Overrides FileTransferProtocol [config.json](#post-installation) setting." + }, { "Name": "SSHPort", "DisplayName": "SSH Port", @@ -5670,15 +6117,6 @@ "Type": "MultipleChoice", "DefaultValue": "Apache Tomcat Restart,Jetty Restart", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -5731,6 +6169,16 @@ "IsPAMEligible": true, "Description": "A password (or valid PAM key if the password is stored in a KF Command configured PAM integration). The password can also be an SSH private key if connecting via SSH to a server using SSH private key authentication. If acting as an *agent* using local file access, just check *No Value*" }, + { + "Name": "CommandPath", + "DisplayName": "GSKCAPICMD installation folder path", + "Type": "String", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "IsPAMEligible": false, + "Description": "The full folder path (not including the file name itself) where the GSKCAPCMD CLI located is installed." + }, { "Name": "LinuxFilePermissionsOnStoreCreation", "DisplayName": "Linux File Permissions on Store Creation", @@ -5750,13 +6198,13 @@ "Description": "The LinuxFileOwnerOnStoreCreation field should contain a valid user ID recognized by the destination Linux server, optionally followed by a colon and a group ID if the group owner differs. Example: 'userID' or 'userID:groupID'. Overrides DefaultOwnerOnStoreCreation [config.json](#post-installation) setting." }, { - "Name": "SudoImpersonatingUser", + "Name": "SudoImpersonatedUser", "DisplayName": "Sudo Impersonating User", "Required": false, "DependsOn": "", "Type": "String", "DefaultValue": "", - "Description": "The SudoImpersonatingUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides [config.json](#post-installation) DefaultSudoImpersonatedUser setting." + "Description": "The SudoImpersonatedUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides [config.json](#post-installation) DefaultSudoImpersonatedUser setting." }, { "Name": "RemoveRootCertificate", @@ -5776,6 +6224,15 @@ "DefaultValue": "False", "Description": "Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations." }, + { + "Name": "FileTransferProtocol", + "DisplayName": "File Transfer Protocol to Use", + "Required": false, + "DependsOn": "", + "Type": "MultipleChoice", + "DefaultValue": "SCP,SFTP,Both", + "Description": "Which protocol should be used when uploading/downloading files - SCP, SFTP, or Both (try one, and then if necessary, the other). Overrides FileTransferProtocol [config.json](#post-installation) setting." + }, { "Name": "SSHPort", "DisplayName": "SSH Port", @@ -5802,15 +6259,6 @@ "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFKDB." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -5882,13 +6330,13 @@ "Description": "The LinuxFileOwnerOnStoreCreation field should contain a valid user ID recognized by the destination Linux server, optionally followed by a colon and a group ID if the group owner differs. Example: 'userID' or 'userID:groupID'. Overrides DefaultOwnerOnStoreCreation [config.json](#post-installation) setting." }, { - "Name": "SudoImpersonatingUser", + "Name": "SudoImpersonatedUser", "DisplayName": "Sudo Impersonating User", "Required": false, "DependsOn": "", "Type": "String", "DefaultValue": "", - "Description": "The SudoImpersonatingUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides [config.json](#post-installation) DefaultSudoImpersonatedUser setting." + "Description": "The SudoImpersonatedUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides [config.json](#post-installation) DefaultSudoImpersonatedUser setting." }, { "Name": "RemoveRootCertificate", @@ -5908,6 +6356,15 @@ "DefaultValue": "False", "Description": "Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations." }, + { + "Name": "FileTransferProtocol", + "DisplayName": "File Transfer Protocol to Use", + "Required": false, + "DependsOn": "", + "Type": "MultipleChoice", + "DefaultValue": "SCP,SFTP,Both", + "Description": "Which protocol should be used when uploading/downloading files - SCP, SFTP, or Both (try one, and then if necessary, the other). Overrides FileTransferProtocol [config.json](#post-installation) setting." + }, { "Name": "SSHPort", "DisplayName": "SSH Port", @@ -5934,15 +6391,6 @@ "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFORA." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -6014,13 +6462,13 @@ "Description": "The LinuxFileOwnerOnStoreCreation field should contain a valid user ID recognized by the destination Linux server, optionally followed by a colon and a group ID if the group owner differs. Example: 'userID' or 'userID:groupID'. Overrides DefaultOwnerOnStoreCreation [config.json](#post-installation) setting." }, { - "Name": "SudoImpersonatingUser", + "Name": "SudoImpersonatedUser", "DisplayName": "Sudo Impersonating User", "Required": false, "DependsOn": "", "Type": "String", "DefaultValue": "", - "Description": "The SudoImpersonatingUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides [config.json](#post-installation) DefaultSudoImpersonatedUser setting.." + "Description": "The SudoImpersonatedUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides [config.json](#post-installation) DefaultSudoImpersonatedUser setting.." }, { "Name": "IsTrustStore", @@ -6076,6 +6524,15 @@ "DefaultValue": "False", "Description": "Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations." }, + { + "Name": "FileTransferProtocol", + "DisplayName": "File Transfer Protocol to Use", + "Required": false, + "DependsOn": "", + "Type": "MultipleChoice", + "DefaultValue": "SCP,SFTP,Both", + "Description": "Which protocol should be used when uploading/downloading files - SCP, SFTP, or Both (try one, and then if necessary, the other). Overrides FileTransferProtocol [config.json](#post-installation) setting." + }, { "Name": "SSHPort", "DisplayName": "SSH Port", @@ -6102,15 +6559,6 @@ "Type": "MultipleChoice", "DefaultValue": "Apache HTTPD Restart,NGNIX Restart,HAProxy Restart,Envoy Proxy Restart", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -6182,13 +6630,13 @@ "Description": "The LinuxFileOwnerOnStoreCreation field should contain a valid user ID recognized by the destination Linux server, optionally followed by a colon and a group ID if the group owner differs. Example: 'userID' or 'userID:groupID'. Overrides DefaultOwnerOnStoreCreation [config.json](#post-installation) setting." }, { - "Name": "SudoImpersonatingUser", + "Name": "SudoImpersonatedUser", "DisplayName": "Sudo Impersonating User", "Required": false, "DependsOn": "", "Type": "String", "DefaultValue": "", - "Description": "The SudoImpersonatingUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides DefaultSudoImpersonatedUser [config.json](#post-installation) setting." + "Description": "The SudoImpersonatedUser field should contain a valid user ID to impersonate using sudo on the destination Linux server. Example: 'impersonatedUserID'. Overrides DefaultSudoImpersonatedUser [config.json](#post-installation) setting." }, { "Name": "RemoveRootCertificate", @@ -6208,6 +6656,15 @@ "DefaultValue": "False", "Description": "Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations." }, + { + "Name": "FileTransferProtocol", + "DisplayName": "File Transfer Protocol to Use", + "Required": false, + "DependsOn": "", + "Type": "MultipleChoice", + "DefaultValue": "SCP,SFTP,Both", + "Description": "Which protocol should be used when uploading/downloading files - SCP, SFTP, or Both (try one, and then if necessary, the other). Overrides FileTransferProtocol [config.json](#post-installation) setting." + }, { "Name": "SSHPort", "DisplayName": "SSH Port", @@ -6234,15 +6691,6 @@ "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFPkcs12." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -6572,6 +7020,16 @@ "Required": true, "IsPAMEligible": false, "Description": "The API Version of Avi / NSX to target. A default is set for the version this was originally developed and tested against." + }, + { + "Name": "RetriesForFailedAuthentication", + "DisplayName": "Retries For Failed Authentication", + "Type": "String", + "DependsOn": "", + "DefaultValue": "0", + "Required": false, + "IsPAMEligible": false, + "Description": "The number of additional login attempts to make if NSX ALB rejects the configured credentials as invalid. NSX ALB can be configured to validate logins against an external identity provider (e.g. LDAP/AD); when that provider is momentarily overwhelmed or unreachable, NSX ALB returns the same generic 'Invalid credentials' error it would for an actually wrong password, even though the configured credentials are correct. Retrying with a short backoff gives that kind of transient identity-provider issue a chance to clear before the job fails outright. Defaults to 0 (no retries), which preserves the original behavior unless this is explicitly configured." } ], "EntryParameters": [], @@ -6792,6 +7250,15 @@ "DefaultValue": "true", "Required": true, "Description": "Determine whether the server uses SSL or not (This field is automatically created)" + }, + { + "Name": "JEAEndpointName", + "DisplayName": "JEA End Point Name", + "Type": "String", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "Description": "Name of the JEA endpoint to use for the session (This field is automatically created)" } ], "EntryParameters": [ @@ -6834,7 +7301,7 @@ "Add": true, "Create": false, "Discovery": false, - "Enrollment": false, + "Enrollment": true, "Remove": true }, "Properties": [ @@ -6900,6 +7367,15 @@ "DefaultValue": "false", "Required": true, "Description": "Boolean value (true or false) indicating whether to restart the SQL Server service after installing the certificate. Example: 'true' to enable service restart after installation." + }, + { + "Name": "JEAEndpointName", + "DisplayName": "JEA End Point Name", + "Type": "String", + "DependsOn": "", + "DefaultValue": "", + "Required": false, + "Description": "Name of the JEA endpoint to use for the session (This field is automatically created)" } ], "EntryParameters": [