+
+
+
+
+
+
+ + + Support + + · + + Installation + + · + + License + + · + + Related Integrations + +
-## PAM Integration +## Overview -This orchestrator extension has the ability to connect to a variety of supported PAM providers to allow for the retrieval of various client hosted secrets right from the orchestrator server itself. This eliminates the need to set up the PAM integration on Keyfactor Command which may be in an environment that the client does not want to have access to their PAM provider. +The F5 WAF Universal Orchestrator extension remotely manages TLS and CA Root certificates uploaded to F5 Distributed Multi-Cloud App Connect, which is the F5 platform that manages WAF services. Certificates bound to HTTP Load Balancers within Multi-Cloud App Connect can be renewed or replaced, but they cannot be removed. -The secrets that this orchestrator extension supports for use with a PAM Provider are: +The extension uses two primary certificate store types: `f5WafTls` and `f5WafCa`. These store types are used to manage stores containing TLS and CA Root certificates, respectively. The `f5WafTls` certificate store type is focused on managing TLS certificates, which are used to enable secure communication over networks. Use cases for `f5WafTls` include discovery of TLS stores, inventorying all TLS certificates within a namespace, adding or renewing certificates, and removing unbound certificates. -|Name|Description| -|----|-----------| -|ServerUsername|The user id that will be used to authenticate to the F5 WAF API endpoints| -|ServerPassword|The API token that will be used to authenticate to the F5 WAF API endpoints| - +On the other hand, the `f5WafCa` store type is used for managing CA Root certificates, which are essential for establishing a chain of trust between different entities. The use cases for `f5WafCa` are similar to those of `f5WafTls`, including discovery, inventory, and management of certificates. However, it is important to note that deleting a CA Root certificate replaces all instances of the same certificate within the namespace, due to an F5 WAF feature. -It is not necessary to use a PAM Provider for all of the secrets available above. If a PAM Provider should not be used, simply enter in the actual value to be used, as normal. +Overall, this extension simplifies the management of certificates within the F5 Distributed Multi-Cloud App Connect platform, providing seamless integration with Keyfactor Command. -If a PAM Provider will be used for one of the fields above, start by referencing the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam). The GitHub repo for the PAM Provider to be used contains important information such as the format of the `json` needed. What follows is an example but does not reflect the `json` values for all PAM Providers as they have different "instance" and "initialization" parameter names and values. +## Compatibility -
+This integration is compatible with Keyfactor Universal Orchestrator version 10.4.1 and later.
+## Support
+The F5 WAF Universal Orchestrator extension is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket with your Keyfactor representative. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com.
+
+> To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab.
+## Installation
+Before installing the F5 WAF Universal Orchestrator extension, it's recommended to install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command.
-### Example PAM Provider Setup
+The F5 WAF Universal Orchestrator extension implements 2 Certificate Store Types. Depending on your use case, you may elect to install one, or all of these Certificate Store Types. An overview for each type is linked below:
+* [F5 WAF TLS](docs/f5waftls.md)
+* [F5 WAF CA](docs/f5wafca.md)
-To use a PAM Provider to resolve a field, in this example the __Server Password__ will be resolved by the `Hashicorp-Vault` provider, first install the PAM Provider extension from the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) on the Universal Orchestrator.
+F5 WAF TLS
-Next, complete configuration of the PAM Provider on the UO by editing the `manifest.json` of the __PAM Provider__ (e.g. located at extensions/Hashicorp-Vault/manifest.json). The "initialization" parameters need to be entered here:
-~~~ json
- "Keyfactor:PAMProviders:Hashicorp-Vault:InitializationInfo": {
- "Host": "http://127.0.0.1:8200",
- "Path": "v1/secret/data",
- "Token": "xxxxxx"
- }
-~~~
+1. Follow the [requirements section](docs/f5waftls.md#requirements) to configure a Service Account and grant necessary API permissions.
-After these values are entered, the Orchestrator needs to be restarted to pick up the configuration. Now the PAM Provider can be used on other Orchestrator Extensions.
+ Requirements
-### Use the PAM Provider
-With the PAM Provider configured as an extenion on the UO, a `json` object can be passed instead of an actual value to resolve the field with a PAM Provider. Consult the [Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) for the specific format of the `json` object.
+ ### Creating an F5 WAF API Token
-To have the __Server Password__ field resolved by the `Hashicorp-Vault` provider, the corresponding `json` object from the `Hashicorp-Vault` extension needs to be copied and filed in with the correct information:
+ In lieu of providing a server password when setting up an F5 WAF certificate store, F5 Multi-Cloud App Connect uses API tokens combined with the user id to authenticate when calling APIs. API Tokens can be created through the F5 Distributed Cloud Console after logging in with the ID you wish to use for the Keyfactor certificate store. Once logged in, select Multi-Cloud App Connect from the options under "Common services". Next, select Account Services from the pull down at the top right of the screen, and select "Account Settings". From there, click on "Credentials" on the left nav and "Add Credentials" on the subsequent screen. In the form shown, select "API Token" from the Credential Type dropdown, and enter the name of the credential and the expiration date. Please note that credentials can only be created for up to 90 day periods of time. After 90 days, a new API token will need to be generated and replaced in your F5 WAF certificate store(s). Clicking Generate will then show the value of the newly created API Token. Copy this and save to a safe place, as this will be the value you will enter in the Server Password field when setting up your certificate store. If you forget or lose this token value, there is no way to access it again in the F5 Distributed Cloud portal. You will need to create a new API Token.
-~~~ json
-{"Secret":"my-kv-secret","Key":"myServerPassword"}
-~~~
+ 
+ 
+ 
+ 
+ 
+ 
-This text would be entered in as the value for the __Server Password__, instead of entering in the actual password. The Orchestrator will attempt to use the PAM Provider to retrieve the __Server Password__. If PAM should not be used, just directly enter in the value for the field.
-