Hashicorp Vault Universal Orchestrator Extension
Support
ยท
Installation
ยท
License
ยท
Related Integrations
## Overview
This integration for the Keyfactor Universal Orchestrator has been tested against Hashicorp Vault 1.10+. It utilizes the **Key-Value** secrets engine to store certificates issues via Keyfactor Command.
The Hashicorp Vault Universal Orchestrator extension implements 5 Certificate Store Types. Depending on your use case, you may elect to use one, or all of these Certificate Store Types. Descriptions of each are provided below.
- [Hashicorp Vault PKI](#HCVPKI)
- [Hashicorp Vault Key-Value PEM](#HCVKVPEM)
- [Hashicorp Vault Key-Value JKS](#HCVKVJKS)
- [Hashicorp Vault Key-Value PKCS12](#HCVKVP12)
- [Hashicorp Vault Key-Value PFX](#HCVKVPFX)
## Compatibility
This integration is compatible with Keyfactor Universal Orchestrator version 10.4 and later.
## Support
The Hashicorp Vault Universal Orchestrator extension is supported by Keyfactor. If you require support for any issues or have feature request, please open a support ticket by either contacting your Keyfactor representative or via the Keyfactor Support Portal at https://support.keyfactor.com.
> If you want to contribute bug fixes or additional enhancements, use the **[Pull requests](../../pulls)** tab.
## Requirements & Prerequisites
Before installing the Hashicorp Vault Universal Orchestrator extension, we recommend that you install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command.
## Certificate Store Types
To use the Hashicorp Vault Universal Orchestrator extension, you **must** create the Certificate Store Types required for your use-case. This only needs to happen _once_ per Keyfactor Command instance.
The Hashicorp Vault Universal Orchestrator extension implements 5 Certificate Store Types. Depending on your use case, you may elect to use one, or all of these Certificate Store Types.
### HCVPKI
Click to expand details
The store type "HCVPKI" can perform inventory on certificates that exist in either the Hashicorp Vault PKI Secrets Engine, or the Keyfactor Secrets Engine.
- The [Hashicorp Vault PKI Secrets Engine](https://developer.hashicorp.com/vault/api-docs/secret/pki) is intended to allow for issuance and storage of certificates that rely on Certificate Authorities outside of Command; typically in Vault.
- The [Keyfactor Secrets Engine](https://github.com/Keyfactor/hashicorp-vault-secretsengine) is designed to support the same interface as the Hashicorp Vault PKI Secrets Engine to issue and enroll certificates using Certificate Authorities managed by Keyfactor Command.
#### Supported Operations
| Operation | Is Supported |
|--------------|--------------|
| Add | ๐ฒ Unchecked |
| Remove | ๐ฒ Unchecked |
| Discovery | ๐ฒ Unchecked |
| Reenrollment | ๐ฒ Unchecked |
| Create | ๐ฒ Unchecked |
#### Store Type Creation
##### Using kfutil:
`kfutil` is a custom CLI for the Keyfactor Command API and can be used to create certificate store types.
For more information on [kfutil](https://github.com/Keyfactor/kfutil) check out the [docs](https://github.com/Keyfactor/kfutil?tab=readme-ov-file#quickstart)
Click to expand HCVPKI kfutil details
##### Using online definition from GitHub:
This will reach out to GitHub and pull the latest store-type definition
```shell
# Hashicorp Vault PKI
kfutil store-types create HCVPKI
```
##### Offline creation using integration-manifest file:
If required, it is possible to create store types from the [integration-manifest.json](./integration-manifest.json) included in this repo.
You would first download the [integration-manifest.json](./integration-manifest.json) and then run the following command
in your offline environment.
```shell
kfutil store-types create --from-file integration-manifest.json
```
Click to expand manual HCVPKI details
Create a store type called `HCVPKI` with the attributes in the tables below:
##### Basic Tab
| Attribute | Value | Description |
| --------- | ----- | ----- |
| Name | Hashicorp Vault PKI | Display name for the store type (may be customized) |
| Short Name | HCVPKI | Short display name for the store type |
| Capability | HCVPKI | Store type name orchestrator will register with. Check the box to allow entry of value |
| Supports Add | ๐ฒ Unchecked | Indicates that the Store Type supports Management Add |
| Supports Remove | ๐ฒ Unchecked | Indicates that the Store Type supports Management Remove |
| Supports Discovery | ๐ฒ Unchecked | Indicates that the Store Type supports Discovery |
| Supports Reenrollment | ๐ฒ Unchecked | Indicates that the Store Type supports Reenrollment |
| Supports Create | ๐ฒ Unchecked | Indicates that the Store Type supports store creation |
| Needs Server | โ
Checked | Determines if a target server name is required when creating store |
| Blueprint Allowed | ๐ฒ Unchecked | Determines if store type may be included in an Orchestrator blueprint |
| Uses PowerShell | ๐ฒ Unchecked | Determines if underlying implementation is PowerShell |
| Requires Store Password | ๐ฒ Unchecked | Enables users to optionally specify a store password when defining a Certificate Store. |
| Supports Entry Password | ๐ฒ Unchecked | Determines if an individual entry within a store can have a password. |
The Basic tab should look like this:
##### Advanced Tab
| Attribute | Value | Description |
| --------- | ----- | ----- |
| Supports Custom Alias | Forbidden | Determines if an individual entry within a store can have a custom Alias. |
| Private Key Handling | Forbidden | This determines if Keyfactor can send the private key associated with a certificate to the store. |
| PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) |
The Advanced tab should look like this:
> For Keyfactor **Command versions 24.4 and later**, a Certificate Format dropdown is available with PFX and PEM options. Ensure that **PFX** is selected, as this determines the format of new and renewed certificates sent to the Orchestrator during a Management job. Currently, all Keyfactor-supported Orchestrator extensions support only PFX.
##### Custom Fields Tab
Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type:
| Name | Display Name | Description | Type | Default Value/Options | Required |
| ---- | ------------ | ---- | --------------------- | -------- | ----------- |
| ServerUsername | Server Username | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 | Secret | | โ
Checked |
| ServerPassword | Server Password | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. | Secret | | ๐ฒ Unchecked |
| UseOAuth | Use OAuth 2.0 (Client Credentials) | Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token. | Bool | false | ๐ฒ Unchecked |
| ClientId | Client ID | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | Secret | | ๐ฒ Unchecked |
| ClientSecret | Client Secret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | Secret | | ๐ฒ Unchecked |
| OAuthUrl | OAuth Token Endpoint | The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | | ๐ฒ Unchecked |
| Scope | OAuth Scope | Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | | ๐ฒ Unchecked |
| VaultRoleName | Vault Role Name | The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | | ๐ฒ Unchecked |
| AuthMountPoint | JWT Auth Mount Point | The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | jwt/ | ๐ฒ Unchecked |
| MountPoint | Mount Point | This is the mount point of the instance of the PKI or Keyfactor secrets engine plugin. If using enterprise namespaces: / | String | | โ
Checked |
| PassphrasePath | Passphrase Path | This is the path to the secret that contains the passphrase to the cert store file. If empty or omitted, assume the secret is named 'passphrase' on the same level as the certificate store secret. | String | | ๐ฒ Unchecked |
The Custom Fields tab should look like this:
###### Server Username
The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200
> [!IMPORTANT]
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
###### Server Password
Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled.
> [!IMPORTANT]
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
###### Use OAuth 2.0 (Client Credentials)
Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token.
###### Client ID
The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### Client Secret
The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### OAuth Token Endpoint
The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### OAuth Scope
Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### Vault Role Name
The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### JWT Auth Mount Point
The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### Mount Point
This is the mount point of the instance of the PKI or Keyfactor secrets engine plugin. If using enterprise namespaces: /
###### Passphrase Path
This is the path to the secret that contains the passphrase to the cert store file. If empty or omitted, assume the secret is named 'passphrase' on the same level as the certificate store secret.
Click to expand details
The Hashicorp Vault Key-Value PEM Certificate Store manages certificates in the PEM format that are stored in the Hashicorp Vault Key-Value secrets engine.
As of version 4.0+ of this integration, each HCVKVPEM certificate store maps to a single certificate secret (plus an optional, separate private key secret) โ the same "one store, one secret" model already used by HCVKVJKS, HCVKVP12, and HCVKVPFX โ rather than a folder that could contain many certificate entries across sub-paths.
> :warning: **Breaking change note for existing HCVKVPEM stores (upgrading from a version prior to 4.0):** `StorePath` used to be a folder path that could contain many certificates, optionally including sub-paths (via the now-removed `SubfolderInventory` field). It now points directly to the single secret containing the certificate. The private key, which used to live as a `private_key` property alongside `certificate` in that same secret, is now read from a separate secret referenced by the new `PrivateKeyPath` field. Existing HCVKVPEM certificate stores must be reconfigured after upgrading โ there is no automatic migration.
#### Hashicorp Vault Key-Value PEM Requirements
#### Secret naming
A certificate store is comprised of one or two secret entries:
- The certificate, at the path configured in `StorePath`.
- Optionally, a secret containing the PEM-encoded private key, at the path configured in `PrivateKeyPath`. Omit `PrivateKeyPath` entirely for certificate-only stores (e.g. a CA trust chain) that have no private key โ unlike the other Key-Value store types, no sibling-secret convention (such as a secret named `passphrase` at the same level) is assumed when it's omitted.
This is what allows a PEM certificate and its private key to each be created as their own secret containing a single key-value pair โ useful when your secret-management tooling only supports creating secrets with a single key-value pair per secret, which the old combined-secret shape did not allow.
Additionally, we can read the certificate and/or private key from a JSON secret that contains the value on a specific property.
To indicate the property name that should be used to retrieve the value, add a "?" at the end of the path, followed by the property name.
**examples:**
StorePath = `kv-v2/mycerts/mycert_pem?certData`
> This path indicates that the secret containing the certificate is named "mycert_pem" and is a JSON secret with the `certData` property containing the PEM-formatted certificate.
>
StorePath = `kv-v2/mycerts/mycert_pem`
> This path indicates that the entire secret value is the PEM-formatted certificate.
> Generally, the paths to the certificate and private key secrets should be in the following format
> `//?`
> if namespaces are not used, that section can be omitted.
This convention applies to both `StorePath` and `PrivateKeyPath`.
#### Supported Operations
| Operation | Is Supported |
|--------------|--------------|
| Add | โ
Checked |
| Remove | โ
Checked |
| Discovery | โ
Checked |
| Reenrollment | ๐ฒ Unchecked |
| Create | โ
Checked |
#### Store Type Creation
##### Using kfutil:
`kfutil` is a custom CLI for the Keyfactor Command API and can be used to create certificate store types.
For more information on [kfutil](https://github.com/Keyfactor/kfutil) check out the [docs](https://github.com/Keyfactor/kfutil?tab=readme-ov-file#quickstart)
Click to expand HCVKVPEM kfutil details
##### Using online definition from GitHub:
This will reach out to GitHub and pull the latest store-type definition
```shell
# Hashicorp Vault Key-Value PEM
kfutil store-types create HCVKVPEM
```
##### Offline creation using integration-manifest file:
If required, it is possible to create store types from the [integration-manifest.json](./integration-manifest.json) included in this repo.
You would first download the [integration-manifest.json](./integration-manifest.json) and then run the following command
in your offline environment.
```shell
kfutil store-types create --from-file integration-manifest.json
```
Click to expand manual HCVKVPEM details
Create a store type called `HCVKVPEM` with the attributes in the tables below:
##### Basic Tab
| Attribute | Value | Description |
| --------- | ----- | ----- |
| Name | Hashicorp Vault Key-Value PEM | Display name for the store type (may be customized) |
| Short Name | HCVKVPEM | Short display name for the store type |
| Capability | HCVKVPEM | Store type name orchestrator will register with. Check the box to allow entry of value |
| Supports Add | โ
Checked | Indicates that the Store Type supports Management Add |
| Supports Remove | โ
Checked | Indicates that the Store Type supports Management Remove |
| Supports Discovery | โ
Checked | Indicates that the Store Type supports Discovery |
| Supports Reenrollment | ๐ฒ Unchecked | Indicates that the Store Type supports Reenrollment |
| Supports Create | โ
Checked | Indicates that the Store Type supports store creation |
| Needs Server | โ
Checked | Determines if a target server name is required when creating store |
| Blueprint Allowed | ๐ฒ Unchecked | Determines if store type may be included in an Orchestrator blueprint |
| Uses PowerShell | ๐ฒ Unchecked | Determines if underlying implementation is PowerShell |
| Requires Store Password | ๐ฒ Unchecked | Enables users to optionally specify a store password when defining a Certificate Store. |
| Supports Entry Password | ๐ฒ Unchecked | Determines if an individual entry within a store can have a password. |
The Basic tab should look like this:
##### Advanced Tab
| Attribute | Value | Description |
| --------- | ----- | ----- |
| Supports Custom Alias | Required | Determines if an individual entry within a store can have a custom Alias. |
| Private Key Handling | Optional | This determines if Keyfactor can send the private key associated with a certificate to the store. |
| PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) |
The Advanced tab should look like this:
> For Keyfactor **Command versions 24.4 and later**, a Certificate Format dropdown is available with PFX and PEM options. Ensure that **PFX** is selected, as this determines the format of new and renewed certificates sent to the Orchestrator during a Management job. Currently, all Keyfactor-supported Orchestrator extensions support only PFX.
##### Custom Fields Tab
Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type:
| Name | Display Name | Description | Type | Default Value/Options | Required |
| ---- | ------------ | ---- | --------------------- | -------- | ----------- |
| ServerUsername | Server Username | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 | Secret | | โ
Checked |
| ServerPassword | Server Password | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. | Secret | | ๐ฒ Unchecked |
| UseOAuth | Use OAuth 2.0 (Client Credentials) | Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token. | Bool | false | ๐ฒ Unchecked |
| ClientId | Client ID | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | Secret | | ๐ฒ Unchecked |
| ClientSecret | Client Secret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | Secret | | ๐ฒ Unchecked |
| OAuthUrl | OAuth Token Endpoint | The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | | ๐ฒ Unchecked |
| Scope | OAuth Scope | Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | | ๐ฒ Unchecked |
| VaultRoleName | Vault Role Name | The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | | ๐ฒ Unchecked |
| AuthMountPoint | JWT Auth Mount Point | The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | jwt/ | ๐ฒ Unchecked |
| IncludeCertChain | Include Certificate Chain | Should the certificate chain be included when performing an enrollment? | Bool | false | ๐ฒ Unchecked |
| MountPoint | Mount Point | The base mount point of the secrets engine. If using Vault Namespaces, include the namespace; ie. / | String | | ๐ฒ Unchecked |
| PrivateKeyPath | Private Key Path | This is the path to the secret that contains the PEM-encoded private key. Optional โ omit for CA trust chain / certificate-only PEM stores that have no private key. Unlike other Key-Value store types, no sibling-secret convention is assumed when this is omitted. | String | | ๐ฒ Unchecked |
The Custom Fields tab should look like this:
###### Server Username
The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200
> [!IMPORTANT]
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
###### Server Password
Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled.
> [!IMPORTANT]
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
###### Use OAuth 2.0 (Client Credentials)
Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token.
###### Client ID
The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### Client Secret
The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### OAuth Token Endpoint
The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### OAuth Scope
Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### Vault Role Name
The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### JWT Auth Mount Point
The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### Include Certificate Chain
Should the certificate chain be included when performing an enrollment?
###### Mount Point
The base mount point of the secrets engine. If using Vault Namespaces, include the namespace; ie. /
###### Private Key Path
This is the path to the secret that contains the PEM-encoded private key. Optional โ omit for CA trust chain / certificate-only PEM stores that have no private key. Unlike other Key-Value store types, no sibling-secret convention is assumed when this is omitted.
Click to expand details
The Hashicorp Vault Key-Value JKS Certificate Store manages certificates in the JKS format that are stored in the Hashicorp Vault Key-Value secrets engine.
Each JKS file stored as a secret in the Key-Value secrets engine is treated as its own certificate store. This file should be a valid JKS certificate store, and contain a collection of one or more certificates.
The inventory job will catalog the certificates contained within the store. Add/Remove operations will add and remove certificates
#### Hashicorp Vault Key-Value JKS Requirements
#### Secret naming
In order to be managed by this orchestrator extension, a certificate store is comprised of two secret entries:
- The certificate with the naming convention `_jks`
- A secret containing the store passphrase located on the same level. This should be named `passphrase`
This is the convention followed by the certificate store if the full path to the secret is not provided, and no passphrase path is provided.
**As of version 3.2+ of this integration, any secret name can be used, and the passphrase path can be anywhere within an accessable area of the KeyValue secrets engine.**
Additionally, we can read the certificate store and/or passphrase secret from a JSON secret that contains the value on a specific property.
The way to indicate the property name that should be used to retreive the value of the certificate store or passphrase, add a "?" at the end of the path, followed by the property name.
**examples:**
StorePath = `kv-v2/mycerts/myjkscertstore?certData`
> This path indicates that the secret containing the certificate store data is named "myjkscertstore" and is a JSON secret with the `certData` property containing the Base64 encoded certificate store.
>
StorePath = `kv-v2/mycerts/myjkscertstore`
> This path indicates that the entire secret value is the base64 encoded certificate store
> Generally, the paths to the certificate store data and passphrase should be in the following format
> `/?`
This convention applies to both the Store Path and Passphrase Path.
#### Base64 encoding
Certificates should be stored in a base64 encoded format.
One method to encode a binary certificate store is to use the following command in a windows powershell or linux/macOs terminal window:
`c:\> cat | base64`
#### Supported Operations
| Operation | Is Supported |
|--------------|--------------|
| Add | โ
Checked |
| Remove | โ
Checked |
| Discovery | โ
Checked |
| Reenrollment | ๐ฒ Unchecked |
| Create | โ
Checked |
#### Store Type Creation
##### Using kfutil:
`kfutil` is a custom CLI for the Keyfactor Command API and can be used to create certificate store types.
For more information on [kfutil](https://github.com/Keyfactor/kfutil) check out the [docs](https://github.com/Keyfactor/kfutil?tab=readme-ov-file#quickstart)
Click to expand HCVKVJKS kfutil details
##### Using online definition from GitHub:
This will reach out to GitHub and pull the latest store-type definition
```shell
# Hashicorp Vault Key-Value JKS
kfutil store-types create HCVKVJKS
```
##### Offline creation using integration-manifest file:
If required, it is possible to create store types from the [integration-manifest.json](./integration-manifest.json) included in this repo.
You would first download the [integration-manifest.json](./integration-manifest.json) and then run the following command
in your offline environment.
```shell
kfutil store-types create --from-file integration-manifest.json
```
Click to expand manual HCVKVJKS details
Create a store type called `HCVKVJKS` with the attributes in the tables below:
##### Basic Tab
| Attribute | Value | Description |
| --------- | ----- | ----- |
| Name | Hashicorp Vault Key-Value JKS | Display name for the store type (may be customized) |
| Short Name | HCVKVJKS | Short display name for the store type |
| Capability | HCVKVJKS | Store type name orchestrator will register with. Check the box to allow entry of value |
| Supports Add | โ
Checked | Indicates that the Store Type supports Management Add |
| Supports Remove | โ
Checked | Indicates that the Store Type supports Management Remove |
| Supports Discovery | โ
Checked | Indicates that the Store Type supports Discovery |
| Supports Reenrollment | ๐ฒ Unchecked | Indicates that the Store Type supports Reenrollment |
| Supports Create | โ
Checked | Indicates that the Store Type supports store creation |
| Needs Server | โ
Checked | Determines if a target server name is required when creating store |
| Blueprint Allowed | ๐ฒ Unchecked | Determines if store type may be included in an Orchestrator blueprint |
| Uses PowerShell | ๐ฒ Unchecked | Determines if underlying implementation is PowerShell |
| Requires Store Password | ๐ฒ Unchecked | Enables users to optionally specify a store password when defining a Certificate Store. |
| Supports Entry Password | ๐ฒ Unchecked | Determines if an individual entry within a store can have a password. |
The Basic tab should look like this:
##### Advanced Tab
| Attribute | Value | Description |
| --------- | ----- | ----- |
| Supports Custom Alias | Required | Determines if an individual entry within a store can have a custom Alias. |
| Private Key Handling | Optional | This determines if Keyfactor can send the private key associated with a certificate to the store. |
| PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) |
The Advanced tab should look like this:
> For Keyfactor **Command versions 24.4 and later**, a Certificate Format dropdown is available with PFX and PEM options. Ensure that **PFX** is selected, as this determines the format of new and renewed certificates sent to the Orchestrator during a Management job. Currently, all Keyfactor-supported Orchestrator extensions support only PFX.
##### Custom Fields Tab
Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type:
| Name | Display Name | Description | Type | Default Value/Options | Required |
| ---- | ------------ | ---- | --------------------- | -------- | ----------- |
| ServerUsername | Server Username | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 | Secret | | โ
Checked |
| ServerPassword | Server Password | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. | Secret | | ๐ฒ Unchecked |
| UseOAuth | Use OAuth 2.0 (Client Credentials) | Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token. | Bool | false | ๐ฒ Unchecked |
| ClientId | Client ID | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | Secret | | ๐ฒ Unchecked |
| ClientSecret | Client Secret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | Secret | | ๐ฒ Unchecked |
| OAuthUrl | OAuth Token Endpoint | The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | | ๐ฒ Unchecked |
| Scope | OAuth Scope | Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | | ๐ฒ Unchecked |
| VaultRoleName | Vault Role Name | The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | | ๐ฒ Unchecked |
| AuthMountPoint | JWT Auth Mount Point | The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | jwt/ | ๐ฒ Unchecked |
| IncludeCertChain | Include Certificate Chain | Should the certificate chain be included when performing an enrollment? | Bool | false | ๐ฒ Unchecked |
| MountPoint | Mount Point | The base mount point of the secrets engine. If using Vault Namespaces, include the namespace; ie. / | String | | ๐ฒ Unchecked |
| PassphrasePath | Passphrase Path | This is the path to the secret that contains the passphrase to the cert store file. If empty or omitted, assume the secret is named 'passphrase' on the same level as the certificate store secret. | String | | ๐ฒ Unchecked |
The Custom Fields tab should look like this:
###### Server Username
The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200
> [!IMPORTANT]
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
###### Server Password
Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled.
> [!IMPORTANT]
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
###### Use OAuth 2.0 (Client Credentials)
Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token.
###### Client ID
The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### Client Secret
The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### OAuth Token Endpoint
The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### OAuth Scope
Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### Vault Role Name
The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### JWT Auth Mount Point
The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### Include Certificate Chain
Should the certificate chain be included when performing an enrollment?
###### Mount Point
The base mount point of the secrets engine. If using Vault Namespaces, include the namespace; ie. /
###### Passphrase Path
This is the path to the secret that contains the passphrase to the cert store file. If empty or omitted, assume the secret is named 'passphrase' on the same level as the certificate store secret.
Click to expand details
The Hashicorp Vault Key-Value PKCS12 Certificate Store manages certificates in the PKCS12 format that are stored in the Hashicorp Vault Key-Value secrets engine.
Each PKCS12 file stored as a secret in the Key-Value secrets engine is treated as its own certificate store. This file should be a valid PKCS12 certificate store, and contain a collection of one or more certificates.
The inventory job will catalog the certificates contained within the store. Add/Remove operations will add and remove certificates
#### Hashicorp Vault Key-Value PKCS12 Requirements
#### Secret naming
In ordered to be managed by this orchestrator extension, a certificate store is comprised of two secret entries:
- The certificate with the naming convention `_p12`
- A secret containing the store passphrase located on the same level. This should be named `passphrase`
This is the convention followed by the certificate store if the full path to the secret is not provided, and no passphrase path is provided.
**As of version 3.2+ of this integration, any secret name can be used, and the passphrase path can be anywhere within an accessable area of the KeyValue secrets engine.**
Additionally, we can read the certificate store and/or passphrase secret from a JSON secret that contains the value on a specific property.
The way to indicate the property name that should be used to retreive the value of the certificate store or passphrase, add a "?" at the end of the path, followed by the property name.
**examples:**
StorePath = `kv-v2/mycerts/myjkscertstore?certData`
> This path indicates that the secret containing the certificate store data is named "myjkscertstore" and is a JSON secret with the `certData` property containing the Base64 encoded certificate store.
>
StorePath = `kv-v2/mycerts/myjkscertstore`
> This path indicates that the entire secret value is the base64 encoded certificate store
> Generally, the paths to the certificate store data and passphrase should be in the following format
> `//?`
> if namespaces are not used, that section can be omitted.
This convention applies to both the Store Path and Passphrase Path.
#### Base64 encoding
Certificates should be stored in a base64 encoded format.
One method to encode a binary certificate store is to use the following command in a windows powershell or linux/macOs terminal window:
`c:\> cat | base64`
#### Supported Operations
| Operation | Is Supported |
|--------------|--------------|
| Add | โ
Checked |
| Remove | โ
Checked |
| Discovery | โ
Checked |
| Reenrollment | ๐ฒ Unchecked |
| Create | โ
Checked |
#### Store Type Creation
##### Using kfutil:
`kfutil` is a custom CLI for the Keyfactor Command API and can be used to create certificate store types.
For more information on [kfutil](https://github.com/Keyfactor/kfutil) check out the [docs](https://github.com/Keyfactor/kfutil?tab=readme-ov-file#quickstart)
Click to expand HCVKVP12 kfutil details
##### Using online definition from GitHub:
This will reach out to GitHub and pull the latest store-type definition
```shell
# Hashicorp Vault Key-Value PKCS12
kfutil store-types create HCVKVP12
```
##### Offline creation using integration-manifest file:
If required, it is possible to create store types from the [integration-manifest.json](./integration-manifest.json) included in this repo.
You would first download the [integration-manifest.json](./integration-manifest.json) and then run the following command
in your offline environment.
```shell
kfutil store-types create --from-file integration-manifest.json
```
Click to expand manual HCVKVP12 details
Create a store type called `HCVKVP12` with the attributes in the tables below:
##### Basic Tab
| Attribute | Value | Description |
| --------- | ----- | ----- |
| Name | Hashicorp Vault Key-Value PKCS12 | Display name for the store type (may be customized) |
| Short Name | HCVKVP12 | Short display name for the store type |
| Capability | HCVKVP12 | Store type name orchestrator will register with. Check the box to allow entry of value |
| Supports Add | โ
Checked | Indicates that the Store Type supports Management Add |
| Supports Remove | โ
Checked | Indicates that the Store Type supports Management Remove |
| Supports Discovery | โ
Checked | Indicates that the Store Type supports Discovery |
| Supports Reenrollment | ๐ฒ Unchecked | Indicates that the Store Type supports Reenrollment |
| Supports Create | โ
Checked | Indicates that the Store Type supports store creation |
| Needs Server | โ
Checked | Determines if a target server name is required when creating store |
| Blueprint Allowed | ๐ฒ Unchecked | Determines if store type may be included in an Orchestrator blueprint |
| Uses PowerShell | ๐ฒ Unchecked | Determines if underlying implementation is PowerShell |
| Requires Store Password | ๐ฒ Unchecked | Enables users to optionally specify a store password when defining a Certificate Store. |
| Supports Entry Password | ๐ฒ Unchecked | Determines if an individual entry within a store can have a password. |
The Basic tab should look like this:
##### Advanced Tab
| Attribute | Value | Description |
| --------- | ----- | ----- |
| Supports Custom Alias | Required | Determines if an individual entry within a store can have a custom Alias. |
| Private Key Handling | Optional | This determines if Keyfactor can send the private key associated with a certificate to the store. |
| PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) |
The Advanced tab should look like this:
> For Keyfactor **Command versions 24.4 and later**, a Certificate Format dropdown is available with PFX and PEM options. Ensure that **PFX** is selected, as this determines the format of new and renewed certificates sent to the Orchestrator during a Management job. Currently, all Keyfactor-supported Orchestrator extensions support only PFX.
##### Custom Fields Tab
Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type:
| Name | Display Name | Description | Type | Default Value/Options | Required |
| ---- | ------------ | ---- | --------------------- | -------- | ----------- |
| ServerUsername | Server Username | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 | Secret | | โ
Checked |
| ServerPassword | Server Password | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. | Secret | | ๐ฒ Unchecked |
| UseOAuth | Use OAuth 2.0 (Client Credentials) | Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token. | Bool | false | ๐ฒ Unchecked |
| ClientId | Client ID | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | Secret | | ๐ฒ Unchecked |
| ClientSecret | Client Secret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | Secret | | ๐ฒ Unchecked |
| OAuthUrl | OAuth Token Endpoint | The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | | ๐ฒ Unchecked |
| Scope | OAuth Scope | Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | | ๐ฒ Unchecked |
| VaultRoleName | Vault Role Name | The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | | ๐ฒ Unchecked |
| AuthMountPoint | JWT Auth Mount Point | The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | jwt/ | ๐ฒ Unchecked |
| IncludeCertChain | Include Certificate Chain | Should the certificate chain be included when performing an enrollment? | Bool | false | ๐ฒ Unchecked |
| MountPoint | Mount Point | The base mount point of the secrets engine. If using Vault Namespaces, include the namespace; ie. / | String | | ๐ฒ Unchecked |
| PassphrasePath | Passphrase Path | This is the path to the secret that contains the passphrase to the cert store file. If empty or omitted, assume the secret is named 'passphrase' on the same level as the certificate store secret. | String | | ๐ฒ Unchecked |
The Custom Fields tab should look like this:
###### Server Username
The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200
> [!IMPORTANT]
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
###### Server Password
Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled.
> [!IMPORTANT]
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
###### Use OAuth 2.0 (Client Credentials)
Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token.
###### Client ID
The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### Client Secret
The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### OAuth Token Endpoint
The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### OAuth Scope
Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### Vault Role Name
The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### JWT Auth Mount Point
The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### Include Certificate Chain
Should the certificate chain be included when performing an enrollment?
###### Mount Point
The base mount point of the secrets engine. If using Vault Namespaces, include the namespace; ie. /
###### Passphrase Path
This is the path to the secret that contains the passphrase to the cert store file. If empty or omitted, assume the secret is named 'passphrase' on the same level as the certificate store secret.
Click to expand details
The Hashicorp Vault Key-Value PFX Certificate Store manages certificates in the PFX format that are stored in the Hashicorp Vault Key-Value secrets engine.
Each PFX file stored as a secret in the Key-Value secrets engine is treated as its own certificate store. This file should be a valid PFX certificate store, and contain a collection of one or more certificates.
The inventory job will catalog the certificates contained within the store. Add/Remove operations will add and remove certificates
#### Hashicorp Vault Key-Value PFX Requirements
#### Secret naming
In ordered to be managed by this orchestrator extension, a certificate store is comprised of two secret entries:
- The certificate with the naming convention `_pfx`
- A secret containing the store passphrase located on the same level. This should be named `passphrase`
This is the convention followed by the certificate store if the full path to the secret is not provided, and no passphrase path is provided.
**As of version 3.2+ of this integration, any secret name can be used, and the passphrase path can be anywhere within an accessable area of the KeyValue secrets engine.**
Additionally, we can read the certificate store and/or passphrase secret from a JSON secret that contains the value on a specific property.
The way to indicate the property name that should be used to retreive the value of the certificate store or passphrase, add a "?" at the end of the path, followed by the property name.
**examples:**
StorePath = `kv-v2/mycerts/myjkscertstore?certData`
> This path indicates that the secret containing the certificate store data is named "myjkscertstore" and is a JSON secret with the `certData` property containing the Base64 encoded certificate store.
>
StorePath = `kv-v2/mycerts/myjkscertstore`
> This path indicates that the entire secret value is the base64 encoded certificate store
> Generally, the paths to the certificate store data and passphrase should be in the following format
> `//?`
> if namespaces are not used, that section can be omitted.
This convention applies to both the Store Path and Passphrase Path.
#### Base64 encoding
Certificates should be stored in a base64 encoded format.
One method to encode a binary certificate store is to use the following command in a windows powershell or linux/macOs terminal window:
`c:\> cat | base64`
#### Supported Operations
| Operation | Is Supported |
|--------------|--------------|
| Add | โ
Checked |
| Remove | โ
Checked |
| Discovery | โ
Checked |
| Reenrollment | ๐ฒ Unchecked |
| Create | โ
Checked |
#### Store Type Creation
##### Using kfutil:
`kfutil` is a custom CLI for the Keyfactor Command API and can be used to create certificate store types.
For more information on [kfutil](https://github.com/Keyfactor/kfutil) check out the [docs](https://github.com/Keyfactor/kfutil?tab=readme-ov-file#quickstart)
Click to expand HCVKVPFX kfutil details
##### Using online definition from GitHub:
This will reach out to GitHub and pull the latest store-type definition
```shell
# Hashicorp Vault Key-Value PFX
kfutil store-types create HCVKVPFX
```
##### Offline creation using integration-manifest file:
If required, it is possible to create store types from the [integration-manifest.json](./integration-manifest.json) included in this repo.
You would first download the [integration-manifest.json](./integration-manifest.json) and then run the following command
in your offline environment.
```shell
kfutil store-types create --from-file integration-manifest.json
```
Click to expand manual HCVKVPFX details
Create a store type called `HCVKVPFX` with the attributes in the tables below:
##### Basic Tab
| Attribute | Value | Description |
| --------- | ----- | ----- |
| Name | Hashicorp Vault Key-Value PFX | Display name for the store type (may be customized) |
| Short Name | HCVKVPFX | Short display name for the store type |
| Capability | HCVKVPFX | Store type name orchestrator will register with. Check the box to allow entry of value |
| Supports Add | โ
Checked | Indicates that the Store Type supports Management Add |
| Supports Remove | โ
Checked | Indicates that the Store Type supports Management Remove |
| Supports Discovery | โ
Checked | Indicates that the Store Type supports Discovery |
| Supports Reenrollment | ๐ฒ Unchecked | Indicates that the Store Type supports Reenrollment |
| Supports Create | โ
Checked | Indicates that the Store Type supports store creation |
| Needs Server | โ
Checked | Determines if a target server name is required when creating store |
| Blueprint Allowed | ๐ฒ Unchecked | Determines if store type may be included in an Orchestrator blueprint |
| Uses PowerShell | ๐ฒ Unchecked | Determines if underlying implementation is PowerShell |
| Requires Store Password | ๐ฒ Unchecked | Enables users to optionally specify a store password when defining a Certificate Store. |
| Supports Entry Password | ๐ฒ Unchecked | Determines if an individual entry within a store can have a password. |
The Basic tab should look like this:
##### Advanced Tab
| Attribute | Value | Description |
| --------- | ----- | ----- |
| Supports Custom Alias | Required | Determines if an individual entry within a store can have a custom Alias. |
| Private Key Handling | Optional | This determines if Keyfactor can send the private key associated with a certificate to the store. |
| PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) |
The Advanced tab should look like this:
> For Keyfactor **Command versions 24.4 and later**, a Certificate Format dropdown is available with PFX and PEM options. Ensure that **PFX** is selected, as this determines the format of new and renewed certificates sent to the Orchestrator during a Management job. Currently, all Keyfactor-supported Orchestrator extensions support only PFX.
##### Custom Fields Tab
Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type:
| Name | Display Name | Description | Type | Default Value/Options | Required |
| ---- | ------------ | ---- | --------------------- | -------- | ----------- |
| ServerUsername | Server Username | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 | Secret | | โ
Checked |
| ServerPassword | Server Password | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. | Secret | | ๐ฒ Unchecked |
| UseOAuth | Use OAuth 2.0 (Client Credentials) | Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token. | Bool | false | ๐ฒ Unchecked |
| ClientId | Client ID | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | Secret | | ๐ฒ Unchecked |
| ClientSecret | Client Secret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | Secret | | ๐ฒ Unchecked |
| OAuthUrl | OAuth Token Endpoint | The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | | ๐ฒ Unchecked |
| Scope | OAuth Scope | Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | | ๐ฒ Unchecked |
| VaultRoleName | Vault Role Name | The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | | ๐ฒ Unchecked |
| AuthMountPoint | JWT Auth Mount Point | The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. | String | jwt/ | ๐ฒ Unchecked |
| IncludeCertChain | Include Certificate Chain | Should the certificate chain be included when performing an enrollment? | Bool | false | ๐ฒ Unchecked |
| MountPoint | Mount Point | The base mount point of the secrets engine. If using Vault Namespaces, include the namespace; ie. / | String | | ๐ฒ Unchecked |
| PassphrasePath | Passphrase Path | This is the path to the secret that contains the passphrase to the cert store file. If empty or omitted, assume the secret is named 'passphrase' on the same level as the certificate store secret. | String | | ๐ฒ Unchecked |
The Custom Fields tab should look like this:
###### Server Username
The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200
> [!IMPORTANT]
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
###### Server Password
Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled.
> [!IMPORTANT]
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
###### Use OAuth 2.0 (Client Credentials)
Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token.
###### Client ID
The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### Client Secret
The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### OAuth Token Endpoint
The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### OAuth Scope
Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### Vault Role Name
The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### JWT Auth Mount Point
The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled.
###### Include Certificate Chain
Should the certificate chain be included when performing an enrollment?
###### Mount Point
The base mount point of the secrets engine. If using Vault Namespaces, include the namespace; ie. /
###### Passphrase Path
This is the path to the secret that contains the passphrase to the cert store file. If empty or omitted, assume the secret is named 'passphrase' on the same level as the certificate store secret.
Hashicorp Vault PKI (HCVPKI)
### Store Creation
#### Manually with the Command UI
Click to expand details
1. **Navigate to the _Certificate Stores_ page in Keyfactor Command.**
Log into Keyfactor Command, toggle the _Locations_ dropdown, and click _Certificate Stores_.
2. **Add a Certificate Store.**
Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form.
| Attribute | Description |
| --------- | ----------- |
| Category | Select "Hashicorp Vault PKI" or the customized certificate store name from the previous step. |
| Container | Optional container to associate certificate store with. |
| Client Machine | This can be any value to help uniquely identify the store. It is not used by this integration. |
| Store Path | For HCVPKI, this will be '/' |
| Store Password | Vault token that will be used for authenticating |
| Orchestrator | Select an approved orchestrator capable of managing `HCVPKI` certificates. Specifically, one with the `HCVPKI` capability. |
| ServerUsername | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 |
| ServerPassword | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| UseOAuth | Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token. |
| ClientId | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| ClientSecret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| OAuthUrl | The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Scope | Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| VaultRoleName | The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| AuthMountPoint | The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| MountPoint | This is the mount point of the instance of the PKI or Keyfactor secrets engine plugin. If using enterprise namespaces: / |
| PassphrasePath | This is the path to the secret that contains the passphrase to the cert store file. If empty or omitted, assume the secret is named 'passphrase' on the same level as the certificate store secret. |
Click to expand details
1. **Generate a CSV template for the HCVPKI certificate store**
```shell
kfutil stores import generate-template --store-type-name HCVPKI --outpath HCVPKI.csv
```
2. **Populate the generated CSV file**
Open the CSV file, and reference the table below to populate parameters for each **Attribute**.
| Attribute | Description |
| --------- | ----------- |
| Category | Select "Hashicorp Vault PKI" or the customized certificate store name from the previous step. |
| Container | Optional container to associate certificate store with. |
| Client Machine | This can be any value to help uniquely identify the store. It is not used by this integration. |
| Store Path | For HCVPKI, this will be '/' |
| Store Password | Vault token that will be used for authenticating |
| Orchestrator | Select an approved orchestrator capable of managing `HCVPKI` certificates. Specifically, one with the `HCVPKI` capability. |
| Properties.ServerUsername | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 |
| Properties.ServerPassword | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.UseOAuth | Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token. |
| Properties.ClientId | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.ClientSecret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.OAuthUrl | The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.Scope | Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.VaultRoleName | The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.AuthMountPoint | The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.MountPoint | This is the mount point of the instance of the PKI or Keyfactor secrets engine plugin. If using enterprise namespaces: / |
| Properties.PassphrasePath | This is the path to the secret that contains the passphrase to the cert store file. If empty or omitted, assume the secret is named 'passphrase' on the same level as the certificate store secret. |
3. **Import the CSV file to create the certificate stores**
```shell
kfutil stores import csv --store-type-name HCVPKI --file HCVPKI.csv
```
Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator
If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_.
| Attribute | Description |
| --------- | ----------- |
| ServerUsername | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 |
| ServerPassword | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| ClientId | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| ClientSecret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
Please refer to the **Universal Orchestrator (remote)** usage section ([PAM providers on the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam)) for your selected PAM provider for instructions on how to load attributes orchestrator-side.
> Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself.
Hashicorp Vault Key-Value PEM (HCVKVPEM)
### Store Creation
#### Manually with the Command UI
Click to expand details
1. **Navigate to the _Certificate Stores_ page in Keyfactor Command.**
Log into Keyfactor Command, toggle the _Locations_ dropdown, and click _Certificate Stores_.
2. **Add a Certificate Store.**
Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form.
| Attribute | Description |
| --------- | ----------- |
| Category | Select "Hashicorp Vault Key-Value PEM" or the customized certificate store name from the previous step. |
| Container | Optional container to associate certificate store with. |
| Client Machine | This can be any value to help uniquely identify the store. It is not used by this integration. |
| Store Path | This is the path to the secret containing the certificate. |
| Store Password | Vault token that will be used for authenticating |
| Orchestrator | Select an approved orchestrator capable of managing `HCVKVPEM` certificates. Specifically, one with the `HCVKVPEM` capability. |
| ServerUsername | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 |
| ServerPassword | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| UseOAuth | Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token. |
| ClientId | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| ClientSecret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| OAuthUrl | The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Scope | Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| VaultRoleName | The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| AuthMountPoint | The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| IncludeCertChain | Should the certificate chain be included when performing an enrollment? |
| MountPoint | The base mount point of the secrets engine. If using Vault Namespaces, include the namespace; ie. / |
| PrivateKeyPath | This is the path to the secret that contains the PEM-encoded private key. Optional โ omit for CA trust chain / certificate-only PEM stores that have no private key. Unlike other Key-Value store types, no sibling-secret convention is assumed when this is omitted. |
Click to expand details
1. **Generate a CSV template for the HCVKVPEM certificate store**
```shell
kfutil stores import generate-template --store-type-name HCVKVPEM --outpath HCVKVPEM.csv
```
2. **Populate the generated CSV file**
Open the CSV file, and reference the table below to populate parameters for each **Attribute**.
| Attribute | Description |
| --------- | ----------- |
| Category | Select "Hashicorp Vault Key-Value PEM" or the customized certificate store name from the previous step. |
| Container | Optional container to associate certificate store with. |
| Client Machine | This can be any value to help uniquely identify the store. It is not used by this integration. |
| Store Path | This is the path to the secret containing the certificate. |
| Store Password | Vault token that will be used for authenticating |
| Orchestrator | Select an approved orchestrator capable of managing `HCVKVPEM` certificates. Specifically, one with the `HCVKVPEM` capability. |
| Properties.ServerUsername | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 |
| Properties.ServerPassword | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.UseOAuth | Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token. |
| Properties.ClientId | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.ClientSecret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.OAuthUrl | The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.Scope | Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.VaultRoleName | The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.AuthMountPoint | The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.IncludeCertChain | Should the certificate chain be included when performing an enrollment? |
| Properties.MountPoint | The base mount point of the secrets engine. If using Vault Namespaces, include the namespace; ie. / |
| Properties.PrivateKeyPath | This is the path to the secret that contains the PEM-encoded private key. Optional โ omit for CA trust chain / certificate-only PEM stores that have no private key. Unlike other Key-Value store types, no sibling-secret convention is assumed when this is omitted. |
3. **Import the CSV file to create the certificate stores**
```shell
kfutil stores import csv --store-type-name HCVKVPEM --file HCVKVPEM.csv
```
Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator
If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_.
| Attribute | Description |
| --------- | ----------- |
| ServerUsername | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 |
| ServerPassword | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| ClientId | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| ClientSecret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
Please refer to the **Universal Orchestrator (remote)** usage section ([PAM providers on the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam)) for your selected PAM provider for instructions on how to load attributes orchestrator-side.
> Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself.
Hashicorp Vault Key-Value JKS (HCVKVJKS)
### Store Creation
#### Manually with the Command UI
Click to expand details
1. **Navigate to the _Certificate Stores_ page in Keyfactor Command.**
Log into Keyfactor Command, toggle the _Locations_ dropdown, and click _Certificate Stores_.
2. **Add a Certificate Store.**
Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form.
| Attribute | Description |
| --------- | ----------- |
| Category | Select "Hashicorp Vault Key-Value JKS" or the customized certificate store name from the previous step. |
| Container | Optional container to associate certificate store with. |
| Client Machine | This can be any value to help uniquely identify the store. It is not used by this integration. |
| Store Path | This is the path to the secret containing the store. |
| Store Password | Vault token that will be used for authenticating |
| Orchestrator | Select an approved orchestrator capable of managing `HCVKVJKS` certificates. Specifically, one with the `HCVKVJKS` capability. |
| ServerUsername | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 |
| ServerPassword | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| UseOAuth | Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token. |
| ClientId | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| ClientSecret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| OAuthUrl | The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Scope | Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| VaultRoleName | The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| AuthMountPoint | The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| IncludeCertChain | Should the certificate chain be included when performing an enrollment? |
| MountPoint | The base mount point of the secrets engine. If using Vault Namespaces, include the namespace; ie. / |
| PassphrasePath | This is the path to the secret that contains the passphrase to the cert store file. If empty or omitted, assume the secret is named 'passphrase' on the same level as the certificate store secret. |
Click to expand details
1. **Generate a CSV template for the HCVKVJKS certificate store**
```shell
kfutil stores import generate-template --store-type-name HCVKVJKS --outpath HCVKVJKS.csv
```
2. **Populate the generated CSV file**
Open the CSV file, and reference the table below to populate parameters for each **Attribute**.
| Attribute | Description |
| --------- | ----------- |
| Category | Select "Hashicorp Vault Key-Value JKS" or the customized certificate store name from the previous step. |
| Container | Optional container to associate certificate store with. |
| Client Machine | This can be any value to help uniquely identify the store. It is not used by this integration. |
| Store Path | This is the path to the secret containing the store. |
| Store Password | Vault token that will be used for authenticating |
| Orchestrator | Select an approved orchestrator capable of managing `HCVKVJKS` certificates. Specifically, one with the `HCVKVJKS` capability. |
| Properties.ServerUsername | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 |
| Properties.ServerPassword | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.UseOAuth | Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token. |
| Properties.ClientId | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.ClientSecret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.OAuthUrl | The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.Scope | Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.VaultRoleName | The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.AuthMountPoint | The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.IncludeCertChain | Should the certificate chain be included when performing an enrollment? |
| Properties.MountPoint | The base mount point of the secrets engine. If using Vault Namespaces, include the namespace; ie. / |
| Properties.PassphrasePath | This is the path to the secret that contains the passphrase to the cert store file. If empty or omitted, assume the secret is named 'passphrase' on the same level as the certificate store secret. |
3. **Import the CSV file to create the certificate stores**
```shell
kfutil stores import csv --store-type-name HCVKVJKS --file HCVKVJKS.csv
```
Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator
If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_.
| Attribute | Description |
| --------- | ----------- |
| ServerUsername | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 |
| ServerPassword | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| ClientId | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| ClientSecret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
Please refer to the **Universal Orchestrator (remote)** usage section ([PAM providers on the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam)) for your selected PAM provider for instructions on how to load attributes orchestrator-side.
> Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself.
Hashicorp Vault Key-Value PKCS12 (HCVKVP12)
### Store Creation
#### Manually with the Command UI
Click to expand details
1. **Navigate to the _Certificate Stores_ page in Keyfactor Command.**
Log into Keyfactor Command, toggle the _Locations_ dropdown, and click _Certificate Stores_.
2. **Add a Certificate Store.**
Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form.
| Attribute | Description |
| --------- | ----------- |
| Category | Select "Hashicorp Vault Key-Value PKCS12" or the customized certificate store name from the previous step. |
| Container | Optional container to associate certificate store with. |
| Client Machine | This can be any value to help uniquely identify the store. It is not used by this integration. |
| Store Path | This is the path to the secret containing the store. |
| Store Password | Vault token that will be used for authenticating |
| Orchestrator | Select an approved orchestrator capable of managing `HCVKVP12` certificates. Specifically, one with the `HCVKVP12` capability. |
| ServerUsername | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 |
| ServerPassword | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| UseOAuth | Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token. |
| ClientId | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| ClientSecret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| OAuthUrl | The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Scope | Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| VaultRoleName | The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| AuthMountPoint | The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| IncludeCertChain | Should the certificate chain be included when performing an enrollment? |
| MountPoint | The base mount point of the secrets engine. If using Vault Namespaces, include the namespace; ie. / |
| PassphrasePath | This is the path to the secret that contains the passphrase to the cert store file. If empty or omitted, assume the secret is named 'passphrase' on the same level as the certificate store secret. |
Click to expand details
1. **Generate a CSV template for the HCVKVP12 certificate store**
```shell
kfutil stores import generate-template --store-type-name HCVKVP12 --outpath HCVKVP12.csv
```
2. **Populate the generated CSV file**
Open the CSV file, and reference the table below to populate parameters for each **Attribute**.
| Attribute | Description |
| --------- | ----------- |
| Category | Select "Hashicorp Vault Key-Value PKCS12" or the customized certificate store name from the previous step. |
| Container | Optional container to associate certificate store with. |
| Client Machine | This can be any value to help uniquely identify the store. It is not used by this integration. |
| Store Path | This is the path to the secret containing the store. |
| Store Password | Vault token that will be used for authenticating |
| Orchestrator | Select an approved orchestrator capable of managing `HCVKVP12` certificates. Specifically, one with the `HCVKVP12` capability. |
| Properties.ServerUsername | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 |
| Properties.ServerPassword | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.UseOAuth | Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token. |
| Properties.ClientId | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.ClientSecret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.OAuthUrl | The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.Scope | Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.VaultRoleName | The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.AuthMountPoint | The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.IncludeCertChain | Should the certificate chain be included when performing an enrollment? |
| Properties.MountPoint | The base mount point of the secrets engine. If using Vault Namespaces, include the namespace; ie. / |
| Properties.PassphrasePath | This is the path to the secret that contains the passphrase to the cert store file. If empty or omitted, assume the secret is named 'passphrase' on the same level as the certificate store secret. |
3. **Import the CSV file to create the certificate stores**
```shell
kfutil stores import csv --store-type-name HCVKVP12 --file HCVKVP12.csv
```
Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator
If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_.
| Attribute | Description |
| --------- | ----------- |
| ServerUsername | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 |
| ServerPassword | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| ClientId | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| ClientSecret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
Please refer to the **Universal Orchestrator (remote)** usage section ([PAM providers on the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam)) for your selected PAM provider for instructions on how to load attributes orchestrator-side.
> Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself.
Hashicorp Vault Key-Value PFX (HCVKVPFX)
### Store Creation
#### Manually with the Command UI
Click to expand details
1. **Navigate to the _Certificate Stores_ page in Keyfactor Command.**
Log into Keyfactor Command, toggle the _Locations_ dropdown, and click _Certificate Stores_.
2. **Add a Certificate Store.**
Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form.
| Attribute | Description |
| --------- | ----------- |
| Category | Select "Hashicorp Vault Key-Value PFX" or the customized certificate store name from the previous step. |
| Container | Optional container to associate certificate store with. |
| Client Machine | This can be any value to help uniquely identify the store. It is not used by this integration. |
| Store Path | This is the path to the secret containing the store. |
| Store Password | Vault token that will be used for authenticating |
| Orchestrator | Select an approved orchestrator capable of managing `HCVKVPFX` certificates. Specifically, one with the `HCVKVPFX` capability. |
| ServerUsername | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 |
| ServerPassword | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| UseOAuth | Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token. |
| ClientId | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| ClientSecret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| OAuthUrl | The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Scope | Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| VaultRoleName | The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| AuthMountPoint | The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| IncludeCertChain | Should the certificate chain be included when performing an enrollment? |
| MountPoint | The base mount point of the secrets engine. If using Vault Namespaces, include the namespace; ie. / |
| PassphrasePath | This is the path to the secret that contains the passphrase to the cert store file. If empty or omitted, assume the secret is named 'passphrase' on the same level as the certificate store secret. |
Click to expand details
1. **Generate a CSV template for the HCVKVPFX certificate store**
```shell
kfutil stores import generate-template --store-type-name HCVKVPFX --outpath HCVKVPFX.csv
```
2. **Populate the generated CSV file**
Open the CSV file, and reference the table below to populate parameters for each **Attribute**.
| Attribute | Description |
| --------- | ----------- |
| Category | Select "Hashicorp Vault Key-Value PFX" or the customized certificate store name from the previous step. |
| Container | Optional container to associate certificate store with. |
| Client Machine | This can be any value to help uniquely identify the store. It is not used by this integration. |
| Store Path | This is the path to the secret containing the store. |
| Store Password | Vault token that will be used for authenticating |
| Orchestrator | Select an approved orchestrator capable of managing `HCVKVPFX` certificates. Specifically, one with the `HCVKVPFX` capability. |
| Properties.ServerUsername | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 |
| Properties.ServerPassword | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.UseOAuth | Enables OAuth 2.0 Client Credentials authentication: the orchestrator obtains a JWT from the configured IdP (e.g. PingFederate, Microsoft Entra ID) and exchanges it for a short-lived Vault token via Vault's JWT auth method, instead of using a static 'Server Password' Vault token. |
| Properties.ClientId | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.ClientSecret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.OAuthUrl | The IdP's OAuth 2.0 token endpoint URL used to obtain a JWT via the Client Credentials grant. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.Scope | Optional OAuth 2.0 scope to request from the IdP (e.g. Entra ID typically needs 'api:///.default'). Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.VaultRoleName | The name of the Vault role, configured under the JWT auth mount (e.g. 'auth/jwt/role/'), to authenticate against using the JWT obtained from the IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.AuthMountPoint | The mount point of Vault's JWT auth method used to exchange the IdP-issued JWT for a Vault token. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| Properties.IncludeCertChain | Should the certificate chain be included when performing an enrollment? |
| Properties.MountPoint | The base mount point of the secrets engine. If using Vault Namespaces, include the namespace; ie. / |
| Properties.PassphrasePath | This is the path to the secret that contains the passphrase to the cert store file. If empty or omitted, assume the secret is named 'passphrase' on the same level as the certificate store secret. |
3. **Import the CSV file to create the certificate stores**
```shell
kfutil stores import csv --store-type-name HCVKVPFX --file HCVKVPFX.csv
```
Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator
If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_.
| Attribute | Description |
| --------- | ----------- |
| ServerUsername | The base URI (and port) to the instance of Hashicorp Vault ex: https://localhost:8200 |
| ServerPassword | Vault token that will be used by the Orchestrator integration for authenticating and performing operations in the Vault instance. Required unless 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| ClientId | The OAuth 2.0 Client ID registered with your IdP. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
| ClientSecret | The OAuth 2.0 Client Secret for the above Client ID. Only used when 'Use OAuth 2.0 (Client Credentials)' is enabled. |
Please refer to the **Universal Orchestrator (remote)** usage section ([PAM providers on the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam)) for your selected PAM provider for instructions on how to load attributes orchestrator-side.
> Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself.
Hashicorp Vault Key-Value PEM
### Hashicorp Vault Key-Value PEM Discovery Job
When the discovery job is executed, it will scan the provided vault path, and any sub-paths contained within it.
The certificate store entry is returned from a discovery job when..
1. A secret entry is found with a key ending in the configured Discovery Suffix (defaults to `_pem`; see below).
1. The entry for the certificate contains the PEM formatted certificate file.
**Note**: Key/Value secrets that do not include a key ending in the Discovery Suffix will be ignored during discovery.
Set the following fields to configure a discovery job for PEM Certificate Stores:
- **Client Machine** - any string; it is unused by the Discovery job
- **SERVER USERNAME** - the full URL to the instance of Vault
- **SERVER PASSWORD** - the Vault Token to be used by the Orchestrator for authenticating into Vault
- **Directories to Search** - used to restrict the certificate store search to a sub-path within the Secrets Engine
- **Extensions** - The namespace (if used) and mount-point of the secrets engine to search.
- **Discovery Suffix** (custom job property) - Overrides the default secret-key-name suffix (`_pem`) Discovery uses to identify candidate PEM certificate secrets. Use this if your organization's secret-naming convention doesn't end in `_pem`.
> :warning: *If your mount point is different than the default "kv-v2" and/or enterprise namespaces are used, you should enter the mount point and namespace into the "Extensions" field in order for discovery to work. Also, if you need to scope discovery to a sub-path rather than the root of the engine mount point, enter that in the "Directories to search" field.*
**Note**: The discovery job will return a collection of secret paths beneath the provided root path whose keys end in the configured Discovery Suffix.
Hashicorp Vault Key-Value JKS
### Hashicorp Vault Key-Value JKS Discovery Job
When the discovery job is executed, it will scan the provided vault path, and any sub-paths contained within it.
The certificate store entry is returned from a discovery job when..
1. A secret entry is found that includes the `_jks` suffix.
1. There is an entry named `passphrase` that contains the password for the store on the same level.
1. The entry for the certificate contain the base64 encoded certificate file.
> :warning:
> While any secret and passphrase location can be used, the discovery job can only discover certificate stores that follow the default convention.
> If you store your certificate stores and passphrases with another convention, the discovery job will not work in that case.
Set the following fields to configure a discovery job for JKS Certificate Stores:
- **Client Machine** - any string; it is unused by the Discovery job
- **SERVER USERNAME** - the full URL to the instance of Vault
- **SERVER PASSWORD** - the Vault Token to be used by the Orchestrator for authenticating into Vault
- **Directories to Search** - used to restrict the certificate store search to a sub-path within the Secrets Engine
- **Extensions** - The namespace (if used) and mount-point of the secrets engine to search.
- **Discovery Suffix** (custom job property) - Overrides the default secret-key-name suffix (`_jks`) Discovery uses to identify candidate JKS certificate secrets. Use this if your organization's secret-naming convention doesn't end in `_jks`.
> :warning: *If your mount point is different than the default "kv-v2" and/or enterprise namespaces are used, you should enter the mount point and namespace into the "Extensions" field in order for discovery to work. Also, if you need to scope discovery to a sub-path rather than the root of the engine mount point, enter that in the "Directories to search" field.*
**Note**: The image shows an example configuration for a Discovery job with the HCVKVPEM store type, but the same approach is used across all of the store types.
Hashicorp Vault Key-Value PKCS12
### Hashicorp Vault Key-Value PKCS12 Discovery Job
When the discovery job is executed, it will scan the provided vault path, and any sub-paths contained within it.
The certificate store entry is returned from a discovery job when..
1. A secret entry is found that includes the `_p12` suffix.
1. There is an entry named `passphrase` that contains the password for the store on the same level.
1. The entry for the certificate contain the base64 encoded certificate file.
> :warning:
> While any secret and passphrase location can be used, the discovery job can only discover certificate stores that follow the default convention.
> If you store your certificate stores and passphrases with another convention, the discovery job will not work in that case.
Set the following fields to configure a discovery job for PKCS12 Certificate Stores:
- **Client Machine** - any string; it is unused by the Discovery job
- **SERVER USERNAME** - the full URL to the instance of Vault
- **SERVER PASSWORD** - the Vault Token to be used by the Orchestrator for authenticating into Vault
- **Directories to Search** - used to restrict the certificate store search to a sub-path within the Secrets Engine
- **Extensions** - The namespace (if used) and mount-point of the secrets engine to search.
- **Discovery Suffix** (custom job property) - Overrides the default secret-key-name suffix (`_p12`) Discovery uses to identify candidate PKCS12 certificate secrets. Use this if your organization's secret-naming convention doesn't end in `_p12`.
> :warning: *If your mount point is different than the default "kv-v2" and/or enterprise namespaces are used, you should enter the mount point and namespace into the "Extensions" field in order for discovery to work. Also, if you need to scope discovery to a sub-path rather than the root of the engine mount point, enter that in the "Directories to search" field.*
**Note**: The image shows an example configuration for a Discovery job with the HCVKVPEM store type, but the same approach is used across all of the store types.
Hashicorp Vault Key-Value PFX
### Hashicorp Vault Key-Value PFX Discovery Job
When the discovery job is executed, it will scan the provided vault path, and any sub-paths contained within it.
The certificate store entry is returned from a discovery job when..
1. A secret entry is found that includes the `_pfx` suffix.
1. There is an entry named `passphrase` that contains the password for the store on the same level.
1. The entry for the certificate contain the base64 encoded certificate file.
> :warning:
> While any secret and passphrase location can be used, the discovery job can only discover certificate stores that follow the default convention.
> If you store your certificate stores and passphrases with another convention, the discovery job will not work in that case.
Set the following fields to configure a discovery job for PFX Certificate Stores:
- **Client Machine** - any string; it is unused by the Discovery job
- **SERVER USERNAME** - the full URL to the instance of Vault
- **SERVER PASSWORD** - the Vault Token to be used by the Orchestrator for authenticating into Vault
- **Directories to Search** - used to restrict the certificate store search to a sub-path within the Secrets Engine
- **Extensions** - The namespace (if used) and mount-point of the secrets engine to search.
- **Discovery Suffix** (custom job property) - Overrides the default secret-key-name suffix (`_pfx`) Discovery uses to identify candidate PFX certificate secrets. Use this if your organization's secret-naming convention doesn't end in `_pfx`.
> :warning: *If your mount point is different than the default "kv-v2" and/or enterprise namespaces are used, you should enter the mount point and namespace into the "Extensions" field in order for discovery to work. Also, if you need to scope discovery to a sub-path rather than the root of the engine mount point, enter that in the "Directories to search" field.*
**Note**: The image shows an example configuration for a Discovery job with the HCVKVPEM store type, but the same approach is used across all of the store types.