Services: Universal Orchestrator Configuration with OAuth

Universal Orchestrator Configuration

By choosing OAuth the window expands and the Universal Orchestrator Configuration opens.

1. Command Agents URL (required):
   Enter the URL of the orchestrator API on the Keyfactor Command server.
   Keyfactor/Agents endpoint e.g.: https://your-server.example.com/Keyfactor/Agents

2. Orchestrator Name (required):
   Enter the name the orchestrator uses to register in Keyfactor Command.

3. Log Level:
   Select from the drop down menu the logging verbosity level. Logging verbosity

   

OAuth Configuration

1. Token URL (required):
   Enter the URL of the token endpoint for your identity provider.

2. Client ID (required):
   Enter the OAuth client identifier.

3. Client Secret (required):
   Enter the OAuth client secret.

4. Scope:
   Restrict the scope(s) of access if required by the Command configuration.
   Multiple scopes should be separated by spaces.

5. Audience:
   Specify the token recipient if required by the Command configuration

6. Token Lifetime minutes (required):
   Set how long OAuth tokens remain valid (default: 60)

Universal Orchestrator Truststore

The orchestrator uses HTTPS to communicate with Keyfactor Command.

Configuring the Truststore:

1. Add trusted certificate authorities to specify which certificate authorities the Universal Orchestrator should trust when connecting to Keyfactor Command.

2. Click Upload Trusted CA.

3. Upload the CA certificate(s) that signed the Command server’s TLS certificate in PEM format.
   If using an intermediate certificate authority, upload all certificates in the chain.

4. Click Save to apply the configuration.
   

   

5. The Orchestrator is automatically registered in Command.

6. Verify the connection in Command by checking the orchestrator status.