Custom Platform Appears to support API Key Operations but it is not documented

[aamburnArcher]

Hi,

Safeguard for Privileged Passwords has added support for the following API Key management tasks:

ChangeApiKey
CheckApiKey

When added to a Custom Platform Script, they are accepted as Platform Task Operations (no error is thrown) and SPP recognizes the tasks.

However, they are not documented as supported Platform Tasks in the SafeguardCustomPlatform Wiki Documentation.

REPRO STEPS

1. Download a sample platform script.
2. Copy the ChangePassword Platform task. Rename it to ChangeApiKey.
3. Copy the CheckPAssword Platform task. Rename it to CheckApiKey.
4. Log into SPP and navigate to Asset Management > Connect and Platforms
5. Create a new Custom Platform Script and upload the edited script.
6. Note "Details" tab shows ChangeApiKey and CheckApiKey as Supported Operations.

EXPECTED BEHAVIOR

If API Key operations are truly supported (that is, if underlying logic will actually support their use, and this isn't a false positive in Custom Platform Script function validation), then it would be expected for documentation to be updated to describe supported parameters and proper usage of the Operations. This would be the preferred case.

If they aren't, then it would be expected that the Custom Platform Script validation would fail in SPP.

The same condition may exist for other new(-er) Platform Tasks, though my testing did not verify.

[VVargaOI]

@aamburnArcher Thanks for the info!
As most API keys get generated by the target asset upon rotation, the fact that the ChangeApiKey and CheckApiKey operations are accepted by SPP does not mean that we can practically use them. For that #37 was necessary too.

[aamburnArcher]

Hi Victor,

Thanks for getting back to me. I agree that the enhancement requested to be able to "write back" the API credential would make the ChangeApiKey operation useful.

However, the parameters required for a CheckApiKey operation are still not documented. For example, this sample script clearly defines the parameters required by CheckPassword:

https://github.com/OneIdentity/SafeguardCustomPlatform/blob/master/SampleScripts/SSH/GenericLinuxWithAD.json

Can I pass in the ClientId and ClientSecret as follows?

{ "ClientId": { "Type": "Secret", "Required": true } }, { "ClientSecret": { "Type": "Secret", "Required": true } },

I can test when time allows.