Keyfactor API appsetting.json File

The KeyfactorAPI appsettings.json configuration file allows you to view or change the Keyfactor Command Keyfactor APIClosed An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. configuration settings.

Windows Installations Under IIS

To update the appsettings.json file:

  1. Navigate to the KeyfactorAPI\Configuration folder on your server, located by default at:

    C:\Program Files\Keyfactor\Keyfactor Platform\KeyfactorAPI\Configuration
  2. Browse to open the appsettings.json file in a text editor (for example, Notepad) and adjust the values as needed.
  3. Save the files.
Copy
Sample Keyfactor API appsettings.json File
{
  "NLogConfigFile": "Configuration/NLog_KeyfactorAPI.config",
  "NLogPoller": {
    "Enabled": false,
    "PollingInterval": 10
  },
  "ExtensionsDirectory": "Extensions",
  "ActiveDirectoryEnforced": false,
  "SqlRetryConfiguration": {
    "NumberOfTries": "5",
    "DeltaTime": "00:00:00.5",
    "MaxTimeInterval": "00:02:00"
  }
}

Container Installations Under Kubernetes

The configurations from the appsettings.json file can be updated in one of two ways for container installations:

  • To update one or two settings, set an environment variable in your custom values file.

  • To update a large number of settings or the entire contents of the appsettings.json file, create a ConfigMap containing the appsettings.json file contents and mount it as a volume to replace the existing appsettings.json file.

Note:  Some appsettings.json settings are overridden by environment variables in a standard installation, so don’t assume that the values you see in an appsettings.json file if you view it within a started container are actually the values in use. Be sure to check for environment variables as well. Environment variables take precedence over values of the same name from the appsettings.json file. For example, in a standard installation, the appsettings.json files ActiveDirectoryEnforced value will show true, but an environment variable is set in each container where this is relevant to set this to false.

To set an environment variable for one or two configuration values:

  1. On your Kubernetes server, edit your values file to add an additionalEnvironmentVariables section (if one does not already exist) and environment variable names and values for the settings to change. For example, the following shows a portion of the example values file (see Install Keyfactor Command in Containers Under Kubernetes) with the ExtensionsDirectory value set to ext.

    additionalEnvironmentVariables:
      - name: ExtensionsDirectory
        value: 'ext'
    
    workloadDefaults:
      volumes:
        - name: root-cas
          configMap:
            name: ca-roots
            items:
              - key: ca-certificates.crt
                path: ca-certificates.crt
    
      volumeMounts:
        - name: root-cas
          mountPath: /etc/pki/tls/certs/ca-bundle.crt   # Common CA bundle path for Command containers
          subPath: ca-certificates.crt    # Source path for your CA bundle may vary
    Note:  Parameters are referenced by full name, including parent parameterClosed A parameter or argument is a value that is passed into a function in an application. name, if applicable. A SQL retry configuration setting would be, for example, SqlRetryConfiguration_NumberOfTries.
  2. Load the new values, referencing the deployment name, Namespace, your customized values file, the Helm chart, and version. For example:

    sudo helm upgrade Helm_Deployment_Name --namespace keyfactor-command --values values-local.yaml oci://repo.keyfactor.com/charts/command --version 26.2.1

To provide the appsettings.json file as a ConfigMap:

  1. On your Kubernetes server, create an appsettings.json file with the full contents of the file, including the updates you want to make. For example:

    Copy
    {
      "NLogConfigFile": "Configuration/NLog_KeyfactorAPI.config",
      "NLogPoller": {
        "Enabled": false,
        "PollingInterval": 10
      },
      "ExtensionsDirectory": "Extensions",
      "ActiveDirectoryEnforced": false,
      "SqlRetryConfiguration": {
        "NumberOfTries": "5",
        "DeltaTime": "00:00:00.5",
        "MaxTimeInterval": "00:02:00"
      }
    }
    Important:  This file needs to be called appsettings.json when you create the ConfigMap for it, not something like appsettings-keyfactorapi.json.
  2. On your Kubernetes server, create a ConfigMap containing the appsettings.json file. For example:

    sudo kubectl create configmap appsettings-keyfactorapi --namespace keyfactor-command --from-file=/opt/kyf_command/appsettings.json
  3. Edit your values file to add a api section under appConfig (if one does not already exist) and a volume and volumeMount for the ConfigMap of the appsettings.json file within that. For example:

    appConfig:
      api:
        volumes:
          - name: appsettings-api-volume
            configMap:
              name: appsettings-keyfactorapi
        volumeMounts:
          - name: appsettings-api-volume
            mountPath: /app/Configuration/appsettings.json
            subPath: appsettings.json
  4. Load the new values, referencing the deployment name, Namespace, your customized values file, the Helm chart, and version. For example:

    sudo helm upgrade Helm_Deployment_Name --namespace keyfactor-command --values values-local.yaml oci://repo.keyfactor.com/charts/command --version 26.2.1

Configuration Settings

The following table shows the configuration settings for the Keyfactor Command KeyfactorAPI application available in the appsettings.json file.

Table 74: KeyfactorAPI Appsetting.json File Parameters

Setting Description
ActiveDirectoryEnforced
A Boolean that indicates whether Active Directory authentication is in use for the Keyfactor Command server (True) or not (False). This should be set to False if you are not using Active Directory. An IIS reset is required to apply changes to this setting.
APILockRetryConfiguration

These settings control retry and timeout behavior for API requests. They are not included by default and can be added manually if needed. If not configured, the default values shown below are used. These settings are supported only by select API operations (for example, PUT Security Roles ID Claims (v2)).

An iisreset is required following changes to this setting.

Setting Description
DeltaTime The base delay between retry attempts. The delay increases exponentially with each retry. Valid values: 0–30 seconds Time format: hh:mm:ss (for example, 00:00:05). The default is 00:00:05 (5 seconds).
NumberOfTries The maximum number of retry attempts before the request fails. Value values: 1-5. The default is 3.
EnableJitter Determines whether a random delay (jitter) is added to retry intervals to reduce contention from simultaneous retries. The default is True.
Timeout The maximum total time allowed for all retry attempts before the request fails. Valid values: 1–30 seconds. Time format: hh:mm:ss (for example, 00:00:05). The default is 00:00:30 (30 seconds).
ExtensionsDirectory

Enter the file path to the extensions to be loaded by the extension loader (for support of custom extensions such as registration handlers and workflow steps). The default value is Extensions.

For Windows installations under IIS, this is a subdirectory of the KeyfactorAPI directory.

This translates to, for example, for Windows installations under IIS:

C:\Program Files\Keyfactor\Keyfactor Platform\KeyfactorAPI\Extensions

Container installations under Kubernetes:

/app/Configuration/Extensions
NLogConfigFile

Enter the file path to the NLog_KeyfactorAPI.config file as a subdirectory of the KeyfactorAPI directory. The default is:

Configuration\\NLog_KeyfactorAPI.config

This translates to, for example:

C:\Program Files\Keyfactor\Keyfactor Platform\KeyfactorAPI\Configuration\NLog_KeyfactorAPI.config

This value is not used for container installations under Kubernetes.

NLogPoller

If turned on, the NLog poller service periodically queries for updates to the custom NLog file.

Setting Description
Enabled A Boolean indicating whether the NLog poller service is turned on (True or False).
PollingInterval The frequency, in seconds, to poll for NLog file updates. The default is 10 seconds.
SqlRetryConfiguration
SQL retry settings (seeChanging SQL Retry Settings for more information).
Setting Description
Delta TimeThe preferred gap time to delay before the next attempt to connect to SQL will be made. The default is .5 (1/2) second.
Max Time IntervalThe maximum time interval before the next attempt to connect to SQL will be made. The default is 2 minutes.
Number Of TriesThe number of times a connection attempt will be made to SQL before an exception is thrown. The default is 5.