Documentation Suite v26.2.1

Submit Search

Service appsetting.json File

The Service appsettings.json file allows you to view or change the Keyfactor Command Service installation and configuration settings.

Windows Installations Under IIS

To update the appsettings.json file for service configuration:

Navigate to the Service\Configuration folder on your server, located by default at:

C:\Program Files\Keyfactor\Keyfactor Platform\Service\Configuration
Browse to open the appsettings.json file in a text editor (for example, Notepad) and adjust the values as needed per Table 76: Keyfactor Command Services Configuration Settings and Keyfactor Command Service Automated Tasks.
Save the file.

Copy

Sample Service appsettings.json File

{
  "NLogConfigFile": "Configuration/NLog_TimerService.config",
  "NLogPoller": {
    "Enabled": true,
    "PollingInterval": 10
  },
  "ExtensionsDirectory": "Extensions",
  "ActiveDirectoryEnforced": false,
  "ConcurrentWorkflows": 1000,
  "AnalysisUrl": "",
  "MetadataGeneration": {
    "Version": 1,
    "Parallelism": 8,
    "ProgressInterval": "00:07:00"
  },
  "SqlRetryConfiguration": {
    "NumberOfTries": "5",
    "DeltaTime": "00:00:00.5",
    "MaxTimeInterval": "00:02:00"
  },
  "Jobs": {
    "BulkAuditProcessing": true,
    "MetadataGeneration": true,
    "PrivateKeyCleanup": true,
    "PurgeAuditHistory": true,
    "EndpointHistory": true,
    "ReportingCleanup": true,
    "ScheduleSslJobs": true,
    "SuspendedWorkflows": true,
    "SyncTemplates": true,
    "StatsUpdate": true,
    "WorkflowCleanup": true,
    "CAHealth": true,
    "CAThreshold": true,
    "CRL": true,
    "ExpirationAlerts": true,
    "IssuedAlerts": true,
    "PendingAlerts": true,
    "QueryItems": true,
    "Reporting": true,
    "SSHKeyRotationAlerts": true,
    "AgentNotificationAlert": true,
    "CASync": true,
    "CollectionQueryAlerts": true,
    "UndecryptableSecretsSearch": true,
    "CertificateStoreWorkflows": true,
    "KeyRotationWorkflows": true,
    "ExpirationWorkflows": true,
    "RevocationMonitoringWorkflows": true,
    "ActionedCertificates": true,
    "CertificateCleanup": true,
    "CATemplateCache": true,
    "CertStoreMirroring": true,
    "SyncTrustedRoots": true,
    "OrchestratorPoolCleanup": true,
    "BackfillBasicConstraints": true,
    "OrchestratorPoolJobTimeoutHandler": true
  }
}

Container Installations Under Kubernetes

The configurations from the appsettings.json file can be updated in one of two ways for container installations:

To update one or two settings, set an environment variable in your custom values file.
To update a large number of settings or the entire contents of the appsettings.json file, create a ConfigMap containing the appsettings.json file contents and mount it as a volume to replace the existing appsettings.json file.

Note: Some appsettings.json settings are overridden by environment variables in a standard installation, so don’t assume that the values you see in an appsettings.json file if you view it within a started container are actually the values in use. Be sure to check for environment variables as well. Environment variables take precedence over values of the same name from the appsettings.json file. For example, in a standard installation, the appsettings.json files ActiveDirectoryEnforced value will show true, but an environment variable is set in each container where this is relevant to set this to false.

To set an environment variable for one or two configuration values:

On your Kubernetes server, edit your values file to add an additionalEnvironmentVariables section (if one does not already exist) and environment variable names and values for the settings to change. For example, the following shows a portion of the example values file (see Install Keyfactor Command in Containers Under Kubernetes) with the ConcurrentWorkflows value set to 1200 and the PurgeAuditHistory service job set to False.
```
additionalEnvironmentVariables:
  - name: ConcurrentWorkflows
    value: '1200'
  - name: Jobs_PurgeAuditHistory
    value: false

workloadDefaults:
  volumes:
    - name: root-cas
      configMap:
        name: ca-roots
        items:
          - key: ca-certificates.crt
            path: ca-certificates.crt

  volumeMounts:
    - name: root-cas
      mountPath: /etc/pki/tls/certs/ca-bundle.crt   # Common CA bundle path for Command containers
      subPath: ca-certificates.crt    # Source path for your CA bundle may vary
```
Note: Notice that the PurgeAuditHistory parameter A parameter or argument is a value that is passed into a function in an application. is referenced by its full name, including its parent parameter name (Jobs_PurgeAuditHistory). Likewise, a SQL retry configuration setting would be, for example, SqlRetryConfiguration_NumberOfTries.
Load the new values, referencing the deployment name, Namespace, your customized values file, the Helm chart, and version. For example:

sudo helm upgrade Helm_Deployment_Name --namespace keyfactor-command --values values-local.yaml oci://repo.keyfactor.com/charts/command --version 26.2.1

To provide the appsettings.json file as a ConfigMap:

On your Kubernetes server, create an appsettings.json file with the full contents of the file, including the updates you want to make. For example:

Copy

{
  "NLogConfigFile": "NLog_TimerService.config",
  "ExtensionsDirectory": "Extensions",
  "ActiveDirectoryEnforced": true,
  "ConcurrentWorkflows": 1000,
  "MetadataGeneration": {
    "Version": 1,
    "Parallelism": 8,
    "ProgressInterval": "00:07:00"
  },
  "SqlRetryConfiguration": {
    "NumberOfTries": "5",
    "DeltaTime": "00:00:00.5",
    "MaxTimeInterval": "00:02:00"
  },
  "Jobs": {
    "BulkAuditProcessing": true,
    "MetadataGeneration": true,
    "PrivateKeyCleanup": true,
    "PurgeAuditHistory": true,
    "EndpointHistory": true,
    "ReportingCleanup": true,
    "ScheduleSslJobs": true,
    "SuspendedWorkflows": true,
    "SyncTemplates": true,
    "StatsUpdate": true,
    "WorkflowCleanup": true,
    "CAHealth": true,
    "CAThreshold": true,
    "CRL": true,
    "ExpirationAlerts": true,
    "IssuedAlerts": true,
    "PendingAlerts": true,
    "QueryItems": true,
    "Reporting": true,
    "SSHKeyRotationAlerts": true,
    "AgentNotificationAlert": true,
    "CASync": true,
    "CollectionQueryAlerts": true,
    "UndecryptableSecretsSearch": true,
    "CertificateStoreWorkflows": true,
    "KeyRotationWorkflows": true,
    "ExpirationWorkflows": true,
    "RevocationMonitoringWorkflows": true
    "CertificateCleanup": true
    "CATemplateCache": true
    "CertStoreMirroring": true
    "SyncTrustedRoots": false
    "OrchestratorPoolCleanup": true
    "BackfillBasicConstraints": true
    "OrchestratorPoolJobTimeoutHandler": true    
  }
}

Important: This file needs to be called appsettings.json when you create the ConfigMap for it, not something like appsettings-service.json.

On your Kubernetes server, create a ConfigMap containing the appsettings.json file. For example:

sudo kubectl create configmap appsettings-service --namespace keyfactor-command --from-file=/opt/kyf_command/appsettings.json

Edit your values file to add a timerservice section under appConfig (if one does not already exist) and a volume and volumeMount for the ConfigMap of the appsettings.json file within that. For example:

appConfig:
  timerservice:
    volumes:
      - name: appsettings-service-volume
        configMap:
          name: appsettings-service
    volumeMounts:
      - name: appsettings-service-volume
        mountPath: /app/Configuration/appsettings.json
        subPath: appsettings.json

Load the new values, referencing the deployment name, Namespace, your customized values file, the Helm chart, and version. For example:

sudo helm upgrade Helm_Deployment_Name --namespace keyfactor-command --values values-local.yaml oci://repo.keyfactor.com/charts/command --version 26.2.1

Configuration Settings

The following table shows the configuration settings for the Keyfactor Command Service available in the appsettings.json file.

Table 76: Keyfactor Command Services Configuration Settings

Setting

Description

ActiveDirectoryEnforced

A Boolean that indicates whether Active Directory authentication is in use for the Keyfactor Command server (True or False). This should be set to False if you are not using Active Directory. An IIS reset is required to apply changes to this setting.

AnalysisUrl

The URL to which traffic is directed for the Analysis application for legacy dashboards and reports. This value is used for container implementations of Keyfactor Command.

ConcurrentWorkflows

The batch size used when suspended workflows are run by the Keyfactor Command service. Also used when running Certificate Entered Collection and Certificate Left Collection workflows to limit the number of certificates flowing through the workflow for each instance of the workflow initiated by the service. The default is 1000.

ExtensionsDirectory

Enter the file path to the extensions to be loaded by the extension loader (for support of custom extensions such as registration handlers and workflow steps). The default value is Extensions.

For Windows installations under IIS, this is a subdirectory of the Service directory.

This translates to, for example, for Windows installations under IIS:

C:\Program Files\Keyfactor\Keyfactor Platform\Service\Extensions

Container installations under Kubernetes:

/app/Configuration/Extensions

Jobs

The jobs run by the Keyfactor Command Service. By default, the Keyfactor Command Service sets all service jobs to run (True). The service jobs can be turned on in the appsettings.json file. Select service jobs have configurable options. For more information, see Keyfactor Command Service Automated Tasks.

Bulk Audit Processing
Metadata Generation
Private Key Cleanup
Purge Audit History
Endpoint History
Reporting Cleanup
Schedule Ssl Jobs
Suspended Workflows
Sync Templates
Stats Update
Workflow Cleanup
CA Health
CA Threshold

CRL
Expiration Alerts
Issued Alerts
Pending Alerts
Query Items
Reporting
SSH Key Rotation Alerts
Agent Notification Alert
CASync
Collection Query Alerts
Undecryptable Secrets Search
Certificate Store Workflows
Key Rotation Workflows
Expiration Workflows

Revocation Monitoring Workflows
Actioned Certificates
Certificate Cleanup
CA Template Cache

Important: Turning off the CATemplateCache job will cause enrollment to be unavailable once the cache expires.
Cert Store Mirroring
Sync Trusted Roots
Orchestrator Pool Cleanup
Backfill Basic Constraints
Orchestrator PoolJob Timeout Handler

MetadataGeneration

During the metadata generation task, the Keyfactor Command service iterates over the certificates in the database, updating the metadata values with values defined by the configuration in a custom metadata extension where the metadata version in the certificate record is less than the value defined here.

Setting	Description
Parallelism	How many threads of the job run simultaneously.
Progress Interval	How often ( in milliseconds) the work from cache is saved to the database.
Version	The version number for comparison.

NLogConfigFile

Enter the file path to the NLog_TimerService.config file as a subdirectory of the Service\Configuration directory. The default is:

NLog_TimerService.config

This translates to, for example:

C:\Program Files\Keyfactor\Keyfactor Platform\Service\Configuration\NLog_TimerService.config

This value is not used for container installations under Kubernetes.

NLogPoller

If turned on, the NLog poller service periodically queries for updates to the custom NLog file.

Setting	Description
Enabled	A Boolean indicating whether the NLog poller service is turned on (True) or not (False).
PollingInterval	The frequency, in seconds, to poll for NLog file updates. The default is 10 seconds.

SqlRetryConfiguration

SQL retry settings (seeChanging SQL Retry Settings for more information).

Setting	Description
Delta Time	The preferred gap time to delay before the next attempt to connect to SQL will be made. The default is .5 (1/2) second.
Max Time Interval	The maximum time interval before the next attempt to connect to SQL will be made. The default is 2 minutes.
Number Of Tries	The number of times a connection attempt will be made to SQL before an exception is thrown. The default is 5.

Was this page helpful? Provide Feedback

Version v26.2.1

On This Page