Skip to content

Manage Asset Credentials in Asset Links

Manage Credentials for Discovery

Use this workflow to update discovery credentials in real time.

Prerequisites

To update configuration and credentials in real time, modify the asset link. For reference, see the IAH Asset Link SDK.

Discovery Workflow

  1. Authorize access: Ensure that the user has the credential_manager role to create or update credential templates and instances. Assign the role through the Authorization Service API.

  2. Upload the asset link template: Upload the asset link configuration template as schema data, together with its schema URI, using the v2 Credential Management API POST /schemas. Use the is_running_on relation from the target gateway to identify the asset link that requires credentials. See Read and Filter Relations for details. Query GET /assets?relationsFilter=object.id eq '<gateway-id>' and predicate eq 'is_running_on' to return the asset link data. Select that asset link and use product_instance_information.manufacturer_product.product_id as resourceIdentifier and product_instance_information.manufacturer_product.product_version as resourceVersion query parameters. Retrieve the generated schema ID from the response Location header.

    Note

    If the same resource identifier and version already exist, the template is not created again.

  3. Create credential instances: Create instances from the uploaded schema ID using the v2 Credential Management API POST /instances. Add instance metadata that defines the IP address ranges where each instance should be applied.

  4. Trigger a discovery scan: Run a discovery scan with Asset Link on the target gateway to apply the new credentials and settings.

  5. Select instances for discovery: For new assets, the system selects the three most recent credential instances by timestamp. For existing assets, it uses the credential instances already associated with the asset based on matching IP addresses.


Figure: Discovery Workflow for Credential Management

Manage Credentials for Monitoring

Use this workflow to enrich existing assets with information from other asset links.

Note

The target application must implement the monitoring process with asset links.

  1. Authorize access: Ensure that the user has the credential_manager role to create or update credential templates and instances. Assign the role through the Authorization Service API.

  2. Upload the asset link template: Upload the target asset link schema data and schema URI using the v2 Credential Management API POST /schemas. Use the is_running_on relation from the target gateway to identify the asset link that requires credentials. See Read and Filter Relations for details. Query GET /assets?relationsFilter=object.id eq '<gateway-id>' and predicate eq 'is_running_on' to return the asset link data. Select that asset link and use product_instance_information.manufacturer_product.product_id as resourceIdentifier and product_instance_information.manufacturer_product.product_version as resourceVersion query parameters. Retrieve the generated schema ID from the response Location header. If the same resource identifier and version already exist, the template is not created again.

  3. Create credential instances: Create instances from the uploaded schema ID using the v2 Credential Management API POST /instances. Add instance metadata that defines the IP address ranges where each instance should be applied. Retrieve the created instance ID from the response Location header.

  4. Create an instance communication template: Create a new instance template using the v2 Credential Management API POST /instances-templates. Retrieve the created instance template ID from the response Location header.

  5. Add instances to the instance template: Add each created instance and map it to the created instance template using the v2 Credential Management API POST /instances-templates/{instancesTemplateId}/instances/{instanceId}.

  6. Trigger monitoring with the instance template: Run the required monitoring scan in the target application using the instance template for existing assets.

  7. Assign monitored instances to existing assets: Create a copy of the instances used for monitoring and map them to existing assets using the v2 Credential Management API POST /assets/{assetId}/instances/{instanceId}.

  8. Retrieve instances for monitored assets: Retrieve all discovery and monitoring credentials used across different asset links for an asset using the v2 Credential Management API GET /assets/{assetId}/instances.


Figure: Monitoring Workflow for Credential Management

Any questions left?

Ask the community