Inventory agent: make the API key location impossible to miss
Several people have been caught out by where the key comes from, and
there were two separate reasons for it.
FreeITSM has TWO unrelated things both called "API keys":
Software > Settings > API Keys 40 hex chars, no prefix, table
`apikeys` - the inventory agent
System > API starts fitsm_, table `api_keys` -
the REST API v1, Bearer auth
A key from the wrong page fails with "Invalid authorization key", which
reads like an expired or mistyped key rather than the wrong KIND of key,
so nobody thinks to go looking for a second keys page.
Inventory-Agent now leads that section with a callout, a table
contrasting the two, and the tell: if it starts fitsm_ it came from the
wrong page. Also explains why an asset script's key lives under
Software, so the location stops feeling arbitrary - the same endpoint
feeds the software inventory.
Troubleshooting split "Authorization key missing" from "Invalid
authorization key", which are different faults, and added the
"Unknown endpoint" row from the user who put /api/v1 in his -ApiUrl.
Software.md named the table `api_keys`. It is `apikeys`. That is
precisely the confusion this commit is about, so it is corrected with a
note rather than quietly.
Add "The inventory agent" page, and separate the two certificate problems
The PowerShell inventory agent had no page of its own - only eight lines
under Assets covering the two endpoints and the API key. Nothing on
deployment, scheduled tasks, or certificates, which is where a user
reporting a failure this week actually got stuck.
Inventory-Agent.md covers running it by hand, the collect-only mode,
rolling it out as a GPO scheduled task, what it collects, where it goes,
and a troubleshooting table.
The certificate section is the bulk of it, because that is the common
failure. Notes that the fixes are ordered by safety, that pinning
deliberately ignores the name on the certificate (so XAMPP's default
localhost certificate stops being a problem), that a thumbprint is not a
secret, and that renewing a certificate silently breaks every pinned
machine.
Also flags on HTTPS-Certificates-and-CA-Bundles that it is the OUTBOUND
problem - FreeITSM not trusting Slack - and links across. A user
searching the wiki for "certificate" was landing there and reading advice
that cannot fix an inbound trust failure.
Thumbprint lookup is given per web server. The Cert:\LocalMachine\My
route is IIS-only; on Apache, XAMPP, WAMP or nginx the certificate is a
file and that store is empty.
Links to Inventory-Agent added from Assets, Software and the sidebar.