{"id":25190143,"url":"https://github.com/keyfactor/cyberark-credentialprovider-pam","last_synced_at":"2025-04-04T11:25:32.117Z","repository":{"id":163755360,"uuid":"481275612","full_name":"Keyfactor/cyberark-credentialprovider-pam","owner":"Keyfactor","description":"A documentation stub for the existing Keyfactor IPAMProvider plugin supporting CyberArk's Credential Provider solution for retrieving credentials.","archived":false,"fork":false,"pushed_at":"2024-06-04T15:42:37.000Z","size":69,"stargazers_count":0,"open_issues_count":3,"forks_count":1,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-02-09T21:19:00.572Z","etag":null,"topics":["keyfactor-pam"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Keyfactor.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-04-13T15:39:51.000Z","updated_at":"2024-06-04T15:42:42.000Z","dependencies_parsed_at":"2024-06-04T17:24:42.109Z","dependency_job_id":"8f6080e3-ec21-4748-bb85-49e69884db75","html_url":"https://github.com/Keyfactor/cyberark-credentialprovider-pam","commit_stats":null,"previous_names":[],"tags_count":15,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keyfactor%2Fcyberark-credentialprovider-pam","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keyfactor%2Fcyberark-credentialprovider-pam/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keyfactor%2Fcyberark-credentialprovider-pam/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keyfactor%2Fcyberark-credentialprovider-pam/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Keyfactor","download_url":"https://codeload.github.com/Keyfactor/cyberark-credentialprovider-pam/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247167838,"owners_count":20895015,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["keyfactor-pam"],"created_at":"2025-02-09T21:19:03.424Z","updated_at":"2025-04-04T11:25:32.083Z","avatar_url":"https://github.com/Keyfactor.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n# CyberArk PAM Provider\n\nA Keyfactor PAM Provider plugin supporting credential retrieval with a CyberArk Credential Provider. The Central Credential Provider (cloud-hosted) can be used, or the standard Credential Provider with installed SDK.\n\n#### Integration status: Production - Ready for use in production environments.\n\n## About the Keyfactor PAM Provider\n\nKeyfactor supports the retrieval of credentials from 3rd party Privileged Access Management (PAM) solutions. Secret values can normally be stored, encrypted at rest, in the Keyfactor Platform database. A PAM Provider can allow these secrets to be stored, managed, and rotated in an external platform. This integration is usually configured on the Keyfactor Platform itself, where the platform can request the credential values when needed. In certain scenarios, a PAM Provider can instead be run on a remote location in conjunction with a Keyfactor Orchestrator to allow credential requests to originate from a location other than the Keyfactor Platform.\n\n## Support for CyberArk PAM Provider\n\nCyberArk PAM Provider is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com\n\n###### To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab.\n\n---\n\n#### Compatibility\nThis release was tested against CyberArk version 12.6.\nUsing this on a Universal Orchestrator requires UO version 10.1 or greater.\n---\n\n\n\n\n### Initial Configuration of PAM Provider\nIn order to allow Keyfactor to use the new CyberArk PAM Provider, the definition needs to be added to the application database.\nThis is done by running the provided `kfutil` tool to install the PAM definition, which only needs to be done one time. It uses API credentials to access the Keyfactor instance and create the PAM definition.\n\nThe `kfutil` tool, after being [configured for API access](https://github.com/Keyfactor/kfutil#quickstart), can be run in the following manner to install the PAM definition from the Keyfactor repository:\n\n```\nkfutil pam types-create -r cyberark-credentialprovider-pam -n CyberArk-CentralCredentialProvider\n```\n\n### Configuring Parameters\nThe following are the parameter names and a description of the values needed to configure the CyberArk PAM Provider.\n\n#### Central Credential Provider\n__Initialization Parameters for each defined PAM Provider instance__\n| Initialization parameter | Display Name | Description |\n| :---: | :---: | --- |\n| AppId | Application ID | The Application ID to use that has access set up for the Safe |\n| Host | CyberArk Host and Port | The hostname (IP address or domain name) including the port. E.G. my.cyberark.net:404 (note: no https:// included) |\n| Site | CyberArk API Site | By default, AIMWebService is the site name, but may be deployed to another site name. |\n\n\n__Instance Parameters for each retrieved secret field__\n| Instance parameter | Display Name | Description |\n| :---: | :---: | --- |\n| Safe | Safe | The name of the Safe the credential resides in. |\n| Folder | Folder | The folder path the credential lives in. If it is nested, use the forward slash e.g. Root\\\\Folder |\n| Object | Object | The name of the password object that has the credential. |\n\nWhen using the SDK Credential Provider, the parameters are instead defined as follows:\n#### SDK Credential Provider\n__Initialization Parameters for each defined PAM Provider instance__\n| Initialization parameter | Display Name | Description |\n| :---: | :---: | --- |\n| AppId | Application ID | The Application ID to use that has access set up for the Safe |\n\n__Instance Parameters for each retrieved secret field__\n| Instance parameter | Display Name | Description |\n| :---: | :---: | --- |\n| Safe | Safe | The name of the Safe the credential resides in. |\n| Folder | Folder | The folder path the credential lives in. If it is nested, use the forward slash e.g. Root\\\\Folder |\n| Object | Object | The name of the password object that has the credential. |\n\n![](images/config.png)\n\n### Configuring for PAM Usage\n#### For CyberArk Central Credential Provider\nIn order for the Central Credential Provider to work, the Safe / Secret being accessed need to be available to the Provider that the CyberArk server is using, and the Application ID needs to be usable from an external requestor.This may require adding IP address or other rules.\n\nCertificate Authentication cannot be required. This may necessitate creating a Site that allows HTTPS requests but does not require a Client Certificate to authenticate. By default the site `AIMWebService` may require a Client Certificate, which would need to be edited or have another site created.\n\n#### For SDK-based local Credential Provider\nTo use a local Credential Provider instead, the Credential Provider will need to be installed on the machine that is using the PAM Provider. After installing the Credential Provider, copy the `NetStandardPasswordSDK.dll` assembly from the install location into the PAM Provider install location. This dll __needs__ to be adjacent to `cyberark-credentialprovider-pam.dll` to be properly loaded.\n__Important__: When running the SDK Credential Provider on Keyfactor Command, the `NetPasswordSDK.dll` needs to be copied instead of `NetStandardPasswordSDK.dll`. This library is compatible with .NET Framework which is necessary to work in Keyfactor Command.\n\nAfter registering the Credential Provider during install, make sure the Provider for the machine has been granted permission to access the Safe, as well as the Application ID that will be used.\n\n#### On Keyfactor Universal Orchestrator\n\u003cdetails\u003e\n\u003csummary\u003eInstallation - CyberArk Central Credential Provider \u003c/summary\u003e\n\u003cp\u003e\nInstall the CyberArk Central Credential Provider as an extension by copying the release contents into a new extension folder named \u003ccode\u003eCyberArk-CentralCredentialProvider\u003c/code\u003e.\nA \u003ccode\u003emanifest.json\u003c/code\u003e file is included in the release. This file needs to be edited to enter in the \"initialization\" parameters for the PAM Provider. Specifically values need to be entered for the parameters in the \u003ccode\u003emanifest.json\u003c/code\u003e of the \u003cb\u003ePAM Provider extension\u003c/b\u003e:\n\n~~~ json\n\"Keyfactor:PAMProviders:CyberArk-CentralCredentialProvider:InitializationInfo\": {\n    \"AppId\": \"myappid\",\n    \"Host\": \"my.cyberark.instance:99999\",\n    \"Site\": \"WithOutCert\"\n  }\n~~~\n\u003c/p\u003e\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003eInstallation - SDK-based local Credential Provider\u003c/summary\u003e\n\u003cp\u003e\nInstall the CyberArk SDK-based local Credential Provider as an extension by copying the release contents into a new extension folder named \u003ccode\u003eCyberArk-SdkCredentialProvider\u003c/code\u003e. The \u003ccode\u003eNetStandardPasswordSDK.dll\u003c/code\u003e assembly will still need to be copied over to the installation location as well.\nThe default \u003ccode\u003emanifest.json\u003c/code\u003e needs to be replaced with the included \u003ccode\u003eSDK-manifest.json\u003c/code\u003e. Rename the existing \u003ccode\u003emanifest.json\u003c/code\u003e as \u003ccode\u003eCentral-manifest.json\u003c/code\u003e and then rename the \u003ccode\u003eSDK-manifest.json\u003c/code\u003e to replace the original \u003ccode\u003emanifest.json\u003c/code\u003e.\nThis file then needs to be edited to enter in the \"initialization\" parameters for the PAM Provider. Specifically values need to be entered for the parameters in the \u003ccode\u003emanifest.json\u003c/code\u003e of the \u003cb\u003ePAM Provider extension\u003c/b\u003e:\n\n~~~json\n\"Keyfactor:PAMProviders:CyberArk-SdkCredentialProvider:InitializationInfo\": {\n    \"AppId\": \"myappid\"\n  }\n~~~\n\u003c/p\u003e\n\u003c/details\u003e\n\n#### Usage with the Keyfactor Universal Orchestrator\nTo use the PAM Provider to resolve a field, for example a Server Password, instead of entering in the actual value for the Server Password, enter a `json` object with the parameters specifying the field.\nThe parameters needed are the \"instance\" parameters above (with appropriate characters escaped for correct JSON formatting):\n\n~~~ json\n{\"Safe\":\"MySafe\",\"Folder\":\"Root\\\\Secrets\",\"Object\":\"MySecret\"}\n~~~\n\nIf a field supports PAM but should not use PAM, simply enter in the actual value to be used instead of the `json` format object above.\n\n#### In Keyfactor - PAM Provider\n##### Installation\nIn order to setup a new PAM Provider in the Keyfactor Platform for the first time, you will need to run the `kfutil` tool (see Initial Configuration of PAM Provider).\n\nAfter the installation is run, the DLLs need to be installed to the correct location for the PAM Provider to function. From the release, the cyberark-credentialprovider-pam.dll should be copied to the following folder locations in the Keyfactor installation. Once the DLL has been copied to these folders, edit the corresponding config file. You will need to add a new Unity entry as follows under `\u003ccontainer\u003e`, next to other `\u003cregister\u003e` tags.\n\n| Install Location | DLL Binary Folder | Config File |\n| --- | --- | --- |\n| WebAgentServices | WebAgentServices\\bin\\ | WebAgentServices\\web.config |\n| Service | Service\\ | Service\\CMSTimerService.exe.config |\n| KeyfactorAPI | KeyfactorAPI\\bin\\ | KeyfactorAPI\\web.config |\n| WebConsole | WebConsole\\bin\\ | WebConsole\\web.config |\n\nWhen enabling a PAM provider for Orchestrators only, the first line for `WebAgentServices` is the only installation needed.\n\nThe Keyfactor service and IIS Server should be restarted after making these changes.\n\n```xml\n\u003cregister type=\"IPAMProvider\" mapTo=\"Keyfactor.Extensions.Pam.CyberArk.CentralCredentialProviderPAM, cyberark-credentialprovider-pam\" name=\"CyberArk-CentralCredentialProvider\" /\u003e\n```\n\n\n\nFor registering the CyberArk for use with the SDK-based Credential Provider, use the following `\u003cregister\u003e` instead.\nMake sure to enter in the correct full path to the directory for `extensionPath` that has the SDK DLL for the PAM Provider.\n\n```xml\n\u003cregister type=\"IPAMProvider\" mapTo=\"Keyfactor.Extensions.Pam.CyberArk.SdkCredentialProviderPAM, cyberark-credentialprovider-pam\" name=\"CyberArk-SdkCredentialProvider\"\u003e\n  \u003cconstructor\u003e\n    \u003cparam name=\"extensionPath\"\u003e\n      \u003cvalue value=\"C:\\Program Files\\Keyfactor\\Keyfactor Platform\\WebAgentServices\\bin\"/\u003e\n    \u003c/param\u003e\n  \u003c/constructor\u003e\n\u003c/register\u003e\n```\n\n##### Usage\nIn order to use the PAM Provider, the provider's configuration must be set in the Keyfactor Platform. In the settings menu (upper right cog) you can select the ___Priviledged Access Management___ option to configure your provider instance.\n\n![](images/setting.png)\n\nAfter it is set up, you can now use your PAM Provider when configuring certificate stores. Any field that is treated as a Keyfactor secret, such as server passwords and certificate store passwords can be retrieved from your PAM Provider instead of being entered in directly as a secret.\n\n![](images/password.png)\n\n\n---\n\n\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkeyfactor%2Fcyberark-credentialprovider-pam","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkeyfactor%2Fcyberark-credentialprovider-pam","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkeyfactor%2Fcyberark-credentialprovider-pam/lists"}