Credential Store

FlexDeploy provides out of box integration with HashiCorp Vault to retrieve secrets. FlexDeploy will authenticate using AppRole authentication method against vault.

HashiCorp Vault Setup

• You must first install and configure HashiCorp Vault if have not already done so.
• Now you can create specific AppRole for FlexDeploy authentication. Use proper role name, for example flexdeploy-role.

• AppRole must have policy that allows FlexDeploy to read specific secrets necessary. Note that FlexDeploy only needs read permission. Example policy file

  Examplay Policy File

  path "kv/*" 
  {
     capabilities = ["read"]
  }
  path "sys/mounts" 
  {
     capabilities = ["read"]
  } 
  path "secret/*"
  {
    capabilities = ["read"]
  }

• You will need role id and secret id for this AppRole for configuration in FlexDeploy.

FlexDeploy Setup

You must first create Credential Store in FlexDeploy by clicking Create Store button on Administration - Security - Credentials page. Credential store represents instance of specific type of credential store provider. If you have more than one HashiCorp Vault installations, you will create equal number of Credential Stores in FlexDeploy.

Here are the configurations necessary for this store.

Now you are ready to create individual credential to be retrieved from Vault.

You can create or edit credentials from Credentials page or from where specific credential is used.

HashiCorp Credential requires two inputs as described below. Keep in mind that AppRole created for FlexDeploy must have read access to paths defined by various credentials.

Here is how edit credential looks like.

Create credential looks similar except you need to provide Scope as well. Scope can not changed once credential is saved.

You can change credential inputs (Secrets Path, Key Name) at any point. FlexDeploy will use these inputs with credential store properties like URL, Role and Secret id to retrieve individual credential for use during Workflow Execution.

FlexDeploy provides out of box integration with CyberArk AAM to retrieve secrets. FlexDeploy will authenticate using client certificate or retrieve credentials using Agent. In this section we will talk about client certificate based authentication.

CyberArk Setup

• Create necessary Application Id(s) in CyberArk AAM.
• Configure safe and credentials.
• Configure Application Id(s) for specific client certificate authentication.
• If necessary, get PEM files for CyberArk server trust.

FlexDeploy Setup

You must first create Credential Store in FlexDeploy by clicking Create Store button on Administration - Security - Credentials page. Credential store represents instance of specific type of credential store provider. If you have more than one CyberArk AAM installations, you will create equal number of Credential Stores in FlexDeploy. Use CyberArk AAM Provider when creating this store.

Here are the configurations necessary for this store.

Now you are ready to create individual credential to be retrieved from CyberArk.

You can create or edit credentials from Credentials page or from where specific credential is used.

CyberArk credential requires two inputs as described below.

Here is how edit credential looks like.

Create credential looks similar except you need to provide Scope as well. Scope can not changed once credential is saved.

You can change credential inputs (Application Id, Query Text) at any point. FlexDeploy will use these inputs with credential store properties like URL, Certificate Path etc. to retrieve individual credential for use during Workflow Execution.

FlexDeploy provides out of box integration with CyberArk AAM to retrieve secrets. FlexDeploy will authenticate using client certificate or retrieve credentials using Agent. In this section we will talk about retrieval of credentials using Agent.

CyberArk Setup

• Create necessary Application Id(s) in CyberArk AAM.
• Configure safe and credentials.
• Configure Application Id(s) for specific client certificate authentication.
• Install and configure CyberArk Agent on FlexDeploy server. You will need location of clipasswordsdk executable for configuration as well.

FlexDeploy Setup

You must first create Credential Store in FlexDeploy by clicking Create Store button on Administration - Security - Credentials page. Credential store represents instance of specific type of credential store provider. If you have more than one CyberArk AAM installations, you will create equal number of Credential Stores in FlexDeploy. Use CyberArk AAM Agent Provider when creating this store.

Here are the configurations necessary for this store.

Now you are ready to create individual credential to be retrieved from CyberArk.

You can create or edit credentials from Credentials page or from where specific credential is used.

CyberArk credential requires two inputs as described below.

Here is how edit credential looks like.

Create credential looks similar except you need to provide Scope as well. Scope can not changed once credential is saved.

You can change credential inputs (Application Id, Query Text) at any point. FlexDeploy will use these inputs with clipasswordsdk to retrieve individual credential for use during Workflow Execution.

FlexDeploy provides out of box integration with Azure Key Vault to retrieve secrets. FlexDeploy will authenticate using the OAuth 2.0 authentication method.

Azure Key Vault Setup

• Create new App registration in the Azure Portal.
• Create a new Client Secret in the Certificates & secrets section in the created app registration.
• Provide the appropriate role to the created app registration in the desired Key Vault's Access policies section (for Vault access policy) or Access control (IAM) section (for Azure role-based access control). 

FlexDeploy Setup

You must first create a Credential Store in FlexDeploy by clicking the Create Store button on Administration - Security - Credentials page. The credential store represents an instance of a specific type of credential store provider. If you have more than one Azure Key Vault, you will create an equal number of Credential Stores in FlexDeploy.

Here are the configurations necessary for this store.

Now you are ready to create an individual credential to be retrieved from the Key Vault.

You can create or edit credentials from the Credentials page or from where the specific credential is used.

Azure Key Vault Credential requires input as described below.

Here is what the edit credential form looks like.

Create credential looks similar except you need to provide Scope as well. The scope can not be changed once the credential is saved.

You can change credential inputs (Secret Name) at any point. FlexDeploy will use these inputs with credential store properties like Vault URL, Client ID, and Client Secret to retrieve individual credentials for use during Workflow Execution.

FlexDeploy provides out of box integration with Thycotic Secret Server to retrieve secrets. 

Thycotic Secret Server Setup

• Make sure Thycotic has web services enabled

FlexDeploy Setup

You must first create a Credential Store in FlexDeploy by clicking the Create Store button on Administration - Security - Credentials page. The credential store represents an instance of a specific type of credential store provider. If you have more than one Thycotic Secret Server, you will create an equal number of Credential Stores in FlexDeploy.

Here are the configurations necessary for this store.

Now you are ready to create an individual credential to be retrieved from the Secret Server

You can create or edit credentials from the Credentials page or from where the specific credential is used.

Thycotic Secret Server requires input as described below.

Here is what the create and edit credential form looks like.

You can change credential inputs (Secret ID) at any point. FlexDeploy will use these inputs with credential store properties to retrieve individual credentials for use during Workflow Execution.