{"type":"doc","content":[{"type":"paragraph","content":[{"text":"FlexDeploy provides out of box integration with CyberArk AAM to retrieve secrets. FlexDeploy will authenticate using client certificate or retrieve credentials using Agent. In this section we will talk about client certificate based authentication.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"CyberArk Setup","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create necessary Application Id(s) in CyberArk AAM.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure safe and credentials.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure Application Id(s) for specific client certificate authentication.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If necessary, get PEM files for CyberArk server trust.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Generating the Client Certificate","type":"text"}]},{"type":"paragraph","content":[{"text":"Here are some steps for creating a client .pem file for authenticating against CyberArk from FlexDeploy. This uses openssl to create a certificate signing request and private key. Your organization may have their own guidelines, but this may help for understanding the general process needed. ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Generate a certificate signing request and private key. Preferably run this on FlexDeploy server. We have to secure private key file, so that it is only accessible by FlexDeploy application process. ","type":"text"}]},{"type":"codeBlock","content":[{"text":"openssl req -newkey -nodes -keyout clientKey.key -out clientCSR.csr ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Present the certificate signing request (.csr file) to your certificate authority (CA). The certificate authority will sign and return a certificate (.crt/.cer file).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The certificate will likely be a .crt, .cer, or .pem file, which are all PEM format. If it's in another format, it will need to be converted to one of these formats. For example, a .p7b file is also a common format to receive certificates. Here's a command for converting from PKCS#7.","type":"text"}]},{"type":"codeBlock","content":[{"text":"openssl pkcs7 -print_certs -in certificate.p7b -out certificate.crt","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a .pem file from the certificate and private key. ","type":"text"}]},{"type":"codeBlock","content":[{"text":"cat clientCertificate.crt clientKey.key > clientPem.pem","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"This set of steps will create a PKCS#8 key file. See ","type":"text"},{"text":"Integrate with CyberArk AAM (HTTP)#Converting Between Key Formats","type":"text","marks":[{"type":"link","attrs":{"href":"#"}}]},{"text":" if you prefer another format.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"FlexDeploy Setup","type":"text"}]},{"type":"paragraph","content":[{"text":"You must first create Credential Store in FlexDeploy by clicking ","type":"text"},{"text":"+ Create","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" button on Configuration - Integration - Credential Store page. Credential store represents instance of specific type of credential store provider. If you have more than one CyberArk AAM installations, you will create equal number of Credential Stores in FlexDeploy. Use CyberArk AAM Provider when creating this store.","type":"text"}]},{"type":"paragraph","content":[{"text":"Here are the configurations necessary for this store.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":610,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":734,"id":"fec8c9bf-90a2-4629-a966-52e2072cd963","collection":"contentId-10926698954","type":"file","height":733}}]},{"type":"table","attrs":{"layout":"full-width","width":1800.0,"localId":"d3b96cb7-2a9e-47ae-b6fa-98a8bf7ffa41"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[275.0]},"content":[{"type":"paragraph","content":[{"text":"Property Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[691.0]},"content":[{"type":"paragraph","content":[{"text":"Notes","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[538.0]},"content":[{"type":"paragraph","content":[{"text":"Example","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[275.0]},"content":[{"type":"paragraph","content":[{"text":"CyberArk URL","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[691.0]},"content":[{"type":"paragraph","content":[{"text":"HTTP URL for CyberArk AAM. FlexDeploy will invoke HTTP GET to retrieve credential. If you use https protocol, then you may have to setup Server Certificate Path.","type":"text"}]},{"type":"paragraph","content":[{"text":"URL can be ","type":"text"},{"text":"https://services-xyz.skytap.com:1234","type":"text","marks":[{"type":"link","attrs":{"href":"https://services-xyz.skytap.com:1234"}}]},{"text":" or ","type":"text"},{"text":"https://services-xyz.skytap.com:1234/AIMWebservice/api/Accounts.","type":"text","marks":[{"type":"link","attrs":{"href":"https://services-xyz.skytap.com:1234/AIMWebservice/api/Accounts."}}]},{"text":" If URL does not end with api/Accounts, then /AIMWebservice/api/Accounts will be added to end of URL automatically for invocation. ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[538.0]},"content":[{"type":"paragraph","content":[{"text":"https://services-xyz.skytap.com:1234","type":"text","marks":[{"type":"link","attrs":{"href":"https://services-xyz.skytap.com:1234"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[275.0]},"content":[{"type":"paragraph","content":[{"text":"Client Certificate Path","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[691.0]},"content":[{"type":"paragraph","content":[{"text":"This is the full path to the .pem file containing the private key and certificate chain used to authenticate FlexDeploy against CyberArk AAM.","type":"text"}]},{"type":"paragraph","content":[{"text":"Only PEM files that contain the private key with certificate e.g. PKCS12/PKCS8 files are supported at this time. You must store the PEM certificate file with private key and certificate on FlexDeploy server in secure location. See the ","type":"text"},{"text":"Integrate with CyberArk AAM (HTTP)#Supported Key Formats","type":"text","marks":[{"type":"link","attrs":{"href":"#"}}]},{"text":" section below to verify your private key meets requirements.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[538.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[275.0]},"content":[{"type":"paragraph","content":[{"text":"Client Private Key Passphrase","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[691.0]},"content":[{"type":"paragraph","content":[{"text":"Private Key passphrase. Leave blank if the private key is unencrypted.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[538.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[275.0]},"content":[{"type":"paragraph","content":[{"text":"Server Certificate Path","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[691.0]},"content":[{"type":"paragraph","content":[{"text":"Optional, only needed if using https protocol. This is the full path to the .pem certificate file which is used to setup trust for CyberArk server.","type":"text"}]},{"type":"paragraph","content":[{"text":"Only PEM certificates are supported at this time. You must store PEM certificate file with certificate on FlexDeploy server in secure location.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[538.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]}]},{"type":"paragraph","content":[{"text":"Now you are ready to create individual credential to be retrieved from CyberArk.","type":"text"}]},{"type":"paragraph","content":[{"text":"You can 1:create or 2:edit credentials from Credentials page or from where specific credential is used.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"full-width","width":1800,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1728,"id":"0287bfd2-5a4d-41f6-a5ba-b0b640d9fd93","collection":"contentId-10926698954","type":"file","height":272}}]},{"type":"paragraph","content":[{"text":"CyberArk credential requires two inputs as described below.","type":"text"}]},{"type":"table","attrs":{"layout":"wide","width":1800.0,"localId":"ddb8f764-5e3d-4aa2-a27a-366d1ab4c1da"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[251.0]},"content":[{"type":"paragraph","content":[{"text":"Input Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[709.0]},"content":[{"type":"paragraph","content":[{"text":"Notes","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[251.0]},"content":[{"type":"paragraph","content":[{"text":"Application Id","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[709.0]},"content":[{"type":"paragraph","content":[{"text":"Application id and Query Text are used to retrieve secret from CyberArk AAM.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[251.0]},"content":[{"type":"paragraph","content":[{"text":"Query","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[709.0]},"content":[{"type":"paragraph","content":[{"text":"Query Text for credential. For example, Safe=Linux%20Accounts;Folder=root;Object=secret","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Here is how the edit credential popup looks like.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":600,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":643,"id":"6fb8e03e-ec75-4c8e-94e9-ef956ae2e4b0","collection":"contentId-10926698954","type":"file","height":467}}]},{"type":"paragraph","content":[{"text":"Create credential looks similar except you need to provide Scope as well. Scope can not changed once credential is saved.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":600,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":641,"id":"df434e31-7989-4c42-a45e-a48d32edb1f2","collection":"contentId-10926698954","type":"file","height":468}}]},{"type":"paragraph","content":[{"text":"You can change credential inputs (Application Id, Query Text) at any point. FlexDeploy will use these inputs with credential store properties like URL, Certificate Path etc. to retrieve individual credential for use during Workflow Execution.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Supported Key Formats","type":"text"},{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"Supported-Key-Formats"},"legacyAnchorId":{"value":"IntegratewithCyberArkAAM(HTTP)-Supported-Key-Formats"}},"macroMetadata":{"macroId":{"value":"fe1c8c69538a8558fd3a4b8969c4a4a7"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"bb7be912-f37b-4a00-9a65-dc844693f758"}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"PKCS#8","type":"text","marks":[{"type":"strong"}]},{"text":" - In a PEM file, the base64 ASCII encoded private key will be contained between -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"PKCS#1 (RSA)","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"- ","type":"text","marks":[{"type":"strong"}]},{"text":" In a PEM file, the base64 ASCII encoded private key will be contained between -----BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY----- lines. This RSA key cannot be password protected. There will be lines before the key similar to Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,2A37A86050838C0D if the key is encrypted, and therefore password protected. If you prefer to use a password to protect the private key, use a PKCS#12 key.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"PKCS#12 (Encrypted) ","type":"text","marks":[{"type":"strong"}]},{"text":"- In a PEM file, the private key will be contained between -----BEGIN ENCRYPTED PRIVATE KEY----- and -----END ENCRYPTED PRIVATE KEY----- lines. A client certificate password is required for this private key format. Supported ciphers are","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"des/des3 (default)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"aes128/aes192/aes256","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"camellia128/camellia192/camellia256","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Converting Between Key Formats","type":"text"},{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"Converting-Between-Key-Formats"},"legacyAnchorId":{"value":"IntegratewithCyberArkAAM(HTTP)-Converting-Between-Key-Formats"}},"macroMetadata":{"macroId":{"value":"0e3efdb0894a6d332745b65fcd0793fe"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"7a604e67-579a-42b9-87d2-22127cc9ac54"}}]},{"type":"paragraph","content":[{"text":"Often, a certificate and key will be provided in the form of .cer and .key files or some other format. OpenSSL or another tool will be needed to convert to the supported PEM format. See some examples below.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a .p12 combined certificate file from .key and .cer files, then export as a .pem file. You will be prompted for the password when running these commands.","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":"openssl pkcs12 -export -in <.cer file> -inkey <.key file> -out <.p12 result file> -name \n\nopenssl pkcs12 -in <.p12 file> -out <.pem result file>","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Convert a PKCS#8 .pem file to PKCS#1. Keep in mind adding options like -des to this command is not supported. To encrypt a key, convert it to PKCS#12 format with the openssl pkcs12 command.","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":"openssl rsa -in <.pem file> -out ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Encrypt a PKCS#8 or PKCS#1 .pem file. You will be prompted for the password when running these commands.","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":"openssl pkcs12 -export -in <.pem file> -out <.p12 file>\n\nopenssl pkcs12 -in <.p12 file> -out ","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}],"version":1}

Browser not supported