Description
Credential management plugin for managing Service users in CyberArk Identity.
Vendor
This platform is designed for remote account management for the following target:
| Vendor | CyberArk |
|---|---|
| Product | CyberArk Identity |
| Product Category | Application |
| Product Versions | 14.4 |
CyberArk
This platform works with the following CyberArk versions:
| CyberArk Solution | Central Policy Management (CPM) |
|---|---|
| CyberArk Product | Central Policy Management (CPM) |
| CyberArk Versions | 12.6 or higher |
| Artifact Version | 14.4 |
| Out of the Box | NO |
| Out of the Box in versions |
Support & Certification
| Support Level | STANDARD |
|---|---|
| Developed by | CyberArk |
| Certification Level | CERTIFIED |
Prerequisites
- In Identity administration, Users page:
The "Is service user" flag on the identity account is selected - to allow token extraction
The "Is 0Auth confidential client" flag on the identity account is selected
Starting from version 20.0.2.18, the REST API Application CPM Plugin Framework DLL is removed from the CyberArk Identity Service User package and must now be consumed as a separate dependency.
Link to MP for Rest API framework - https://community.cyberark.com/marketplace/s/#a35Vy000000Lj3lIAC-a39Vy000002WA1VIAW
Support
Target devices
The CPM supports remote account management for Identity Service users accounts on the following target devices:
- CyberArk Identity
Note - Starting from version 2.0 of the CyberArk Identity Service User platform, you must first import version 1.1 of the REST API Framework. For details, see Create CPM plugins for REST API applications.
Accounts
The CPM supports account management for the following accounts:
- CyberArk Identity service user accounts
Platforms
Make sure that the following target account platform is displayed in the PVWA Platform Management page:
- CyberArk Identity Service user
Connection Methods
This plugin supports the following connection methods to the remote machine:
- Rest API
Supported Actions
Action | Supported | Target user specification |
|---|---|---|
| Verify | YES | No special permissions required |
| Change | YES | No special permissions required |
| Reconcile | YES | Required role and permissions: Role: "sysadmin" Permissions: "/lib/rights/cybrservicetenantaccess.json" |
Linked accounts
Logon Account
Action | Supported | Required | Target user specification |
|---|---|---|---|
| Logon account | NO | - | - |
| Reconcile account | YES | NO | - |
Configuration
Import platform
This procedure is relevant because the platform is not included in the installation.
Account parameters
Required:
Name | Platform Level | Account Level | Description | Default |
|---|---|---|---|---|
| KeyID |
| The KeyID used in the API call | - | |
| Password |
| The system user's password (Generated by Identity). Password must be between 8 and 64 characters long, contain at least one digit, and contain at least one upper and one lower case letter. | - | |
| Address |
| Identity tenant address | - |
Optional:
Name | Platform Level | Account Level | Description | Default |
|---|---|---|---|---|
| UserName |
| The display name of the service user in Identity | - |
Platform parameters
| Name | Platform level | Account Level | Description | Default |
|---|---|---|---|---|
AddressValidationPattern | Yes | - | A regex to limit the address parameter value. Acceptable values: Regex | .* Note; CyberArk recommends that you change the default value for enhanced security. |
ConfigurationFilePath |
| The plugin configuration file (Part of the "Generic Rest API Plugin" suite) | CyberArkIdentityServiceUserPluginConfiguration.xml |