Description
Manage IBM Guardium privileged accounts.
Vendor
This platform is designed for remote account management for the following target:
| Vendor | IBM |
|---|---|
| Product | Guardium |
| Product Category | Security Appliance |
| Product Versions | Version: 10.1.2_r100604_v10_1_2_1-el67-20161123_1511 external_r1286-20161123_1511 Latest patch number: 200 Latest patch description: Guardium Patch Update (GPU) for Version 10.0 |
CyberArk
This platform works with the following CyberArk versions:
| CyberArk Solution | Privileged Credentials Management |
|---|---|
| CyberArk Product | Central Policy Manager (CPM) |
| CyberArk Versions | 9.7 or higher |
| Artifact Version | 1.0 |
| Out of the Box | NO |
| Out of the Box in versions |
Support & Certification
| Support Level | STANDARD |
|---|---|
| Developed by | CyberArk |
| Certification Level | CERTIFIED |
| Connection Methods | HTTP/HTTPS |
Actions
The following table lists the supported management actions for this platform:
| Action | Supported | Permissions |
|---|---|---|
| Verify | YES | |
| Change | YES | |
| Reconcile | YES | |
| Delete | NO |
Linked Accounts
The following linked accounts are in use by the plugin.
Logon Account
| Supported | NO |
|---|---|
| Required | NO |
| Platforms | |
| Permissions |
Reconcile Account
| Supported | YES |
|---|---|
| Required | NO |
| Platforms | |
| Permissions |
ExtraPass2 Account
| Supported | YES |
|---|---|
| Required | YES |
| Platforms | |
| Permissions |
Prerequisites
Prior to installing the IBM Guardium plug-in the following command will need to be run on the IBM Guardium's CLI. Running this command will register the client_id on the device. The client_id and client_secret will be required to authenticate to the API and will be used as a linked account (known as the ClientID account). Run the following command in Guardium's CLI to register oauth_client1:
grdapi register_oauth_client client_id=oauth_client1
The response will be similar to the following:
{"client_id":"oauth_client1","client_secret":"abcde123-fg45-hijklmnop6789" ,"grant_types":"password","scope":"read,write","redirect_uri":"https://someApp"}
Using this response, a new account will need to be created in the vault. The username would be oauth_client1 and the password would be the client_secret value.
Installation
Import Platform
Do the following to import the platform:
| Step | How To |
|---|---|
| Import the platform | See Add new platform topic in the Online Help Center or in the Privileged Access Security Implementation Guide. |
Configuration
Platform Settings
Specify the following parameters at the platform level:
Parameter Name | Description | Acceptable Values | Default Value |
|---|---|---|---|
| UseSSL | If the connection will be established with either HTTP or HTTPS and if it will ignore untrusted certificates | Yes/No/IgnoreUntrustedCertificate | Yes |
| Debug | Enable debug logs | Yes/No | No |
Account Settings
Account Mandatory Parameters
Specify the following parameters on the account:
| Parameter Name | Description | Acceptable Values |
|---|---|---|
| Username | Username of the target account | |
| Address | Address of the target account |
Account Optional Parameters
Specify the following parameters on the account:
| Parameter Name | Description | Acceptable Values | Default Value |
|---|---|---|---|
| Port | Port of the target device | 8443 |