- Getting started
- Best practices
- Tenant
- About the Tenant Context
- Searching for Resources in a Tenant
- Managing Robots
- Connecting Robots to Orchestrator
- Setup Samples
- Storing Robot Credentials in CyberArk
- Setting up Attended Robots
- Setting up Unattended Robots
- Storing Unattended Robot Passwords in Azure Key Vault (read-only)
- Storing Unattended Robot Credentials in HashiCorp Vault (read-only)
- Deleting Disconnected and Unresponsive Unattended Sessions
- Robot Authentication
- Robot Authentication With Client Credentials
- SmartCard Authentication
- Audit
- Resource Catalog Service
- Folders Context
- Automations
- Processes
- Jobs
- Triggers
- Logs
- Monitoring
- Queues
- Assets
- Storage Buckets
- Test Suite - Orchestrator
- Other Configurations
- Integrations
- Classic Robots
- Host administration
- Organization administration
- Troubleshooting
Managing Credential Stores
Orchestrator Database
- Click Create, Orchestrator database stores do not have any configurable properties.
CyberArk
- In the Name field, type a name for the new credential store.
- In the App ID field, enter the application ID for your Orchestrator instance from the CyberArk® PVWA (Password Vault Web Access) interface. See here for details.
- In the CyberArk Safe field, enter the safe name as defined in the CyberArk® PVWA. See here for details.
- In the CyberArk Folder field, enter the location in which CyberArk® stores your credentials.
-
Click Create. Your new credential store is ready for use.
CyberArk CCP
- In the Name field, type a name for the new credential store.
- In the App ID field, enter the application ID for your Orchestrator instance from the CyberArk® PVWA (Password Vault Web Access) interface. See here for details.
- In the CyberArk Safe field, enter the safe name defined in the CyberArk® PVWA. See here for details.
- In the CyberArk Folder field, enter the location in which CyberArk® stores your credentials.
- In the Central Credential Provider URL field, enter the Central Credential Provider's address.
-
In the Web Service Name field, enter the name of the Central Credential Provider web service. If you leave this field empty, the default name is used: AIMWebService.
10.The Client Certificate needs to be configured when the the CyberArk Application uses the client certificate authentication method. The expected input is a.pfx
file which stores the private and the public key of the certificate. The client certificate needs to be installed on the machine where CyberArk CCP AIMWebservice is deployed.Note:The client certificate is used by CyberArk credential provided to authenticate the application defined in Orchestrator credential store. See the official CyberArk documentation for details on application authentication methods.
The client certificate is a PKCS12 binary format file that stores the certificate chain public key(s) and the private key.
If the client certificate is encoded in base 64 then run the followingcertutil
command to decode it in binary format:certutil -decode client_certificate_encoded.pfx client_certificate.pfx
- In the Client Certificate Password field, enter the password of the client certificate.
- The Server Root Certificate needs to be configured when a self signed Root CA certificate is used by the CyberArk CCP AIMWebService for incoming HTTP
requests. It is used in HTTPS TLS handshake certificate chain validation. The expected input is a
.crt
file which stores the root CA certificate public key. -
Click Create. Your new credential store is ready for use.
Azure Key Vault
Key Vault credential stores use RBAC type authentication. After you've created a service principal, perform these steps:
-
In the Name field, type a name for the new credential store.
-
In the Key Vault Uri field, enter the address of your Azure Key Vault. This is
https://<vault_name>.vault.azure.net/
. -
In the Directory ID field, enter the directory ID found in the Azure portal.
-
In the Client Id field, enter the Application ID from your Azure AD App Registrations section where the Orchestrator app was registered.
-
In the Client Secret field, enter the secret needed to authenticate the client account entered in the previous step.
-
Click Create. Your new credential store is ready for use.
HashiCorp Vault
- In the Type field, select HashiCorp Vault or HashiCorp Vault (read-only) as your credential store.
- In the Name field, specify a name for the HashiCorp Vault credential store.
- In the Vault Uri field, indicate the URI to the HTTP API of HashiCorp Vault.
-
In the Authentication Type field, indicate your preferred authentication method. Depending on the option you choose, yo must configure additional fields:
-
AppRole – This is the recommended authentication method. If you choose this option, make sure to also configure the following fields:
- Role Id – Indicate the role ID to use with the AppRole authentication method
- Secret Id – Enter the secret ID to use with the AppRole authentication type.
-
UsernamePassword – If you choose this option, make sure to also configure the following fields:
- Username – Enter the username to use with UsernamePassword.
- Password – Indicate the password to use with UsernamePassword authentication type.
-
Ldap – If you choose this option, make sure to also configure the following fields:
- Username – Specify the username to use with the LDAP authentication type.
- Password – Indicate the password to use with LDAP authentication type.
-
Token – If you choose this option, make sure to also configure the following field:
- Token – Enter the token to use with the Token authentication type.
-
- In the Secrets Engine field, indicate the secrets engine to use. Your options are:
- KeyValueV1
- KeyValueV2
- ActiveDirectory
- In the Secrets Engine Mount Path field, provide the path of the secrets engine. If not supplied, it defaults to
kv
for KeyValueV1,kv-v2
for KeyValueV2 andad
for ActiveDirectory. - In the Data Path field, enter the path prefix to use for all stored secrets.
- In the Namespace field, specify the namespace to use. Only available in HashiCorp Vault Enterprise.
-
Click Create. Your new credential store is ready for use.
BeyondTrust
-
In the Type field, select one of the following options:
- BeyondTrust Password Safe - Managed Accounts
- BeyondTrust Password Safe - Team Passwords
- In the Name field, specify the name of the BeyondTrust credential store.
- In the BeyondTrust Host URL field, specify the URL of your secret server instance.
- In the API Registration Key field, indicate the value of the API registration key from BeyondTrust.
-
In the API Run As Username field, specify the BeyondTrust username under which you want to execute the calls.
BeyondTrust Password Safe - Managed Accounts
If you chose BeyondTrust Password Safe - Managed Accounts, continue with the following steps:
-
Optionally, in the Default Managed System Name field, indicate a fallback Managed System to be used in case no other Managed System has been provided in the Orchestrator Asset.
- In the System-Account Delimiter field, specify the delimiter used to split the Managed System name from the Managed Account name in the Orchestrator Asset.
- In the Managed Account Type field, indicate the BeyondTrust managed account type.
-
Click Create. Your new credential store is ready for use.
BeyondTrust Password Safe - Team Passwords
If you chose BeyondTrust Password Safe - Team Passwords, continue with the following steps:
-
Optionally, in the Folder Path Prefix field, indicate a default folder path prefix. This will be added in front of all Orchestrator Asset values.
- In the Folder / Account Delimiter field, enter the delimiter used to split the Path from the Title in the Orchestrator Asset.
-
Click Create. Your new credential store is ready for use.
Navigate to Credential Stores (Tenant > Credential Stores) and from the More Actions menu of the desired store, select Edit. The Edit Credential Store dialog appears is displayed.
When using 2 or more credential stores, you have the ability to select which is the default store used for Robots and Assets. The same store may be used as the default for both, or you can select a different default store for each.
To select a default store, from the More Actions menu, select Set as robots default store and/or Set as assets default store.
To delete a credential store, select Remove from the More Actions menu of the desired store.
If the selected store is in use, a warning dialog will appear listing the number of robots and assets that will be affected. Click Delete to confirm the removal or Cancel to abort. Note that you must have at least one credential store active at all times. If only one is present, then the option to delete it does not appear.