The beSECURE/CyberArk integration allows beSECURE to pull credentials for SMB (Windows) or SSH (UNIX) from a CyberArk Account Identity Manager (AIM). Note: This guide references the legacy CyberArk Application Identity Manager interface which is now known as CyberArk Application Access Manager.


Configuring CyberArk to integrate with beSECURE

To integrate CyberArk with beSECURE, do the following:

  1. Sign in to CyberArk Password Vault.
  2. Depending on your platform and setup, create a UnixSSH, UnixSSHKeys, WinDomain, WinServerLocal, or WinDesktopLocal PolicyID.
  3. Under the Advanced tab, make note of the policy’s Safe, Folder, and Object values. beSECURE will use these settings to retrieve the credentials for this element by way of the following query:
    Safe=<value>;Folder=<value>;Object=<value>

  4. Create an Application ID for beSECURE by doing the following:
    1. Open the Applications page.
    2. Select Add Application.
    3. In the Name box, enter BeyondSecurity.
    4. Select Add.
  5. Secure the Application ID with a client-side certificate serial number by doing the following:
    1. Generate the client-side certificate by running the following command: 
      openssl req -x509 -newkey rsa:4096 -keyout server_key.pem -out server_cert.pem -nodes -days 365 -subj "/CN=localhost/O=Client\ Certificate\ Demo"
      Note: You can increase the days 365 value to extend the expiration date. The subj value is provided for your own information and is not enforced by the server.
    2. Extract and copy the certificate’s Serial Number by running the following command (the output will appear in the following example format: serial=EC4D1A3C2342A393):
      openssl x509 -in server_cert.pem -serial -noout
    3. Open the BeyondSecurity Application ID, and then select Add > Certificate Serial Number.
    4. Paste the Certificate Serial Number to the Application ID.

 

Configuring beSECURE to integrate with CyberArk

To integrate beSECURE with CyberArk, do the following:

  1. Log in to beSECURE.
  2. In the upper-left corner of the Home page, select DevOps.
  3. Select Scans > Credentials Storage.
  4. Select the Newbutton .
  5. On the Credentials Storage Detailspage, do the following:
    1. In the Name box, enter CyberArk.
    2. In the Available box, select users to assign them permissions to the CyberArk Credentials Storage.
    3. In the Storage Location box, select CyberArk Application Identity Manager (AAM).
    4. In the CyberArk IP Address or FQDN (and port if differs 443) box, enter the CyberArk’s server IP address or FQDN followed by its port number (for example, services-uscentral.skytap.com:12091).
    5. In the AppID box, enter BeyondSecurity.
    6. In the Query box, enter the Safe, Folder, and Object values from CyberArk in the following query: 
      Safe=<value>;Folder=<value>;Object=<value>
    7. In the Client Side Certificate, paste the Certificate and Key information from CyberArk. For example:
      -----BEGIN PRIVATE KEY---
MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQCvhg8yMPUdZcFS
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----MIIFPzCCAyegAwIBAgIJAOxNGjwjQqOTMA0GCSqGSIb3DQEBCwUAMDYxEjAQBgNV
-----END CERTIFICATE-----

    8. Select Modify.


Note: If you have a p12 certificate instead of a .pem file, use this command to extract the two components from it in place of the Certificate and Key Information:

openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys
openssl pkcs12 -in path.p12 -out newfile.key.pem -nocerts -nodes