Platform On-PremControl accessSecretsCyberark

Set up CyberArk

Prerequisites

CyberArk CCP infrastructure

You need:

  • CyberArk CCP installed
  • Network connectivity between Itential Platform and CyberArk CCP
  • Firewall rules that allow HTTP API communication

When using CyberArk on Windows Server 2022 or newer, you cannot configure Client Credential Authentication (mutual TLS) and TLS 1.3 simultaneously. This is a known compatibility issue between CyberArk and IIS. See CyberArk Support.

CyberArk CCP configuration

Configure these items in CyberArk CCP:

  • A Safe containing your secrets
  • An Application ID (AppID) for Itential Platform authentication
  • Permissions that allow Itential Platform to retrieve secrets

Itential Platform requirements

You need:

  • Administrative access to Itential Platform
  • Write access to the Itential Platform server for configuration

Initial setup

Step 1: Install and verify CyberArk CCP

1

Install CyberArk CCP

Install CyberArk CCP following the CyberArk CCP installation guide or verify its installation.

2

Test connectivity

Test connectivity from your Itential Platform server to your CyberArk CCP instance.

Step 2: Configure the Itential Platform connection

Configure Itential Platform to connect to CyberArk CCP using one of three methods: Properties File, Environment Variable, or Server Profile (properties.json).

All three configuration methods are available in Platform 6, but 2023.2 only supports the Server Profile (properties.json) method.

Configuration parameters

Properties FileEnvironment VariableServer ProfileDescription
secret_provider_nameITENTIAL_SECRET_PROVIDER_NAMEvaultProps.secretProviderNameThe secrets provider type ("CyberArkCcp")
cyberark_urlITENTIAL_CYBERARK_URLvaultProps.cyberarkUrlThe URL to CyberArk Central Credential Provider
cyberark_app_idITENTIAL_CYBERARK_APP_IDvaultProps.appIdUnique ID of the application issuing the secret request
cyberark_connection_timeoutITENTIAL_CYBERARK_CONNECTION_TIMEOUTvaultProps.connectionTimeoutSeconds CCP will try to retrieve the secret value
cyberark_reason_textITENTIAL_CYBERARK_REASON_TEXTvaultProps.reasonTextReason for retrieving the secret (appears in audit log)
cyberark_allow_invalid_certificatesITENTIAL_CYBERARK_ALLOW_INVALID_CERTIFICATESvaultProps.allowInvalidCertificatesIf true, disables TLS certificate validation
cyberark_caITENTIAL_CYBERARK_CAvaultProps.caAbsolute path to .pem file containing CA root certificate chain
cyberark_keyITENTIAL_CYBERARK_KEYvaultProps.keyAbsolute path to certificate key file
cyberark_certificateITENTIAL_CYBERARK_CERTIFICATEvaultProps.certificateAbsolute path to .pem file containing client certificate
cyberark_ca_contentsITENTIAL_CYBERARK_CA_CONTENTSvaultProps.caContentsPEM-encoded CA root certificate chain as a string
cyberark_key_contentsITENTIAL_CYBERARK_KEY_CONTENTSvaultProps.keyContentsPEM-encoded certificate key as a string
cyberark_certificate_contentsITENTIAL_CYBERARK_CERTIFICATE_CONTENTSvaultProps.certificateContentsPEM-encoded client certificate as a string

Configuration examples

1secret_provider_name=CyberArkCcp
2cyberark_url=https://cyberark.company.com/AIMWebService
3cyberark_app_id=Itential-Platform
4cyberark_connection_timeout=30
5cyberark_allow_invalid_certificates=true
6cyberark_ca=/etc/pki/cyberark/ca.pem
7cyberark_key=/etc/pki/cyberark/key.pem
8cyberark_certificate=/etc/pki/cyberark/cert.pem
9cyberark_reason_text=Configuration of Itential Platform

Step 3: Verify the connection

1

Restart Itential Platform

Restart Itential Platform to apply configuration changes.

2

View configuration

View the CyberArk CCP configuration in Admin Essentials (read-only):

  • Platform 6: Navigate to Admin Essentials > Configuration
  • 2023.2: Navigate to Admin Essentials > Profiles
3

Check health endpoint

Check the Itential Platform health endpoint (GET /health/status) for CyberArk CCP connectivity.

4

Test secret retrieval

Retrieve a test secret to validate your setup. See Use secrets for details.

Next steps

Use secrets

Reference secrets in configurations

Troubleshoot

Resolve common issues