[ Applies to ] StorageGuard 9.x and later / CyberArk Privileged Access Manager / Credential Provider (AIM) and Central Credential Provider (CCP)
StorageGuard can retrieve the password of a scan account from CyberArk each time it scans, instead of storing the password itself. When CyberArk rotates the password, StorageGuard picks up the new one automatically. This article explains the two supported retrieval methods and how to set up a CyberArk credential for each.
In this article
Choose a retrieval method
StorageGuard supports two ways of retrieving passwords from CyberArk. Each one has its own credential type in StorageGuard.
| Method | Credential type | How it works | What to install |
|---|---|---|---|
| Credential Provider (AIM) | Cyber-Ark | StorageGuard asks a CyberArk Credential Provider agent that runs locally on the master server. The agent retrieves the password from the vault. | CyberArk Credential Provider on the StorageGuard master server. Nothing on collector servers. |
| Central Credential Provider (CCP) | Cyber-Ark CCP | StorageGuard calls the CyberArk CCP web service (REST API) over HTTPS. No agent is needed on StorageGuard servers. | Nothing on StorageGuard servers. The CCP server must be reachable from the master server. |
Tip: Use CCP if your organization prefers not to install agents on application servers, or if CyberArk is already exposing CCP for other applications. Use AIM if the Credential Provider is your standard, or if the master server can't reach a CCP server.
Before you begin
For both methods
- An Application ID (AppID) defined in CyberArk for StorageGuard, with permission to retrieve the account from its safe.
- The Safe name and the Account ID (the account's object name) of each scan account.
- The Folder that contains the account, if it isn't the safe's root folder.
- A StorageGuard account with administrative privileges.
For Credential Provider (AIM)
- The CyberArk Credential Provider installed and running on the StorageGuard master server. You don't need to install it on collector servers.
- The Credential Provider user is a member of the safe that holds the account.
- The port the Credential Provider listens on, if it isn't the default.
For Central Credential Provider (CCP)
- The host name of the CCP server, and its port if it isn't the default.
- Outbound HTTPS from the StorageGuard master server to the CCP server.
- If the AppID authenticates with a client certificate: the certificate file and its password.
- If the AppID authenticates by allowed machines: the master server's address added to the AppID's allowed machines.
Create the CyberArk credential
- In StorageGuard, go to the Configuration tab and select Scan > Authentication > Credentials.
- Click Add Credentials.
- In the Type list, select the credential type for your method:
- Cyber-Ark for the Credential Provider (AIM).
- Cyber-Ark CCP for the Central Credential Provider (CCP).
- Fill in the fields as described in Credential Provider (AIM) fields or Central Credential Provider (CCP) fields.
- Save the credential.
Credential Provider (AIM) fields
| Field | Required | Description |
|---|---|---|
| Name | Optional | A descriptive name for the credential. You select the credential by this name when you create a connectivity policy. |
| AppID | Required | The CyberArk application ID that StorageGuard uses to authenticate when it requests the password. If you leave it empty, StorageGuard uses the default value from Admin > Properties. |
| Safe | Required | The name of the CyberArk safe that contains the account. If you leave it empty, StorageGuard uses the default value from Admin > Properties. |
| AccountID | Required | The CyberArk account identifier, also called the object name. |
| Folder | Optional | The folder inside the safe that contains the account. If you leave it empty, StorageGuard uses the root folder. If you leave it empty, StorageGuard uses the default value from Admin > Properties. |
| Port | Optional | The port the Credential Provider agent on the master server listens on. This is not the vault port. If you leave it empty, StorageGuard uses the default value from Admin > Properties. |
| Username pattern | Optional | The format of the user name StorageGuard sends to the scanned system. See Username pattern values. If you leave it empty, StorageGuard uses the default value from Admin > Properties. |
Central Credential Provider (CCP) fields
| Field | Required | Description |
|---|---|---|
| Name | Optional | A descriptive name for the credential. You select the credential by this name when you create a connectivity policy. |
| App ID | Required | The CyberArk application ID that StorageGuard uses to authenticate to CCP. |
| Safe | Required | The name of the CyberArk safe that contains the account. |
| Account ID | Required | The CyberArk account identifier, also called the object name. |
| Folder | Optional | The folder inside the safe that contains the account. If you leave it empty, StorageGuard uses the root folder. |
| Host | Required | The host name or IP address of the CCP server. If the CCP server uses HTTPS, enter the name that appears in its server certificate. |
| Port | Optional | The port the CCP web service listens on. If you leave it empty, StorageGuard uses the default port. |
| Certificate | Optional | The client certificate StorageGuard presents to CCP. Click Upload file and select the certificate file. Required only if the AppID authenticates with a client certificate. |
| Certificate password | Optional | The password that protects the certificate file. |
| Confirm Certificate password | Optional | Enter the certificate password again. |
| Username pattern | Optional | The format of the user name StorageGuard sends to the scanned system. See Username pattern values. |
Username pattern values
The Username pattern field controls how StorageGuard builds the user name from the account properties in CyberArk. Choose the format the scanned system expects.
| Pattern | Returns | Example |
|---|---|---|
{LogonDomain}{UserName} |
The user name in NetBIOS format. This is the default if you leave the field empty. | CORP\svc_storageguard |
{UserName}@{Address} |
The user name in FQDN (UPN) format. | svc_storageguard@corp.example.com |
{UserName} |
The user name only, without a domain. | svc_storageguard |
Set CyberArk default values
If most of your CyberArk credentials share the same AppID, safe, folder, port, or username pattern, you can set these once as defaults. Credential fields left empty then use the default values.
- Go to Admin > Properties.
- Expand the Cyber-Ark Configuration group.
- Double-click a property to edit its value.
Note: Defaults apply to credentials of type Cyber-Ark (AIM).
Use the credential in a scan
- Create a new Connectivity Policy and select the CyberArk credential you created.
- Associate the connectivity policy with each storage or backup system that should use this account.
- Run a scan of one of those systems and check that it completes without authentication errors.
Troubleshooting
| Symptom | Likely cause | Resolution |
|---|---|---|
| AIM: StorageGuard can't reach the Credential Provider | The Credential Provider service isn't running on the master server, or the Port value doesn't match the port it listens on. | Start the service on the master server and confirm the port in the credential or in the defaults. |
| The request is rejected as not authorized | The AppID isn't allowed to retrieve the account, or the request doesn't pass the AppID's authentication checks (allowed machines, OS user, or certificate). | Ask your CyberArk administrator to check the AppID's safe permissions and authentication settings. For AIM, confirm the Credential Provider user is a member of the safe. |
| The account isn't found | The Safe, Folder, or Account ID doesn't match CyberArk. | Check the values against the account in CyberArk. The account ID is the object name, not the user name. |
| CCP: connection timeout or host not found | The Host or Port value is wrong, or a firewall blocks the master server. | Confirm the CCP address and port, and allow HTTPS from the master server to the CCP server. |
| CCP: certificate or TLS error | The certificate file or password is wrong, the certificate isn't the one configured for the AppID, or the host name doesn't match the CCP server certificate. | Upload the correct certificate, re-enter both password fields, and enter the host name exactly as it appears in the server certificate. |
| The password is retrieved but the scan fails to log in | The system expects a different user name format. | Change the Username pattern. See Username pattern values. |
[ Still need help? ]
If StorageGuard still can't retrieve the password, submit a request and include the credential type, the error message, and the scan log.
Comments
0 comments
Please sign in to leave a comment.