Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Enjoy members-only rewards and discounts
  • Create and access a list of your products
Sign In Create an Account Dell Financial Services Premier Sign In Partner Program Sign In
Contact Us

Your Dell.com Carts

OpenManage Enterprise 4.0.x User's Guide

PDF

Enable CyberArk integration for password management

OpenManage Enterprise offers integration with CyberArk, a third-party identity management system, to manage privileged credentials in secure vaults for enhanced security and access control. This guide outlines the steps to integrate a CyberArk Privileged Access Manager (PAM) (deployed on-site using self-hosted architecture) with OpenManage Enterprise. See the CyberArk Documentation for more details.

Prerequisites

  • CyberArk integration is only available on devices with the OpenManage Enterprise Advanced+ license.
  • Ensure that the target devices are onboarded within a single CyberArk safe. OpenManage Enterprise supports one safe.
  • Only local iDRAC passwords can be rotated using CyberArk. Accounts that are managed using directory services like active directory and LDAP cannot be used with CyberArk integration.
  • Ensure that the appliance is accessible to the Central Credential Provider Host.

Steps

To enable CyberArk password rotation:

  1. Select Enable CyberArk Integration to enable CyberArk integration. Once Cyberark is enabled, the appliance retrieve the credentials for iDRACs, which are already configured in the CyberArk.
  2. Click Export to generate a downloadable list of iDRACs eligible for this feature.
  3. Click Upload to upload the certificate that is used for authenticating the Central Credential Provider Host to the appliance. Only Certificate-Based Authentication is supported.
  4. Enter the Central Credential Provider Host IPv4 address or FQDN and Port #.
  5. Enter the Application ID assigned to the appliance from CyberArk to provide a single sign-on to mobile applications.
  6. Enter the Safe name to allow the appliance to locate the required iDRAC credentials.
  7. Select an IP address, FQDN, or Service Tag to decide how credentials are retrieved. Confirm that the account name configured for iDRACs on Password Vault Web Access (PVWA) matches the IP address, FQDN, or Service Tag. This value is based on the chosen value for the Retrieve Credentials By field.
  8. Click Test Connection to verify that the appliance can access and authenticate the central credential provider host. Testing the connection fails when CyberArk is configured without any accounts that are added in the Password Vault Web Access (PVWA).
  9. Click Apply to save the changes or click Discard to reset the settings to the previous values.

Results

To disable CyberArk integration, clear the Enable CyberArk Integration check box and click Apply. All saved discovery jobs are triggered to ensure that the eligible devices have the appropriate credentials.

NOTE: Important things to consider when enabling CyberArk Integration:
  • Ensure proper configuration of CyberArk to prevent disruptions in accessing iDRAC devices through OpenManage Enterprise. Dell Technologies is not responsible for CyberArk software. As a customer of CyberArk, you are responsible for your business, technical, and support relationship with CyberArk. Ensure that you work directly with CyberArk for installing, testing functionality and scalability and the overall management of their software.
  • When using CyberArk to manage device credentials, OpenManage Enterprise periodically retrieves passwords from the vault before performing specific tasks. If the retrieval process fails due to vault inaccessibility, incorrect credentials, or ongoing rotation, device tasks also fail, causing the device to enter an unknown state.
  • Whenever OpenManage Enterprise cannot connect to a device, an internal event CDEV6131 is generated. If you observe such events for CyberArk managed devices, inform your CyberArk administrator to determine whether the correct credentials are being retrieved.
  • When a device managed by CyberArk is discovered with new credentials, the credential type changes to 'discovery.' However, any tasks that are initiated from the appliance on the device use CyberArk credentials.
  • Disable CyberArk password management for a specific iDRAC by removing the device account from CyberArk and rediscovering it in OpenManage Enterprise for updated credentials in all management operations.

Related references

Configure iDRAC password management

Rate this content

Accurate
Useful
Easy to understand
Was this article helpful?
0/3000 characters
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please select whether the article was helpful or not.
  Comments cannot contain these special characters: <>()\