Enable CyberArk integration for password management
OpenManage Enterprise offers integration with CyberArk, a third-party identity management system, to manage privileged credentials in secure vaults for enhanced security and access control. This guide outlines the steps to integrate a CyberArk Privileged Access Manager (PAM) (deployed on-site using self-hosted architecture) with OpenManage Enterprise. See the CyberArk Documentation for more details.
Prerequisites
CyberArk integration is only available on devices with the OpenManage Enterprise Advanced+ license.
Ensure that the target devices are onboarded within a single CyberArk safe. OpenManage Enterprise supports one safe.
Only local iDRAC passwords can be rotated using CyberArk. Accounts that are managed using directory services like active directory and LDAP cannot be used with CyberArk integration.
Ensure that the appliance is accessible to the Central Credential Provider Host.
Steps
To enable CyberArk password rotation:
Select
Enable CyberArk Integration to enable CyberArk integration. Once Cyberark is enabled, the appliance retrieve the credentials for iDRACs, which are already configured in the CyberArk.
Click
Export to generate a downloadable list of iDRACs eligible for this feature.
Click
Upload to upload the certificate that is used for authenticating the
Central Credential Provider Host to the appliance. Only Certificate-Based Authentication is supported.
Enter the
Central Credential Provider Host IPv4 address or FQDN and
Port #.
Enter the
Application ID assigned to the appliance from CyberArk to provide a single sign-on to mobile applications.
Enter the
Safe name to allow the appliance to locate the required iDRAC credentials.
Select an
IP address,
FQDN, or
Service Tag to decide how credentials are retrieved. Confirm that the account name configured for iDRACs on Password Vault Web Access (PVWA) matches the
IP address,
FQDN, or
Service Tag. This value is based on the chosen value for the
Retrieve Credentials By field.
Click
Test Connection to verify that the appliance can access and authenticate the central credential provider host. Testing the connection fails when CyberArk is configured without any accounts that are added in the Password Vault Web Access (PVWA).
Click
Apply to save the changes or click
Discard to reset the settings to the previous values.
Results
To disable CyberArk integration, clear the
Enable CyberArk Integration check box and click
Apply. All saved discovery jobs are triggered to ensure that the eligible devices have the appropriate credentials.
NOTE:Important things to consider when enabling CyberArk Integration:
Ensure proper configuration of CyberArk to prevent disruptions in accessing iDRAC devices through OpenManage Enterprise. Dell Technologies is not responsible for CyberArk software. As a customer of CyberArk, you are responsible for your business, technical, and support relationship with CyberArk. Ensure that you work directly with CyberArk for installing, testing functionality and scalability and the overall management of their software.
When using CyberArk to manage device credentials, OpenManage Enterprise periodically retrieves passwords from the vault before performing specific tasks. If the retrieval process fails due to vault inaccessibility, incorrect credentials, or ongoing rotation, device tasks also fail, causing the device to enter an unknown state.
Whenever OpenManage Enterprise cannot connect to a device, an internal event
CDEV6131 is generated. If you observe such events for CyberArk managed devices, inform your CyberArk administrator to determine whether the correct credentials are being retrieved.
When a device managed by CyberArk is discovered with new credentials, the credential type changes to 'discovery.' However, any tasks that are initiated from the appliance on the device use CyberArk credentials.
Disable CyberArk password management for a specific iDRAC by removing the device account from CyberArk and rediscovering it in OpenManage Enterprise for updated credentials in all management operations.