Line of business (LOB)

Prerequisites:

• PAM - Self-Hosted only: The machine where you are running the GenerateLOBs script requires a trusted certificate for the PVWA. To ensure that this certificate is trusted by the machine, the certificate must be added to the machine's LocalMachine\Root certificate store. We recommend you do this manually before you run the script. Alternatively, you can authorize the script to add the certificate to the trusted root for you.

• Make sure that the PVWA/Privilege Cloud portal is accessible from the machine where you are running the script.

• Recommended: Gather the information required by the GenerateLOBs script

  Required information

  Detail	Description
  PVWA/Privilege Cloud portal URL	The URL for the PVWA/Privilege Cloud portal, starting with https:// and excluding the full path. For example: PVWA: https://cyberarkvault.example.com When the PVWA is behind a load balancer, use the load balancer's URL. Privilege Cloud: https://myorg.privilegecloud.cyberark.com
  Vault/Privilege Cloud admin credentials	The Vault/Privilege Cloud admin username and password. These credentials are used during LOB creation and are not saved.
  Vault address	The IP address of the Vault/Privilege Cloud component.
  Synchronizer Safe name	The name of the Synchronizer Safe that will store the LOBs. This is the name that was given to the Safe when the Vault Synchronizer was installed.   PAM - Self-Hosted users only: If you are working with multiple Vault Synchronizers to connect to a single Vault, make sure to specify the relevant Synchronizer Safe name, for example SyncSafe1 or SyncSafe2.
  LOB names	You can add one or multiple LOBs simultaneously using this script. Decide on names for the LOBs. When the script prompts for the LOB names, list the names separated by commas.   The LOB name must not begin with a special character or number, and must not contain spaces.
  LOB platform	The name of the platform for the LOB account (CyberArk Vault or a duplication of the CyberArk Vault platform). Default: CyberArk Vault

The GenerateLOBs script and accompanying files are located in the Vault Synchronizer installation package, provided by CyberArk Customer Support. From the unzipped package ( <Sync-package directory>), copy the following files to the Windows machine where you are going to run the script:

• The Modules folder

• GenerateLOBs.ps1

Open a Windows PowerShell window, navigate to where you copied the GenerateLOBs script, and run the following command to start the script:

.\GenerateLOBs.ps1

The script opens. Follow all the prompts using the information you gathered above.

The LOBs are added. For each LOB, a user and an account are created.

For each LOB, add the LOB user to the list of members of each Safe that needs to sync with Conjur as described in Sync a Safe to Conjur - Add LOB user as member of target Safe.

Create an LOB Vault user using one of the following methods:

POST https://<PVWA_IP>/PasswordVault/api/Users

{
    "username":"<LOB user name>",
    "userType": "AppProvider",
    "initialPassword": "<password>",
    "authenticationMethod": ["AuthTypePass"],
    "location": "\\",
    "expiryDate": "",
    "vaultAuthorization":"",
    "enableUser": true,
    "changePassOnNextLogon": false,
    "passwordNeverExpires": true,
    "description": "<description>"
}

Create an account in the PVWA/Privilege Cloud

1. In PVWA/Privilege Cloud, create an account for the LOB user using all of the following values:

   Parameter	Value
   System Type	Application
   Platform Name	CyberArk Vault   This value can be CyberArk Vault or any duplicate of the CyberArk Vault platform. Otherwise, the Vault Synchronizer will not be able to sync the LOB. Ensure that the platform is activated.
   Store in Safe	The name given to the Synchronizer Safe when the Vault Synchronizer was installed.
   User Name	The LOB user name as created in the previous step.
   Address	The IP address of the Vault For Privilege Cloud, contact CyberArk support.
   Password	The password for the LOB user
   Customize Account Name	The name of the account. The account name must have a prefix of LOBUser_.
   Allow automatic password management	Disabled

   For example:

   

2. Add the LOB user to the list of members of each Safe that needs to sync with Conjur as described in Sync a Safe to Conjur - Add LOB user as member of target Safe.

3. Log off from PVWA.