Manage privileged objects in CyberArk PAM - Self-Hosted

Identity Administration supports managing privileged accounts and objects in CyberArk Privileged Access Manager - Self-Hosted. This topic describes how to configure Identity Administration to authenticate to PAM - Self-Hosted REST APIs. These APIs can leverage the Identity Administration System for Cross-domain Identity Management (SCIM) server to manage objects in PAM - Self-Hosted.

SCIM endpoints facilitate the integration of IGA platforms that comply with SCIM clients, such as SailPoint, to simplify and automate the lifecycle management of privileged accounts. SCIM uses CyberArk Password Vault Web Access (PVWA) to manage objects in PAM - Self-Hosted without requiring a VPN connection.

Before you begin

When integrating PAM - Self-Hostedwith a third-party IGA application, start by performing the steps in Set up SCIM for PAM - Self-Hosted. When you reach step 2-2, return to this topic to configure Identity Administration.

Before you configure Identity Administration, you need the following:

• PAM - Self-Hosted Vault updated to version 12.1 or later

• PVWA (Password Vault Web Access) component in PAM - Self-Hosted updated to version 12.2 or later

• URL for the PAM - Self-Hosted instance (not the PVWA sign-in URL)

• Identity Connector version 21.7 or later with the API Proxy Service enabled. This enables Identity Administration to invoke the corresponding PAM - Self-Hosted REST APIs through the secure, VPN-less tunnel. See Install the Identity Connector for more information.

• Do not use the following characters in usernames when integrating with PAM - Self-Hosted:

  Unsupported characters for usernames

  Character	Description
  ?	question mark
  <	less than
  >	greater than
  *	asterisk
  "	double quotation mark
  /	forward slash
  \	backslash

Configure Identity Administration integration with PAM - Self-Hosted

Step 1: Create a service account for the Vault integration

1. In the Identity Administration portal, go to Core Services > Users and click Add User.

2. Enter the name of the service account user in the Login name field. Enter an email address and display name.

3. Create a password for the service user.

4. Select Is service user and Is OAuth confidential client.

5. Click Create User.

Step 2: Create a role for the Vault integration

The service user must have a role with permission to the OAuth2 Client app used to access Identity Administration SCIM APIs for the IGA-PAM - Self-Hosted integration. See Configure the SCIM server for more information about configuring Identity Administration as a SCIM server and creating the service user.

1. Go to Core Services > Roles, then click Add Role.

2. Enter a unique name for the role and click Save.

3. In the role you just created, go to the Members tab. Click Add and add the identity-privilege-integration-user$ service user.

4. Go to the Administrative Rights tab and add Vault Management.

5. Click Save.

Step 3: Configure Identity Administration

1. In the Identity Administration portal, go to Settings > Integration > Vault Configuration.

2. In the PVWA URL field, enter the URL for the PAM - Self-Hosted instance (not the PVWA sign-in URL).

3. Select a Identity Administration Connector to use with this service. Choose either Any available connector or a specific connector from the list.
4. Click Save.

Step 4: Configure the Vault

1. Download the following CyberArk Marketplace scripts to a server that can communicate with PVWA.

   Configuration scripts

   Script	Download
   Create SCIM service user	https://cyberark-customers.force.com/mplace/s/#a352J000000aft4QAA-a392J000002OyRKQA0
   Identity  and PAS integration configuration	https://cyberark-customers.force.com/mplace/s/#a352J000000afGWQAY-a392J000002OgE6QAK

2. In PowerShell, go to the directory where the scripts are located and run the command to create a SCIM service user:

   .\CreateSCIMServiceUser.ps1 -PVWAUrl <PAS-PVWA-URL>

   where <PAS-PVWA-URL> is the URL for the Password Vault Web Access instance. For example:

   https://example.acme.com/PasswordVault

3. When prompted, enter your PAM - Self-Hosted admin credentials.

   The script creates a SCIM service user.

4. Run the configuration script. In PowerShell, run the following command:

   .\IdentityConfiguration.ps1 -portalUrl <PAS-PVWA-URL> -cyberArkIdentityMetadataUrl <CYBERARK-IDENTITY-METADATA-URL> - cyberArkIdentityClientId __idaptive_cybr_user_oidc

   Command parameters

   Parameter	Description
   portalURL	URL for PVWA. For example: https://example.acme.com/PasswordVault
   cyberArkIdentityMetadataUrl	Tenant URL in the following format: https://<your_tenant_url>/__idaptive_cybr_user_oidc/.well-known/openid-configuration For example: https://abc0123.id.cyberark.cloud/__idaptive_cybr_user_oidc/.well-known/openid-configuration
   cyberArkIdentityClientId __	idaptive_cybr_user_oidc

5. When prompted, enter your PAM - Self-Hosted admin credentials.

6. Add identity-privilege-integration-user$ as a Safe member to the Safes that you want to manage with Identity Administration. See Add a Safe member for instructions.

7. Grant Safe permissions to the identity-privilege-integration-user$. Perform the appropriate steps for your environment.

   Integrate Identity Administration with an external Identity Governance and Administration (IGA) solution.

   Grant all Safe permissions (as a Safe owner) to the identity-privilege-integration-user$. See Manage Safes for instructions.

   Manage Safe access with CyberArk Identity Compliance.

   Grant the identity-privilege-integration-user$ permission to manage Safes and Safe members. See Manage Safes for instructions.

Identity Administration configuration is complete.

Step 5: Configure PAM - Self-Hosted to integrate with Identity Administration

Return to Set up SCIM for PAM - Self-Hosted to complete the integration.