CyberArk is an identity and access manager offering a wide set of identity security capabilities. You can use it to submit Workload Automation jobs without specifying any passwords, which are retrieved from the CyberArk vault.

How it can be integrated with Workload Automation? Simply by using 2 files:

  • the CyberArkVault library file

  • the CyberArk.ini properties file that needs to be customized

The CyberArkVault library file allows you to retrieve the password for a specific user from CyberArk. The password is not stored locally on the Workload Automation workstation, but retrieved from CyberArk while the Workload Automation job is running.

There are 2 types of integration methods:

  • With the Central Credential Provider (CCP) that starts an HTTPS call to CyberArk Central Credential Provider that manage the accesses.
  • With the local Credential Provider (CP) that starts a secure call to CyberArk Credential Provider using a proprietary CyberArk library file.

Installation Steps

  1. Download the package from Automation Hub and extract it to all your agents.
  2. Stop the agent with ShutDownLwa
  3. Save the CyberArkVault library file and the CyberArk.ini properties file to a path of your choice.
  4. Add in the JobManager.ini file, [Launchers] section, the PasswordResolver key.
  5. Set the PasswordResolver key with to the full path to the CyberArkVault_version_number library file.

  1. Edit the CyberArk.ini properties file

7. Restart the agent witn StartUpLwa command.

8. Add the necessary accounts in CyberArk, using the dedicated interface

Job Definitions

There are 2 types of jobs that are eligible to run with CyberArk integration:

  • Windows Native Job

Define the job specifying a user managed by CyberArk and defined in the Windows OS too but with empty password (the password will be returned by CyberArk)

then specify a user by using a query syntax as the follow:

section_name::parameter_name=parameter_value;

  • Job Application Plug-In

You can specify the CyberArk user and then using the syntax for password type: ${agent:password.<username>}

or you can specify a user by using a query syntax as the follow: section_name::parameter_name=parameter_value;…

Query Syntax building

User Syntax:

section_name::parameter_name=parameter_value;…

By using the above query user syntax it’s possible to build some examples as follows:

 

Comment wrap
Further Reading
article-img
Automation | August 11, 2022
Automating SAP Data Services batch jobs with HCL Workload Automation
SAP Data Services is a one-stop solution from SAP to manage your data integration, cleansing, transformations, and data management.
article-img
Automation | August 10, 2022
Connect AWS Batch with HCL Workload Automation
Let us first understand about the AWS Batch, before moving on to AWS Batch plug-in and how it is benefits to our workload automation users. The AWS Batch is available on Automation Hub, download it to empower your Workload Automation environment.
article-img
Automation | August 8, 2022
Connect to Amazon S3 with HCL Workload Automation
Are you working with Amazon S3 and would you like an easy way to perform your batch operations? We have what you are looking for!
Close
Filters result by
Sort:
|