BeyondTrust Password Safe (Secrets Management) Secret Path Expressions

Use the path expressions listed in this topic to use the BeyondTrust Password Safe (Secrets Management) in your source authentication configurations.

Secret URL syntax:

secrets://{CredentialProviderName}/{SecretURL}

The following is an explanation of the attributes of this URL:

  • CredentialProviderName – The name of the credential provider source configured in ISC.

  • SecretURL – A query string that uniquely identifies the secret within BeyondTrust Password Safe. It specifies the managed system and the managed account within that system. The format of the SecretURL is as follows:

    systemName={nameOfManagedSystem}&accountName={nameOfManagedAccount}

Important

  • CredentialProviderName and SecretURL must be URL-encoded individually before constructing the final secret path expression.

  • systemName and accountName are reserved keywords in the SecretURL format and must not be used as part of the values for nameOfManagedSystem or nameOfManagedAccount.

Tip
Use urlencoder.org to encode your URL attributes.

Before Encoding

secrets://BeyondTrust Password Safe/systemName=Microsoft Entra ID&accountName=user@company.onmicrosoft.com

After Encoding

secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

  • To add a prefix – ?prefix=<prefix>

    For example, if the secret value returned after evaluation is Secure#456, but the complete value required by the secret field is app1-dev@Secure#456 then the secret path expression will be as follows to add the required prefix:

    secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com?prefix=app1-dev%40

  • To add a suffix – ?suffix=<suffix>

    For example, if the secret value returned after evaluation is app1-dev, but the complete value required by the secret field is app1-dev@Secure#456 then the secret path expression will be as follows to add the required suffix:

    secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Duser%40company.onmicrosoft.com?suffix=%40Secure%23456