# Configuring BeyondTrust Password Safe On-Premise (Secrets Manager)

## Base Configuration

Provide the base configuration parameters. Information you entered during the initial creation of the credential provider is automatically entered into the fields in the **Base Configuration** page. You can edit this information if necessary.

> [!NOTE]
>
> **Screenshot**
>
> [![Base Configuration](<https://documentation.sailpoint.com/connectors/credential_providers/beyondtrust_onprem/help/img/base_config.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/beyondtrust_onprem/help/img/base_config.png>)
>
> [![Base Configuration](<https://documentation.sailpoint.com/connectors/credential_providers/beyondtrust_onprem/help/img/base_config_1.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/beyondtrust_onprem/help/img/base_config_1.png>)

> [!NOTE]
>
> Ensure that the name and description of each credential provider is unique.

1. Go to **Admin \> Connections \> Credential Providers**.
2. Search for the credential provider you want to edit.
3. Enter a unique **Credential Provider Name**.
4. Enter a **Credential Provider Description** that provides details necessary to distinguish it from similar credential providers.
5. Select a **Credential Provider Owner** by typing the owner's name into the field provided. Matches display after you type at least two letters. Select the credential provider owner as required.
6. Select a **Virtual Appliance Cluster** with connectivity to the credential provider. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
7. (Optional) If your BeyondTrust API registration uses client certificate authentication, upload a valid client certificate (.pfx file) required to support this feature. Drag and drop the file onto the **Upload Files** box to upload it, or select anywhere within the **Upload Files** box to choose the file on your computer.

   > **Note**
   >
   > You can download the client certificate from Password Safe. Go to **Configuration \> System \> Downloads**.
8. Select **Save**.

## Connection Settings

Configure the authentication parameters to connect to and authenticate with BeyondTrust Password Safe On-Premise (Secrets Manager).

> [!NOTE]
>
> **Screenshot**
>
> [![Connection Settings](<https://documentation.sailpoint.com/connectors/credential_providers/beyondtrust_onprem/help/img/connection_settings.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/beyondtrust_onprem/help/img/connection_settings.png>)
>
> [![Connection Settings](<https://documentation.sailpoint.com/connectors/credential_providers/beyondtrust_onprem/help/img/connection_settings_1.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/beyondtrust_onprem/help/img/connection_settings_1.png>)

To configure an authenticated connection:

1. Enter the **Host URL** to connect to BeyondTrust Password Safe.
2. Enter the **Client ID** and **Client Secret** assigned to the Application User Account.
3. (Optional) Enable **Use Client Certificate** if your API registration in BeyondTrust uses client certificate authentication. Then, in the **Client Certificate Password** field, enter the password used to authenticate the client certificate.

   > **Important**
   >
   > To support this feature, you need to upload a valid client certificate from BeyondTrust in [Base Configuration](<#base-configuration>).
4. (Optional) Enable credential caching. For more information, refer to [Caching Credentials](<https://documentation.sailpoint.com/connectors/credential_providers/beyondtrust_onprem/help/cred_caching.html>).
5. Select **Save**.