# BeyondTrust Password Safe On-Premise (Secrets Manager) Credential Provider

The SailPoint BeyondTrust Password Safe On-Premise (Secrets Manager) credential provider provides credential cycling functionality to fetch refreshed credentials from BeyondTrust On-Premise Password Safe for source authentication.

This guide discusses how to manage a BeyondTrust Password Safe On-Premise (Secrets Manager) credential provider.

For information on creating a new BeyondTrust Password Safe On-Premise (Secrets Manager) credential provider, refer to [Adding a New Credential Provider in SailPoint](<https://documentation.sailpoint.com/connectors/credential_providers/beyondtrust_onprem/help/config_new_cred_prov.html>).

## Prerequisites

Before you configure your credential provider, you must consider the following prerequisite items.

- You must have an **API Access Policy** API registration configured in BeyondTrust. For more information, refer to [API registration](<https://docs.beyondtrust.com/bips/docs/ps-cloud-configure-api-registration>) in the BeyondTrust documentation.
- The service account should have permissions to fetch managed account details, to create a password release request, and to fetch credentials. For more information, refer to [Role-based access](<https://docs.beyondtrust.com/bips/docs/ps-cloud-configure-role-based-access>) in the BeyondTrust documentation.
- Ensure that the accounts managed by the credential provider are API-enabled within BeyondTrust. For more information, refer to [Enable API setting for managed account](<https://docs.beyondtrust.com/bips/docs/ps-cloud-configure-role-based-access#enable-api-setting-for-managed-account>) in the BeyondTrust documentation.
- The virtual appliance must be able to communicate with the BeyondTrust API. In BeyondTrust, add the virtual appliance's IP address to the API registration authentication rules.
- To communicate with the BeyondTrust server via HTTPS, copy the certificate of the BeyondTrust instance to the `/certificates/` folder in the virtual appliance located at `/home/sailpoint`.
- Map the hostname for the host on the virtual appliance.
- Reboot the virtual appliance whenever any changes are made to it.
- For VA-based Deep Governance connectors, the source and credential provider virtual appliances must be in the same cluster.
- VA-based Deep Governance connectors, SaaS-based Deep Governance, Discovery, and Quick Compliance connectors now support the use of credential providers.

> [!NOTE]
>
> The linked documents on this page are not maintained by SailPoint and are subject to change without notice.

## Supported Platforms

This credential provider supports the following platforms:

- BeyondInsight 24.3.0.1186 and later

> [!NOTE]
>
> This credential provider supports all the platforms listed in [Password Safe supported platforms](<https://docs.beyondtrust.com/bips/docs/ps-supported-platforms>). It does not support Custom Plugins.