CyberArk Central Secret Path Expressions

Use the path expressions listed in this topic to use the CyberArk Central Credential Provider (CCP) in your source authentication configurations.

Path syntax: {params required to fetch secret}/{secretKey}

Secret URL: secrets://{CyberArk Central Credential Provider Source Name}/{params required to fetch secret}/{secretKey}

Important

The URL path should always start with the prefix, secrets://. Each URL should be URL-encoded. Each URL attribute in the path is case-sensitive

The CyberArk Central Credential Provider (CCP) fetches secret using REST API. The REST API URL format to fetch secrets is as follows:

https://<IIS_Server_Host_URL>/<WebService_NAME>/api/Accounts?<param1>=<value>&<param2>=<value>&

Note

In the provided example, the parameters required to fetch the secret are <param1>=<value>&<param2>=<value>&

Secret URL example:

Before Encoding

secrets://<CyberArk Central Credential Provider Source>/<Object=Cloud Service-AWS-Salesforce-admin&AppID=Test1>/<Content>

Where:

<CyberArk Central Credential Provider Source> - Configured Credential Provider
<Object=Cloud Service-AWS-Salesforce-harshaladmin&AppID=Test1> - Parameters required to fetch secrets
<Content> - Key to retrieve from the secret response

After Encoding

secrets://CyberArk%20Central%20Credential%20Provider%20Source/Object%3DCloud%20Service-AWS-Salesforce-admin%26AppID%3DTest1/Content

Tip

Use urlencoder.org to encode your URL attributes.

Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

To add a prefix - ?prefix=<prefix>. For example, if the secret value returned after evaluation is LocalAdmin, but the complete value required by the secret field is DomainOne\LocalAdmin then the secret path expression will be as follows to add the required prefix:
```
secrets://CyberArk%20Central%20Credential%20Provider%20Source/Object%3DCloud%20Service-AWS-Salesforce-admin%26AppID%3DTest1/Content?prefix=DomainOne%5C
```
To add a suffix - ?suffix=<suffix>. For example, if the secret value returned after evaluation is localadministrator, but the complete value required by the secret field is localadminstrator@sp.com then the secret path expression will be as follows to add the required suffix:
```
secrets://CyberArk%20Central%20Credential%20Provider%20Source/Object%3DCloud%20Service-AWS-Salesforce-admin%26AppID%3DTest1/Content?prefix=suffix=%40sp.com
```

Important

All input parameters must be encoded.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.