# SailPoint CyberArk Conjur Cloud Credential Provider Documentation

> CyberArk Conjur Cloud Credential Provider Documentation

# Documentation

# Adding a New Credential Provider in SailPoint

Create a new credential provider integration in SailPoint to automatically rotate refreshed authentication credentials for configured sources.

To create a new credential provider:

1. Go to **Admin \> Connections \> Credential Providers**.
2. Select **Create New**.

   > **Screenshot**
   >
   > [![Credential Providers landing page with the Create New button highlighted](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/common/assets/img/landing_screen.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/common/assets/img/landing_screen.png>)
3. Search for the credential provider type and select **Configure**.

   > **Note**
   >
   > For a list of the available types of credential providers, as well as access to the documentation for each type, refer to the [Identity Security Connectors](<https://documentation.sailpoint.com/connectors/help/identity_security_connectors.html>) landing page.
4. Enter the following in the provided fields:

   - Enter a unique **Credential Provider Name** to help administrators differentiate it from others.
   - Enter a **Credential Provider Description**.
   - Select a **Credential Provider Owner** who is responsible for the credential provider's operations.
   - Select a **Virtual Appliance Cluster** with connectivity to the credential provider.
5. Select **Continue** to create the new credential provider with your selections.
6. (Optional) Enable credential caching. For more information, refer to [Caching Credentials](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/cred_caching.html>).

# Configure a Source to Use a Credential Provider

After you create a credential provider, you can begin configuring your sources to use it for authentication. When you use a credential provider in a source configuration, any authentication fields you need to configure allow you to use the credential provider or use static authentication credentials.

To configure your source to use a credential provider:

1. In the source's **Base Configuration** tab, select **Use a Credential Provider**.

   > **Note**
   >
   > Enabling a credential provider in your connector adds an additional 30-second timeout for each connector operation.
2. Toggle every secret field in the configuration pages which should use the credential provider to **Credential Path**. The field changes to accept the secret path expression for the credential provider instead of the static value.

   > **Screenshot**
   >
   > **Static Value**
   >
   > [![Static Value field selected](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/img/conn_field_static_2.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/img/conn_field_static_2.png>)
   >
   > **Credential Path**
   >
   > [![Credential Path field selected](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/img/conn_field_cred_path_2.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/img/conn_field_cred_path_2.png>)
3. Enter the secret path expression for the credential provider into the **Credential Path** field.

> [!NOTE]
>
> For a list of all available SailPoint credential provider path expressions, refer to [Credential Provider Secret Path Expressions](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/secret_path_expressions.html>).

# Configuring CyberArk Conjur Cloud

## Base Configuration

Provide the base configuration parameters. Information you entered during the initial creation of the credential provider is automatically entered into the fields in the **Base Configuration** page. You can edit this information if necessary.

> [!NOTE]
>
> **Screenshot**
>
> [![Base Configuration](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/img/base_config.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/img/base_config.png>)

> [!NOTE]
>
> Ensure that the name and description of each credential provider is unique.

1. Go to **Admin \> Connections \> Credential Providers**.
2. Search for the credential provider you want to edit.
3. Enter a unique **Credential Provider Name**.
4. Enter a **Credential Provider Description** that provides details necessary to distinguish it from similar credential providers.
5. Select a **Credential Provider Owner** by typing the owner's name into the field provided. Matches display after you type at least two letters. Select the credential provider owner as required.
6. Select a **Virtual Appliance Cluster** with connectivity to the credential provider. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
7. Select **Save**.

## Connection Settings

Configure the authentication parameters to connect to and authenticate with the Conjur CyberArk Secret Server host.

> [!NOTE]
>
> **Screenshot**
>
> [![Connection Settings](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/img/connection_settings_2.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/img/connection_settings_2.png>)

To configure an authenticated connection:

1. Enter the **Host URL** for the Conjur CyberArk Secret Server host.
2. Enter the **Host Application ID** provided by Conjur to authenticate the Conjur CyberArk Secret Server host.
3. Enter the **Host API Key** to authenticate the host created on Conjur Secret Server.

   > **Note**
   >
   > You must configure a host for Conjur Cloud to generate a Host Application ID and a Host API Key. For more information, refer to [Prerequisites](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/index.html#prerequisites>).
4. (Optional) Enable credential caching. For more information, refer to [Caching Credentials](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/cred_caching.html>).
5. Select **Save**.

# Caching Credentials

SailPoint credential providers can save the credentials it receives from the systems they manage to cache. Cached credentials may expire after a period of time and need to be refreshed. Credential providers can't use expired credentials saved to cache.

> [!NOTE]
>
> **Screenshot**
>
> [![Enable Credentials Caching checkbox](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/img/cred_caching.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/img/cred_caching.png>)

To enable credential caching for credential providers:

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Credential Providers**.
3. Search for the credential provider that you want to enable caching on and select its name.
4. Select **Edit Configuration**.
5. Select the **Enable Credentials Caching** checkbox.

   > **Note**
   >
   > The option to enable this feature may be in a different configuration tab depending on your selected credential provider.
6. Select **Save**.

## Credentials Expiration

Depending on the managed system the credential provider is connected to, the credentials may have an expiration time limit. The credential provider uses the following hierarchy to determine expiration, with the highest priority first and the lowest priority last:

1. If the credentials received from the managed system contain an expiration time, then they are cached until that expiration time.
2. If the credentials received from the managed system don't contain an expiration time, then you can add one by configuring the `expirationTimeInSeconds` attribute in the source of credential provider using APIs.

   > **Note**
   >
   > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.
3. If the credentials received from the managed system don't contain an expiration time and you don't create one via APIs, then by default the credentials expire after one day.

# CyberArk Conjur Cloud Credential Provider

The SailPoint CyberArk Conjur Cloud credential provider offers credential cycling for added security in configured SailPoint connectors. This Credential Provider fetches authorization credentials from Conjur Cloud to authenticate sources in SailPoint.

This guide discusses how to manage a CyberArk Conjur Cloud credential provider.

For information on creating a new CyberArk Conjur Cloud credential provider, refer to [Adding a New Credential Provider in SailPoint](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/config_new_cred_prov.html>).

## Prerequisites

Before you configure your credential provider, you must consider the following prerequisite items.

- Configure a host for Conjur Cloud. To do this, complete Lesson 1 through Lesson 8 found in this CyberArk [Tutorial](<https://docs.cyberark.com/conjur-cloud/latest/en/Content/ConjurCloud/ccl-getstarted-lp.htm?tocpath=Get started%7CTutorial%7C_____0>). Afterward, generate and fetch the Host Application ID and the Host API key.

  > **Note**
  >
  > The linked document is not maintained by SailPoint and is subject to change without notice.
- For VA-based Deep Governance connectors, the source and credential provider virtual appliances must be in the same cluster.
- VA-based Deep Governance connectors, SaaS-based Deep Governance, Discovery, and Quick Compliance connectors now support the use of credential providers.

## Supported Platforms

This credential provider supports the following platforms:

- CyberArk Conjur Cloud

# CyberArk Conjur Cloud Credential Provider Secret Path Expressions

Use the path expressions listed in this topic to use the CyberArk Conjur Cloud credential providers in your source authentication configurations. For more information, refer to [Retrieve a secret](<https://docs.conjur.org/Latest/en/Content/Developer/Conjur_API_Retrieve_Secret.htm?tocpath=Developer%7CREST APIs%7C_____7>) in the CyberArk documentation.

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

The CyberArk Conjur Cloud Credential Provider can provide any field supported by CyberArk Conjur Cloud.

## Username

Path syntax: `secrets://{CredentialProviderSourceName}/{ResourceIdOfSecret}`

> [!NOTE]
>
> The `ResourceIdofSecret` attribute can be obtained from **Conjur Cloud \> Resources** then select the created Secret.

> [!NOTE]
>
> **Screenshot**
>
> [![Conjur Cloud Resources](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/img/conjurcloud_operatingsys.png>)](<https://documentation.sailpoint.com/connectors/credential_providers/cyberark_conjur_cloud/help/img/conjurcloud_operatingsys.png>)

For example:

**Before Encoding**

```text
secrets://CyberarkConjurCloudSource/data/vault/LDAP Safe/Operating System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount/username
```

> [!IMPORTANT]
>
> The URL path should always start with the prefix, secrets://. Each URL attribute should be URL-encoded. For example, `CredentialProviderSourceName`, `ResourceIdOfSecret`, the prefix, and the suffix must be encoded separately. Each URL attribute in the path is case-sensitive.

**After Encoding**

After you encode the URL path, it should appear as follows:

```text
secrets://CyberarkConjurCloudSource/data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fusername
```

The following is an explanation of the attributes of this URL:

- `CyberarkConjurCloudSource` - The Configured Credential Provider in the Credential Provider Section.
- `data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fusername` - The encoded resource ID of the secret.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Password

Path syntax: `secrets://{CredentialProviderSourceName}/{ResourceIdOfSecret}`

For example:

**Before Encoding**

```text
secrets://CyberarkConjurCloudSource/data/vault/LDAP Safe/Operating System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount/password
```

> [!IMPORTANT]
>
> The URL path should always start with the prefix, secrets://. Each URL attribute should be URL-encoded. For example, `CredentialProviderSourceName`, `ResourceIdOfSecret`, the prefix, and the suffix must be encoded separately. Each URL attribute in the path is case-sensitive.

**After Encoding**

After you encode the URL path, it should appear as follows:

```text
secrets://CyberarkConjurCloudSource/data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fpassword
```

The following is an explanation of the components of this URL:

- `CyberarkConjurCloudSource` - Configured Credential Provider in the Credential Provider Section.
- `data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fpassword` - The encoded resource ID of the secret.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

- To add a prefix - `?prefix=<prefix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin` then the secret path expression will be as follows to add the required prefix:

  ```text
  secrets://CyberarkConjurCloudSource/data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fusername?prefix=DomainOne%5C
  ```
- To add a suffix - `?suffix=<suffix>`. For example, if the secret value returned after evaluation is `localadministrator`, but the complete value required by the secret field is `localadminstrator@sp.com` then the secret path expression will be as follows to add the required suffix:

  ```text
  secrets://CyberarkConjurCloudSource/data%2Fvault%2FLDAP%20Safe%2FOperating%20System-LDAPServer1-PUWCPMAD3.CredentialP.lab-ServiceAccount%2Fusername?suffix=%40sp.com
  ```

> [!IMPORTANT]
>
> All input parameters must be encoded.