Integrating SailPoint with CyberArk Privileged Access Manager (Self-Hosted)
Integration
This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.
A SailPoint and self-hosted CyberArk Privileged Access Manager (PAM) integration provides deep governance capability for Accounts and Groups (Safes). This integration is capable of end-to-end life cycle management.
This document is designed to give information about the requirements and field definitions needed to set up a working integration of a CyberArk PAM (Self-Hosted) source in SailPoint.
Note
To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.
Supported Features
The SailPoint CyberArk PAM (Self-Hosted) connector supports the following features:
Note
Before you can use any item marked with an asterisk (*), SailPoint must activate the feature for your site.
Account Management
- Aggregation (Internal and External Users)
- Account refresh
- Create account via provisioning (Local Users)
- Enable and disable account via provisioning
- Delete Accounts
-
Add and remove entitlements (Local Groups)
Note
The SailPoint CyberArk PAM (Self-Hosted) connector uses PUT method to add users to groups via the Groups endpoint.
Entitlement Management (Groups)
- Groups aggregation
- Single group aggregation
- Aggregate container or safe permissions as Direct Permissions
Supported Use Cases
The following use cases are facilitated by the CyberArk PAM (Self-Hosted) connector:
Read Operation
-
Fetch local and external users from the PAM system.
Local users refers to users locally residing in PAM. External users refers to users synced from external managed system to PAM systems.
-
Fetch local groups from the PAM system.
- View Safes/Containers and its permissions assigned to groups.
Provisioning
- Create local users on the PAM system.
- Add or remove internal and external users from local groups. This indirectly assigns and revokes Safes and its associated permissions.
- Enable or disable internal and external users residing on the PAM system.
For more information on features, refer to Source Features.
Supported Managed Systems
The CyberArk PAM (Self-Hosted) connector supports the following managed system:
- CyberArk Privileged Access Manager (PAM) 13.0.0
- CyberArk Privileged Access Manager (PAM) 14.0.1
Note
The CyberArk PAM (Self-Hosted) connector only supports interactions with a cloud-hosted SCIM server.
Prerequisites
- Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.
-
You must have CyberArk Identity SCIM Server installed on your enterprise.
For information on configuring the CyberArk Identity SCIM Server, refer to Configure the SCIM server in the CyberArk documentation or reach out to your CyberArk partner.
-
For more prerequisite information for deploying CyberArk PAM (Self-Hosted), refer to Manage privileged objects in CyberArk PAM - Self-Hosted.
Administrator Permissions
For the permissions and access details, refer to SCIM Server Configuration.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.