Skip to content

Discovering Applications with BeyondTrust Password Safe Cloud PAM

The SailPoint BeyondTrust Password Safe Cloud PAM Discovery connector retrieves application details configured in BeyondTrust Password Safe Cloud via the public API. The connector uses OAuth 2.0 client credentials grant_type=client_credentials to authenticate with BeyondTrust, provides continuous application discovery, and identifies inventory across the enterprise. This visibility helps you prioritize and focus governance efforts on high-impact applications.

Supported Platforms

  • BeyondTrust Password Safe Cloud public API.

Supported Features

The BeyondTrust Password Safe Cloud PAM discovery connector supports the following features:

  • Test Connection.
  • Application discovery.

For more information, refer to Discovering Enterprise Applications.

Prerequisites

For the successful configuration of your source, your organization must configure the following requirements:

Create an API Registration Type of API Access Policy

  1. Go to Configuration > General > API Registrations.
  2. Select Create API Registration.
  3. Select API Access Policy from the dropdown list.
  4. Select Add Authentication Rules. Add at least one IP rule. The IP rules are used to authenticate and authorize, granting discovery permissions for platforms and requestable managed system targets.
  5. Select Create Registration.

Create an Application User and Add to a Group

An API Access Policy must be assigned to an application user for processing IP rules.

  1. Go to Configuration > Role Based Access > User Management.
  2. Select the Users tab.
  3. Select Create New User.
  4. Select Add an Application User from the dropdown.
  5. Enter a username.
  6. In API Access Policy, select the API Access Policy created.
  7. Copy the client ID and the client secret somewhere safe.
  8. Select Create User.
  9. Select the Groups tab.
  10. Select Create New Group.
  11. Enter a name and description.

  12. Enter the group details:

    • Users - The user must be assigned to the group.
    • Features - The group must have Password Safe System Management with read-only permission.

Note

Store the client secret securely. It is required for OAuth token requests and must match the value configured in SailPoint.

Required Permissions

In BeyondTrust, this is commonly associated with Password Safe System Management (Read) (or equivalent) within the API Access Policy assigned to the Application user. Align the exact role and permission names with BeyondTrust's current documentation for your tenant.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.