Skip to content

Discovering Applications with CyberArk Privilege Cloud Shared Services PAM

The SailPoint CyberArk Shared Services PAM Discovery connector retrieves application details configured in CyberArk Shared Services. The connector provides continuous application discovery and identifies inventory across the enterprise. This visibility helps you prioritize and focus governance efforts on high-impact applications. For instructions on creating a CyberArk Shared Services PAM Discovery connector, refer to Base Configuration.

Supported Platforms

  • CyberArk Shared Services.

Supported Features

The CyberArk Shared Services PAM Discovery connector supports the following features:

  • Test Connection.
  • Discovery Application.

Prerequisites

To use OAuth 2.0 authentication, you must create a service account in CyberArk Shared Services and assign the roles required to retrieve platforms.

Create an OAuth Service User

  1. Sign in to the CyberArk Identity Administration portal.
  2. Go to Core Services > Users and select Add User.

  3. Enter the following credentials:

    • Login name - This serves as the Client ID.
    • Display Name - Enter a descriptive name for the service user.
    • Password - This serves as the Client Secret.

  4. In the Status checklist section, select Is OAuth confidential client.

  5. Verify that the following options are automatically selected:

    • Is Service User
    • Password never expires

  6. Select Create User.

Note

Securely store the Login name and Password. You will need these values to generate the OAuth token.

Assign Privilege Cloud Roles

  1. Go to Core Services > Roles.
  2. Select the appropriate Privilege Cloud role based on the required access level (for example, an administrative or read-only role).
  3. Go to the Members section and select Add.
  4. Search for and select the service user you created in the previous section.
  5. Select Save.

Required Permissions

The CyberArk Shared Services PAM Discovery connector requires specific permissions to retrieve platform and application data. Assign the OAuth 2.0 service user to the Privilege Cloud Users role in CyberArk to ensure it has the necessary access.

Add the connector user to each Safe (required for GET/Accounts).

  1. In Privilege Cloud, go to Policies > Safes.
  2. Open the Safe that contains the accounts you want to discover.
  3. Select Members and then select Add Member.
  4. Search for and select the connector service user (or a group that contains that user).

  5. In Set Permissions:

    1. Set the permission preset to Read only.
    2. Enable Access so the member can access accounts in this Safe.

  6. Select Save.

  7. Repeat these steps for each Safe whose accounts should appear in account discovery.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.