Managing Credential Stores

Creating a Credential Store

1. Click Add on the Credential Stores page. The Add New Credential Store dialog appears.
2. From the Type drop-down, select which secure store is used.
   The available options depend upon which plugins have been enabled.
3. The next steps will vary if you are creating an Orchestrator Database, CyberArk, or Azure Key Vault credential store.
4. Create a store using one of the platforms below.

Orchestrator Database

1. Click Create, Orchestrator database stores do not have any configurable properties.
   Note: You can only have one Orchestrator Database store.

CyberArk

Note: A CyberArk store configured in multiple tenants using the same App ID, Safe, and Folder Name, will permit access to stored credentials across tenants. To maintain tenant-level security and isolation, ensure different configurations are used for each tenant's CyberArk store.

1. In the Name field, type a name for the new credential store.
2. In the App ID field, enter the application ID for your Orchestrator instance from the CyberArk® PVWA (Password Vault Web Access) interface. See here for details.
3. In the CyberArk Safe field, enter the safe name as defined in the CyberArk® PVWA. See here for details.
4. In the CyberArk Folder field, enter the location in which CyberArk® stores your credentials.

5. Click Create. Your new credential store is ready for use.

   
   

   

   
   

CyberArk CCP

Note: A CyberArk store configured in multiple tenants using the same App ID, Safe, and Folder Name, will permit access to stored credentials across tenants. To maintain tenant-level security and isolation, ensure different configurations are used for each tenant's CyberArk store.

1. In the Name field, type a name for the new credential store.
2. In the App ID field, enter the application ID for your Orchestrator instance from the CyberArk® PVWA (Password Vault Web Access) interface. See here for details.
3. In the CyberArk Safe field, enter the safe name defined in the CyberArk® PVWA. See here for details.
4. In the CyberArk Folder field, enter the location in which CyberArk® stores your credentials.
5. In the Central Credential Provider URL field, enter the Central Credential Provider's address.
6. In the Web Service Name field, enter the name of the Central Credential Provider web service. If you leave this field empty, the default name is used: AIMWebService.
7. The Client Certificate needs to be configured when the the CyberArk Application uses the client certificate authentication method. The expected input is a .pfx file which stores the private and the public key of the certificate. The client certificate needs to be installed on the machine where CyberArk CCP AIMWebservice is deployed.
   Note:

   The client certificate is used by CyberArk credential provided to authenticate the application defined in Orchestrator credential store. See the official CyberArk documentation for details on application authentication methods.

   The client certificate is a PKCS12 binary format file that stores the certificate chain public key(s) and the private key.

   If the client certificate is encoded in base 64 then run the following certutil command to decode it in binary format:

   certutil -decode client_certificate_encoded.pfx client_certificate.pfx

• In the Client Certificate Password field, enter the password of the client certificate.
• The Server Root Certificate needs to be configured when a self signed Root CA certificate is used by the CyberArk CCP AIMWebService for incoming HTTP requests. It is used in HTTPS TLS handshake certificate chain validation. The expected input is a .crt file which stores the root CA certificate public key.

• Click Create. Your new credential store is ready for use.

  
  

  

  
  

Azure Key Vault

Key Vault credential stores use RBAC type authentication. After you've created a service principal, perform these steps:

1. In the Name field, type a name for the new credential store.

2. In the Key Vault Uri field, enter the address of your Azure Key Vault. This is https://<vault_name>.vault.azure.net/.

3. In the Directory ID field, enter the directory ID found in the Azure portal.

4. In the Client Id field, enter the Application ID from your Azure AD App Registrations section where the Orchestrator app was registered.

5. In the Client Secret field, enter the secret needed to authenticate the client account entered in the previous step.

6. Click Create. Your new credential store is ready for use.

Editing a Credential Store

Navigate to Credential Stores (Tenant > Credential Stores) and from the More Actions menu of the desired store, select Edit. The Edit Credential Store dialog appears is displayed.

Note: The Orchestrator Database store does not have any editable properties.

Setting a Default Credential Store

When using 2 or more credential stores, you have the ability to select which is the default store used for Robots and Assets. The same store may be used as the default for both, or you can select a different default store for each.

To select a default store, from the More Actions menu, select Set as robots default store and/or Set as assets default store.

Note: Changing the default store does not change an existing robot or asset configuration, it only controls what appears pre-selected in the Credential Stores drop-down when creating new robots or assets. Robots and assets always get their passwords from the store that was used when creating them. To change the credential store for a certain robot or asset, you must change it at the robot or asset level.

Deleting a credential store

To delete a credential store, select Remove from the More Actions menu of the desired store.

If the selected store is in use, a warning dialog will appear listing the number of robots and assets that will be affected. Click Delete to confirm the removal or Cancel to abort. Note that you must have at least one credential store active at all times. If only one is present, then the option to delete it does not appear.

Note: A credential store designated as default cannot be deleted. You must first select a different default store for the credential type.