Credential Provider
Introduction
Credential Provider aids for the credential rotation process which prevents the static storage of passwords in ISC.
SailPoint ISC currently supports 10 credential Providers to fetch and rotate the passwords for the source connections.
The credential providers in ISC
AWS Secrets Manager.
Azure Key Vault.
BeyondTrust Password Safe Cloud (Secrets Manager).
BeyondTrustPassword Safe On-Premise (Secrets Manager).
CyberArk Central Credential Provider.
CyberArk Conjur Cloud.
Delinea Secret Server (Cloud) - Secrets Manager.
Delinea Secret Server (On-Premise) - Secrets Manager.
HashiCorp Vault (On-Premise).
HashiCorp Vault (Cloud).
Functionality of Credential Providers
All these credential Providers provides the credential cycling functionality to authenticate into ISC. It fetches the recently refreshed credentials for the connectors to transact with source for the secure connection with ISC.
Prerequisites
The credential providers for VA-based Deep Governance connectors, the source and credential provider virtual appliance must be in the same VA Cluster. Now the VA-based Deep Governance connectors, SaaS-based Discovery connectors and Quick Compliance connectors now support the use of credential providers.
Service accounts must have the right permissions to support the credential provider.
CyberArk Central Credential Provider
One of the components in CyberArk which is a cybersecurity platform mainly used for privileged access management.
With the CCP,
The credentials are stored in CyberArk Vault.
ISC connects with the CyberArk CCP.
Fetches the recent password using,
AppID
Safe
Object name/credential path
CCP URL
Requirements for CyberArk Credential Providers
Host URL.
Certificate File Name.
Certificate Password.
PFX file:2(for certificate serial Number Authentication). Contains Certificate along with the private keys used for security purpose.
Whenever the source uses the credential provider, we have to mention the credential path,(where the password is stored) wherever we use the password.
Path syntax-Path syntax - {params required to fetch secret}/{secretKey}
Secret URL - secrets://{CyberArk Central Credential Provider Source Name}/{params required to fetch secret}/{secretKey}
Adding a New Credential Provider in SailPoint
Sign in to SailPoint.
Admin > Connections > Credential providers.
Select create new.
Select the credential providers type and select configure.
In base configuration
Enter the details:
Enter a Credential Provider Name.
Enter a Credential Provider Description.
Select a Credential Provider Owner.
Select a virtual appliance cluster.
Upload the pfx file.
Select save.
In Connection Settings
Enter the HostURL.
Enter the Certificate File Name and Certificate Password to authenticate.
Enable Credential caching.
Select Save.
Configuring a Source to Use a Credential Provider
After the creation of a credential provider, you can configure the source to use the CCP.
In the Source Base Configuration tab, Select Use a Credential Provider.
Select every secret field in the configuration pages which can use the CCP, and provide the credential path.
Active Directory Source Configuration with CCP
In Base Configuration: Select Use a Credential Provider
In Forest Setting
Likewise in Domain, Exchange, IQ Service, Additional Settings mention the credential path.
Conclusion
In CCP can also save the credentials in cache. But it needs to be refreshed.
Thus Credential Cycling functionality of CCP in ISC is used to fetch the recent passwords in a more secure way.
