Legacy Credentials

NOTE:

This document contains information for the Legacy UI. For new UI instances, navigate to Vault.

In the Legacy UI, a Credential stores a User ID and can include a password or an SSH key pair. When connecting to an application, VPAM can pass the stored sign-in information to the RDP, SSH, or Telnet sign-in window.

Requirements

Confirm the following before you add a Credential:

  • You know the User ID that VPAM must store.

  • You know whether the Credential uses a password or an SSH key pair.

  • You have the domain, if the target service requires one.

  • You have access to the SSH key pair that you plan to use.

IMPORTANT:

SSH key pair configuration does not work if the key pair is password protected.

Add a Credential

To add a credentials, follow the steps below:

  1. Navigate to the System Admin tab > Credentials.

  2. Select New.

  3. Complete the form.

  4. Select Save.

After you add one or more Credentials, edit the related services to use them.

To edit or delete a Credential:

  1. Navigate to the System Admin tab > Credentials.

  2. Click View on the credential you want to edit or delete.

  3. Click Edit to modify the credential.

  4. Click Edit > Delete to delete the credential.

Configure SSH Key Pairs

SSH Credentials can use password-based or key-based authentication. To use key-based authentication, upload the private key and public key pair to the server so VPAM can present the key on behalf of the connecting user.

NOTE:

SSH key pair configuration does not work if the key pair is password protected.

To add an SSH Key Pair:

  1. Navigate to the System Admin tab > Hover the Credentials menu > Click New SSH Key Pair.

  2. Enter a name for the SSH key pair.

  3. Enter a meaningful description.

  4. Select Upload.

  5. Select Choose File for the private key file.

  6. Select Choose File for the public key file.

  7. Select Save SSH Key Pair.

TIP:

VPAM supports RSA, DSA, and ECDSA key formats.

After you upload a key pair, you can link it to Credential types, except Credential Pools. You can link one key pair to multiple Credentials at the same time.

VPAM is compatible with RSA, DSA and ECDSA key formats. Generate a key from the command line:

ssh-keygen -m PEM

NOTE:

Legacy OpenSSH versions do not support the -m PEM flag. For those versions, the flag is not required.

If you have an existing OpenSSH key in the new format, you might need to convert it to -m PEM. Use the following sample command:

ssh-keygen -p -f /path/user/.ssh/existing_keyfile -m PEM

NOTE:

The -p flag removes the passphrase from the file.

SSH PAM modules add an extra prompt during sign-in, such as a Google Authenticator verification code.

SSH PAM modules are configured separately from normal sshd settings. The configuration files are typically:

/etc/pam.d/sshd and /etc/ssh/sshd_config.

For successful SSH service launches, the connecting host must use consistent authentication methods in the PAM and sshd configurations.

For example, if password authentication is enabled in the PAM settings, it must also be enabled in sshd_config, and vice versa. If the two configurations do not match, VPAM might not handle the Credential correctly.