External PAM Configurations

The External PAM Configurations enables System Admininstrators to integrate their existing Privileged Access Management (PAM) providers into their VPAM server.

NOTE:

External PAM Configurations may require additional licensing obtained directly with the provider.

From the External PAM Configurations page, System Administrators can create, update, test, and manage External PAM Server Configurations. The currently supported PAMs are:

  • BeyondTrust

  • CyberArk

  • Delinea

  • Delinea Platform

  • HashiCorp

  • Imprivata PAM

PAM Server Configurations

The Privileged Access Management (PAM) Server Configurations are connection profiles that allow the system to connect to and communicate with remote, third-party PAM servers and vaults. Each configuration contains:

  • Connection Details: The PAM server URL and authentication credentials.

  • Provider Type: Which PAM system is connected.

  • Configuration Parameters: Provider-specific settings for credential retrieval.

Requirements

System Administrators that configure External PAM Configurations, must have the following assets at hand:

  • PAM Server HTTPS URL: Use a safe HTTP  URL for your PAS server to send credentials and API keys in request headers or request bodies.

  • Certificate Chain File: If the vault certificate is not signed by a CA in the PAS trust store, provide a PEM certificate chain in the configuration's Certificate field. in a PEM File. (Not required, but recommended).

    Read PEM, DER, CRT, and CER: X.509 Encodings and Conversions for more information.

  • Outbound Connections: PAS must be able to make outbound TCP connections to the vault host and port in the configuration URL. HTTPS normally uses TCP 443. Ensure to configure your firewall.

  • Permissions: Internal Users require the MANAGE_PLUGINS permission.

  • Provider Connectivity: Your PAM server must be able to connect to your PAS server.

NOTE:

Legacy Plugin functionality is still supported. Contact Imprivata Support for more information.

Configure External PAM Connections

An External PAM Configuration defines how VPAM connects to an existing PAM provider and its remote server or secret vault. It identifies the provider and supplies the connection details, authentication information, and provider-specific settings your PAS server needs to retrieve credentials.

System Administrators create global configurations, which assume the VPAM server can reach the remote PAM server or vault directly. Testing a configuration checks whether VPAM can connect using the supplied settings.

IMPORTANT:

Ensure to configure your secrets in your PAM provider before completing any of the processes below.

NOTE:

After you configure the External PAM Configurations, these settings persist during the upgrades to the VPAM server and they also persist if your External PAM releases a new version.

To create a new External PAM Configuration:

  1. Navigate to System Administration > External PAM Configurations.

  2. Click Add PAM Server Configurations.

  3. Complete the form.

    Ensure you have the assets described in the requirements.

    IMPORTANT:

    Use Ignore SSL Certificates only for testing purposes. Not attaching SSL creates vulnerabilities in the system.

  4. Click Test Configuration to validate connectivity. (Optional)

  5. Click Create New External PAM Configuration.

To view your external PAM Configurations, navigate to System Administration > External PAM Configurations.

The configuration list displays:

  • Name: User-defined identifier.

  • Description: User-defined comment.

  • PAM Type: The PAM System provider.

  • URL: The PAM server's address.

  • Actions: Edit button to update the configuration.

To update an External PAM Configuration:

  1. Navigate to System Administration > External PAM Configurations.

  2. Select the configuration you want to update.

  3. Click Edit.

  4. Update any field.

  5. Click Test Configuration to validate connectivity. (Optional)

  6. Click Save External PAM Configuration.

To delete an External PAM Configuration:

  1. Navigate to System Administration > External PAM Configurations.

  2. Select the configuration you want to delete.

  3. Click Edit.

  4. Click Delete.

  5. Confirm the deletion.

CAUTION:

Deleting a PAM configuration also deletes its configured credential lookups and removes the associated credential object from every Host and Service where it was assigned.