{"id":6559,"date":"2020-10-27T13:00:06","date_gmt":"2020-10-27T19:00:06","guid":{"rendered":"http:\/\/gregsowell.com\/?p=6559"},"modified":"2021-09-28T08:05:56","modified_gmt":"2021-09-28T14:05:56","slug":"cyberark-vault-integration-with-ansible-tower","status":"publish","type":"post","link":"https:\/\/gregsowell.com\/?p=6559","title":{"rendered":"Cyberark Vault Integration With Ansible Tower"},"content":{"rendered":"<p><a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/Untitled-1-2.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/Untitled-1-2-300x169.png\" alt=\"\" width=\"300\" height=\"169\" class=\"aligncenter size-medium wp-image-6561\" srcset=\"https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/Untitled-1-2-300x169.png 300w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/Untitled-1-2-768x432.png 768w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/Untitled-1-2-1024x576.png 1024w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/Untitled-1-2.png 1280w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>Cyberark has some impressive security tools, and in today&#8217;s example I&#8217;m using their Vault product.  We are connecting in through their <a href=\"https:\/\/www.cyberark.com\/products\/privileged-account-security-solution\/application-identity-manager\/\">AIM(Application Identity Manager) system<\/a>.  Like other secrets engines, AIM allows me to pull secure credentials from it at run time.  Also, I&#8217;d like to give a big shoutout to the team at CyberArk for providing us with this excellent demo environment!<\/p>\n<p><strong>**CyberArk PAM (depending on your software package) may require the below additional license to allow API access**<\/strong><br \/>\n<code>Product Code<br \/>\nAPP-ISV-SUBS<\/p>\n<p>Product Name<br \/>\nSecret management for commercial software (part of C3 integrations)<\/p>\n<p>Description<br \/>\nSecret management for commercial software (part of C3 integrations). Price per single integration unit. Minimum purchase<br \/>\nof 5 integration units<\/code><\/p>\n<h2>Demo Video<\/h2>\n<p><iframe loading=\"lazy\" width=\"560\" height=\"315\" src=\"https:\/\/www.youtube.com\/embed\/SAuSRCqlOgI\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen><\/iframe><\/p>\n<h2>CyberArk<\/h2>\n<p>First I create an application&#8230;honestly I was lazy and just used testappid.<br \/>\n<a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca1.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca1-300x101.png\" alt=\"\" width=\"300\" height=\"101\" class=\"aligncenter size-medium wp-image-6565\" srcset=\"https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca1-300x101.png 300w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca1-768x258.png 768w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca1-1024x343.png 1024w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca1.png 1184w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>Next you add authentication certificates to use with the app.<br \/>\n<a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca2.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca2-300x150.png\" alt=\"\" width=\"300\" height=\"150\" class=\"aligncenter size-medium wp-image-6566\" srcset=\"https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca2-300x150.png 300w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca2-768x383.png 768w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca2.png 808w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>After this I browse to policies and hit access control.  From here I add any safes that I need access to.<br \/>\n<a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca3.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca3-300x146.png\" alt=\"\" width=\"300\" height=\"146\" class=\"aligncenter size-medium wp-image-6567\" srcset=\"https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca3-300x146.png 300w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca3-768x375.png 768w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca3-1024x500.png 1024w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca3.png 1112w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>I then select the safe and edit the members list.<br \/>\n<a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca4.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca4-300x162.png\" alt=\"\" width=\"300\" height=\"162\" class=\"aligncenter size-medium wp-image-6568\" srcset=\"https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca4-300x162.png 300w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca4-768x414.png 768w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca4-1024x552.png 1024w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca4.png 1313w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>Add the app that needs access.  I just wanted it to retrieve passwords, and not have any other access so, it only has retrieve.<br \/>\n<a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca5.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca5-300x151.png\" alt=\"\" width=\"300\" height=\"151\" class=\"aligncenter size-medium wp-image-6569\" srcset=\"https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca5-300x151.png 300w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca5-768x386.png 768w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca5-1024x514.png 1024w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca5.png 1067w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>After this I pop into the vault.<br \/>\n<a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca6.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca6-300x126.png\" alt=\"\" width=\"300\" height=\"126\" class=\"aligncenter size-medium wp-image-6570\" srcset=\"https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca6-300x126.png 300w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca6.png 624w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>I open the safe in question.  Here it&#8217;s &#8220;Test&#8221;.<br \/>\n<a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca7.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca7-190x300.png\" alt=\"\" width=\"190\" height=\"300\" class=\"aligncenter size-medium wp-image-6571\" srcset=\"https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca7-190x300.png 190w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca7.png 379w\" sizes=\"auto, (max-width: 190px) 100vw, 190px\" \/><\/a><\/p>\n<p>I then create a password object.  In my case it&#8217;s &#8220;ansible&#8221; and the password is redhat.  **After this hit the Logoff button**<br \/>\n<a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca8.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca8-300x129.png\" alt=\"\" width=\"300\" height=\"129\" class=\"aligncenter size-medium wp-image-6572\" srcset=\"https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca8-300x129.png 300w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca8-768x330.png 768w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/ca8.png 874w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<h2>Tower Configuration<\/h2>\n<p>Tower has a custom credential lookup plugin to utilize CA AIM, which I&#8217;ll use as a lookup for other credentials.<\/p>\n<p>First I add a new credential of type &#8220;CyberArk AIM Central Credential Provider Lookup&#8221;<br \/>\n<a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower1-1.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower1-1-300x142.png\" alt=\"\" width=\"300\" height=\"142\" class=\"aligncenter size-medium wp-image-6577\" srcset=\"https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower1-1-300x142.png 300w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower1-1-768x363.png 768w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower1-1-1024x484.png 1024w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower1-1.png 1055w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>Next I put in my CA AIM URL, application id(in this case testappid), the client key, and the client cert.<br \/>\n<a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower2.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower2-300x211.png\" alt=\"\" width=\"300\" height=\"211\" class=\"aligncenter size-medium wp-image-6578\" srcset=\"https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower2-300x211.png 300w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower2-768x541.png 768w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower2-1024x722.png 1024w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower2.png 1128w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>Now I create another standard credential of any type(in this instance I use a standard machine credential.  For password I click the magnifying glass and it displays the Cyberark AIM credential I just created.<br \/>\n<a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower3.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower3-300x132.png\" alt=\"\" width=\"300\" height=\"132\" class=\"aligncenter size-medium wp-image-6579\" srcset=\"https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower3-300x132.png 300w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower3-768x338.png 768w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower3-1024x450.png 1024w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower3.png 1101w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>I now put in the object query based on the safe of Test and object of ansible.<br \/>\n<a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower4.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower4-300x131.png\" alt=\"\" width=\"300\" height=\"131\" class=\"aligncenter size-medium wp-image-6580\" srcset=\"https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower4-300x131.png 300w, https:\/\/gregsowell.com\/wp-content\/uploads\/2020\/10\/tower4.png 594w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">safe=Test;object=ansible<\/code><\/pre>\n<h2>Github Scripts<\/h2>\n<p><a href=\"https:\/\/github.com\/gregsowell\/ansible-cyberark\">My CyberArk repo is here<\/a>.<\/p>\n<p>Here is a demo script using a custom credential to display the ansible password:<br \/>\n<script src=\"http:\/\/gist-it.appspot.com\/https:\/\/github.com\/gregsowell\/ansible-cyberark\/blob\/main\/cyberark-aim-show-pwd.yml\"><\/script><br \/>\nAs you can see, all of the magic is done in the lookup plugin, so nothing special to show here; that&#8217;s what&#8217;s so cool about the lookup(it&#8217;s so simple and clean).<\/p>\n<p>Here&#8217;s another version updating the backup user on some Cisco switches:<br \/>\n<script src=\"http:\/\/gist-it.appspot.com\/https:\/\/github.com\/gregsowell\/ansible-cyberark\/blob\/main\/cyberark-aim-ios-user-pwd.yml\"><\/script><\/p>\n<h2>Conclusion<\/h2>\n<p>It was a bear to figure all of this out, but once you have your head wrapped around it, it&#8217;s really quite simple.  I really like how clean it all is.<\/p>\n<p>If you have any questions or comments, please let me know.<br \/>\nThanks and happy CyberArking \ud83d\ude09<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cyberark has some impressive security tools, and in today&#8217;s example I&#8217;m using their Vault product. We are connecting in through their AIM(Application Identity Manager)\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[49,8,24,13],"tags":[],"class_list":["post-6559","post","type-post","status-publish","format-standard","hentry","category-ansible","category-networking","category-security","category-server"],"_links":{"self":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/6559","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6559"}],"version-history":[{"count":12,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/6559\/revisions"}],"predecessor-version":[{"id":6912,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/6559\/revisions\/6912"}],"wp:attachment":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6559"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6559"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6559"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}