Ensuring Passwordless Job Schedulation with CyberArk Integration

​CyberArk is an identity and access manager offering a wide set of identity security capabilities. You can use it to submit Workload Automation jobs without specifying any passwords, which are retrieved from the CyberArk vault.

​How it can be integrated with Workload Automation? Simply by using 2 files:

• the CyberArkVault library file

• the CyberArk.ini properties file that needs to be customized

​The CyberArkVault library file allows you to retrieve the password for a specific user from CyberArk. The password is not stored locally on the Workload Automation workstation, but retrieved from CyberArk while the Workload Automation job is running.
 
There are 2 types of integration methods:

1. With the Central Credential Provider (CCP) that starts an HTTPS call to CyberArk Central Credential Provider that manage the accesses.
2. With the local Credential Provider (CP) that starts a secure call to CyberArk Credential Provider using a proprietary CyberArk library file.

​6. Edit the CyberArk.ini properties file

​7. Restart the agent witn StartUpLwa command.
8. Add the necessary accounts in CyberArk, using the dedicated interface

Job Definitions
There are 2 types of jobs that are eligible to run with CyberArk integration:
 

• Windows Native Job

Define the job specifying a user managed by CyberArk and defined in the Windows OS too but with empty password (the password will be returned by CyberArk)

then specify a user by using a query syntax as the follow:
section_name::parameter_name=parameter_value

• Job Application Plug-In

 
You can specify the CyberArk user and then using the syntax for password type: ${agent:password.<username>}
 
or you can specify a user by using a query syntax as the follow: section_name::parameter_name=parameter_value;

Query Syntax building
 
User Syntax:

section_name::parameter_name=parameter_value;...
 
By using the above query user syntax it’s possible to build some examples as follows:

---

Authors Bio

Andrea Fiore, ​Workload Automation Senior Software Engineer, HCL Technologies

Andrea joined HCL in April 2017 in the Verification&Validation Test team. He works as verification tester for Workload Automation suite both on L3 Support team (in distributed and cloud-native environments) and in Test Team for new releases developing.
He has a master's degree in Computer Science Engineering, with specialization in Automatic and System Engineer.