BeyondTrust Password Safe

The BeyondTrust Password Safe connector allows for secure management and automation of privileged credentials, integrating seamlessly with security workflows.

BeyondTrust Password Safe is a comprehensive privileged access management solution that secures and manages credentials, ensuring only authorized individuals have access to sensitive systems. This connector allows Swimlane Turbine users to automate credential management, access requests, and system updates, enhancing security and compliance. By integrating with BeyondTrust Password Safe, Swimlane Turbine users can streamline privileged account operations, reduce manual overhead, and rapidly respond to access-related incidents within their security workflows.

Limitations

None to date.

Supported Versions

This BeyondTrust Password Safe connector uses the latest Version API.

Additional Docs

BeyondTrust Password Safe API Documentation Link

Configuration

Prerequisites

To effectively utilize the BeyondTrust Password Safe connector with Swimlane Turbine, ensure you have the following:

API Key Authentication with the necessary parameters:

URL: The endpoint URL for the BeyondTrust Password Safe API.

Key: Your unique API key to authenticate requests.

Run As: The username of the user performing actions via the API.

Password: The password associated with the 'Run As' user.

Authentication Methods

The BeyondTrust Password Safe connector uses the API Key authentication method to connect to the BeyondTrust Password Safe API.

The following are required to set up the asset:

API Key: The API key generated from BeyondTrust Password Safe.

RunAs Username: The username of the account that has permissions to use the API key.

RunAs Password: The password for the RunAs user account.

API Endpoint: The URL endpoint for the BeyondTrust Password Safe API.

Example configuration in apikey.yaml:

apikey: c479a66f…c9484d
runas_username: doe-main\johndoe
runas_password: un1qu3
api_endpoint: https://your-beyondtrust-instance/api/public/v3

Capabilities

This BeyondTrust Password Safe connector provides the following capabilities:

Check in or Release a Request

Get Credentials

Get Managed Accounts

Get Managed Systems

Update Credentials

Check in or Release a Request

BeyondTrust Password Safe's documentation for this action can be found here.

Required Roles: Requestor role to managed account referenced by the request.

Get Credentials

BeyondTrust Password Safe's documentation for this action can be found here.

Required Permissions: None.

Get Managed Accounts

BeyondTrust Password Safe's documentation for this action can be found here.

Required Roles: Requestor, Requestor/Approver, or ISA role.

Get Managed Systems

BeyondTrust Password Safe's documentation for this action can be found here.

Required Permissions: Password Safe System Management (Read).

Update Credentials

BeyondTrust Password Safe's documentation for this action can be found here.

Required Permissions:

Password Safe Account Management (Read/Write).

ISA Role or Credentials Manager Role on a Smart Rule referencing the account.

Configurations

BeyondTrust Password Safe API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
key	The API key configured in BeyondInsight for your application.	string	Required
runas	The username of a BeyondInsight user that has been granted permission to use the API key.	string	Required
pwd	The RunAs user password surrounded by square brackets (optional; required only if the User Password is required on the application API registration).	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Check in or Release a Request

Checks in or releases a specified request in BeyondTrust Password Safe using the request ID before expiration.

Endpoint

URL: Requests/{{id}}/Checkin

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	ID of the request to check-in/release.

Input Example

{"path_parameters":{"id":"12345678"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":204,"response_headers":{},"reason":"OK","json_body":{}}

Get Credentials

Retrieves active and approved credentials for a specified request ID in BeyondTrust Password Safe.

Endpoint

URL: Credentials/{{requestId}}

Method: GET

Input

Argument Name	Type	Required	Description
parameters.type	string	Optional	The type of credential to retrieve.
path_parameters.requestId	string	Required	ID of the request for which to retrieve the credentials.

Input Example

{"parameters":{"type":"dsskey"},"path_parameters":{"requestId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
Credentials	string	Output field: Credentials

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"Credentials":"string"}}

Get Managed Accounts

Retrieve a list of managed accounts available for request by the current user, with optional query parameters for specificity.

Endpoint

URL: /ManagedAccounts

Method: GET

Input

Argument Name	Type	Required	Description
parameters.systemName	string	Optional	(optional) Name of the managed system.
parameters.accountName	string	Optional	(optional) Name of the managed account.
parameters.systemID	string	Optional	(optional) ID of the Managed System.
parameters.workgroupName	string	Optional	(optional) Name of the Workgroup.
parameters.applicationDisplayName	string	Optional	(optional, when given, type must be application) Display name of the application.
parameters.ipAddress	string	Optional	(optional, when given type must be one of system, domainlinked, or database) IP Address of the managed asset.
parameters.type	string	Optional	(optional/recommended) Type of the managed account to return.
parameters.limit	number	Optional	(optional) (default- 1000) Number of records to return
parameters.offset	number	Optional	(optional) (default- 0) Number of records to skip before returning records

Input Example

{"parameters":{"systemName":"Test Name","accountName":"Test Account","systemID":"12233344","workgroupName":"Test Group","applicationDisplayName":"Test","ipAddress":"1.2.333.44","type":"system","limit":1000,"offset":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
PlatformID	number	Unique identifier
SystemId	number	Unique identifier
SystemName	string	Name of the resource
DomainName	string	Name of the resource
AccountId	number	Unique identifier
AccountName	string	Name of the resource
InstanceName	string	Name of the resource
UserPrincipalName	string	Name of the resource
ApplicationID	number	Unique identifier
ApplicationDisplayName	string	Name of the resource
DefaultReleaseDuration	number	Output field: DefaultReleaseDuration
MaximumReleaseDuration	number	Output field: MaximumReleaseDuration
LastChangeDate	string	Date value
NextChangeDate	string	Date value
IsChanging	boolean	Output field: IsChanging
ChangeState	number	Output field: ChangeState
IsISAAccess	boolean	Output field: IsISAAccess
PreferredNodeID	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"PlatformID":1,"SystemId":12345,"SystemName":"ExampleSystem","DomainName":"example.com","AccountId":67890,"AccountName":"ExampleAccount","InstanceName":"ExampleInstance","UserPrincipalName":"[email protected]","ApplicationID":54321,"ApplicationDisplayName":"ExampleApp","DefaultReleaseDuration":30,"MaximumReleaseDuration":60,"LastChangeDate":"2023-01-01T00:00:00Z","NextChangeDate":"2023-02-01T00:00:00Z","IsChanging":true}}

Get Managed Systems

Retrieve a list of systems managed by BeyondTrust Password Safe, detailing each system's attributes and status.

Endpoint

URL: /ManagedSystems

Method: GET

Input

Argument Name	Type	Required	Description
parameters.type	string	Optional	The entity type of the managed system.
parameters.name	string	Optional	The name of the managed system.
parameters.limit	number	Optional	(default- 100000) Number of records to return.
parameters.offset	number	Optional	(default- 0) Number of records to skip before returning records (can only be used in conjunction with limit).

Input Example

{"parameters":{"type":"server","name":"example_system","limit":100000,"offset":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"WorkgroupID":1,"HostName":"example-host","IPAddress":"192.168.1.1","DNSName":"example.com","InstanceName":"instance1","IsDefaultInstance":true,"Template":"template1","ForestName":"forest1","UseSSL":false,"ManagedSystemID":123,"EntityTypeID":456,"AssetID":null,"DatabaseID":null,"DirectoryID":null,"CloudID":null}]}

Update Credentials

Updates the credentials for a specified managed account in BeyondTrust Password Safe, with an option to apply changes system-wide.

Endpoint

URL: ManagedAccounts/{{managedAccountID}}/Credentials

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.managedAccountID	string	Required	ID of the managed account for which to set the credentials.
Password	string	Optional	(optional) The new password to set. If not given, generates a new random password.
PublicKey	string	Optional	(required if PrivateKey is given and updateSystem = true) The new public key to set on the host.
PrivateKey	string	Optional	The private key to set (provide passphrase if encrypted).
Passphrase	string	Optional	(optional) The passphrase to use for an encrypted private key.
UpdateSystem	boolean	Optional	(default- true) Whether to update the credentials on the referenced system.

Input Example

{"json_body":{"Password":"","PublicKey":"","PrivateKey":"","Passphrase":"","UpdateSystem":true},"path_parameters":{"managedAccountID":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":204,"response_headers":{},"reason":"OK","json_body":{}}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT

Docs powered by Archbee