BeyondTrust connector

Add a BeyondTrust connector to use credentials stored in your on-premises or cloud-hosted BeyondTrust instance. Once connected, you can use these credentials to authenticate other integration types in DigiCert® Trust Lifecycle Manager, streamlining configuration and centralizing credentials management.

Before you begin

Before adding a BeyondTrust secrets manager connector in Trust Lifecycle Manager, make sure the following prerequisites are satisfied.

DigiCert prerequisites

You need at least one active DigiCert sensor to establish and manage the connection to your BeyondTrust instance. To learn more, see Deploy and manage sensors.
For fault-tolerant connectivity, use multiple sensors to manage the connector. If one of the sensors fails, the connector automatically fails over to use one of the other sensors.

BeyondTrust prerequisites

The BeyondTrust instance must allow access from the outbound IP addresses of any DigiCert sensors you use to set up the connector.
The access policy for the BeyondTrust instance must include the View Password policy type, with API Only Access enabled.
You need API access credentials (RunAs username, API key, and RunAs user password if required) for the BeyondTrust instance, for a user with the Requester and Approver roles on the managed systems.
For each managed account you will use for authentication in Trust Lifecycle Manager, the Account Settings must have the API Enabled option turned on.

Add BeyondTrust connector

To add a BeyondTrust connector in Trust Lifecycle Manager:

From the Trust Lifecycle Manager menu, go to Integrations > Connectors.
Select the Add connector button.
In the Secrets manager section, select the option for BeyondTrust.
Complete the form as described in the following steps.
Configure the general connector properties in the top section of the form:
- Name: Assign a friendly name to this connector.
- Business unit: Select a business unit for this connector. Only users assigned to this business unit can manage the connector.
- Managing sensor: Select one or more active DigiCert sensors to manage the integration.
  Tip
  Selecting multiple sensors adds fault-tolerance to the integration. If one sensor fails, Trust Lifecycle Manager will automatically fail over and use one of the other sensors.
Configure the BeyondTrust access details in the Link instance section:
- Hostname or IP address: Enter the hostname or IP address for your BeyondTrust instance.
- API key: Enter the API key associated with the RunAs user.
- Username: Enter the "RunAs" username for BeyondTrust API access.
- Password: Enter the password for the RunAs user if required by BeyondTrust. Otherwise, leave this empty.
Select Add to create the BeyondTrust connector with the configured settings.

What's next

Once the BeyondTrust connection is established, you can select it when configuring authentication for F5 appliances in Trust Lifecycle Manager.
To reference specific credentials in the connected BeyondTrust instance, provide the managed system and account names using the format SystemName/AccountName (for example, F5LTM/AdminAccount).
When you manage or rotate credentials in BeyondTrust, the updated credentials are automatically applied wherever they're referenced in Trust Lifecycle Manager.

In this section: