BeyondTrust connector

Add a BeyondTrust connector to use credentials stored in your on-premises or cloud-hosted BeyondTrust instance. Once connected, you can use these credentials to authenticate other integration types in DigiCert® Trust Lifecycle Manager, streamlining configuration and centralizing credentials management.

Before you begin

Before adding a BeyondTrust secrets manager connector in Trust Lifecycle Manager, make sure the following prerequisites are satisfied.

DigiCert prerequisites

Your account must include the Secrets managers category under Integrations > Connectors > Add connector. For help verifying or enabling this feature, contact your DigiCert account representative.
You need at least one active DigiCert sensor to securely establish and manage the connection to your secrets manager instance. To learn more, see センサーを展開および管理する.
For fault-tolerant connectivity, use multiple sensors to manage the connector. If one of the sensors fails, the connector automatically fails over to use one of the other sensors.

BeyondTrust prerequisites

The BeyondTrust instance must allow access from the outbound IP addresses of any DigiCert sensors you use to set up the connector.
The access policy for the BeyondTrust instance must include the View Password policy type, with both the Auto Approve and API Only Access options enabled.
You need API access credentials (RunAs username, API key, and RunAs user password if required) for the BeyondTrust instance, for a user with the Password Safe Requester role for one or more of the managed account smart groups.
For each service account you will use for authentication in Trust Lifecycle Manager, the Account Settings must have the API Enabled option turned on.

Add BeyondTrust connector

To add a BeyondTrust connector in Trust Lifecycle Manager:

From the Trust Lifecycle Manager menu, go to Integrations > Connectors.
Select the Add connector button.
In the Secrets manager section, select the option for BeyondTrust.
次の手順に従って、フォームのすべての項目に入力します。
Configure the general connector properties in the top section of the form:
- Name: Assign a friendly name to this connector.
- Business unit: Select a business unit for this connector. Only users assigned to this business unit can manage the connector.
- Managing sensor: Select one or more active DigiCert sensors to manage the integration.
  ヒント
  Selecting multiple sensors adds fault-tolerance to the integration. If one sensor fails, Trust Lifecycle Manager will automatically fail over and use one of the other sensors.
Configure the BeyondTrust access details in the Link instance section:
- Hostname or IP address: Enter the hostname or IP address for your BeyondTrust instance.
- API key: Enter the API key associated with the RunAs user.
- Username: Enter the "RunAs" username for BeyondTrust API access.
- Password: Enter the password for the RunAs user if required by BeyondTrust. Otherwise, leave this empty.
Select Add to create the BeyondTrust connector with the configured settings.

What's next

Once the BeyondTrust connection is established, you can select it when configuring authentication for F5 appliances or AWS Certificate Manager (ACM) in Trust Lifecycle Manager.
To reference specific credentials in the connected BeyondTrust instance, provide the managed system and account names using the format SystemName/AccountName (for example, F5LTM/AdminAccount).
When you manage or rotate credentials in BeyondTrust, the updated credentials are automatically applied wherever they're referenced in Trust Lifecycle Manager.

このセクションの内容: