Setting up a Delinea integration¶

Certificate Manager - SaaS uses the Delinea Secret Server REST API to access credentials stored in Delinea Secret Server. After you connect Certificate Manager - SaaS to Secret Server, you can create credential references in Certificate Manager - SaaS that point to secrets stored in Secret Server.

You can then assign a credential reference to a machine in Certificate Manager - SaaS. When Certificate Manager - SaaS provisions a certificate to that machine, it uses the Delinea credential to access the machine.

Certificate Manager - SaaS reads the secret from Secret Server each time it uses the credential, so a password you rotate in Secret Server takes effect the next time Certificate Manager - SaaS uses it. You don't need to update anything in Certificate Manager - SaaS.

Step 1: Deploy VSatellites in your datacenter¶

If you don't already have any VSatellites installed, you'll need to get those up and running first. VSatellite is the connector between Certificate Manager - SaaS and Delinea.

The VSatellites need to be able to reach Secret Server over HTTPS. If Secret Server restricts access by IP address, you'll need the IP addresses of the VSatellites in the next step.

Follow our documentation to deploy VSatellites.

Step 2: Create an application account in Delinea Secret Server¶

Certificate Manager - SaaS signs in to Secret Server with an application account. An application account can't sign in to the Secret Server web interface, and it doesn't use a user license.

1. In Secret Server, create an application account for Certificate Manager - SaaS, with multifactor authentication turned off. For instructions, see the Delinea documentation.

2. Give the account a role with the View Secret and View User permissions. We also recommend the List permission, so the account can see the folder structure.

   Important

   Don't give the account the Administrator role. Grant only the permissions listed here.

3. Give the account permission on only the folders that hold the secrets Certificate Manager - SaaS needs to read.

4. If Secret Server restricts access by IP address, allow the IP addresses of your VSatellites.

Step 3: Set up the Delinea integration in Certificate Manager - SaaS¶

With the application account in place, you're ready to connect Certificate Manager - SaaS to Secret Server.

Performed by: System Administrator

1. Sign in to Certificate Manager - SaaS.

2. Click Integrations > Credential Managers.

3. Click New, and then select Delinea Credential Manager.

4. Under Password Retrieval, complete the fields according to the following guidelines:

   • Configuration name: A name for this connection. It must be at least 3 characters, with no leading or trailing spaces.
   • Secret Server URL: The URL of your Secret Server. Certificate Manager - SaaS rejects any URL that doesn't start with https://, because the application account's password is sent when Certificate Manager - SaaS signs in.
   • Username: The username of the application account.
   • Password: The password of the application account.
   • Domain: (Optional) The Active Directory domain of the application account. You can enter the short name, such as CORP, or the fully qualified domain name.
   • Choose a VSatellite: The VSatellites that can connect to Secret Server. Choose at least one.

   Note

   Certificate Manager - SaaS doesn't verify the certificate that Secret Server presents. The connection is still encrypted.

5. Click Test Access. Certificate Manager - SaaS confirms, through each VSatellite you chose, that the URL belongs to a Secret Server and that the application account can sign in. Save stays unavailable until the test succeeds and every VSatellite you chose can reach Secret Server.

   Avoid locking the application account

   Secret Server locks an account after repeated failed sign-ins, and then rejects even the correct password until the lockout ends. Certificate Manager - SaaS signs in each time it reads a credential, so a wrong password can lock the application account quickly and stop every Delinea credential from working. Certificate Manager - SaaS doesn't retry a rejected sign-in. If the test fails with a sign-in error, check the username, password, and domain before you test again.

   If your access is unsuccessful, check the troubleshooting tips below.

6. Click Save.

Step 4: Create Delinea credentials in Certificate Manager - SaaS¶

With the connection in place, you can create credentials in Certificate Manager - SaaS. Delinea credentials in Certificate Manager - SaaS are references to secrets stored in Secret Server.

Performed by: System Administrator

1. Click Inventory > Credentials.

2. Click New > Delinea Credential. Complete the fields on the Add a New Credential screen according to the following guidelines:

   • Name: A name for the credential. It must be at least 3 characters, with no leading or trailing spaces.
   • Configuration: The Delinea connection you set up in Step 3.
   • Owning Teams: The teams that can use this credential.
   • Access Type: Choose what Certificate Manager - SaaS reads from the secret:
     • Username and Password: Both the username and the password.
     • Password Only: Only the password. Use this for a secret whose template has no username field.
   • Secret ID: The numeric ID of the secret in Secret Server. It must be a positive whole number.

3. Click Save. The Credentials page opens with your new credential listed.

4. You can now test the credential you just created. Click the vertical ellipses icon on the row of the new credential, and select Test Access.

   Note

   Test Access reads the secret to confirm that it has the fields the credential needs, so Secret Server's audit log records a secret view each time you test.

   If Certificate Manager - SaaS was unable to access the credential, see the troubleshooting tips below.

Step 5: Assign the Delinea credential on a Certificate Manager - SaaS machine¶

Performed by: Resource Owner or higher

Now that the credential is in Certificate Manager - SaaS, you can assign it to a machine, as long as the Owning Team assigned to the machine matches the Owning Team assigned to the credential.

Limitations¶

• A credential refers to a secret by its numeric ID only, not by name or folder path.
• The secret's template must use the default username and password field slugs.
• Secrets that require check-out, require approval for access, or are protected by DoubleLock aren't supported.
• SSH key credentials aren't supported.
• Delinea Secret Server doesn't accept client-certificate authentication to its REST API, so the connection uses only a username and password.

Troubleshooting¶

Use these tips to troubleshoot common errors.

Delinea connection errors¶

Delinea credential errors¶