Skip to main content

BeyondTrust Password Safe

· 51 min read
Pradeep Kadambar
Pradeep Kadambar
Creator
BeyondTrust Password Safe is an enterprise solution for privileged account, credential, and secrets management. It automates password rotation, enforces strong security policies, monitors and audits privileged sessions, and manages access for human and machine identities across traditional, cloud, and DevOps environments.

Versions: 8.0.0 P10

Introduction​

This plugin integrates RSA Governance and Lifecycle (G&L) with BeyondTrust Password Safe using the BeyondTrust REST API v3 and OAuth 2.0 authentication. It retrieves credentials for use by collectors and connectors. Credentials are not cached; each retrieval fetches the current password directly from BeyondTrust, so password rotation policies are respected automatically.

Prerequisites​

Before you begin, ensure you have the following:

  • Administrative access to your BeyondTrust Password Safe instance.
  • A list of managed accounts that RSA G&L will access.
  • The IP address or CIDR range of the RSA G&L instance for API access configuration.

Application Setup​

This section describes how to configure BeyondTrust Password Safe for OAuth-based API access by RSA G&L.

info

This section is provided for reference only. Contact your BeyondTrust administrator to configure BeyondTrust Password Safe in line with your organization's security requirements.

Step 1: Create a User Group and Smart Group​

  1. Create a User Group:

    1. Navigate to Configuration > Role Based Access > User Management.
    2. Click the Groups tab and select Create New Group > Create a New Group.
    3. Enter API Access as the Group Name, provide a Description, and click Create Group.

  2. Create a Smart Group:

    1. Navigate to Managed Accounts.
    2. Select the accounts RSA G&L will access.
    3. Click Add to Smart Group.
    4. In the Add To Manual Smart Group dialog, enter G&L in the Smart Group (manual) field.
    5. Click Add As New Option.

    6. Set Category to Managed Accounts, provide an optional Description, and click Add Selected Accounts To Smart Group.

Step 2: Configure API Access and Permissions​

  1. Configure an API Access Policy:

    1. Go to Configuration > General > API Registrations.
    2. Click Create API Registration and select API Access Policy.
    3. Fill in the registration details, including the Access Token Duration.

    4. Click Add Authentication Rule, select CIDR and IP Rule, and enter the CIDR range for your RSA G&L instance.
    5. Click Create Rule.

  2. Assign Permissions:

    1. Open the API Access group and select the Features tab.
    2. Select All Features, then search for and select Password Safe Account Management and Password Safe System Management.
    3. Click Assign Permissions and grant Read Only access.

Step 3: Create an Access Policy​

  1. Go to Configuration > Privileged Access Management Policies > Access Policies.
  2. Click Create Policy.
  3. Enter G&L API Auto Approve Policy as the Access Policy Name, provide a Description, and click Create Policy.

  4. On the Schedule tab, click Create Schedule.

  5. Enable All Day and verify the Recurrence settings.

  6. Under Policy Types, select View Password, Auto Approve, and API Only Access.

  7. Click Create Schedule.

Step 4: Assign Smart Group Roles​

  1. Go to User Management > Groups > API Access.
  2. Click the Smart Groups tab, find the G&L smart group, and select Edit Password Safe Roles.
  3. Select the Requestor role.
  4. For Access Policy, select G&L API Auto Approve Policy.

  5. Click Save Roles.

Step 5: Create an API User​

  1. Go to Configuration > Role Based Access > User Management.
  2. Click the Users tab and select Add an Application User.
  3. Enter svc_gl_pam as the Username.
  4. Under API Access Policy, select the policy you created.
  5. Copy and store the Client ID and Client Secret. These are required for the G&L configuration.

  6. Click Create User.
  7. Assign the user to the API Access group.

Step 6: Enable API Access on Managed Accounts​

  1. Go to Managed Accounts.
  2. For each account, set Enable API Access to Yes in the Account Settings.

Installation and Configuration in G&L​

note

Requires RSA Governance and Lifecycle 8.0.0 Patch 10 or later.

Complete the Application Setup section before proceeding. You will need the Client ID and Client Secret from Step 5.

Step 1: Install the Plugin​

  1. Log in to the RSA G&L UI as a System Administrator.

  2. Open the Admin menu and click System.

  3. Click the Password Vault tab.

  4. Scroll to the Vault Types section and click Upload New Vault Type.

  5. Enter a Vault Type Name (for example, BeyondTrust-Password-Safe) and an optional description. Click Choose File, select the distribution JAR (beyondtrust-password-safe-plugin-dist-1.0-<timestamp>.jar), and click OK.

    note

    After uploading, restart all remote G&L agents to load the new vault type.

  6. After the upload completes, BeyondTrust Password Safe appears in the Vault Types list.

Step 2: Configure the Password Vault​

  1. Scroll to the Password Vault Configuration section. Select BeyondTrust Password Safe from the dropdown and click + Create.

  2. Complete the following fields, click Test Connection, and click OK to save.

    FieldDescription
    Base URLBase URL of your BeyondTrust Password Safe instance (for example, https://instance.company.com)
    Client IDOAuth 2.0 Client ID from the registered BeyondTrust application
    Client SecretOAuth 2.0 Client Secret from the registered BeyondTrust application (masked)

  3. The saved configuration shows Edit, Test Connection, and Delete options. Use Test Connection at any time to verify connectivity.

Step 3: Create Vault Profiles​

A vault profile maps a G&L managed account to a Managed System and Account in BeyondTrust. Create one profile per account.

  1. Navigate to the Password Vault Profiles section and click + Create Profile.

  2. Complete the following fields and click Test Profile. A Credential retrieved successfully response confirms the account is reachable in BeyondTrust. Click OK to save.

    FieldDescriptionExample
    NameDisplay name for this profileOracle DB Admin
    DescriptionOptional descriptionOracle production DBA account
    System NameManaged System name exactly as it appears in BeyondTrust Password SafePROD-DB-01
    Account NameManaged Account name exactly as it appears in BeyondTrust Password Safeoracle_dba

  3. The profile appears in the list. The Identifier column shows System Name (Account Name).

  4. Repeat for each account that requires BeyondTrust password retrieval.

  5. In G&L, open the collector or connector configuration, locate Use Password Vault, select the profile, click Test, and save.

Known Limitations​

  • Fixed request duration. Each credential checkout is valid for 1 minute. If a checkout is still active when a new request is submitted for the same account, BeyondTrust returns a 409 Conflict error. Wait for the active request to expire and retry, or manually check in the request from the BeyondTrust Password Safe UI.
  • Double-quote characters in passwords. Double-quote characters are removed from retrieved passwords. If an account password contains double quotes, update the password in BeyondTrust to use a different special character.

Troubleshooting​

API Authentication Errors​

  • Verify that the Client ID and Client Secret are correct.
  • Confirm that the API user is assigned to the API Access user group.
  • Confirm that the API access policy is configured with the correct IP address or CIDR range for the RSA G&L instance.

Unable to Retrieve Passwords​

  • Confirm that the Requestor role is assigned to the G&L smart group.
  • Verify that the access policy is configured to auto-approve requests.
  • Confirm that API access is enabled on the managed accounts.

Access Denied Errors​

  • Verify that the API Access user group has Read Only permissions for Password Safe Account Management and Password Safe System Management.

References​