WIXLIB

REMOTE SUPPORTDELINEA SECRET SERVER INTEGRATIONCreate an OAuth API AccountThe Delinea API account is used from within Delinea to make Remote Support Command API calls to Remote Support.1. In /login, navigate to Management API Configuration.2. Click Add.3. Check Enabled.4. Enter a name for the account.5. OAuth Client ID and OAuth Client Secret is used during theOAuth configuration step in Delinea.6. Set the following Permissions:lllCommand API: Full Access.Reporting API: Allow Access to Support Session Reportsand Recordings.Endpoint Credential Manager API: Allow Access.oIf ECM groups are enabled on the site, select whichECM Group to use. ECMs that are not associatedwith a group come under Default.Note: The ECM Group feature is only present if enabled whenyour site is built. If it is not present, please contact your siteadministrator.7. Click Save at the top of the page to create the account.SALES: www.beyondtrust.com/contactSUPPORT: www.beyondtrust.com/supportDOCUMENTATION: www.beyondtrust.com/docs 2003-2022 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, ordepository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.11TC: 5/27/2022

REMOTE SUPPORTDELINEA SECRET SERVER INTEGRATIONAllow ECM ConnectionsRemote Support 20.2 and later1. Go to /login Management API Configuration.2. Add or edit an API account.3. Under Permissions, check Allow Access for EndpointCredential Manager API.SALES: www.beyondtrust.com/contactSUPPORT: www.beyondtrust.com/supportDOCUMENTATION: www.beyondtrust.com/docs 2003-2022 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, ordepository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.12TC: 5/27/2022

REMOTE SUPPORTDELINEA SECRET SERVER INTEGRATIONConfigure the Delinea Secret Server Plugin for Integration withBeyondTrust Remote SupportSALES: www.beyondtrust.com/contactSUPPORT: www.beyondtrust.com/supportDOCUMENTATION: www.beyondtrust.com/docs 2003-2022 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, ordepository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.13TC: 5/27/2022

REMOTE SUPPORTDELINEA SECRET SERVER INTEGRATIONInstall the Endpoint Credential ManagerThe Endpoint Credential Manager (ECM) must be installed on a system with the following requirements:System RequirementslWindows Vista or newer, 64-bit onlyl.NET 4.5 or newerlProcessor: 2GHz or fasterlMemory: 2GB or greaterlAvailable Disk Space: 80GB or greater1. To begin, download the BeyondTrust Endpoint Credential Manager (ECM) from BeyondTrust Support at beyondtrustcorp.servicenow.com/csm2. Start the BeyondTrust Endpoint Credential Manager Setup Wizard.3. Agree to the EULA terms and conditions. Mark the checkbox if you agree, and then clickInstall.If you need to modify the ECM installation path, click the Options button to customizethe installation location.Note: You are not allowed to proceed with the installation unlessyou agree to the EULA.4. Click Next on the Welcome screen.5. Choose a location for the credential manager, and then click Next.SALES: www.beyondtrust.com/contactSUPPORT: www.beyondtrust.com/supportDOCUMENTATION: www.beyondtrust.com/docs 2003-2022 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, ordepository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.14TC: 5/27/2022

REMOTE SUPPORTDELINEA SECRET SERVER INTEGRATION6. On the next screen, you can begin the installation or review any previous step.7. Click Install when you are ready to begin.8. The installation takes a few moments. On the Completed screen, click Finish.Note: To ensure optimal up-time, administrators can install up to five ECMs on different Windows machines to communicatewith the same site on the BeyondTrust Appliance B Series. A list of the ECMs connected to the B Series Appliance site can befound at /login Status Information ECM Clients.Note: When multiple ECMs are connected to a BeyondTrust site, the B Series Appliance routes requests to the ECM that hasbeen connected to the B Series Appliance the longest.SALES: www.beyondtrust.com/contactSUPPORT: www.beyondtrust.com/supportDOCUMENTATION: www.beyondtrust.com/docs 2003-2022 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, ordepository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.15TC: 5/27/2022

REMOTE SUPPORTDELINEA SECRET SERVER INTEGRATIONInstall and Configure the Plugin1. Once the BeyondTrust ECM is installed, extract and copy the plugin files to the installation directory (typically C:\ProgramFiles\Bomgar\ECM).2. Run the ECM Configurator to install the plugin.3. The Configurator should automatically detect the plugin and load it. If so, skip to step 4 below. Otherwise, follow these steps:llllFirst, ensure that the DLL is not blocked. Right-click on the DLL and selectProperties.On the General tab, look at the bottom of the pane. If there is a Security sectionwith an Unblock button, click the button.Repeat these steps for any other DLLs packaged with the plugin.In the Configurator, click the Choose Plugin button and browse to the locationof the plugin DLL.4. Click the gear icon in the Configurator window to configure plugin settings.5. The following settings are available:Setting NameDescriptionNotesEndpoint URLThe full URL to the SecretServer web servicesAPI UserUsername of the APIaccount created in SecretServerYesAPI PasswordPassword of the aboveuserYesSALES: www.beyondtrust.com/contacte.g., https:// delinea-serverhostname dSUPPORT: www.beyondtrust.com/supportYesDOCUMENTATION: www.beyondtrust.com/docs 2003-2022 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, ordepository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.16TC: 5/27/2022

REMOTE SUPPORTDELINEA SECRET SERVER INTEGRATIONSetting NameAPI DomainDescriptionDomain of the API accountcreated in Secret ServerNotesRequiredUsed only if the API account is not a local user in SecretServerNoAPI Organization Organization of the APIaccount created in SecretServerNot typically used for such accountsNoInclude domaincredentials forWhen checked, in additionto retrieving machinespecific credentials for theselect endpoint, it alsoretrieves domaincredentials where thedomain field (configuredbelow) matches one of theconfigured domainsThis field can contain multiple domains separated withcommasNoDomain FieldAPI web service fieldcontaining domain namesThe default value of Domain should be left unless anorganization is using another field to store this information ondomain secretsYesMachine FieldAPI web service fieldThe default value of Machine should be left unless ancontaining machine names organization is using another field to store this information onmachine-specific secretsYesDefault Domainfor LocalBeyondTrustUsersWhen a value is supplied,This setting is necessary if some or all BeyondTrust users arethe plugin initially attempts local users but the corresponding accounts in Secret Serverto retrieve credentials forare domain accounts with the same username portionthe user with the usernamefrom BeyondTrust and theconfigured default domainNoEnable fall-backto local accountif domainaccount notfoundWhen checked, the plugin This setting is necessary if some or all BeyondTrust users arefirst attempts to retrievedomain users but the corresponding accounts in Secretcredentials for the user as Server are domain accounts with the same username portiona domain user and then, ifno match is found, makes asecond attempt without thedomainNoInclude defaultorganizationIf enabled, the suppliedorganization is includedwhen querying for amatching Secret ServeruserNoThe test functionality allows you to test new or updated configuration without the need to go through the representative console or to savethe changes first. The form collects information to simulate a request from the B Series Appliance to the ECM. This means you can test thesettings without having the ECM service running or connected to the B Series Appliance.Note: While the test does simulate a request from the B Series Appliance to the ECM, it does not in any way test configurationor connectivity to the B Series Appliance. It is used only for configuration, connectivity, permissions, etc., related to thepassword vault system.SALES: www.beyondtrust.com/contactSUPPORT: www.beyondtrust.com/supportDOCUMENTATION: www.beyondtrust.com/docs 2003-2022 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, ordepository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.17TC: 5/27/2022

REMOTE SUPPORTDELINEA SECRET SERVER INTEGRATIONConsole User InformationThe fields collected in this section simulate the information that is sent to the ECM about the user logged into the console and requestingcredentials from the password vault.llSRA Console Username: The username of the console user. Depending on the type of security provider and how it is configured,this might be username-only ( joe.user), which is the most common format, or it might include other information and in otherformats, such as down-level domain info (ACME\joe.user) or email / UPN (joe.user@acme-inc.com).Distinguished Name: For LDAP Security Providers, the provider often populates the Distinguished Name of the user in additionto the username. The Distinguished Name includes domain information which is extracted by the integration and used to helpidentify the matching account in the password vault. An example DN is: uid joe.user,ou HelpDesk,dc acme-inc,dc com.Jump Item InformationThe fields collected in this section simulate the information that is sent to the ECM about the endpoint or Jump Item to which the consoleuser may connect.lJump Item Type: Because different Jump Items result in different pieces of information being sent to the ECM, as well as how theECM may query the password vault for applicable credentials, it is important to identify the type of Jump Item you wish to simulateas part of the test process.Note: The Jump Client type should be used to simulate Remote Jump and Local Jump items as well.SALES: www.beyondtrust.com/contactSUPPORT: www.beyondtrust.com/supportDOCUMENTATION: www.beyondtrust.com/docs 2003-2022 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, ordepository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.18TC: 5/27/2022

REMOTE SUPPORTDELINEA SECRET SERVER INTEGRATIONllllHostname / IP Address: For most types of Jump Items, the primary piece of information used to find credentials in the passwordvault is the endpoint's hostname or IP address.Website URL: For Web Jump items, rather than a hostname, the ECM is provided with the URL to which the item points. This fieldvalidates that the supplied string appears to be an actual URL.Additional IP Address: For Jump Client items, in addition to the machine's name, the installed client also makes the machine'spublic and private IP addresses available to the ECM. Some integrations use this information to query for credentials in addition toor even instead of those which match the hostname value.Application Name: For testing credential retrieval for injection into an application via an RDP SecureApp item, the ECM isprovided with both a value to identify the endpoint (Hostname / IP Address) and one to identify the specific application. Therequired value for Application Name may vary across integrations. The integration specific installation guides should contain moreinformation on possible values.Test ResultsIf the test fails for any reason, error information is displayed to assist indiagnosing the cause of the failure. In most cases these errors are handledand then assigned a type, such as an authentication-related error, and thendisplayed with the inputs as well as any specific error messages. However,there may still be some instances where a particular error might not beanticipated, so the information is displayed in a more raw form.Note: It's important to note that, either way, the same informationis included in the Configurator.log, along with more detail as toexactly what point in the execution the failure occurred.It's possible that the test succeeds in that it doesn't encounter any errorsand yet it doesn't return any credentials. Because this is a perfectly validresult, it is not treated as an error.In either case, if the test succeeds but the results do not match what is expected, it's important to make note of the inputs which led tothose results and verify permissions and access to credentials within the password vault.When the search does yield one or more matching credentials, the testdoes allow for one additional level of verification by allowing a tester toretrieve a specific credential as would occur if it were selected for injectionwithin the console. The tester simply clicks the Retrieve Credential buttonin the right column of the results list, and the integration then attempts toretrieve that credential on behalf of the supplied user.SALES: www.beyondtrust.com/contactSUPPORT: www.beyondtrust.com/supportDOCUMENTATION: www.beyondtrust.com/docs 2003-2022 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, ordepository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.19TC: 5/27/2022

REMOTE SUPPORTDELINEA SECRET SERVER INTEGRATIONThe test displays the result of the attempt to retrieve the credential, but forsecurity reasons no password is ever displayed in clear text.Note: Only credentials are retrieved; no actual passwords are retrieved or displayed. The settings used for the test are theones currently entered on the screen, not necessarily what is saved.IMPORTANT!Access to individual Secret Server user secrets is handled by a delegated trust feature built into Secret Server. This means that auser can grant access to their secrets to an API user. The first time a user attempts to access an endpoint via the BeyondTrustrepresentative console, a request for this access is generated, and an email is sent to the user. The user can either approve therequest, granting API user access to their credentials for future sessions, or they can deny the request. This access can be revokedby the user at any time. If for some reason the email is not received, the page to manage this access is available to all Secret Serverusers under Tools Manage Applications.When using the Test Settings button to test the retrieval of secrets for a user who has NOT approved access for the API account, theresulting dialog for the test is similar to the screen shot below.The Configurator.log should indicate that authentication was successful but that permission to access that user's secrets is pendingapproval.SALES: www.beyondtrust.com/contactSUPPORT: www.beyondtrust.com/supportDOCUMENTATION: www.beyondtrust.com/docs 2003-2022 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, ordepository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.20TC: 5/27/2022

REMOTE SUPPORTDELINEA SECRET SERVER INTEGRATIONClear Token CacheTo avoid excessive authentication calls to Delinea, the plugin caches (in an encrypted form) authentication tokens for users as theyattempt to retrieve secrets through the integration. Subsequent calls use the cached token until it expires. At that point, a newauthentication token is retrieved and cached. The Clear Token Cache button allows an admin to clear all cached authentication tokens ifsuch action becomes necessary for maintenance, testing, etc.SALES: www.beyondtrust.com/contactSUPPORT: www.beyondtrust.com/supportDOCUMENTATION: www.beyondtrust.com/docs 2003-2022 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, ordepository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.21TC: 5/27/2022

Configure Delinea Secret Server for Integration with BeyondTrust Remote Support 7 Create API Account 8 Enable Web Services 9 Configure BeyondTrust Remote Support for Integration with Delinea Secret Server 10 Create an OAuth API Account 11 Allow ECM Connections 12 Remote Support 20.2 and later 12