Delinea Integration

The Delinea integration enables Axonius to securely pull privileged credentials from the Delinea Secret Server. The integration ensures that privileged credentials are secured in the Delinea Secret Server, rotated to meet company guidelines, and meet complexity requirements.

Description of Product Integration

Axonius uses the Secret Server REST API to fetch credentials from the Delinea Secret Server; refer to Delinea REST API Documentation.
Axonius authenticates to Delinea Secret Server using bearer token authentication.

The integration supports both an on-premise Delinea Secret Server and a cloud instance of Delinea Secret Server.

The credentials are only fetched by Axonius when:

• Creating a new adapter connection
• Updating an existing adapter connection
• Running an enforcement set
• Fetching asset information for adapters during discovery cycles

Axonius does not store the credentials anywhere and deletes any trace of credentials.

To enable fetching credentials from your Delinea Secret Server, you need to:

1. Install and configure Delinea Secret Server or use the Cloud instance of Delinea Secret Server.
2. Enable and configure the External Password Managers - Enterprise Password Management Settings in Axonius.
3. Configure adapter connection credentials to fetch passwords from Delinea Secret Server.

Enable Delinea Integration

1. Toggle on Delinea Secret Server.

2. Specify the following parameters:

   • Delinea Secret Server URL (required)
     • On-premise - Use the format: https://<hostname>/SecretServer (for example: https://demo-server/SecretServer)
     • Cloud - Use the format: https://<tenant>.secretservercloud.com (for example: https://mycompany.secretservercloud.com)
   • User name and Password (required) - The credentials of a local Delinea user. The required permissions depend on the state of the 'hide launcher password' security setting:
     • If 'hide launcher password' is activated, the user must be an Owner or Editor of the secret to access the real password and properly populate the vault with secrets. Otherwise, the password will display as Not Valid For Display.
     • If the setting is not activated, a User with Viewer (read-only) permission is sufficient.

• Port (optional, default: 443) - If specified, this port will be used for the connection. Otherwise, the system defaults to 443 for https URLs or if http/https not supplied in URL, and 80 for http URL.
• Verify SSL (required, default: false) - Select whether to verify the SSL certificate offered by the value supplied in Delinea Secret Server URL. For more details, see SSL Trust & CA Settings.
• API Version (default: V10) - Select the API version to use.
• Use Oauth2 - This option is relevant for API V10. Enable this option to use the Delinea Secret Server OAuth 2.0 endpoints for authentication instead of a username and password. When enabled, enter your client_id and client_secret in the respective User name and Password fields.
• Certificate File - Upload a certificate file, if needed.
• Gateway Name - Select the gateway through which to connect to the Delinea Secret Server if required.

Working with Delinea

Once the Delinea integration is enabled in Axonius, a new Delinea Secret Server icon appears in all password fields when configuring adapters or Enforcement Sets, allowing you to enter a password manually or fetch the secret from Delinea Secret Server.

To fetch the password from Delinea Secret Server:

1. In a password field, click the Delinea icon. If you have configured more than one password manager, click the vault icon and select Delinea Secret Server from the drop-down. A Delinea Secret Server dialog opens.

   

2. In the dialog, specify the following parameters:

   1. Secret ID (required) - The secret ID for the password. This secret ID represents a unique identifier for the secret in Delinea.
   2. Field Name (required, default: Password) - The field name for the password. This is case sensitive.

3. Click Fetch.

   • If the fetch is successful, a green indication is displayed next to the Delinea icon.

     

   • If the fetch is unsuccessful, a red indication is displayed next to the Delinea icon. Hovering over the Delinea Secret Server icon shows the error.