Central Credential Provider operations

This topic provides input and output XML elements, and sample XML requests and responses for the operation in the Central Credential Provider folder. 

When you use a context item as an input for an adapter request, you must enclose the adapter request in the <request-data> elements. However, when you create a static request, <request-data> is not required and the adapter request starts with the <cyberark-adapter-request> element.

Get Password

The Get Password operation retrieves the password, in an encrypted format, from the CyberArk Central Credential Provider. 

The Get Password operation is based on the agent less Application Access Manager (AAM) method, which ensures that the adapter can retrieve the passwords securely using an Application ID, and query parameters that match your requirement. With accurate authorization, the adapter uses API calls (REST or SOAP) to get password. 

The agent less AAM method ensures that privileged credentials from the CyberArk vault are retrieved in a secured format. These credentials can be used to access service accounts, Web services, databases, and so on instead of storing the credentials within the application itself (either inside a configuration file or in a database). 

The response contains the password in the Content key in the JSON body. Password retrieved from the API call is in a plain text, which the adapter converts to an encrypted format. This can be further used as a secure context item input in other workflows. 

To view information about the adapter module for Central Credential Provider operation, see Get-Password-workflow. 

Before you run the Get Password operation

• To run this operation, you must ensure that the Central Credential Provider component is installed and running in your environment. 
• Passwords are sensitive data and BMC recommends that you secure and mask them in the Grid Log and Process Files on the peers where these adapters are enabled and where the Development Studio is installed. To mask password data, do these steps:
  1. Navigate to the AO_HOME/config directory and edit the log_config.xml file.

  2. Locate the <log-config> section and add the <replacement-string> and mask pattern to replace secure data.
     For replacement string, provide any valid replacement string regex. For masking pattern, provide any valid regex to represent the data pattern.

     <log-config>
       <replacement-string>$1***MASKED***$2</replacement-string>
       <patterns>
         <mask-pattern><![CDATA[(\"Content\":\")[^&]*?\"(,\"|}</message-body>)]]></mask-pattern>
         <mask-pattern><![CDATA[(\"password\":)[^&]*(})]]></mask-pattern>
       </patterns>
     </log-config>

     For more information, see Hiding the display of secure data in log files.

Get Password adapter request elements

The following table describes the input XML elements for the adapter request.

The following figure shows a sample XML request to retrieve the password with AppID and Query.

The following figure shows another sample XML request to retrieve the password using AppID and query with KeyStore file (JKS format).

The following figure shows the adapter response for the request if the password is retrieved successfully.

The following figure shows the adapter response for the request if the password is not retrieved.

The following table describes the output elements for the operation.