rConfigdelinea.com ↗
rConfigBack up devices with passwords from Delinea Secret Server.
rConfig reads each device's username, password and enable password from a Delinea Secret Server secret at connection time, for every backup and operation.
For Secret Server self-hosted and Secret Server Cloud, formerly Thycotic. rConfig does not store device passwords for vault-backed credential sets.
Delinea Secret Server support is new in rConfig V8.4.2.
Early access. This integration is built from Delinea's published API documentation and follows its documented request and response formats. Environments vary, so we’d welcome your feedback as you roll it out. If anything behaves differently in your deployment, contact rConfig support and we’ll work through it with you.
Secret Server holds the passwords. rConfig keeps the configs.
If your network device accounts already live in Delinea Secret Server, rConfig can use them where they are. A credential set points at one secret by its ID, and rConfig reads that secret each time it connects to a device.
rConfig does not keep its own copy of the device passwords, so Secret Server stays the one place they are managed. The configurations rConfig backs up still land in a versioned archive, ready to compare and restore.
How rConfig reads from Secret Server.
Four steps, from an API user to a backup that uses a Secret Server password.
Connect
In Platform > Integrations, switch Delinea on. Enter the Secret Server address and a dedicated API user, with an AD domain if the user needs one.Test
Test Connection calls the Secret Server version endpoint, using the values in the form before you save them.Map
Create a credential set tied to Delinea. Its vault endpoint is the numeric secret ID from the secret's URL. Fields match by slug or field name: username, password and enable-password by default.Back up
Devices use the credential set as normal. rConfig signs in with an OAuth2 password grant, reads the secret at connection time and uses it for that backup or operation.
One way to work with every vault.
These work the same for HashiCorp Vault, Idira (CyberArk) and Delinea Secret Server.
No device passwords in rConfig
Username, password and enable password come from Delinea Secret Server at connection time, for each backup or operation. rConfig does not store device passwords for vault-backed credential sets.
Several vaults at once
HashiCorp Vault, Idira (CyberArk) and Delinea Secret Server can all be switched on together. Each credential set is tied to one vault.
Map the fields per credential set
Choose which vault keys become the username, the password and the enable password, one credential set at a time.
Test before you save
Each vault has its own switch, address and sign-in settings under Platform > Integrations. Test Connection runs against the values in the form before you save them.
Vault secrets stay encrypted
Tokens, API passwords and private keys you enter are stored encrypted and never sent back to the browser.
Mixed estates and .env fallback
Vault-backed and regular credential sets work side by side. Existing .env vault settings keep working until you save settings in the UI.
What you need, and what it won’t do.
Secrets that require checkout, a comment or approval are not supported. Keep the secrets rConfig reads free of those settings.
The Delinea Secret Server integration, at a glance.
The details your security team will ask about. Share this section before the demo.
- rConfig version
- V8.4.2 and later
- Licence
- Included in V8 Pro Starter and every plan above it. See the plan comparison
- Status
- Early access, built from Delinea's published API documentation
- Secret Server editions
- Secret Server self-hosted and Secret Server Cloud
- Authentication
- OAuth2 password grant with a dedicated API user, optional AD domain
- Token handling
- Cached encrypted, refreshed when Secret Server returns 401
- Vault endpoint
- The numeric secret ID, taken from the secret's URL
- Field matching
- By slug or field name; defaults username, password and enable-password
- When credentials are read
- At connection time, for each backup or operation
- Device credentials
- Not cached, and not stored for vault-backed credential sets
- Vault secrets
- Stored encrypted, never sent back to the browser
- Settings
- Platform > Integrations: on/off switch, address and authentication, Test Connection on unsaved values
- Test Connection
- Calls the Secret Server version endpoint
- Other vaults
- HashiCorp Vault and Idira (CyberArk) can be on at the same time
- .env settings
- Keep working until settings are saved in the UI
- Not supported
- Secrets that require checkout, a comment or approval; API users with MFA on
- Documentation
- Delinea Secret Server docs, Key vault overview
Delinea, Secret Server and Thycotic are trademarks of their owner, Delinea. This integration is not endorsed by Delinea. See delinea.com.
Delinea Secret Server credentials: common questions
What network and security teams ask before they connect rConfig to Secret Server. If yours isn't here, ask it on the demo call.
How does rConfig get credentials from Secret Server?
At connection time, rConfig signs in to Secret Server with a dedicated API user and reads the secret named in the credential set. It uses that secret's username, password and enable password for the backup or operation.
Which Secret Server editions work?
Secret Server self-hosted and Secret Server Cloud.
Is this the same product as Thycotic Secret Server?
Yes. Delinea Secret Server was formerly Thycotic Secret Server.
How does rConfig sign in?
With an OAuth2 password grant for a dedicated API user, with an optional AD domain. rConfig caches the token encrypted and refreshes it when Secret Server returns 401.
Does rConfig cache or store device passwords?
No. The device credentials are read for each backup or operation and are not cached. rConfig does not store device passwords for vault-backed credential sets.
What goes in a credential set?
The numeric secret ID, which you can take from the secret's URL in Secret Server. Fields are matched by slug or field name. The defaults are username, password and enable-password, and you can change the mapping per credential set.
Are there secrets rConfig can't read?
Yes. Secrets that require checkout, a comment or approval are not supported. The API user should also have MFA turned off.
Can I test the connection before I save it?
Yes. Test Connection calls the Secret Server version endpoint with the values in the form, before you save them.
Can I use Delinea alongside HashiCorp Vault or Idira (CyberArk)?
Yes. Several vaults can be on at once. Each credential set is tied to one vault, and vault-backed and regular credential sets work side by side.
What happens to my existing .env vault settings?
They keep working as a fallback until you save vault settings in the rConfig UI.
Do I need a separate licence?
No. Key vault integrations are included in V8 Pro Starter and every plan above it.
What does early access mean?
The integration is built from Delinea's published API documentation and follows its documented request and response formats. Environments vary, so we'd welcome your feedback as you roll it out. If anything behaves differently in your deployment, contact rConfig support and we'll work through it with you.
See rConfig back up a device with a Secret Server password.
Book 30 minutes with an rConfig engineer. We'll walk through the Delinea settings, a credential set and a backup that reads its password from Secret Server.