rConfigpaloaltonetworks.com ↗
rConfigIdira (CyberArk) keeps the device passwords. rConfig asks for them.
rConfig pulls each device's username, password and enable password from Palo Alto Networks Idira (CyberArk) through the Central Credential Provider (CCP) REST API. It asks at connection time, for every backup and operation.
rConfig does not store device passwords for vault-backed credential sets, and no agent is installed on the rConfig server.
Idira (CyberArk) support is new in rConfig V8.4.2.
Early access. This integration is built from Palo Alto Networks' published API documentation and follows its documented request and response formats. Environments vary, so we’d welcome your feedback as you roll it out. If anything behaves differently in your deployment, contact rConfig support and we’ll work through it with you.
Idira holds the passwords. rConfig keeps the configs.
If your privileged access team already keeps network device accounts in Idira (CyberArk), rConfig can read them from there. A credential set points at a safe and an object, and rConfig fetches the account each time it connects to a device.
rConfig does not keep its own copy of those passwords, so the vault stays the one place they are managed. The configurations rConfig backs up still land in a versioned archive, ready to compare and restore.
Coming from CyberArk? Read what the move to Idira means for your CCP setup.
How rConfig reads from Idira (CyberArk).
Four steps, from the CCP address to a backup that uses a vault password.
Connect
In Platform > Integrations, switch Idira (CyberArk) on and enter the CCP address and the Application ID. If CCP asks for a client certificate, paste the certificate, private key and CA bundle as PEM.Test
Test Connection runs against the values in the form before you save them. Add a test query to check a safe. rConfig shows only the key names that come back, never the values.Map
Create a credential set tied to Idira. Its vault endpoint is a CCP query, such asSafe=Network&Object=core-switches. By default UserName becomes the username and Content the password. Name an account property for the enable password.Back up
Devices use the credential set as normal. At each backup or operation, rConfig asks CCP for the account with your Application ID, Safe and Object, and uses it for that connection.
One way to work with every vault.
These work the same for HashiCorp Vault, Idira (CyberArk) and Delinea Secret Server.
No device passwords in rConfig
Username, password and enable password come from Idira (CyberArk) at connection time, for each backup or operation. rConfig does not store device passwords for vault-backed credential sets.
Several vaults at once
HashiCorp Vault, Idira (CyberArk) and Delinea Secret Server can all be switched on together. Each credential set is tied to one vault.
Map the fields per credential set
Choose which vault keys become the username, the password and the enable password, one credential set at a time.
Test before you save
Each vault has its own switch, address and sign-in settings under Platform > Integrations. Test Connection runs against the values in the form before you save them.
Vault secrets stay encrypted
Tokens, API passwords and private keys you enter are stored encrypted and never sent back to the browser.
Mixed estates and .env fallback
Vault-backed and regular credential sets work side by side. Existing .env vault settings keep working until you save settings in the UI.
Works with the CCP you already run.
rConfig uses the Central Credential Provider REST API only. Conjur, the agent-based Credential Provider and the SDKs are out of scope.
The Idira (CyberArk) integration, at a glance.
The details your security team will ask about. Share this section before the demo.
- rConfig version
- V8.4.2 and later
- Licence
- Included in V8 Pro Starter and every plan above it. See the plan comparison
- Status
- Early access, built from Palo Alto Networks' published CCP API documentation
- Deployments
- Self-hosted PAM (Privilege Vault) and Privilege Cloud, where the Central Credential Provider is exposed
- Interface
- CCP REST API:
GET {CCP address}/AIMWebService/api/Accounts - Query
- AppID, Safe and Object
- Authentication
- Application ID (allowed machines), optional client certificate for mutual TLS
- Certificates
- Client certificate, private key and CA bundle, pasted as PEM
- Vault endpoint
- A CCP query per credential set, for example
Safe=Network&Object=core-switches - Default mapping
- UserName to username, Content to password; enable password from a named account property
- When credentials are read
- At connection time, for each backup or operation
- Device passwords in rConfig
- Not stored for vault-backed credential sets
- Vault secrets
- Stored encrypted, never sent back to the browser
- Settings
- Platform > Integrations: on/off switch, address and authentication, Test Connection on unsaved values
- Test Connection
- Optional test query that shows key names only, never values
- Other vaults
- HashiCorp Vault and Delinea Secret Server can be on at the same time
- .env settings
- Keep working until settings are saved in the UI
- Agent on the rConfig server
- None
- Out of scope
- Conjur, the agent-based Credential Provider, SDKs
- Documentation
- Idira (CyberArk) docs, Key vault overview
Palo Alto Networks, Idira and CyberArk are trademarks of their owners. This integration is not endorsed by Palo Alto Networks. See paloaltonetworks.com.
Idira (CyberArk) credentials: common questions
What network and security teams ask before they connect rConfig to Idira (CyberArk). If yours isn't here, ask it on the demo call.
How does rConfig get credentials from Idira (CyberArk)?
rConfig calls the Central Credential Provider (CCP) REST API at connection time: GET {CCP address}/AIMWebService/api/Accounts, with your Application ID and the credential set's Safe and Object. It uses the account that comes back for that backup or operation.
Which Idira (CyberArk) deployments work?
Self-hosted PAM (Privilege Vault) and Privilege Cloud deployments that expose the Central Credential Provider.
Do I install anything on the rConfig server?
No. rConfig talks to CCP over its REST API, so no Credential Provider agent is installed on the rConfig server.
How does rConfig authenticate to CCP?
With an Application ID, checked against its allowed machines, and optionally a client certificate for mutual TLS. You paste the certificate, private key and CA bundle into the rConfig UI as PEM.
What goes in a credential set?
A CCP query as the vault endpoint, for example Safe=Network&Object=core-switches. By default UserName maps to the username and Content to the password. The enable password comes from an account property you name, and you can change the mapping per credential set.
Does rConfig store device passwords?
No. For vault-backed credential sets, rConfig pulls the username, password and enable password from the vault for each backup or operation and does not store device passwords.
Can I test the connection before I save it?
Yes. Test Connection runs against the values in the form before you save. It can also run a test query, and it shows only the key names that come back, never the values.
Can I use Idira alongside HashiCorp Vault or Delinea?
Yes. Several vaults can be on at once. Each credential set is tied to one vault, and vault-backed and regular credential sets work side by side.
Are Conjur or the agent-based Credential Provider supported?
No. The integration uses the Central Credential Provider REST API. Conjur, the agent-based Credential Provider and the SDKs are out of scope.
We run CyberArk. Is this the same integration?
Yes. CyberArk is now part of Palo Alto Networks and sold as Idira. The Central Credential Provider kept its name and API, so the integration works with existing CyberArk CCP deployments and with Idira.
What happens to my existing .env vault settings?
They keep working as a fallback until you save vault settings in the rConfig UI.
Do I need a separate licence?
No. Key vault integrations are included in V8 Pro Starter and every plan above it.
What does early access mean?
The integration is built from Palo Alto Networks' published API documentation and follows its documented request and response formats. Environments vary, so we'd welcome your feedback as you roll it out. If anything behaves differently in your deployment, contact rConfig support and we'll work through it with you.
See rConfig back up a device with an Idira password.
Book 30 minutes with an rConfig engineer. We'll walk through the Idira (CyberArk) settings, a credential set and a backup that reads its password from the vault.