Overview
This article outlines how to integrate BeyondTrust Password Safe as a Credential Provider in SailPoint Identity Security Cloud (ISC) to support secure credential usage within source configurations and workflows.
This approach enables dynamic credential retrieval while eliminating hardcoded secrets and preserving existing provisioning logic.
By externalizing credential management to BeyondTrust Password Safe, organizations can centralize privileged credential management, improve security, and enable scalable automation through SailPoint Identity Security Cloud.
Documentation Links
Important Distinction
Important: This integration uses BeyondTrust Password Safe and not
BeyondTrust Secrets Safe.
The credential provider implementation described in this article relies on
Password Safe Managed Systems and Managed Accounts.
The secret path syntax uses managed system and managed account values from Password Safe and is not applicable to Secrets Safe.
Key Benefits
- Centralized and secure credential management
- Elimination of hardcoded secrets in workflows and source configurations
- Reduced operational risk through preservation of existing provisioning logic
- Reusable and scalable automation patterns
- Improved credential auditing and lifecycle management
- Support for Privileged Task Automation (PTA) use cases
Business Use Case
In our environment, we needed to move Active Directory users between Organizational Units (OUs) using SailPoint workflows.
An existing Before Provisioning Rule already handled production provisioning and had proven stable over time.
Modifying this rule would have introduced unnecessary risk to end users and patient-facing systems.
To mitigate this risk, we:
- Leveraged ISC Workflows
- Utilized Privileged Task Automation (PTA)
- Introduced BeyondTrust Password Safe as a secure credential source
- Avoided changes to existing production provisioning logic
This allowed us to deliver the new functionality while minimizing the impact to existing processes.
Disclaimer
This document provides guidance based on lessons learned during implementation. All examples use redacted or sample values.
This article was reviewed and refined with the assistance of AI to improve clarity, grammar, spelling, and overall organization. All technical content, configurations, and implementation details are based on real-world experience within the author’s environment.
Security Considerations
When implementing BeyondTrust Password Safe as a Credential Provider, follow these security best practices:
- Store all API credentials and secrets in a secure vault
- Never expose Client IDs or Client Secrets in source control repositories
- Apply least-privilege access principles
- Restrict API access by IP address ranges whenever possible
- Enable credential caching only when required
- Regularly rotate API credentials and service account passwords
- Audit credential usage through BeyondTrust Password Safe logging
- Review ISC activity logs for credential-related operations
- Limit managed account access to only the required systems and workflows
This approach helps maintain centralized, auditable, and compliant credential management.
Architecture Overview
Understanding the components involved can simplify troubleshooting and implementation.
Credential Provider Flow
Identity Security Cloud
|
V
Virtual Appliance Cluster
|
V
BeyondTrust Password Safe
|
V
Credential Retrieval
The configured Virtual Appliance (VA) Cluster is responsible for connectivity between ISC and BeyondTrust Password Safe.
When a credential is requested, ISC uses the Credential Provider configuration to retrieve the secret through the VA cluster.
Privileged Task Automation Flow
Workflow
|
V
Privileged Action Gateway (PAG)
|
V
Credential Provider
|
V
Target System
(Active Directory)
When executing a PTA action, the Privileged Action Gateway (PAG) retrieves the required credentials from the configured credential provider and performs the requested operation against the target system.
Requirements
BeyondTrust Password Safe
- Password Safe deployed and in Production state
- API access configured
- Managed systems configured
- Managed accounts configured
SailPoint Identity Security Cloud
- Credential Provider capability enabled
- Workflow capability enabled
- Privileged Task Automation configured
- Virtual Appliance cluster deployed and healthy
- Privileged Action Gateway configured (for PTA use cases)
BeyondTrust Password Safe Configuration
1. Create API Registration
Navigate to:
Configuration → API RegistrationsClick:
Create API RegistrationConfigure:
- API Access Policy
- Allowed IP ranges
- Other organizational requirements
2. Create an Application User
Navigate to:
Role Based Access → User Management → UsersClick:
Create New User → Add an Application UserRecord and securely store:
- Client ID
- Client Secret
The Client Secret is only displayed during creation and should be stored securely.
- The Client Secret can be reset if needed.
- Store the Client Secret in your organization's approved secrets management solution.
3. Configure Group Access
Navigate to:
Role Based Access → User Management → GroupsCreate a new group and assign the Application User.
Required Feature Permissions
Grant the group the following minimum permissions:
Credential Management → Read
Password Safe Account Management → Read
Password Safe System Management → Read
Managed Account Access Requirements
In addition to feature permissions, the managed account referenced by the secret path must:
- Be onboarded into Password Safe
- Be associated with a managed system
- Be accessible through the assigned Application User group
- Be included in one or more Smart Groups assigned to that group
- Support API retrieval
- Be configured according to organizational requestability requirements
Failure to meet these requirements may prevent credential retrieval even when API authentication succeeds.
ISC Credential Provider Configuration
1. Create Credential Provider
Navigate to:
Admin → Connections → Credential ProvidersClick:
New
Configure:
- Name
- Description
- Owner
- Virtual Appliance Cluster
Click Save.
2. Configure Connection Settings
Provide:
Host URL:
https://<Tenant>.ps.beyondtrustcloud.com
Client ID
Client Secret
Enable:
Credential CachingSave the configuration.
Active Directory Source Configuration
Navigate to:
Admin → Connections → SourcesOpen the desired Active Directory source.
Navigate to:
Domain SettingsChange the password configuration from:
Static Valueto:
Credential Path
Secret Path Format
secrets://<CredentialProviderName>/<SecretURL>
Where:
SecretURL =
systemName=<SystemName>&accountName=<AccountName>
URL Encoding Requirements
Important: Both the Credential Provider Name and SecretURL must be URL-encoded independently before constructing the final secret path.
| Character | Encoded Value |
|---|---|
| Space | %20 |
| @ | %40 |
| = | %3D |
| & | %26 |
| # | %23 |
Additionally:
- The Credential Provider name must exactly match the configured ISC Credential Provider name.
systemNameandaccountNameare reserved keywords.- Special characters should always be URL encoded before constructing the final secret path.
Example
Credential Provider:
BeyondTrust Password SafeManaged System:
Microsoft Entra IDManaged Account:
svc-admin@company.onmicrosoft.comConstruct:
systemName=Microsoft Entra ID&accountName=svc-admin@company.onmicrosoft.com
URL Encode:
systemName%3DMicrosoft%20Entra%20ID%26accountName%3Dsvc-admin%40company.onmicrosoft.com
Final Secret Path:
secrets://BeyondTrust%20Password%20Safe/systemName%3DMicrosoft%20Entra%20ID%26accountName%3Dsvc-admin%40company.onmicrosoft.com
Conclusion
Integrating BeyondTrust Password Safe as a Credential Provider in SailPoint Identity Security Cloud enables secure, centralized credential management while supporting dynamic credential retrieval within workflows and source configurations.
By externalizing privileged credentials from workflow definitions and source configurations, organizations can strengthen their security posture, reduce operational risk, and improve maintainability.
This approach allows teams to introduce new automation capabilities without modifying existing provisioning logic, preserving the stability of production systems while enabling scalable automation.
Although implementation requires coordination across ISC, BeyondTrust Password Safe, Virtual Appliance infrastructure, and Privileged Task Automation components, the resulting architecture provides a flexible and reusable framework for secure credential management.
This guide is based on lessons learned during implementation and is intended to serve as an end-to-end reference for teams implementing BeyondTrust Password Safe Credential Providers within SailPoint Identity Security Cloud.