Is it possible to onboard VA OS user on PAM?

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi Everyone ,

This is to check if you have faced a similar requirement where it’s required to onboard/lodge the OS user for VAs (sailpoint) into a PAM solution.

Thanks,
Shailee

2

What requirements are you looking at? Just storing the credential? Credential rotation and possibly verification?

You will not be able to implement a use case that would require installing additional agents or software on the VAs.

1 Like
3

Hi Alex,

Thanks for the response. Yes, requirement is to store, rotate and verify the credentials from PAM.

Regards,
Shailee

4

What PAM solution are you working with?

5

We are using CyberArk

6

In this case yes you can do this - you can configure CyberArk to SSH into the VA and use the passwd command to change it (which the VAs support).

2 Likes
7

Hi @adunker ,

Yes I understand that. However, in my understanding it is not possible to create an addition OS user on VAs. In our case, it is the minimum requirement to have an additional reconciliation account for SSH to rotate “sailpoint” user’s password to ensure the actual “sailpoint” user account isn’t lost in the process.

Thanks,
Shailee

8

@shaileeM - correct the VA architecture as a managed image would prevent you form being able to fulfill this requirement.

9

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.