Configure Cyberark Conjur Integration

Last modified on September 1, 2022

Overview

Conjur is a secrets management platform that integrates with popular tools to provide data encryption, identity-based authorizations for humans and machines, and role-based access control for secrets like passwords, SSH keys, and web services. This guide walks you through the steps to integrate Conjur with strongDM.

Secret store integrations allow you to use your existing third-party secret stores with strongDM. Your credentials are saved in a tool you control. Those credentials are never transmitted to strongDM in any form. To learn more about secret store integrations and their usage, read the Secret Stores Reference.

Prerequisites

The following items are required to successfully integrate Conjur with strongDM:

Configure Conjure

Complete these steps to configure your Conjur instance and to set up your integrations with strongDM:

  1. Install Conjure, set up an account, and initialize an admin user.
  2. Define a policy that determines your Conjur entities and describes relationships between them. An entity can be a policy, a host, an application (such as strongDM), a user, a layer, a group, or a variable.
  3. Add secret stores for specific applications, such as strongDM, to be able to authenticate to Conjur.

Step 1: Install your environment

For help setting up your Conjur environment, follow Conjur’s Quick Start guide or check the conjur-quickstart repository. During this setup, you can use Docker to install and start Conjur, generate a master key to encrypt the database, and create an admin account for your Conjur instance.

Step 2: Define a policy

After you set up your Conjur environment, define a policy that determines what users or applications have access to certain credentials. For example, when creating your strongDM resources, you can define a Postgres policy similar to the following sample YAML file. To learn more about policy statements, read the Conjur Policy documentation.

- !policy
  id: Postgres
  body:
    # Define a non-human identity that represents an application, as well as username/password secrets
  - !host strongDM
  - !variable dbUser
  - !variable dbPass
  - !permit
    # Give permissions to the non-human identity to read, update, and fetch the password
    role: !host strongDM
    privileges: [read, update, execute]
    resource: !variable dbPass
  - !permit
    # Give permissions to the non-human identity to read, update, and fetch the username
    role: !host strongDM
    privileges: [read, update, execute]
    resource: !variable dbUser

When you submit the policy, Conjur generates API keys and stores them in the location you specified. You receive a JSON response containing information about created roles, such as account IDs, API keys, and other metadata. In our example, the policy defines an API key for an application like strongDM. Use the generated API keys to configure your gateway or relay and to authenticate the application to Conjur.

Loaded policy 'root'
{
  "created_roles": {
    "myConjurAccount:host:Postgres/strongDM": {
      "id": "myConjurAccount:host:Postgres/strongDM",
      "api_key": "30vdp11zbq1622anzsea2aws45d3kzmtfy1jxg2y4jdy078fvb0a1"
    }
  },
  "version": 1
}

Step 3: Store a secret

Once you define a policy, generate and store values for your application’s secrets. This action gives your application access to Conjur. In the following steps, we continue with the sample policy defined earlier.

  1. Log in to your Conjur instance with the API key for your host account. Make sure to replace the colon with /:

    docker-compose exec client conjur authn login -u host/Postgres/strongDM
    
  2. Generate a 12-hex character value and store it in a variable:

    secretVal=$(openssl rand -hex 12 | tr -d '\r\n')
    
  3. Store secret values for the dbUser and dbPass variables in our sample policy. For dbUser, add the value of the username instead of a random value:

    docker-compose exec client conjur variable values add Postgres/dbUser <USERNAME>
    

    Then set a policy predefined variable named Postgres/dbPass with a randomly generated secret:

    docker-compose exec client conjur variable values add Postgres/dbPass ${secretVal}
    

    Paths to these credentials provide values when connnecting a strongDM resource to work with Conjur. In our example, we can later set the Username (path) value to Postgres/dbUser and the Password (path) value to Postgres/dbPass.

    Add Datasource Cyberark Conjur
    Add Datasource Cyberark Conjur

    For more information about storing secrets in variables, see the Store a Secret in Conjur reference.

Configure Your Gateway or Relay

To allow communication with your Conjur instance, strongDM needs to know what credentials to use. For this information, refer to the JSON response you received when defining your Conjur policy.

Loaded policy 'root'
{
  "created_roles": {
    "myConjurAccount:host:Postgres/strongDM": {
      "id": "myConjurAccount:host:Postgres/strongDM",
      "api_key": "30vdp11zbq1622anzsea2aws45d3kzmtfy1jxg2y4jdy078fvb0a1"
    }
  },
  "version": 1
}

Use this metadata to configure your gateway or relay environment. Add the following properties as environment variables on your relay or gateway.

PropertyDescription
CONJUR_ACCOUNTThe Conjur account the secrets are registered to (for example, myConjurAccount in our JSON sample)
CONJUR_AUTHN_LOGINThe individual role accessing this secret (for example, host/Postgres/strongDM in our JSON sample); note that the colon is replaced with /
CONJUR_AUTHN_API_KEYThe API key for the given username (for example, 30vdp11zbq1622anzs... in our JSON sample)

Create the Secret Store in strongDM

After completing the steps in the previous sections, create the Conjur secret store in the strongDM Admin UI.

  1. Log in to the strongDM Admin UI.

  2. Go to Network > Secret Stores.

  3. Click Add secret store.

  4. Add a Name and select Cyberark Conjur from the Type dropdown. Both fields are required.

  5. When the Application URL field appears, add the root URL for your Conjur instance. This value serves as the base URL for the Username (path) and Password (path) fields when you connect a resource.

    Add a Cyberark Conjur Secret Store
    Add a Cyberark Conjur Secret Store
  6. Click Create secret store to save. If you have configured the relay or gateway server correctly for Conjur secret store access and authorization, you can see the green online indicator.

Connect to a strongDM Resource

You can now use the Cyberark Conjur secret store when connecting to different strongDM resources.

  1. From the Admin UI, go to Infrastructure > Datasources.

  2. Click Add datasource.

  3. Enter the different properties for your database resource.

  4. From the Secret Store drop-down, select the Conjur secret store option you created in the previous section.

    Add a Cyberark Conjur Secret Store
    Add a Cyberark Conjur Secret Store
  5. In the Username (path) field, add the path to retrieve the username and authenticate the application with Conjur. In our example, the path is Postgres/dbUser.

  6. In the Password (path) field, add the path to retrieve the password and authenticate the application with Conjur. In our example, the path is Postgres/dbPass.

  7. When all required fields are complete, click Create. When the resource is ready, the Health icon indicates a positive, green status.

Top