The privileged accounts that are set up on the following applications/ database can be managed through Privileged Account Manager. To manage those accounts, you must customize the sample script and add it to the Privileged Account Manager rule.
Following are the tested applications on which you can reset the password of the accounts that are existing for those applications:
IMPORTANT:Privileged Account Manager server must have Java 1.6 or higher for password reset to work on the following applications:
SAP
VMWare ESXi
eDirectory
NetIQ eDirectory is a list of objects that represent network resources, such as network users, servers, printers, print queues, and applications.You can enable password check-out feature to access the eDirectory server.
To enable credential checkout feature for eDirectory, you can add the rules by using the eDirectory policy template.
Active Directory
Active Directory is a directory service that authenticates and authorizes all users and computers in a Windows domain type network. It assigns and enforces security policies for all computers and installs, or updates software.You can enable password check-out feature to access the Active Directory server.
To enable credential checkout feature for Active Directory, you can add the rules by using the Active Directory policy template.
System Applications Products
System Applications Products (SAP) is an Enterprise Resource Planning System (ERP). You can enable the password check-out feature to access the SAP application.
To connect Privileged Account Manager with the Systems, Applications, and Products (SAP) application, ensure that you download the following files on the Privileged Account Manager server:
SAP Java connector (JCO)
You can download the JCO from the SAP Connectors site
The following files must be downloaded from the SAP Service Marketplace Web site to the location /opt/netiq/npum/service/local/cmdctrl/lib/ (for Linux) and c:\Program Files\npum\opt\netiq\npum\service\local\cmdctrl\lib (for Windows):
sapjco3.jar
(For Linux) libsapjco3.so
(For Windows) sapjco3.dll
NOTE:The download is free to any SAP software customer or development partner, but you are required to log in to the mentioned website.
To enable credential checkout feature for SAP, you can add the rules by using the SAP policy template.
VMware ESXi
The VMware ESXi is a type-1 hypervisor that is used for the hardware virtualization. You can enable password check-out feature to access the ESXi server.
Privileged Account Manager bundles the VMWare Infrastructure Java API to communicate with VMware ESXi server. The default location to VMWare Infrastructure Java API is /opt/netiq/npum/service/local/cmdctrl/lib/ (for Linux) and c:\Program Files\npum\opt\netiq\npum\service\local\cmdctrl\lib (for Windows).
To enable credential checkout on ESXi, you can add the rules by using the ESX policy template.
Local Accounts on Linux
Privileged Account Manager supports Credential Checkout feature for local user accounts on any Linux Operating System running SSH.
Local Accounts on Unix
Privileged Account Manager supports Credential Checkout feature for local user accounts on AIX Operating System.
Prerequisite
In AIX machine, configure the following:
Specify AcceptEnv LC_ALL in the sshd_config file.
Restart sshd service.
Local Accounts on Windows
Prerequisite
For RHEL 8 (64-bit) and RHEL 7 (64 bit), install the redhat-lsb-core package.
For RHEL 8 (64-bit) and SLES 15 (64-bit), install the lsb-release package.
On Windows Manager:
Ensure that the Windows Remote Management (WinRM) service is running on Windows. To start winrm service, run the following command:
Enable-PSRemoting –force
Add the target machine, where the password must be changed, to the WinRM trusted host. To add all servers as trusted host, run the following command:
winrm set winrm/config/client '@{TrustedHosts="*"}'
Set the PowerShell execution policy to Remotesigned using the following command:
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned
On Linux Manager:
Install the taskmanager package.
On Target Machine:
Ensure the following is done:
Powershell 2.0 or later must be installed in all the windows target machines as Privileged Account Manager uses PowerShell scripts to change password.
Windows Remote Management (WinRM) service must be running on the Windows machine. To start WinRM service, use the command:
Enable-PSRemoting –force
IP address of the task manager must be added to the trusted host of the target machine. To add trusted host, use the command:
winrm set winrm/config/client '@{TrustedHosts="x.x.x.x"}'
Privileged Account Manager supports Credential Checkout feature for local user accounts on Window Operating System.
The credential checkout feature can be customized for the applications such as Salesforce, and so on.
To enable credential checkout for applications such as LDAP, Active Directory, SAP, ESXi you can import the respective policy template. When you import the policy template, all the components required for configuring a credential checkout, such as resource, and rule are added with default values. You must customize these according to your requirement.
To enable credential checkout for application whose policy template is not available, you need to add the application server as a resource in the credential vault and add a rule for credential checkout. For information about adding a resource, see contextual help. For information about adding a rule, see Adding a Rule.