You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: AAM Applications/README.md
+6-6Lines changed: 6 additions & 6 deletions
Original file line number
Diff line number
Diff line change
@@ -1,13 +1,13 @@
1
1
> **General**
2
-
> - These scripts Uses REST API and can support v9.10 of PVWA and up
3
-
> - The goal for these scripts is to allow easy Export and Import of applications including application authentications
4
-
> - In this example script you will find examples of Get applications, get speciifc applications authentication methods and creating applications with thier authentication methods
2
+
> - These scripts Uses REST API and can support v9.10 of PVWA and up.
3
+
> - The goal for these scripts is to allow easy Export and Import of applications including application authentications.
4
+
> - In this example script you will find examples of Get applications, get specific applications authentication methods and creating applications with their authentication methods.
5
5
6
6
# Export/Import Applications
7
7
In order to run the tool you need to run some simple commands in Powershell.
8
-
The Tool supports two modes: [*Import*](#import-command) and [*Export*](#export-command)
9
-
The export will be done to a CSV file that will contain all information, the import would know to create the applications from the same CSV file.
10
-
The CSV file can be adjusted if needed
8
+
The tool supports two modes: [*Import*](#import-command) and [*Export*](#export-command)
9
+
The export will be done to a CSV file that will contain all the information, the import will be able to create the applications from the same CSV file.
With the newer version of the REST API's (seen as 2nd gen in the CyberArk documentation), in order to be able to upload accounts that have custom platform properties (file categories) these need to be already enabled/set at the platform level of the platform that the accounts will be linked with. This is also relevant to be able to upload accounts that have linked 'login' and 'reconcile' accounts listed in the CSV file.
20
+
With the newer version of the REST APIs (seen as 2nd gen in the CyberArk documentation), in order to be able to upload accounts that have custom platform properties (file categories) these need to be already enabled/set at the platform level of the platform that the accounts will be linked with. This is also relevant to be able to upload accounts that have linked 'login' and 'reconcile' accounts listed in the CSV file.
21
21
22
-
When accounts are attempted to be onboarded that have custom platform properties listed in the relevant columns in the csv however have not been already added at the platform level, a meaningful error will be seen relating to the fact that the account property has not been account to the platform.
22
+
When there is an attempt to onboard accounts that have custom platform properties (listed in the relevant columns in the CSV) which have not been already added at the platform level; a meaningful error will be displayed, related to the fact that the account property has not been added to the platform.
23
23
24
24
There are six FC's that are required to be added to the platform if an account has a linked 'login' and 'reconcile' account set, three are for the linked 'login' account and three are for the linked 'reconcile' account. Further information on how to do this can be found in this CyberArk KB:
- Note that the URL needs to include 'PasswordVault', for example: "https://myPVWA.myDomain.com/PasswordVault"
34
-
- When working with PVWA behind a load balancer, note that the session must be defined as sticky session. Alternatively, work with a single node PVWA
34
+
- When working with PVWA behind a load balancer, note that the session must be defined as sticky session. Alternatively, work with a single node PVWA.
35
+
35
36
- LogonToken
36
-
- The logon token when using Privilege Cloud Shared Services (ISPSS)
37
-
- To generate Token See https://github.com/cyberark/epv-api-scripts/tree/main/Identity%20Authentication
37
+
- The logon token when using Privilege Cloud Shared Services (ISPSS).
38
+
- To generate Token see https://github.com/cyberark/epv-api-scripts/tree/main/Identity%20Authentication
39
+
38
40
- DisableSSLVerify
39
41
**(NOT RECOMMENDED)**
40
-
- In cases when you want to test the script on a PVWA environment that does not include a valid SSL certificate, you can use this parameter
42
+
- Disable the SSL verification.
43
+
- Use only if the PVWA environment doesn't include a valid SSL certificate.
44
+
41
45
- AuthType
42
46
- Authentication types for logon.
43
47
- Available values: _CyberArk, LDAP, RADIUS_
44
48
- Default value: _CyberArk_
49
+
45
50
- OTP
46
51
- In cases where RADIUS authentication is used and one-time-password is needed, use this parameter to enter the OTP value
52
+
47
53
- Create / Update / Delete
48
-
The supported actions for onboarding or offboarding of accounts
54
+
- The supported actions for onboarding or offboarding the accounts.
55
+
49
56
- CPM_NAME
50
-
- Sets the name of the CPM to be used. Defaults to PasswordManager
57
+
- Sets the name of the CPM to be used.
58
+
- Default: PasswordManager
59
+
51
60
- CsvPath
52
61
- The CSV Path for the accounts to be onboarded
62
+
53
63
- CsvDelimiter
54
64
- The CSV delimiter to be used.
55
65
- Available values: comma, tab
56
66
- Default value: _comma delimited_
67
+
57
68
- TemplateSafe
58
-
- The Template safe to copy properties from
59
-
- Using this parameter requires that the template safe exists
60
-
- The process will create any new safe according to the Template Safe including managing CPM and Safe Members
69
+
- The Template Safe to copy properties from.
70
+
- Using this parameter requires that the template Safe exists.
71
+
- The process will create any new safe according to the Template Safe including managing CPM and Safe Members.
72
+
61
73
- NoSafeCreation
62
-
- In case used, safes that do not exist will not be created
74
+
- Safes that don't already exist will not be created.
75
+
63
76
- DisableAutoUpdate
64
-
- By default, the script will automatically update itself to the latest version
65
-
- Using this switch will disable this ability and will keep the current version
77
+
- Disable the automatic update and keep the current version.
78
+
- Default: script will update itself to the latest version.
79
+
66
80
- CreateOnUpdate
67
-
- By default, the script will automatically not create new accounts when in update mode
68
-
- Using this switch will automatic create accounts that do not exist when running in update mode
81
+
- Enable the creation of non-existing accounts when running in [*Update*](#update-command) mode.
82
+
- Default: script will not create new accounts in [*Update*](#update-command) mode.
83
+
69
84
- WideAccountsSearch
70
-
- By default, the script will not search by account object name assuming WideAccountsSearch is set to "no"
71
-
- Using this switch when "WideAccountsSearch" is set to "Yes" to greatly increase search speeds
85
+
- If set to "Yes": greatly increase search speeds.
86
+
- Default: flag is set to "No". The script will not search by account object name.
87
+
72
88
- NarrowSearch
73
-
- By default, the script when "name" is populated searches are done by getting all accounts from a safe, then comparing names in PowerShell
74
-
- Using this switch will search the safe by username and address, then do compare of name in PowerShell
89
+
- Search the safe by "username" and "address", then do a comparison of "name" in PowerShell.
90
+
- Default: when "name" is populated, searches are done by getting all accounts from a Safe, then comparing names in PowerShell.
91
+
75
92
- ignoreAccountName
76
-
- By default, the script will automatically compare the account "name" when searching.
77
-
- Using this switch will ignore "name" when searching for accounts to update. Use this if account name could be different
93
+
- Ignores "name" when searching for accounts to update. Use this if account name could be different from the one in the Vault.
94
+
- Default: the script will compare the account "name" when searching.
95
+
78
96
- ConcurrentSession
79
-
- By default, Any sessions logged into will be disconnected.
80
-
- Using this switch will allow for Concurrent Sessions for the user. This includes additional REST API calls (Which must also be set to ConcurrentSession) or allow for connected PVWA user sessions to remain.
97
+
- Enables Concurrent Sessions for the user. This includes additional REST API calls (which must also be set to ConcurrentSession) or allows connected PVWA user sessions to remain.
98
+
- Default: any sessions logged into will be disconnected.
99
+
81
100
- BypassSafeSearch
82
-
- By default, the script will automatically search to see if the account exists or if it needs to be created
83
-
- Using this switch in create/update mode will prevent safe searches, but may result in account operations failures if the safe does not exist. This should only be used when it is known all safes listed already exist. USE WITH EXTREME CAUTION.
101
+
- In [*Create*](#create-command) or [*Update*](#update-command) mode: prevent Safe searches, but may result in account operations failure if the Safe does not exist. This should only be used when all Safes listed already exist. USE WITH EXTREME CAUTION.
102
+
- Default: the script searches if the account exists or if it needs to be created.
103
+
84
104
- BypassAccountSearch
85
-
- By default, the script will automatically search for requested accounts to determine if they exist. This search is done via "name" property or a combination of "username" and "address" if "name" is not present
86
-
- Using this switch in create mode will assume that the account does not exist and will attempt to create them. If the name property is populated only duplicate "name" properties will be detected and will cause a failure. If the "name" property is not populated, there is no checking for duplicate accounts and all other scenarios MAY result in duplicates. USE WITH EXTREME CAUTION.
105
+
- In [*Create*](#create-command) mode: account is assumed to **not** exist and the script will attempt to create it.
106
+
- If "name" property is populated: only duplicate "name" properties will be detected and will cause a failure.
107
+
- If "name" property is not populated: no checking for duplicate accounts and all other scenarios *may* result in duplicates. USE WITH EXTREME CAUTION.
108
+
- Default: script will search for requested accounts to determine if they already exist. This search is done via the "name" property *or* combination of "username" and "address" if there is no "name".
87
109
88
110
### Create Command:
89
111
```powershell
@@ -100,12 +122,12 @@ If you want to Create Accounts and Safes according to a Safe Template:
0 commit comments