CyberArk Workforce Identity

Important: The formerly known Next-Gen Access integration has been renamed CyberArk Workforce Identity.

CyberArk Workforce Identity provides secure access management solutions for enterprises. It includes single sign-on (SSO), multi-factor authentication (MFA), and lifecycle management, ensuring that employees can seamlessly and securely access applications and data. The platform enhances security by reducing the risk of credential-related breaches, while improving user productivity and compliance.

The following sections explain prerequisites, resources, and instructions for integrating with SaaS Management.

• Stored CyberArk Workforce Identity Information
• Required Minimum Permissions for CyberArk Workforce Identity
• Authentication Method for CyberArk Workforce Identity
• Required Credentials for CyberArk Workforce Identity
• Tasks for Integrating CyberArk Workforce Identity with SaaS Management
• CyberArk Workforce Identity API Endpoints

Stored CyberArk Workforce Identity Information

The following table describes the available integration tasks and stored data within SaaS Management.

Available Integration Tasks

Information Stored

HR Roster

• User ID
• Email
• First Name
• Last Name
• Active Date
• Status
• Department
• Location

Application Roster
• User ID
• Email
• First Name
• Last Name
• Active Date
• Status

Application Access
• User ID
• Occurred (Last Login)

Application Discovery
• Application Name
• Application Label
• Application Description
• Instance ID

SSO Application Roster
• First Name
• Last Name
• Unique ID
• Email
• Application Name
• Application Label
• Application ID

SSO Application Access
• Unique ID
• Occurred (Application Launch)
• Application Name
• Application Label
• Application ID
• Application Instance ID

Note:The information stored is subject to change as enhancements are made to the SaaS application.

Required Minimum Permissions for CyberArk Workforce Identity

The following minimum permissions are required:

• Read-only System Administrator
• Application Management.

Authentication Method for CyberArk Workforce Identity

OAuth 2.0 With Client Credentials is the required authentication method.

Required Credentials for CyberArk Workforce Identity

The following credentials are required:

• Tenant URL
• Client ID
• Client Secret.

Tasks for Integrating CyberArk Workforce Identity with SaaS Management

Perform the following tasks in sequential order to integrate CyberArk Workforce Identity with SaaS Management.

• Creating an OAuth Client for CyberArk Workforce Identity
• Obtaining Your CyberArk Workforce Identity Tenant URL, Client ID, and Client Secret
• Integrating CyberArk Workforce Identity With SaaS Management

Creating an OAuth Client for CyberArk Workforce Identity

Complete the following steps to create an OAuth client.

To create an OAuth client:

1. To import a Web App, sign in to your CyberArk Workforce Identity admin portal.
2. Go to Web Apps and click the Add Web Apps button. The Add Web Apps page opens.
3. Select the Import tab.
4. Download the OauthClientApp.zip folder from the SaaS Management Resources drive.
5. Click Upload and upload the OauthClientApp.zip folder to add the application. After the application is added, the application’s Overview tab opens.

Important:Do not change the Application ID.

6. To create a client credential user, go to the General Usage tab and click the link to create a user.

The Login Name and Password given by the user will be the respective Client ID and Client Secret. These two fields are needed as user input. After these values are provided, click the Create User button. An example Client ID is clientID@metasaas.com.

You are now able to see the new user under the All Service Users listing.

7. To create a new role, click Roles on the Core Services menu. Then click Add Role. The Add Role page opens.
a. In the Name field, enter the name of the role and click Save.
b. On the Add Role page, click the Members tab. The Add Members page opens. Add the client credential user that was created in step 2 and click Add.
c. On the Add Role page, click the Administrative Rights tab. The Add Rights window opens. Select Read Only System Administration and Application Management. Then click Add.
d. Click Save. The Role has been added to the Web App.
8. Go back to the General Usage tab for the Web App that was imported.
a. Select the Permissions tab. The Select User, Group, or Role page opens. Add the new permission (Role) and (User) that was created in steps 6 and 7 and click Add.
b. Click Save. The deployment is complete.
9. Continue to Obtaining Your CyberArk Workforce Identity Tenant URL, Client ID, and Client Secret.

Obtaining Your CyberArk Workforce Identity Tenant URL, Client ID, and Client Secret

The following section explains how to obtain CyberArk Workforce Identity information that is needed to integrate with SaaS Management. After you have this information, proceed to Integrating CyberArk Workforce Identity With SaaS Management.

• For the Tenant URL, use the URL that you received as the CyberArk Workforce Identity URL in your welcome email. Enter the URL without https://.

For example, if the Tenant URL is https://abk4810.id.cyberark.cloud, enter only abk4810.id.cyberark.cloud 

• For the Client ID and Client Secret, see step 6 in Creating an OAuth Client for CyberArk Workforce Identity.

Note:Do not enable Two-Factor Authentication.

Integrating CyberArk Workforce Identity With SaaS Management

To Integrate CyberArk Workforce Identity with SaaS Management, perform the following steps.

To integrate CyberArk Workforce Identity with SaaS Management:

1. In SaaS Management, add the CyberArk Workforce Identity application. For more information, see Adding an Application.
2. Copy and paste the following CyberArk Workforce Identity information from Creating an OAuth Client for CyberArk Workforce Identity into SaaS Management:
• Tenant URL 
• Client ID 
• Client Secret 
3. Click Authorize.

Tip:After the Application Discovery integration task has been enabled after 24 hours, you can add the discovered SSO enabled applications to your list of Managed SaaS Applications. For more information, see Adding Discovered SSO Enabled Applications to Your List of Managed SaaS Applications.

CyberArk Workforce Identity API Endpoints

Application Access, Application Discovery, and SSO Application Access

https://<TenantURL>/Redrock/query

Application Roster, HR Roster

https://<TenantURL>/Redrock/query

 

https://<TenantURL>/UserMgmt/GetUserAttributes

SSO Application Roster

https://<TenantURL>/Redrock/query

 

https://<TenantURL>/UPRest/GetUPData