Fudo Password Vault

Fudo Enterprise can retrieve secrets from the Password Vault of another (remote) Fudo Enterprise instance and use them as passwords for monitored accounts. The local Fudo Enterprise connects to the remote instance through its User Access Gateway (UAG) API, authenticating with an API key.

Prerequisites on the Remote Fudo

Before adding the repository, create a dedicated user on the remote Fudo Enterprise instance that hosts the Password Vault, and authenticate it with an API key. The repository uses this key to connect to the remote instance.

  1. On the remote Fudo Enterprise, select User Management > Users and click Add user.

  2. Enter a user name.

  3. Click Save to create the user.

  4. From the Role drop-down list, select a role that includes Password Vault management permissions.

  5. Go to the Safes tab and select the safe named portal to grant the user access to the User Access Gateway.

  6. From the Add authentication method drop-down list, select API key.

  7. Generate the API key (or enter your own).

  8. Copy the generated key - you will provide it when adding the repository.

  9. Click Save and Close.

Note

The API key cannot be retrieved after the authentication method is saved, so copy it before saving.

Note

Make sure this user has at least read access (for example, the View permission) to the Password Vault collection that stores the secrets you want to use.

Adding a New Passwords Repository

  1. Select Settings > External passwords repositories.

  2. Click Add password repository.

  3. Specify object’s name.

  4. In the URL field, provide the address of the Fudo User Access Gateway, which serves as a password vault (for example, its IP address).

  5. In the Server certificate field, provide the User Access Gateway (UAG) HTTPS certificate of the remote Fudo, or click the Get certificate button to obtain it from the remote server.

Warning

If HTTPS is used without providing a server certificate, the connection is not verified and is accepted.

  1. Select FUDO PASSWORD VAULT button in the Type section.

../../_images/6-1-external-psswd-repository-pv.png

Note

On the remote Fudo Enterprise, the UAG HTTPS certificate is available in Settings > System, the General tab, Certificates section (User Access Gateway HTTPS certificate).

  1. In the API key field, provide the API key of the remote Fudo Enterprise UAG user (copied in the prerequisites stage).

  1. Click Save.

  2. Assign the external password repository to an account.

    • Select Management > Accounts.

    • Browse objects and click an account to access the settings form.

    • In the Credentials section, on the Replace secret with field, select Repository button.

    • From the Passwords repository drop-down list select the repository defined above.

    • Provide the Login and, optionally, the Domain - the same values as in the Secret on the remote Fudo Enterprise.

    ../../_images/6-1-external-psswd-repository.png

    • Click Save.

Matching Secrets from the Password Vault

When a Password Vault repository is assigned to an account, Fudo Enterprise matches the account against the secrets stored in the remote Password Vault. The name of the secret is irrelevant; matching is based on the account fields.


All fields that are filled in on the account must have the same values in the Password Vault secret. If the account has the following fields filled in, the secret must hold the same values to be matched:

  • Login

  • Domain

  • Address (URL with protocol and port)

For example, an account with login User_1 used on the SSH server 10.0.100.1 (port 65522) in the domain fudo matches a secret with the following values:

  • Login: User_1

  • secret value (password): pass

  • Domain: fudo

  • URL: ssh://10.0.100.1:65522

Warning

  • If any of these fields is missing in the Password Vault secret, Fudo Enterprise does not match it to the account, and the operation silently fails.

  • If the remote Password Vault has a Basic tier license, fetching the secret silently fails.

Editing a Passwords Repository

To edit a passwords repository definition, proceed as follows.

  1. Select Settings > External passwords repositories.

  2. Locate the repository definition and click on its name to edit its configuration as needed.

  3. Click Save.

Deleting a Passwords Repository

To delete a passwords repository definition, proceed as follows.

  1. Select Settings > External passwords repositories.

  2. Find desired repository definition, select it, and click the Delete selected button.

  3. Click Save.

Note

You cannot delete password repository definition if it is assigned to any account.

Related Topics: