CyberArk: SQL plus launch using CyberArk PAM 14.4

Connect to Oracle SQLPlus via CyberArk PSM (Privileged Session Manager)

CyberArk PSM offers secure, isolated, and monitored access to Oracle databases using SQLPlus. This article explains how to configure CyberArk PSM to enable connections to Oracle databases using SQLPlus OIC 19c.

---

 Prerequisites

To connect to Oracle databases via SQLPlus:

• Oracle Instant Client (OIC) 19c x64 is required

• Recommended version: 19.18.0 or as per Oracle compatibility matrix

• SQLPlus is typically installed automatically during PSM installation

---

 Installation and Configuration Workflow

Task	Description
1️⃣ Install Oracle Database Tools	SQLPlus + Instant Client (auto-installed with PSM)
2️⃣ Configure AppLocker	Allow SQLPlus to run on the PSM
3️⃣ Configure PSM Connection Component	Setup connection path and settings in PVWA

---

Step 1: Verify Oracle SQLPlus Installation

No manual installation is needed — SQLPlus is automatically installed during the PSM setup.

• Confirm SQLPlus is located at:

  makefile
  
  C:\oracle\instantclient\sqlplus.exe
  

---

Step 2: Configure AppLocker for Oracle SQLPlus

1. Navigate to the AppLocker configuration file:

   java
   
   C:\Program Files (x86)\CyberArk\PSM\Hardening\PSMConfigureAppLocker.xml
   

2. Remove Read-Only Attribute

   • Right-click the XML file → Properties → Uncheck "Read-only"

3. Edit the XML:

   • Open PSMConfigureAppLocker.xml

   • Find the Oracle x64 connection clients section

   • Uncomment the Oracle section by removing the lines:

     xml
     
     <!-- If relevant, uncomment this part after installing Oracle client and Toad 16 x64.
     ...
     End of oracle connections comment -->
     

4. Verify Path Accuracy:
   Ensure the paths match where sqlplus.exe is installed.

5. Save the XML file

6. Apply the AppLocker Configuration:
   Open PowerShell as Administrator and run:

   powershell
   
   CD "C:\Program Files (x86)\CyberArk\PSM\Hardening"
   ./PSMConfigureAppLocker.ps1
   

---

Step 3: Configure SQLPlus Connection Component in PVWA

1. Login to PVWA as an Admin.

2. Go to:
   Administration → System Configuration → Options

3. Expand:
   Connection Components → PSM-SQLPlus

4. Verify Target Settings:

   • Ensure the path is set correctly for SQLPlus:

     css
     
     "C:\oracle\instantclient\sqlplus.exe" "{UserName}/{Password}@{Address}[:{Port}][/{Database}] [{ConnectAs}]"
     
     
     
     
     Ref : Oracle SQL Developer | CyberArk Docs

CyberArk: SSMS20 launch using CyberArk PAM 14.4

 Connect SQL Server Management Studio to CyberArk PSM with Database Authentication

CyberArk Privileged Session Manager (PSM) provides secure and monitored access to sensitive systems, including Microsoft SQL Server. This article walks you through the complete step-by-step setup to enable SQL Server Management Studio (SSMS) connections to SQL databases via CyberArk PSM, using local database authentication.

---

What You'll Achieve

You’ll configure:

• SSMS as a PSM connection client

• AppLocker policies to permit SSMS

• PVWA connection component with proper parameters

• Account and security settings for database access

---

 Prerequisites

Before you begin:

• PSM must be installed and operational

• CyberArk PVWA is accessible

• SSMS installer is downloaded from Microsoft

• Local database account with permissions is created

---

Step-by-Step Configuration

 Step 1: Import SQL Server Connection Component

1. Go to the CyberArk Marketplace.

2. Download the connection component:
   SQL Server Management Studio with Database Authentication.

3. Copy files from:

   java
   
   C:\Program Files (x86)\CyberArk\PSM\Components\Connectors\PSM-SSMSConnetor
   

   To:

   java
   
   C:\Program Files (x86)\CyberArk\PSM\Components
   

---

Step 2: Install SSMS on the PSM Server

1. Download SQL Server Management Studio (SSMS) from the Microsoft website.

2. Install it at:

   pgsql
   
   C:\Program Files (x86)\Microsoft SQL Server Management Studio 20\Common7\IDE\Ssms.exe
   

---

 Step 3: Configure AppLocker for SSMS

1. Navigate to the PSM Hardening folder:

   java
   
   C:\Program Files (x86)\CyberArk\PSM\Hardening
   

2. Remove read-only attribute from PSMConfigureAppLocker.xml.

3. Edit PSMConfigureAppLocker.xml:

   xml
   
   <Application Name="SSMS20" Type="Exe" Path="C:\Program Files (x86)\Microsoft SQL Server Management Studio 20\Common7\IDE\Ssms.exe" Method="Publisher" />
   

4. Save and close the file.

5. Apply AppLocker policy:

   powershell
   
   CD "C:\Program Files (x86)\CyberArk\PSM\Hardening"
   ./PSMConfigureAppLocker.ps1
   

---

Step 4: Configure Account Settings in PVWA

While onboarding the target database account, define:

Parameter	Value
Username	Local database user (e.g., sa)
Address	Hostname/IP or FQDN of the SQL server

---

Step 5: Configure Connection Component Settings

In PVWA → Connection Components, configure:

🔸 Target Settings

Parameter	Description	Default
ClientInstallationPath	Path to ssms.exe	C:\Program Files (x86)\Microsoft SQL Server Management Studio 20\Common7\IDE\Ssms.exe
WindowLoadTimeout	Time to load Connect window (in sec)	500
CmdLineParmsHideTimeout	Cmd parameter hide delay (ms)	20000
ClientErrorTimeout	Wait time for error (sec)	30
ApplicationStartTimeout	App launch timeout (ms)	500000
Timeout	Wait for app window (ms)	8000
SSMSErrorMessageDisplayDuration	Display error pop-up duration (ms)	30000
MainWindowTitle	(Optional) App main window title	-
MainWindowClass	(Optional) App main window class	-

🔸 Encryption Settings

Parameter	Description	Default
Encryption	Enforce encrypted connection	Mandatory
TrustServerCert	Trust self-signed SQL cert	No
HostNameInCertificate	SQL server hostname (required if TrustServerCert = No)	FQDN

🔸 Optional

Parameter	Purpose
AllowMappingLocalDrives	Allow drive mapping during session

Happy Learning !!

CyberArk : HTML5 Gateway Installation Step by Step

CyberArk PSM HTML5 Gateway 14.4 Installation on Rocky Linux 8.10

This guide walks you through the steps to install the CyberArk PSM HTML5 Gateway (version 14.4) on Rocky Linux 8.10.

1. Install Required Packages and Libraries

Run the following command as root:

bash

dnf install -y cairo libpng libjpeg-turbo java-1.8.0-openjdk-headless openssl

2. Install Java JDK (v1.8)

If you require the full JDK (not just the headless version):

bash

dnf install -y java-1.8.0-openjdk-devel

Verify installation:

bash

java -version

Set JAVA_HOME if needed:

bash

echo "export JAVA_HOME=$(dirname $(dirname $(readlink -f $(which java))))" >> ~/.bashrc
source ~/.bashrc

3. Download HTML5GW14.4 and Import CyberArk RPM Signature

• Download the HTML5 Gateway and unzip the package:

bash

cp /opt/HTML5Gateway-Rls-v14.4.zip
unzip HTML5Gateway-Rls-v14.4.zip
cd /opt/RHELinux-Intel64/

• Import the CyberArk RPM GPG key:

bash

rpm --import RPM-GPG-KEY-CyberArk

• Verify the RPM package:

bash

rpm -K -v CARKpsmgw-14.4.0-8.x86_64.rpm

4. Install Apache Tomcat (v9)

4.1 Create Tomcat User & Directory

bash

export CATALINA_HOME=/opt/tomcat
useradd -m -s /sbin/nologin -k /dev/null -d "$CATALINA_HOME" tomcat

4.2 Download and Extract Tomcat

bash

cd /opt
curl -O https://downloads.apache.org/tomcat/tomcat-9/v9.0.87/bin/apache-tomcat-9.0.87.tar.gz
mkdir -p $CATALINA_HOME
tar xf apache-tomcat-9.0.87.tar.gz -C $CATALINA_HOME --strip-components=1

4.3 Set Ownership & Permissions

bash

chown -R tomcat:tomcat $CATALINA_HOME
chmod 600 $CATALINA_HOME/conf/server.xml

5. Create Tomcat Systemd Service

Create the tomcat.service file:

bash

vi /etc/systemd/system/tomcat.service

Paste the following configuration:

ini

[Unit]
Description=Apache Tomcat Web Application Container
After=network.target

[Service]
Type=forking
Environment=JAVA_HOME=/usr/lib/jvm/jre
Environment=CATALINA_HOME=/opt/tomcat
Environment=CATALINA_BASE=/opt/tomcat
Environment='CATALINA_OPTS=-Xms128M -Xmx768M -server -XX:+UseParallelGC'
Environment='JAVA_OPTS=-Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom'

ExecStart=/opt/tomcat/bin/startup.sh
ExecStop=/opt/tomcat/bin/shutdown.sh

User=tomcat
Group=tomcat
[Install]
WantedBy=multi-user.target

Set the permissions and enable the service:

bash

chown root:root /etc/systemd/system/tomcat.service
systemctl daemon-reload
systemctl enable tomcat

6. Generate Self-Signed Keystore (Not Recommended)

For a self-signed certificate, generate a keystore:

bash

keytool -genkeypair -alias tomcat -keyalg RSA -keysize 2048 -keystore /opt/tomcat/keystore -validity 3650

Example values:

• Keystore password: changeit

• CN: Fully Qualified Domain Name (FQDN) of HTML5 GW (e.g., html5.corp.com)

7. Enable SSL in Tomcat

Edit the server.xml file:

bash

vi /opt/tomcat/conf/server.xml

Add or modify the following <Connector> element:

xml

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
           clientAuth="false" sslProtocol="TLS"
           keystoreFile="/opt/certs/keystore"
           keystorePass="changeit" />

8. Generate and Install Domain SSL Keystore

8.1 Create san_config.cnf

cp /opt/certs/
vi /opt/certs/san_config.cnf


[ req ]
default_bits       = 2048
distinguished_name = req_distinguished_name
req_extensions     = req_ext
prompt             = no

[ req_distinguished_name ]
CN  = html5.corp.com
O   = NGT
OU  = IT
L   = Hyderabad
ST  = TS
C   = IN

[ req_ext ]
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = html5.corp.com
DNS.2 = html5
IP.1  = 10.0.0.50

8.2 Generate CSR:

bash

cp /opt/certs/
openssl genrsa -out html5.key 2048
openssl req -new -key html5.key -out html5.csr -config san_config.cnf

8.3 Submit CSR to CA and obtain the html5.crt and ca-chain.crt.

8.4 Create .p12 File:

bash

openssl pkcs12 -export -inkey html5.key -in html5.crt -certfile ca-chain.crt -out html5.p12 -name html5cert

8.5 (Optional) Convert to JKS Keystore:

bash

keytool -importkeystore -destkeystore html5.jks -srckeystore html5.p12 -srcstoretype PKCS12 -alias html5cert

9. Configure TLS in Tomcat’s server.xml

Edit /opt/tomcat/conf/server.xml to configure TLS:

xml

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="/opt/certs/html5.p12"
                     type="RSA"
                     certificateKeystoreType="PKCS12"
                     certificateKeystorePassword="changeit" />
    </SSLHostConfig>
</Connector>

10. Set Permissions on Cert Files

bash

mkdir -p /opt/certs
cp html5.p12 /opt/certs/
chown -R tomcat: /opt/certs
chmod 600 /opt/certs/html5.p12

11. Start/Enable Tomcat Service

(Optional: Create systemd service for Tomcat)

bash

sudo systemctl daemon-reexec
sudo systemctl start tomcat
sudo systemctl enable tomcat

12. Open Firewall Port and Test Tomcat

bash

firewall-cmd --permanent --add-forward-port=port=443:proto=tcp:toport=8443
firewall-cmd --reload
systemctl start tomcat

Visit https://<HTML5GW-IP> to verify if the Tomcat page loads correctly.

13. Install CyberArk HTML5 Gateway

13.1 Prepare Parameters

Copy the sample configuration:

bash

cp /path/to/HTML5GW/psmgwparms.sample /var/tmp/psmgwparms
vi /var/tmp/psmgwparms

Sample config:

bash

AcceptCyberArkEULA=Yes
Hardening=Yes
WebAppsDir=/opt/tomcat/webapps
WebApplicationServerUser=tomcat
WebApplicationServerGroup=tomcat
EndPointAddress=https://<PVWA>/passwordvault
EnableScreenAutoResize=Yes

13.2 Install RPM

bash

cp /opt/RHELinux-Intel64/
rpm -ivh CARKpsmgw-14.4.0-8.x86_64.rpm

13.3 Start Services

bash

systemctl status guacd
systemctl restart tomcat

14. Secure guacd <-> WebApp

14.1 Import Cert to JVM Truststore

bash

keytool -import -alias webapp_guacd_cert \
 -keystore /usr/lib/jvm/java-1.8.0-openjdk*/jre/lib/security/cacerts \
 -trustcacerts -file /opt/certs/html5.cer


keytool -import -alias domain_cert \
 -keystore /usr/lib/jvm/java-1.8.0-openjdk*/jre/lib/security/cacerts \
 -trustcacerts -file /opt/certs/domainca.cer


keytool -import -alias domain_chain_cert \
 -keystore /usr/lib/jvm/java-1.8.0-openjdk*/jre/lib/security/cacerts \
 -trustcacerts -file /opt/certs/domainchain.cer

14.2 Configure SSL for guacd

bash

vi /etc/guacamole/guacd.conf

Uncomment and set:

ini

[ssl]
server_certificate = /opt/certs/html5.cer
server_key = /opt/certs/html5.key

Restart guacd:

bash

systemctl restart guacd

15. Final Configuration and Hardening

Update psmgw.conf in /etc/opt/CARKpsmgw/webapp/ to point to the correct configuration.

Restart services:

bash

systemctl restart guacd
systemctl restart tomcat

16. Add Gateway in PVWA

• Log into PVWA as admin.

• Go to Options > Privileged Session Management > Add Configured PSM Gateway Servers.

• Add the FQDN of the gateway and set the port to 443.

Test the HTML5 connection.

Testing Via PVWA:

Official Ref : 

Installation : Install PSM HTML5 Gateway using an RPM package | CyberArk Docs

Configuration:Secure Access with an HTML5 Gateway | CyberArk Docs 

---

All the best!

2. Sailpoint Integration with MS-AD

1. Sailpoint Installation & Configuration

SAILPOINT IIQ 8.1 INSTALLATION & CONFIGURATION

Provide security to your Oragnization

Secure your organization with following tools 


Provide security to your organization users by using

- Identity Manager ( Oracle Identity Manager | SailPoint IIQ)


Provide Security to your organization Applications by Using

- Access Manager ( Oracle Access Maanger | OKTA )


Provide Security to your Oraganization Assets by using

- PAM ( CyberArk | BeyondTrust | RSA BT )



Thanks & Regards,
OratechSoft

Oracle IAM/IdM Suite Bundle patch History

Oracle IAM Suite Bundle patch History 

Master Patch
Critical Patch History
 
Weblogic Patch history : Click Here

OIM Bundle Patch history : Click Here

OAM Bundle Patch history : Click Here 

SOA Bundle Patch History : Click Here

OHS Patch history : Click Here

Happy Learning !!

Lakshmi Prasad

 

Oracle Identity & Access Management 12C Installation & Configuration

Oracle Identity & Access Management 12C Installation & Configuration

Oracle Identity Manager 12c (12.2.1.3.0 )


Oracle Access Manager 12c (12.2.1.3.0 )


Upgrade of  OIM11gR2PS3 to OIM12cR1PS3


Upgrade of OAM11gR2PS3 to OAM12cR1PS3

Oracle IAM General Overview Complete Workflow Analysis by Lakshmi Prasad

1. Oracle Identity Manager Overview






2. User on-Boarding  process



3. User Reconciliation Process


4. User Provisioning Process