# SecretManagement.CyberArk: An extension for the  SecretManagement PowerShell module

The [SecretManagement](https://docs.microsoft.com/en-us/powershell/utility-modules/secretmanagement/overview?view=ps-modules) PowerShell module provides a common interface to interact with a wide array of secret vaults enabled through SecretManagement extensions. There are a handful of SecretManagement extensions, including for [Azure KeyVault](https://www.powershellgallery.com/packages/Az.KeyVault), [KeePass](https://www.powershellgallery.com/packages/SecretManagement.KeePass), and [LastPass](https://www.powershellgallery.com/packages/SecretManagement.LastPass).

The `SecretManagement` module supports having multiple secret vault types registered at the same time -- allowing you to access secrets in Azure KeyVault, KeePass, LastPass, etc. through the same cmdlets. The same secrets vault type can also be registered multiple times, allowing you to easily retrieve secrets from multiple KeePass databases.

[SecretManagement.CyberArk](https://www.powershellgallery.com/packages/SecretManagement.CyberArk/) is a SecretManagement extension that brings support to connecting to CyberArk (now Idira) using the Central Provider/Central Credential Provider (using [CredentialRetriever](https://github.com/pspete/CredentialRetriever/)) or REST API (using [psPAS](https://github.com/pspete/psPAS)).

# Using SecretManagement.CyberArk with the Central Credential Provider

The [SecretManagement.CyberArk README](https://github.com/aaearon/SecretManagement.CyberArk) provides the information we need to start working with the module.

The first step is to install and import both the `Microsoft.PowerShell.SecretManagement` and `SecretManagement.CyberArk` modules.

```powershell
PS > Install-Module Microsoft.PowerShell.SecretManagement
PS > Install-Module SecretManagement.CyberArk
PS > Import-Module Microsoft.PowerShell.SecretManagement
PS > Import-Module SecretManagement.CyberArk
```

Next is to register a secret vault with the module `SecretManagement.CyberArk`. We give it a name to refer to when working with a secret and specify that we want to use the Central Credential Provider and pass the relevant details in `VaultParameters`.

```powershell
PS > $VaultParameters = @{
           ConnectionType       = 'CentralCredentialProvider'
           AppID                = 'windowsScript'
           URL                  = 'https://comp01'
           SkipCertificateCheck = $true
    }

PS > Register-SecretVault -Name CyberArk -ModuleName SecretManagement.CyberArk -VaultParameters $VaultParameters
```

`Get-SecretInfo` returns information about a secret: the name of the account, the data type of the secret when using `Get-Secret` and the `SecretManagement` Vault the secret is found in.

It also returns a `Metadata` property that shows information in CyberArk about the account.

```powershell
PS > Get-SecretInfo -VaultName CyberArk -Filter windowsAdmin01
Name                                                                    Type         VaultName
----                                                                    ----         ---------
Operating System-ioSHARPWindowsDomainAccount-iosharp.lab-windowsAdmin01 SecureString CyberArk

PS > Get-SecretInfo -VaultName CyberArk -Filter windowsAdmin01 | Select-Object -ExpandProperty Metadata

Key                       Value
---                       -----
PolicyID                  ioSHARPWindowsDomainAccount
Folder                    Root
LastTask                  ChangeTask
CreationMethod            PVWA
Safe                      Windows
CPMStatus                 success
UserName                  windowsAdmin01
PasswordChangeInProcess   False
Address                   192.168.0.10
Name                      Operating System-ioSHARPWindowsDomainAccount-iosharp.lab-windowsAdmin01
LastSuccessVerification   1660836856
SequenceID                116
LastSuccessReconciliation 1660834970
DeviceType                Operating System
LastSuccessChange         1660923260
RetriesCount              -1

PS >
```

We retrieve the secret in a similar way through `Get-Secret`, returned as a `SecureString`.

```powershell
PS > $Secret = Get-Secret -VaultName CyberArk -Name 'Operating System-ioSHARPWindowsDomainAccount-iosharp.lab-windowsAdmin01'
PS > $Secret.GetType()

IsPublic IsSerial Name                                     BaseType
-------- -------- ----                                     --------
True     False    SecureString                             System.Object

PS > $Secret | ConvertFrom-SecureString -AsPlainText
UTyga8!ZOEDvPhQsrwlI(xjb2K$c
PS >
```

The SecretManagement module supports adding and removing secrets through `Set-Secret` and `Remove-Secret` however as the Central Provider and Central Credential Provider do not support this functionality, these two cmdlets are only implemented for the `REST` ConnectionType.

# Working with multiple `SecretManagement.CyberArk` secret vaults

We can register multiple `SecretManagement.CyberArk` secret vaults. These secret vaults can use different connection types.

```powershell
PS > $TestEnvironmentVaultParameters = @{
           ConnectionType = 'CredentialProvider'
           AppID          = 'linuxApp'
           ClientPath     = 'C:\Path\To\CLIPasswordSDK.exe'
      }

PS > Register-SecretVault -Name CyberArkTest -ModuleName SecretManagement.CyberArk -VaultParameters $TestEnvironmentVaultParameters
PS > $ProductionEnvironmentVaultParameters = @{
           ConnectionType       = 'CentralCredentialProvider'
           AppID                = 'windowsScript'
           URL                  = 'https://comp01'
     }

PS > Register-SecretVault -Name CyberArkProduction -ModuleName SecretManagement.CyberArk -VaultParameters $ProductionEnvironmentVaultParameters
```

Executing `Get-SecretVault` shows us all our register secret vaults and their names so we can specify which Vault to get the secret from.

```powershell
PS > Get-SecretVault

Name               ModuleName                IsDefaultVault
----               ----------                --------------
CyberArkProduction SecretManagement.CyberArk False
CyberArkTest       SecretManagement.CyberArk False

PS >
```

# Conclusion

The `SecretManagement.CyberArk` extension allows you to retrieve secrets from multiple CyberArk environments using different connection methods through the same cmdlets provided by the `SecretManagement` module.

`SecretManagement.CyberArk` can be found in the [PowerShell Gallery](https://www.powershellgallery.com/packages/SecretManagement.CyberArk/). The code is available on [GitHub](https://github.com/aaearon/SecretManagement.CyberArk).

%[https://github.com/aaearon/SecretManagement.CyberArk]