feat(beyondtrust-password-safe): new BeyondTrust Password Safe PAM integration

Password Safe REST API v3, 5 commands: list managed accounts/systems, create release request, get credential. PS-Auth session auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 15:39:18 +02:00
parent 8fa1ade945
commit 5089e4466d
6 changed files with 539 additions and 0 deletions
@@ -0,0 +1,77 @@
+id: beyondtrust_password_safe
+name: BeyondTrust Password Safe
+version: 1.0.0
+description: "BeyondTrust Password Safe (Secrets Safe REST API v3) — privileged access and credential retrieval: list managed accounts and systems, request a credential release, and retrieve the credential. API-key (PS-Auth) session authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: list managed accounts/systems, create release request, get credential."
+category: identity
+
+# Per-instance configuration. Auth signs in with an API key + runas user
+# (header 'Authorization: PS-Auth key=<api_key>; runas=<runas_user>;'), which
+# establishes a session reused for the request.
+config_schema:
+  properties:
+    base_url:
+      type: string
+      description: "BeyondTrust URL (e.g. https://beyondtrust.example.com)"
+    api_key:
+      type: string
+      description: "API registration key"
+      x-soar-sensitive: true
+    runas_user:
+      type: string
+      description: "Username to run as"
+    insecure:
+      type: boolean
+      description: "Trust any TLS certificate (not secure)"
+      default: false
+  required:
+    - base_url
+    - api_key
+    - runas_user
+
+commands:
+  - id: list_managed_accounts
+    name: beyondtrust-list-managed-accounts
+    description: "List managed accounts."
+    risk: read
+    inputs_schema:
+      properties:
+        account_name: { type: string, description: "Optional account name filter" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: list_managed_systems
+    name: beyondtrust-list-managed-systems
+    description: "List managed systems."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+  - id: create_release_request
+    name: beyondtrust-create-release-request
+    description: "Request a credential release for a managed account."
+    inputs_schema:
+      properties:
+        system_id: { type: string, description: "Managed system ID" }
+        account_id: { type: string, description: "Managed account ID" }
+        duration_minutes: { type: number, description: "Access duration in minutes (default 30)" }
+        reason: { type: string, description: "Reason for the request" }
+      required: [system_id, account_id]
+    outputs_schema: { properties: {} }
+  - id: get_credential
+    name: beyondtrust-get-credential
+    description: "Retrieve the credential for an approved request."
+    inputs_schema:
+      properties:
+        request_id: { type: string, description: "Request ID (from create-release-request)" }
+      required: [request_id]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: beyondtrust-test-connection
+    description: "Verify the sign-in (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }