From 9da00ad7b97cfb9c6e8cd39d2ef66ffd3ba0d614 Mon Sep 17 00:00:00 2001 From: Guillaume BOURGEOIS Date: Sat, 11 Jul 2026 23:37:54 +0200 Subject: [PATCH] feat(cyberark-pas): new CyberArk PAS privileged-access integration PVWA REST API, 11 commands: list/get accounts, change/verify/reconcile credentials (CPM rotation), retrieve password, add/delete account, list safes, list users. Session (logon) auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) --- integrations/cyberark-pas/manifest.yaml | 140 ++++++++++++++++++ .../cyberark-pas/scripts/add_account.py | 119 +++++++++++++++ .../scripts/change_credentials.py | 102 +++++++++++++ .../cyberark-pas/scripts/delete_account.py | 97 ++++++++++++ .../scripts/get_account_details.py | 96 ++++++++++++ .../cyberark-pas/scripts/get_password.py | 99 +++++++++++++ .../cyberark-pas/scripts/list_accounts.py | 93 ++++++++++++ .../cyberark-pas/scripts/list_safes.py | 92 ++++++++++++ .../cyberark-pas/scripts/list_users.py | 92 ++++++++++++ .../scripts/reconcile_credentials.py | 97 ++++++++++++ .../cyberark-pas/scripts/test_connection.py | 91 ++++++++++++ .../scripts/verify_credentials.py | 97 ++++++++++++ 12 files changed, 1215 insertions(+) create mode 100644 integrations/cyberark-pas/manifest.yaml create mode 100644 integrations/cyberark-pas/scripts/add_account.py create mode 100644 integrations/cyberark-pas/scripts/change_credentials.py create mode 100644 integrations/cyberark-pas/scripts/delete_account.py create mode 100644 integrations/cyberark-pas/scripts/get_account_details.py create mode 100644 integrations/cyberark-pas/scripts/get_password.py create mode 100644 integrations/cyberark-pas/scripts/list_accounts.py create mode 100644 integrations/cyberark-pas/scripts/list_safes.py create mode 100644 integrations/cyberark-pas/scripts/list_users.py create mode 100644 integrations/cyberark-pas/scripts/reconcile_credentials.py create mode 100644 integrations/cyberark-pas/scripts/test_connection.py create mode 100644 integrations/cyberark-pas/scripts/verify_credentials.py diff --git a/integrations/cyberark-pas/manifest.yaml b/integrations/cyberark-pas/manifest.yaml new file mode 100644 index 0000000..a08ce46 --- /dev/null +++ b/integrations/cyberark-pas/manifest.yaml @@ -0,0 +1,140 @@ +id: cyberark_pas +name: CyberArk PAS +version: 1.0.0 +description: "CyberArk Privileged Access Security (PVWA REST API) — PAM containment and IR: list and read privileged accounts, rotate/verify/reconcile credentials (CPM), retrieve a password for incident response, add/delete accounts, and list safes and vault users. Session (logon) authentication; stdlib-only, no extra Python dependencies." +changelog: "1.0.0 — Initial release: list/get accounts, change/verify/reconcile credentials, retrieve password, add/delete account, list safes, list users." +category: identity + +# Per-instance configuration. Each command logs on to PVWA (returns a session +# token used as the Authorization header), performs the action, then logs off. +config_schema: + properties: + url: + type: string + description: "PVWA base URL (e.g. https://pvwa.example.com)" + username: + type: string + description: "Vault username" + password: + type: string + description: "Vault password" + x-soar-sensitive: true + auth_method: + type: string + description: "Logon method: Cyberark, LDAP, RADIUS, or Windows (default Cyberark)" + default: "Cyberark" + insecure: + type: boolean + description: "Trust any TLS certificate (not secure)" + default: false + required: + - url + - username + - password + +commands: + - id: list_accounts + name: cyberark-list-accounts + description: "List/search privileged accounts." + risk: read + inputs_schema: + properties: + search: { type: string, description: "Free-text search (username, address, name)" } + filter: { type: string, description: "Filter expression (e.g. safeName eq MySafe)" } + limit: { type: number, description: "Max accounts (default 50)" } + required: [] + outputs_schema: { properties: {} } + - id: get_account_details + name: cyberark-get-account-details + description: "Get a single account's details by account ID." + risk: read + inputs_schema: + properties: + account_id: { type: string, description: "Account ID" } + required: [account_id] + outputs_schema: { properties: {} } + - id: change_credentials + name: cyberark-change-credentials + description: "Rotate an account's credential immediately to a new random password (CPM change). Use to contain a compromised privileged account." + inputs_schema: + properties: + account_id: { type: string, description: "Account ID" } + change_entire_group: { type: boolean, description: "Also change dependent accounts in the group (default false)" } + required: [account_id] + outputs_schema: { properties: {} } + - id: verify_credentials + name: cyberark-verify-credentials + description: "Mark an account's credential for verification by the CPM." + inputs_schema: + properties: + account_id: { type: string, description: "Account ID" } + required: [account_id] + outputs_schema: { properties: {} } + - id: reconcile_credentials + name: cyberark-reconcile-credentials + description: "Mark an account's credential for reconciliation by the CPM." + inputs_schema: + properties: + account_id: { type: string, description: "Account ID" } + required: [account_id] + outputs_schema: { properties: {} } + - id: get_password + name: cyberark-get-password + description: "Retrieve an account's current password (for incident response). Requires a reason." + inputs_schema: + properties: + account_id: { type: string, description: "Account ID" } + reason: { type: string, description: "Reason for retrieval (audited)" } + required: [account_id] + outputs_schema: { properties: {} } + - id: add_account + name: cyberark-add-account + description: "Add a new privileged account to a safe." + inputs_schema: + properties: + name: { type: string, description: "Account name" } + address: { type: string, description: "Target machine address" } + user_name: { type: string, description: "Account username" } + platform_id: { type: string, description: "Platform ID (e.g. WinServerLocal)" } + safe_name: { type: string, description: "Safe name" } + secret: { type: string, description: "The password/secret to store" } + secret_type: { type: string, description: "password or key (default password)" } + required: [name, address, user_name, platform_id, safe_name] + outputs_schema: { properties: {} } + - id: delete_account + name: cyberark-delete-account + description: "Delete an account by ID." + inputs_schema: + properties: + account_id: { type: string, description: "Account ID" } + required: [account_id] + outputs_schema: { properties: {} } + - id: list_safes + name: cyberark-list-safes + description: "List safes." + risk: read + inputs_schema: + properties: + search: { type: string, description: "Optional safe-name search" } + limit: { type: number, description: "Max safes (default 50)" } + required: [] + outputs_schema: { properties: {} } + - id: list_users + name: cyberark-list-users + description: "List vault users." + risk: read + inputs_schema: + properties: + search: { type: string, description: "Optional username search" } + filter: { type: string, description: "Filter (e.g. userType eq EPVUser)" } + required: [] + outputs_schema: { properties: {} } + + - id: test_connection + name: cyberark-test-connection + description: "Verify connectivity and logon credentials (used by the Test button)." + risk: read + inputs_schema: + properties: {} + required: [] + outputs_schema: { properties: {} } diff --git a/integrations/cyberark-pas/scripts/add_account.py b/integrations/cyberark-pas/scripts/add_account.py new file mode 100644 index 0000000..cf973ca --- /dev/null +++ b/integrations/cyberark-pas/scripts/add_account.py @@ -0,0 +1,119 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +class Client: + def __init__(self, cfg): + self.cfg = cfg + self.base = str(cfg.get("url", "")).rstrip("/") + "/PasswordVault" + self.ctx = _ctx(cfg) + self.token = None + + def _open(self, method, path, body=None, params=None, auth=True): + url = self.base + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Accept": "application/json"} + if auth and self.token: + headers["Authorization"] = self.token + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=self.ctx) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + def logon(self): + method = str(self.cfg.get("auth_method") or "Cyberark").strip() or "Cyberark" + body = { + "username": self.cfg.get("username", ""), + "password": self.cfg.get("password", ""), + "concurrentSession": True, + } + tok = self._open("POST", "/API/auth/" + urllib.parse.quote(method, safe="") + "/Logon", body=body, auth=False) + # tok is the session token (a plain string when parsed from the JSON body) + self.token = tok if isinstance(tok, str) else str(tok) + return self.token + + def logoff(self): + try: + self._open("POST", "/API/Auth/Logoff", body={}) + except Exception: + pass + + def call(self, method, path, body=None, params=None): + return self._open(method, path, body=body, params=params) + + +def _run(fn): + try: + cfg = _cfg() + inputs = _inputs() + client = Client(cfg) + client.logon() + try: + result = fn(client, inputs) + finally: + client.logoff() + print(json.dumps(result)) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(client, inputs): + name = inputs.get("name") + if not name: + raise Exception("name is required") + address = inputs.get("address") + if not address: + raise Exception("address is required") + user_name = inputs.get("user_name") + if not user_name: + raise Exception("user_name is required") + platform_id = inputs.get("platform_id") + if not platform_id: + raise Exception("platform_id is required") + safe_name = inputs.get("safe_name") + if not safe_name: + raise Exception("safe_name is required") + secret = inputs.get("secret") + secret_type = inputs.get("secret_type") + + body = { + "name": name, + "address": address, + "userName": user_name, + "platformId": platform_id, + "safeName": safe_name, + "secretType": secret_type or "password", + } + if secret: + body["secret"] = secret + + return client.call("POST", "/API/Accounts", body=body) + + +_run(main) diff --git a/integrations/cyberark-pas/scripts/change_credentials.py b/integrations/cyberark-pas/scripts/change_credentials.py new file mode 100644 index 0000000..005e178 --- /dev/null +++ b/integrations/cyberark-pas/scripts/change_credentials.py @@ -0,0 +1,102 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +class Client: + def __init__(self, cfg): + self.cfg = cfg + self.base = str(cfg.get("url", "")).rstrip("/") + "/PasswordVault" + self.ctx = _ctx(cfg) + self.token = None + + def _open(self, method, path, body=None, params=None, auth=True): + url = self.base + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Accept": "application/json"} + if auth and self.token: + headers["Authorization"] = self.token + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=self.ctx) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + def logon(self): + method = str(self.cfg.get("auth_method") or "Cyberark").strip() or "Cyberark" + body = { + "username": self.cfg.get("username", ""), + "password": self.cfg.get("password", ""), + "concurrentSession": True, + } + tok = self._open("POST", "/API/auth/" + urllib.parse.quote(method, safe="") + "/Logon", body=body, auth=False) + # tok is the session token (a plain string when parsed from the JSON body) + self.token = tok if isinstance(tok, str) else str(tok) + return self.token + + def logoff(self): + try: + self._open("POST", "/API/Auth/Logoff", body={}) + except Exception: + pass + + def call(self, method, path, body=None, params=None): + return self._open(method, path, body=body, params=params) + + +def _run(fn): + try: + cfg = _cfg() + inputs = _inputs() + client = Client(cfg) + client.logon() + try: + result = fn(client, inputs) + finally: + client.logoff() + print(json.dumps(result)) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +q = lambda v: urllib.parse.quote(str(v), safe="") + + +def main(client, inputs): + account_id = inputs.get("account_id") + if not account_id: + raise Exception("account_id is required") + change_entire_group = bool(inputs.get("change_entire_group") or False) + result = client.call( + "POST", + "/API/Accounts/" + q(account_id) + "/Change", + body={"ChangeEntireGroup": change_entire_group}, + ) + return result if result else {"ok": True} + + +_run(main) diff --git a/integrations/cyberark-pas/scripts/delete_account.py b/integrations/cyberark-pas/scripts/delete_account.py new file mode 100644 index 0000000..79ec066 --- /dev/null +++ b/integrations/cyberark-pas/scripts/delete_account.py @@ -0,0 +1,97 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +class Client: + def __init__(self, cfg): + self.cfg = cfg + self.base = str(cfg.get("url", "")).rstrip("/") + "/PasswordVault" + self.ctx = _ctx(cfg) + self.token = None + + def _open(self, method, path, body=None, params=None, auth=True): + url = self.base + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Accept": "application/json"} + if auth and self.token: + headers["Authorization"] = self.token + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=self.ctx) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + def logon(self): + method = str(self.cfg.get("auth_method") or "Cyberark").strip() or "Cyberark" + body = { + "username": self.cfg.get("username", ""), + "password": self.cfg.get("password", ""), + "concurrentSession": True, + } + tok = self._open("POST", "/API/auth/" + urllib.parse.quote(method, safe="") + "/Logon", body=body, auth=False) + # tok is the session token (a plain string when parsed from the JSON body) + self.token = tok if isinstance(tok, str) else str(tok) + return self.token + + def logoff(self): + try: + self._open("POST", "/API/Auth/Logoff", body={}) + except Exception: + pass + + def call(self, method, path, body=None, params=None): + return self._open(method, path, body=body, params=params) + + +def _run(fn): + try: + cfg = _cfg() + inputs = _inputs() + client = Client(cfg) + client.logon() + try: + result = fn(client, inputs) + finally: + client.logoff() + print(json.dumps(result)) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +q = lambda v: urllib.parse.quote(str(v), safe="") + + +def main(client, inputs): + account_id = inputs.get("account_id") + if not account_id: + raise Exception("account_id is required") + client.call("DELETE", "/API/Accounts/" + q(account_id)) + return {"ok": True} + + +_run(main) diff --git a/integrations/cyberark-pas/scripts/get_account_details.py b/integrations/cyberark-pas/scripts/get_account_details.py new file mode 100644 index 0000000..73b720a --- /dev/null +++ b/integrations/cyberark-pas/scripts/get_account_details.py @@ -0,0 +1,96 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +class Client: + def __init__(self, cfg): + self.cfg = cfg + self.base = str(cfg.get("url", "")).rstrip("/") + "/PasswordVault" + self.ctx = _ctx(cfg) + self.token = None + + def _open(self, method, path, body=None, params=None, auth=True): + url = self.base + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Accept": "application/json"} + if auth and self.token: + headers["Authorization"] = self.token + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=self.ctx) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + def logon(self): + method = str(self.cfg.get("auth_method") or "Cyberark").strip() or "Cyberark" + body = { + "username": self.cfg.get("username", ""), + "password": self.cfg.get("password", ""), + "concurrentSession": True, + } + tok = self._open("POST", "/API/auth/" + urllib.parse.quote(method, safe="") + "/Logon", body=body, auth=False) + # tok is the session token (a plain string when parsed from the JSON body) + self.token = tok if isinstance(tok, str) else str(tok) + return self.token + + def logoff(self): + try: + self._open("POST", "/API/Auth/Logoff", body={}) + except Exception: + pass + + def call(self, method, path, body=None, params=None): + return self._open(method, path, body=body, params=params) + + +def _run(fn): + try: + cfg = _cfg() + inputs = _inputs() + client = Client(cfg) + client.logon() + try: + result = fn(client, inputs) + finally: + client.logoff() + print(json.dumps(result)) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +q = lambda v: urllib.parse.quote(str(v), safe="") + + +def main(client, inputs): + account_id = inputs.get("account_id") + if not account_id: + raise Exception("account_id is required") + return client.call("GET", "/API/Accounts/" + q(account_id)) + + +_run(main) diff --git a/integrations/cyberark-pas/scripts/get_password.py b/integrations/cyberark-pas/scripts/get_password.py new file mode 100644 index 0000000..ed9317a --- /dev/null +++ b/integrations/cyberark-pas/scripts/get_password.py @@ -0,0 +1,99 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +class Client: + def __init__(self, cfg): + self.cfg = cfg + self.base = str(cfg.get("url", "")).rstrip("/") + "/PasswordVault" + self.ctx = _ctx(cfg) + self.token = None + + def _open(self, method, path, body=None, params=None, auth=True): + url = self.base + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Accept": "application/json"} + if auth and self.token: + headers["Authorization"] = self.token + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=self.ctx) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + def logon(self): + method = str(self.cfg.get("auth_method") or "Cyberark").strip() or "Cyberark" + body = { + "username": self.cfg.get("username", ""), + "password": self.cfg.get("password", ""), + "concurrentSession": True, + } + tok = self._open("POST", "/API/auth/" + urllib.parse.quote(method, safe="") + "/Logon", body=body, auth=False) + # tok is the session token (a plain string when parsed from the JSON body) + self.token = tok if isinstance(tok, str) else str(tok) + return self.token + + def logoff(self): + try: + self._open("POST", "/API/Auth/Logoff", body={}) + except Exception: + pass + + def call(self, method, path, body=None, params=None): + return self._open(method, path, body=body, params=params) + + +def _run(fn): + try: + cfg = _cfg() + inputs = _inputs() + client = Client(cfg) + client.logon() + try: + result = fn(client, inputs) + finally: + client.logoff() + print(json.dumps(result)) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +q = lambda v: urllib.parse.quote(str(v), safe="") + + +def main(client, inputs): + account_id = inputs.get("account_id") + if not account_id: + raise Exception("account_id is required") + reason = inputs.get("reason") + body = {"reason": reason} if reason else {} + result = client.call("POST", "/API/Accounts/" + q(account_id) + "/Password/Retrieve", body=body) + return {"password": result} + + +_run(main) diff --git a/integrations/cyberark-pas/scripts/list_accounts.py b/integrations/cyberark-pas/scripts/list_accounts.py new file mode 100644 index 0000000..fff3c9c --- /dev/null +++ b/integrations/cyberark-pas/scripts/list_accounts.py @@ -0,0 +1,93 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +class Client: + def __init__(self, cfg): + self.cfg = cfg + self.base = str(cfg.get("url", "")).rstrip("/") + "/PasswordVault" + self.ctx = _ctx(cfg) + self.token = None + + def _open(self, method, path, body=None, params=None, auth=True): + url = self.base + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Accept": "application/json"} + if auth and self.token: + headers["Authorization"] = self.token + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=self.ctx) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + def logon(self): + method = str(self.cfg.get("auth_method") or "Cyberark").strip() or "Cyberark" + body = { + "username": self.cfg.get("username", ""), + "password": self.cfg.get("password", ""), + "concurrentSession": True, + } + tok = self._open("POST", "/API/auth/" + urllib.parse.quote(method, safe="") + "/Logon", body=body, auth=False) + # tok is the session token (a plain string when parsed from the JSON body) + self.token = tok if isinstance(tok, str) else str(tok) + return self.token + + def logoff(self): + try: + self._open("POST", "/API/Auth/Logoff", body={}) + except Exception: + pass + + def call(self, method, path, body=None, params=None): + return self._open(method, path, body=body, params=params) + + +def _run(fn): + try: + cfg = _cfg() + inputs = _inputs() + client = Client(cfg) + client.logon() + try: + result = fn(client, inputs) + finally: + client.logoff() + print(json.dumps(result)) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(client, inputs): + search = inputs.get("search") + filter_ = inputs.get("filter") + limit = int(inputs.get("limit") or 50) + return client.call("GET", "/API/Accounts", params={"search": search, "filter": filter_, "limit": limit}) + + +_run(main) diff --git a/integrations/cyberark-pas/scripts/list_safes.py b/integrations/cyberark-pas/scripts/list_safes.py new file mode 100644 index 0000000..6aba763 --- /dev/null +++ b/integrations/cyberark-pas/scripts/list_safes.py @@ -0,0 +1,92 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +class Client: + def __init__(self, cfg): + self.cfg = cfg + self.base = str(cfg.get("url", "")).rstrip("/") + "/PasswordVault" + self.ctx = _ctx(cfg) + self.token = None + + def _open(self, method, path, body=None, params=None, auth=True): + url = self.base + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Accept": "application/json"} + if auth and self.token: + headers["Authorization"] = self.token + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=self.ctx) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + def logon(self): + method = str(self.cfg.get("auth_method") or "Cyberark").strip() or "Cyberark" + body = { + "username": self.cfg.get("username", ""), + "password": self.cfg.get("password", ""), + "concurrentSession": True, + } + tok = self._open("POST", "/API/auth/" + urllib.parse.quote(method, safe="") + "/Logon", body=body, auth=False) + # tok is the session token (a plain string when parsed from the JSON body) + self.token = tok if isinstance(tok, str) else str(tok) + return self.token + + def logoff(self): + try: + self._open("POST", "/API/Auth/Logoff", body={}) + except Exception: + pass + + def call(self, method, path, body=None, params=None): + return self._open(method, path, body=body, params=params) + + +def _run(fn): + try: + cfg = _cfg() + inputs = _inputs() + client = Client(cfg) + client.logon() + try: + result = fn(client, inputs) + finally: + client.logoff() + print(json.dumps(result)) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(client, inputs): + search = inputs.get("search") + limit = int(inputs.get("limit") or 50) + return client.call("GET", "/API/Safes", params={"search": search, "limit": limit}) + + +_run(main) diff --git a/integrations/cyberark-pas/scripts/list_users.py b/integrations/cyberark-pas/scripts/list_users.py new file mode 100644 index 0000000..57f520c --- /dev/null +++ b/integrations/cyberark-pas/scripts/list_users.py @@ -0,0 +1,92 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +class Client: + def __init__(self, cfg): + self.cfg = cfg + self.base = str(cfg.get("url", "")).rstrip("/") + "/PasswordVault" + self.ctx = _ctx(cfg) + self.token = None + + def _open(self, method, path, body=None, params=None, auth=True): + url = self.base + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Accept": "application/json"} + if auth and self.token: + headers["Authorization"] = self.token + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=self.ctx) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + def logon(self): + method = str(self.cfg.get("auth_method") or "Cyberark").strip() or "Cyberark" + body = { + "username": self.cfg.get("username", ""), + "password": self.cfg.get("password", ""), + "concurrentSession": True, + } + tok = self._open("POST", "/API/auth/" + urllib.parse.quote(method, safe="") + "/Logon", body=body, auth=False) + # tok is the session token (a plain string when parsed from the JSON body) + self.token = tok if isinstance(tok, str) else str(tok) + return self.token + + def logoff(self): + try: + self._open("POST", "/API/Auth/Logoff", body={}) + except Exception: + pass + + def call(self, method, path, body=None, params=None): + return self._open(method, path, body=body, params=params) + + +def _run(fn): + try: + cfg = _cfg() + inputs = _inputs() + client = Client(cfg) + client.logon() + try: + result = fn(client, inputs) + finally: + client.logoff() + print(json.dumps(result)) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(client, inputs): + search = inputs.get("search") + filter_ = inputs.get("filter") + return client.call("GET", "/API/Users", params={"search": search, "filter": filter_}) + + +_run(main) diff --git a/integrations/cyberark-pas/scripts/reconcile_credentials.py b/integrations/cyberark-pas/scripts/reconcile_credentials.py new file mode 100644 index 0000000..a2d74fc --- /dev/null +++ b/integrations/cyberark-pas/scripts/reconcile_credentials.py @@ -0,0 +1,97 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +class Client: + def __init__(self, cfg): + self.cfg = cfg + self.base = str(cfg.get("url", "")).rstrip("/") + "/PasswordVault" + self.ctx = _ctx(cfg) + self.token = None + + def _open(self, method, path, body=None, params=None, auth=True): + url = self.base + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Accept": "application/json"} + if auth and self.token: + headers["Authorization"] = self.token + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=self.ctx) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + def logon(self): + method = str(self.cfg.get("auth_method") or "Cyberark").strip() or "Cyberark" + body = { + "username": self.cfg.get("username", ""), + "password": self.cfg.get("password", ""), + "concurrentSession": True, + } + tok = self._open("POST", "/API/auth/" + urllib.parse.quote(method, safe="") + "/Logon", body=body, auth=False) + # tok is the session token (a plain string when parsed from the JSON body) + self.token = tok if isinstance(tok, str) else str(tok) + return self.token + + def logoff(self): + try: + self._open("POST", "/API/Auth/Logoff", body={}) + except Exception: + pass + + def call(self, method, path, body=None, params=None): + return self._open(method, path, body=body, params=params) + + +def _run(fn): + try: + cfg = _cfg() + inputs = _inputs() + client = Client(cfg) + client.logon() + try: + result = fn(client, inputs) + finally: + client.logoff() + print(json.dumps(result)) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +q = lambda v: urllib.parse.quote(str(v), safe="") + + +def main(client, inputs): + account_id = inputs.get("account_id") + if not account_id: + raise Exception("account_id is required") + result = client.call("POST", "/API/Accounts/" + q(account_id) + "/Reconcile", body={}) + return {"ok": True} if not result else result + + +_run(main) diff --git a/integrations/cyberark-pas/scripts/test_connection.py b/integrations/cyberark-pas/scripts/test_connection.py new file mode 100644 index 0000000..9f49726 --- /dev/null +++ b/integrations/cyberark-pas/scripts/test_connection.py @@ -0,0 +1,91 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +class Client: + def __init__(self, cfg): + self.cfg = cfg + self.base = str(cfg.get("url", "")).rstrip("/") + "/PasswordVault" + self.ctx = _ctx(cfg) + self.token = None + + def _open(self, method, path, body=None, params=None, auth=True): + url = self.base + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Accept": "application/json"} + if auth and self.token: + headers["Authorization"] = self.token + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=self.ctx) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + def logon(self): + method = str(self.cfg.get("auth_method") or "Cyberark").strip() or "Cyberark" + body = { + "username": self.cfg.get("username", ""), + "password": self.cfg.get("password", ""), + "concurrentSession": True, + } + tok = self._open("POST", "/API/auth/" + urllib.parse.quote(method, safe="") + "/Logon", body=body, auth=False) + # tok is the session token (a plain string when parsed from the JSON body) + self.token = tok if isinstance(tok, str) else str(tok) + return self.token + + def logoff(self): + try: + self._open("POST", "/API/Auth/Logoff", body={}) + except Exception: + pass + + def call(self, method, path, body=None, params=None): + return self._open(method, path, body=body, params=params) + + +def _run(fn): + try: + cfg = _cfg() + inputs = _inputs() + client = Client(cfg) + client.logon() + try: + result = fn(client, inputs) + finally: + client.logoff() + print(json.dumps(result)) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(client, inputs): + client.call("GET", "/API/Safes", params={"limit": 1}) + return {"ok": True} + + +_run(main) diff --git a/integrations/cyberark-pas/scripts/verify_credentials.py b/integrations/cyberark-pas/scripts/verify_credentials.py new file mode 100644 index 0000000..2b8ae4b --- /dev/null +++ b/integrations/cyberark-pas/scripts/verify_credentials.py @@ -0,0 +1,97 @@ +import json, os, sys, ssl, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def _ctx(cfg): + if cfg.get("insecure"): + c = ssl.create_default_context() + c.check_hostname = False + c.verify_mode = ssl.CERT_NONE + return c + return None + + +class Client: + def __init__(self, cfg): + self.cfg = cfg + self.base = str(cfg.get("url", "")).rstrip("/") + "/PasswordVault" + self.ctx = _ctx(cfg) + self.token = None + + def _open(self, method, path, body=None, params=None, auth=True): + url = self.base + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Accept": "application/json"} + if auth and self.token: + headers["Authorization"] = self.token + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60, context=self.ctx) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + def logon(self): + method = str(self.cfg.get("auth_method") or "Cyberark").strip() or "Cyberark" + body = { + "username": self.cfg.get("username", ""), + "password": self.cfg.get("password", ""), + "concurrentSession": True, + } + tok = self._open("POST", "/API/auth/" + urllib.parse.quote(method, safe="") + "/Logon", body=body, auth=False) + # tok is the session token (a plain string when parsed from the JSON body) + self.token = tok if isinstance(tok, str) else str(tok) + return self.token + + def logoff(self): + try: + self._open("POST", "/API/Auth/Logoff", body={}) + except Exception: + pass + + def call(self, method, path, body=None, params=None): + return self._open(method, path, body=body, params=params) + + +def _run(fn): + try: + cfg = _cfg() + inputs = _inputs() + client = Client(cfg) + client.logon() + try: + result = fn(client, inputs) + finally: + client.logoff() + print(json.dumps(result)) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +q = lambda v: urllib.parse.quote(str(v), safe="") + + +def main(client, inputs): + account_id = inputs.get("account_id") + if not account_id: + raise Exception("account_id is required") + result = client.call("POST", "/API/Accounts/" + q(account_id) + "/Verify", body={}) + return {"ok": True} if not result else result + + +_run(main)