CyberArk Integration

General Overview

This guide explains the configuration of multi-factor authentication (MFA) for CyberArk with Mirket. It also includes instructions to configure your CyberArk for integration with Mirket RADIUS.

Prior configuration and deployment of CyberArk are required before setting up MFA with Mirket. CyberArk offers various MFA configuration modes. In this integration, we've configured RADIUS authentication for CyberArk.

This integration was tested with version 10.2.0(10.2.0.55) of CyberArk.

Preparation Steps

Before proceeding with these procedures, ensure the following:

You've completed the installation and configuration of the Mirket (go to Mirket Installation Steps).
End-users can access the CyberArk.

Configuring RADIUS in CyberArk

Configuring Shared Secret Key

To enable RADIUS authentication with CyberArk, create a shared secret key. This key should be stored in an encrypted file. Run CAVaultManager on the Vault server to generate an encrypted RADIUS shared secret key and save it as a file.

Execute CMD as an administrator on the Vault server.
Enter "CAVaultManager SecureSecretFiles /SecretType Radius /Secret / \RadiusSecret.dat". Then press Enter. An example command to create a shared secret file, using abc123 as the shared secret, would be: "C:\Program Files (x86)\PrivateArk\Server>CAVaultManager.exe SecureSecretFiles /SecretType Radius /Secret abc123 /SecuredFileName C:\test.dat."

Configuring RADIUS Server on the Vault

Initiate Server Central Administration on the Vault server. Then shut down the PrivateVault server.
Find the dbparm.ini file locate at C:\Program Files (x86)\PrivateArk\Server.
Modify the dbparm.ini file and enter "RadiusServerInfo=<RADIUS Server IP/Host name>;<RADIUS Port>;<Vault IP/Hostname>;<RADIUS shared secret file>" in the Main section. For instance: RadiusServersInfo=10.0.1.1; 1812; Client; RadiusSecret.dat
- RADIUS Server IP/Host name: Refers to the Mirket(Radius Server) IP address or hostname.
- RADIUS Port: Determines the port number used by the RADIUS client for communication with the RADIUS server. The default port is 1812.
- Vault Hostname: Represents the name or IP address of the RADIUS client (Vault server).
- RADIUS shared secret file: Indicates the location and filename of the previously created shared secret key file.
Note: In our example, we don't include the file path for the RadiusSecret.dat file because it's located at C:\Program Files (x86)\PrivateArk\Server. Therefore, you won't need to specify the complete file path for RadiusServerInfo to reference RadiusSecret.dat.
Initiate the PrivateVault server.

Configuring RADIUS Authentication within the CyberArk Privileged Account Security Portal

Access the Privileged Account Security portal by logging in as an administrator. Then, select Options.
Go to Authentication Methods > radius.

Enter a policy name in the DisplayName field under the Properties section. This name will be visible on the Privileged Account Security portal login page.
Choose the "Yes" option from both the Enable dropdown list and the UseRadius dropdown list.

Log out from the Privileged Account Security portal. Check the sign-out screen to verify the successful addition of the newly added authentication method.

Configure User Authentication as RADIUS

Initiate the PrivateArk console and sign in to the Vault.
Go to Tools > Administrative Tools > Users and Groups.

Then choose the user and click on Update.

Select the Authentication tab. Then choose the RADIUS Authentication option from the Authentication method dropdown list.

Configure Mirket

To enable Mirket to receive authentication requests from CyberArk, follow these steps:

Define CyberArk as a RADIUS client resource within Mirket.
Create an authentication policy for the CyberArk RADIUS client resource or include it in an existing authentication policy.
Attach the CyberArk resource to the Mirket Radius.

Add CyberArk as a Resource in Mirket with Radius Gateway

Before starting, ensure that you have installed Mirket Radius Gateway from the Configuration > Gateway. To add a Radius Gateway to the Mirket, follow these steps:

Go to Configuration > Gateway and click on the Add Radius Gateway button.
On the displayed screen, enter a name for your Radius Gateway in the Name field.
Enter the SAM value of the gateway in the Sam Value field. In Mirket, user identification is done using the SAM (Security Account Manager) name. This is preferred over the standard username. This username is used for authentication and access controls.
Enter the IP address of the server where the gateway is installed in the Host IP Address field.
Enter the authentication port value you set for the gateway in the Auth Port field. The default value is 1812.
Enter the accounting port value you specified for the gateway in the Acc Port field. The default value is 1813. Note: After completing these fields, you must create a RADIUS client for the newly created RADIUS Gateway.
Click on the Add Radius Client option at the bottom of the displayed screen.
Enter a name for your Radius Client in the Radius Client field.
Enter the IP address of the client(firewall) that will communicate with the gateway in the IP Address field.
Enter the secret key that the client will communicate with the gateway in the Secret Key field.

Click on the Save button to confirm the settings.

Configuring Radius Gateway

After creating the Radius Gateway, click on the Download > Config from the menu on the right side of the gateway.

This option will generate a script related to the gateway, which will be displayed from the RADIUS Setup config file. The config file will automatically begin downloading once this option is selected.

Replace the existing config file in the "C:\MirketRadius" directory with the downloaded file. Alternatively, copy the displayed script and paste it into the config file in "C:\MirketRadius".

Then, restart the Mirket Radius Service.

You can check whether the Radius Gateway you created is active by navigating to Configuration > Gateway.

User and Group configuration on Mirket

To set up multifactor authentication, make sure you have at least one user or group in Mirket.

If it is preferred to use a local user, you can first create a local group and then create a local user and make the user a member of the group. Alternatively, you can create a local user without creating a local group.

If it is preferred to use LDAP users, the priority External Source is created by pulling users from Active Directory or OpenLDAP in Mirket. Note: Before proceeding, ensure that you have installed Mirket LDAP Gateway. (Refer to create LDAP Gateway.)

Add a Radius Rule to Mirket

Radius Rules define user access to resources and the authentication methods available (such as SMS, Approve / Deny, OTP, etc.).

First, you should follow these steps:

Go to Configuration > Radius Rules.
Click on the Add Radius Rule button.
On the displayed screen, enter a name for the rule in the Name field.
Enter the rule description in the Description field.
Select the Radius Client to which the rule will apply from the Radius Client dropdown list.
Enter the source IP addresses to which the rule will apply in the Source Adress field.
Select the source countries where the rule will be applied from the Source Country dropdown list.
Click on the Next button.

Specify whether the rule will be applied to a user or a group.
After specifying, click on the Next button.

Select the users or groups to which the rule will apply. Transfer your selections to the Selected Users/Groups table by clicking the arrow icon next to the Available Users/Groups table.
Click on the Next button.

Select the time period when the rule will run.
- All: The rule will run every day.
- Recurring: The rule will run on the specified days and times.
- One Time: The rule will run within the date range you specify.
After selecting, click on the Next button.

Specify whether the user or group will be granted access based on the rule in the Action field.
Select the authentication provider to which the rule will apply from the Auth Method dropdown list.

Click on Save to confirm the settings.

Test the Integration

To validate the integration between Mirket MFA and your CyberArk, perform authentication using a mobile token on your mobile device. For RADIUS resources, available authentication methods include Approve/Deny authentication.

In this example, we illustrate the use of the Approve/Deny authentication method.

Connect to "http://<host_name or IP address>/passwordvault" on the server where Password Vault Web Access is installed. Then, choose the RADIUS option.

Enter your Mirket username in the Username field.
Input your password in the Password field.
Click on Sign in. Then, select the 'Approve' option(found in the Mirket mobile app) immediately and make sure it doesn't time out.