CyberArk SIA (Secure Infrastructure Access) Connector (DPA)

The Connector Management service mediates between your environment and CyberArk's ISPSS services. It enables you to manage CyberArk components and deploy communication tunnels between your organization and CyberArk's cloud environment.

The Connector Management agent is an on-premises component installed on the customer machine to run local CyberArk functions.

The connector installation script includes the agent setup files, certificate, and ID file. The connector installation script contains a secret token for authentication, which expires after five minutes, for security reasons. If the security token expires, you can reload the script, which contains a new security token.

This post is to summarize the steps for installing DPA Connector to your existing CyberArk Connector Servers at on-prem. 

Introduction

 https://docs.cyberark.com/ispss-deployment/latest/en/content/setup/dpa_install-connector.htm

Roles 

For admin who wants to have access to Secure Infrastructure Access page, you will need a specific role permission. 

DpaAdmin - The primary administrative role for the Dynamic Privilege Access service

Configure a connector

1 Add a connector to a selected pool

Usually the selected pool is your current pool for your existing legacy connector, which will be end of life at the end of 2025. 

2 Select an OS platform: Linux or Windows

3 Kee a default configuration

4 Copy generated script 

5 Run copied script in an administrator powershell window

6 CyberArk DPA Connector Service

Check Certificates

 

In case there is certificate error. You can disable TLS Certificate Validation

Eventually you will need to import the proper root ca cert and intermediate ca cert, although it has automtically imported , sometimes, it will be some mistakes there. 

Get a proper intermediate ca cert from one of your PSM servers:

1 Based on server manager's Remote Desktop Services Certificates info, you can easily find it out from Certificates console

2 Certificates Console - Copy to file

3 Go through Certificate Export Wizard

Some options:

No, do not export the private key

Base-64 encoded X.509 (.CER)

4 Import into SIC Certificate page

Privilege Cloud Configuration Options

 

1 Find out new html 5 gateway name

2 Make sure all your psm gateways are using this new Gateway

Including your PSMServer load balancer vip one, you will need to make this change. 

3 After confirmed all is working, you can remove legacy secure tunnel:

CyberArk Privilege Cloud Secure Tunnel

References

• https://docs.cyberark.com/ispss-deployment/latest/en/content/setup/dpa_install-connector.htm