One Identity Safeguard for Privileged Sessions 6.9.3 - Creating custom Credential Store plugins

Introduction

The following sections provide an overview on creating custom Credential Store plugins that can be used to authenticate on the target servers using an external Credential Store server (for example, a password manager or SSH private key store). For details on using an existing plugin, see "Integrating external authentication and authorization systems" in the Administration Guide.

This document is a general overview of plugin requirements. If you want to write your own custom plugin, make sure to use the Plugin SDK. For details, see: https://oneidentity.github.io/safeguard-sessions-plugin-sdk/1.6.0/

The Credential Store plugin is a Python module.One Identity Safeguard for Privileged Sessions (SPS) invokes the module to request the password or the SSH private key of the target user. The plugin processes the request, returns the result to SPS, and exits. SPS then processes the result.

The backup and restore functionality of SPS handles the uploaded Credential Store plugin as part of SPS's configuration. You do not need to create separate backups of your Credential Store plugin.

Plugin packaging

An SPS plugin is a .zip file that contains a MANIFEST file (with no extension) and a Python module named main.py in its root directory. The plugin .zip file may also contain an optional default.cfg file that serves to provide an example configuration, which you can use as a basis for customization if you wish to adapt the plugin to your site's needs. The size of the .zip file is limited to 20 megabytes.

Including additional modules

You can invoke additional Python modules from main.py, provided that the total size of the .zip bundle does not exceed 20 megabytes and all calls are executed within the plugin timeout.

The modules must be compatible with the selected Python environment. For more information, see If you have entry_point: main.py in the MANIFEST file (the main.py starting with '#!/usr/bin/env pluginwrapper3').

The MANIFEST file

The MANIFEST file is a YAML file and should conform to version 1.2 of the YAML specification.

It must contain the following information about the plugin:

• name: The identifier of the plugin during the upload to SPS. The initial character must be an alphabetical character, while the rest may be alphabetical characters, numerals or '_'. While case sensitivity is supported, special characters (for example, '@' or '&') are not permitted.
• description: The description of the plugin. This description is displayed on the SPS web interface.
• version: The version number of the plugin. It must begin with a numeral (for example, 2.0.3).
• type: The type of the plugin. It must be credentialstore for a Credential Store plugin and aa for an Authentication and Authorization plugin.
• api: The version number of the required SPS API. The current version number is 1.2.

It may contain the following elements:

• entry_point: main.py: The custom entry point of the plugin.
• scb_min_version: The minimum syslog-ng Store Box product version compatible with the plugin. For example, 5.10.0 means 5F10.
• scb_max_version: The maximum compatible syslog-ng Store Box product version. To allow any version below a certain value, add the ~charater. For example, 5.11.0~ means "any version up till, but not including, 5.11.0".

name: name: SPS_TPAM
description: OneIdentity TPAM plugin
version: 2.0.1
type: credentialstore
api: 1.1
entry_point: main.py