Configuring Safeguard A2A and Credential Requests for Privileged Passwords (4384110)

Overview

The Application-to-Application (A2A) service allows external applications to retrieve managed credentials from SPP without user interaction and without exposing passwords to operators. Authentication is certificate-based: the calling application presents a client certificate, and a per-account API key authorises retrieval of the specific credential.

Starting with SPP 8.x / A2A API v4, the service supports four credential types:

A2A also supports Bidirectional mode (writing credentials back to SPP) and an Access Request Broker mode for impersonating SPP users to create access requests programmatically.

Prerequisites

1. Certificate user — Create a local certificate user in SPP whose authentication certificate matches the client certificate the application will present.
2. Trusted CA — If the client certificate is issued by an internal CA, upload the CA chain to SPP under Appliance > Trusted Certificates.
3. A2A service enabled — Confirm the A2A global service is enabled under Appliance > Service Configuration > Application to Application.
4. Asset/Account — The target asset and account must already exist and be managed by SPP.

Resolution steps are available in the attached document (Configuring Safeguard A2A and Credential Requests for Privileged Passwords.docx), please download the file below.