The following sections provide an overview on creating custom Credential Store plugins that can be used to authenticate on the target servers using an external Credential Store server (for example, a password manager or SSH private key store). For details on using an existing plugin, see "Integrating external authentication and authorization systems" in the Administration Guide.
This document is a general overview of plugin requirements. If you want to write your own custom plugin, make sure to use the Plugin SDK. For details, see: https://oneidentity.github.io/safeguard-sessions-plugin-sdk/1.3.0/
Using custom plugins in SPS is recommended only if you are familiar with both Python and SPS. Product support applies only to SPS: that is, until the entry point of the Python code and passing the specified arguments to the Python code. One Identity is not responsible for the quality, resource requirements, or any bugs in the Python code, nor any crashes, service outages, or any other damage caused by the improper use of this feature, unless explicitly stated in a contract with One Identity. If you want to create a custom plugin, contact our Support Team for details and instructions.
The Credential Store plugin is a Python module.One Identity Safeguard for Privileged Sessions (SPS) invokes the module to request the password or the SSH private key of the target user. The plugin processes the request, returns the result to SPS, and exits. SPS then processes the result.
The backup and restore functionality of SPS handles the uploaded Credential Store plugin as part of SPS's configuration. You do not need to create separate backups of your Credential Store plugin.
An SPS plugin is a .zip file that contains a MANIFEST file (with no extension) and a Python module named main.py in its root directory. The plugin .zip file may also contain an optional default.cfg file that serves to provide an example configuration, which you can use as a basis for customization if you wish to adapt the plugin to your site's needs. The size of the .zip file is limited to 20 megabytes.
You can invoke additional Python modules from main.py, provided that the total size of the .zip bundle does not exceed 20 megabytes and all calls are executed within the plugin timeout.
The modules must be compatible with the selected Python environment. For more information, see If you have entry_point: main.py in the MANIFEST file (the main.py starting with '#!/usr/bin/env pluginwrapper3').
The MANIFEST file is a YAML file and should conform to version 1.2 of the YAML specification.
It must contain the following information about the plugin:
It may contain the following elements:
name: name: SPS_TPAM description: OneIdentity TPAM plugin version: 2.0.1 type: credentialstore api: 1.1 entry_point: main.py