Ctrlk
Help CenterGet A Demo
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Delinea Secret Server

This feature is part of the Enterprise plan. If it is not enabled for your organization, please contact StrongDM at the StrongDM Help Center.

Overview

Delinea Secret Server is a service for securely storing and accessing secrets, such as API keys, passwords, certificates, and cryptographic keys. This guide describes how to integrate Secret Server with StrongDM.

Secret store integrations allow you to use your existing third-party secret stores with StrongDM. Your credentials are stored in a service that is controlled by you, and those credentials are never transmitted to StrongDM in any form. If you would like to learn more about how the Secret Store integration works and why you might wish to use it, please read the Secret Stores Reference.

Delinea also publishes a guide to this integration from the Secret Server side. Please see Integrating StrongDM with Secret Server and the linked Prerequisites and Configuration pages (see Related documentation).

Prerequisites

The following items are required to integrate Secret Server with StrongDM:

  • StrongDM account with the Administrator permission level

  • Healthy StrongDM gateway or relay to allow authentication with Secret Server

  • Delinea Secret Server account set up with a user's username and password, and at least one secret to a resource

  • Correct path(s) to the secret(s) stored in Secret Server

If you plan to use Delinea Platform mode instead of standalone Secret Server, see Authentication modes for additional prerequisites.

Configuration

To integrate StrongDM with Delinea Secret Server, follow the steps in this section to set up your Secret Server account and secrets, configure your gateway or relay, and create the secret store in StrongDM.

Set up Secret Server account and secrets

  1. Log in to your Secret Server account. For the purposes of this guide, we log in with the Local Login option.

  2. Go to Administration > Users, Roles, Access > User Management.

  3. Ensure that you have a user set up with which the StrongDM service can authenticate to Delinea. The user should have a username and password, which are the credentials needed to access secrets stored in Secret Server. Additionally, the user must have the Application Account option set to Yes in order for it to work with StrongDM. For background on Application Accounts, see Creating Users in the Delinea documentation.

  4. Go to the Secrets section.

  5. Ensure that you have an existing secret. If you do not, click Create Secret to add one.

  6. Select a secret and notice the URL in your web browser's address bar. It should look similar to https://example.secretservercloud.com/app/#/secret/7/general, with a number value, such as 7. The number represents the key to the secret stored in Secret Server. Remember the URL for when you are done with configuration and want to connect to a StrongDM resource.

Authentication modes

StrongDM auto-detects which Delinea authentication mode to use based on the Server Address that you provide. Please see the Configure your gateway or relay section.

Use Secret Server mode if you run standalone Secret Server Cloud or Secret Server On-Premises.

Use Delinea Platform mode if your organization has upgraded to the Delinea Platform and wants to authenticate with a Platform-native service user instead of maintaining a separate Secret Server Application Account.

Secret Server mode (default)

Secret Server mode is used when the DELINEA_SERVER_URL (the Server Address) is a Secret Server Cloud or on-premises URL. DELINEA_USERNAME and DELINEA_PASSWORD are the Secret Server user account credentials.

Delinea Platform mode

Delinea Platform mode is used when DELINEA_SERVER_URL (the Server Address) is a Delinea Platform tenant URL (for example, https://your-tenant.delinea.app). In this mode:

  • DELINEA_USERNAME holds the Platform OAuth client ID.

  • DELINEA_PASSWORD holds the Platform OAuth client secret. StrongDM exchanges these for an access token via the tenant's identity service (client_credentials grant, xpmheadless scope), and then queries the tenant's Vault Broker to locate the backing Secret Server. Both lookups happen on the configured gateway or relay; no Delinea credentials are sent to StrongDM.

Prerequisites for Platform mode

  • The Platform tenant must have Secret Server Cloud Platform Identity Integration enabled. See Connecting to Secret Server Cloud in the Delinea documentation.

  • You must have a Platform OAuth client with the xpmheadless scope; the client ID and secret are what you supply via DELINEA_USERNAME and DELINEA_PASSWORD. To create this service user, see Adding Users in the Delinea documentation. For background on the underlying token exchange, see Using Secret Server APIs from Delinea Platform.

Configure your gateway or relay

To allow communication with Secret Server, StrongDM needs to know what credentials to use. You can pass credentials by either provisioning credentials to the StrongDM node (gateway, relay, or proxy worker), or you can configure your gateway or relay environment with properties as environment variables.

Node credentials provisioning method (recommended)

You can provision DELINEA_USERNAME and DELINEA_PASSWORD to the node instead of setting them as environment variables.

On the gateway or relay, run:

Each value is entered at a hidden prompt and never appears in the environment file. A provisioned credential takes precedence over an environment variable of the same name.

This applies in both authentication modes. In Delinea Platform mode, the same two variables carry the Platform OAuth client ID and client secret.

Note that DELINEA_SERVER_URL and DELINEA_API_TENANT are configuration, not credentials, and are read from the environment only.

Environment variables remain fully supported and no migration is required. For more information, please see Provision Node Credentials.

Environment variables method

Use the following steps to configure your gateway or relay environment with properties as environment variables.

To allow communication with Secret Server, StrongDM needs to know what credentials to use. You can pass credentials by either provisioning credentials to the StrongDM node (gateway, relay, or proxy worker), or you can configure your gateway or relay environment with properties as environment variables.

Node credentials provisioning method (recommended)

You can provision DSV_CLIENT_ID and DSV_CLIENT_SECRET to the node instead of setting them as environment variables. On the gateway or relay, run:

Each value is entered at a hidden prompt and never appears in the environment file. A provisioned credential takes precedence over an environment variable of the same name. You must still restart the service.

Note that DSV_TENANT and DSV_TLD are configuration, not credentials, and they are read from the environment only. Alternatively, you can set them in the Admin UI, which takes precedence over the environment variable.

Environment variables remain fully supported and no migration is required. See Provision Node Credentials for container support and how to migrate existing environment variables.

Environment variables method

Use the following steps to configure your gateway or relay environment with properties as environment variables.

The table shown includes the environment variables that Delinea supports. Add all required environment variables on your relay or gateway. For DELINEA_SERVER_URL and DELINEA_API_TENANT, you must set one but not both. Open the environment file for editing. The default location is /etc/sysconfig/sdm-proxy for gateways and relays, or /etc/sysconfig/sdm-worker for proxy clusters. Add or edit the following environment variables:

Environment variable
Requirement
Description

DELINEA_USERNAME

Required

Credential identifier that StrongDM uses to authenticate to Delinea. In Secret Server mode, this is the Secret Server user account username. In Delinea Platform mode, this is the Platform OAuth client ID. See Authentication modes.

DELINEA_PASSWORD

Required

Credential secret that StrongDM uses to authenticate to Delinea. In Secret Server mode, this is the Secret Server user account password. In Delinea Platform mode, this is the Platform OAuth client secret. See Authentication modes.

DELINEA_SERVER_URL

Optional

URL of your Delinea instance. Two URL shapes are supported and auto-detected: A Secret Server URL (such as https://example.secretservercloud.com or https://secretserver.example.com), or a Delinea Platform tenant URL (such as https://your-tenant.delinea.app). When a Platform URL is supplied, StrongDM authenticates against the tenant's identity service and discovers the underlying Secret Server URL automatically. This is only needed if you are using an on-premises version of Delinea or Thycotic, where you are not logged in to any Software as a Service (SaaS) but you are logged in to your own server. It is used if you did not already set the server address in the Admin UI when adding the secret store.

DELINEA_API_TENANT

Optional

(Secret Server Cloud only): Your Delinea Secret Server Cloud tenant name, which you can find in your Secret Server URL (such as https://example.secretservercloud.com), where the tenant name is "example." Leave this blank when using a Delinea Platform tenant URL or an on-premises Secret Server URL. It is used if you did not already set the tenant name in the Admin UI when adding the secret store.

For both DELINEA_API_TENANT and DELINEA_SERVER_URL, the properties set in the Admin UI take precedence over the environment variable. The environment variable is only used if the setting in the Admin UI is empty. See section Create a secret store in StrongDM.

Create a secret store in StrongDM

  1. Log in to the StrongDM Admin UI.

  2. Go to Settings > Secrets Management and to the Secret Stores tab.

  3. Click Add secret store.

  4. On the Add Secret Store form that displays, set all the required secret store properties.

  1. Click Create secret store.

If you have configured the relay or gateway server correctly for Secret Server access and authorization, you can see the green online indicator.

Secret store properties

Property
Requirement
Description

Display Name

Required

The name for this secret store integration that is displayed throughout StrongDM

Type

Required

The type of secret store; select Delinea Secret Server

Server Address

Optional

The URL of your Delinea instance. Two URL shapes are supported and auto-detected: A Secret Server URL such as https://example.secretservercloud.com or https://secretserver.example.com or a Delinea Platform tenant URL such as https://your-tenant.delinea.app. When a Platform URL is supplied, StrongDM authenticates against the tenant's identity service and discovers the underlying Secret Server URL automatically. If you already set environment variables on your gateway or relay, the server address is the same property as the DELINEA_SERVER_URL environment variable; what you set in the Admin UI takes precedence over the environment variable

Tenant Name

Optional

(Secret Server Cloud only): Your Delinea Secret Server Cloud tenant name, which you can find in your Secret Server URL such as https://example.secretservercloud.com, where the tenant name is "example". Leave this blank when using a Delinea Platform tenant URL or an on-premises Secret Server URL. If you already set environment variables on your gateway or relay, the tenant name is the same property as the DELINEA_API_TENANT environment variable; what you set in the Admin UI takes precedence over the environment variable

Configuration is now complete.

Connect to a StrongDM Resource

Now that you have set up secret store integration, you can use the Delinea Secret Server secret store to connect to different StrongDM resources.

  1. In the Admin UI, go to Infrastructure > Datasources.

  2. Click Add Resource.

  3. On the form that displays, set the properties for your database resource, including the secret store properties

  4. When all required fields are complete, click Create.

When the resource is ready, the Health icon indicates a positive, green status.

Delinea Secret Server properties

Property
Description

Secret Store

Type of secret store. Select Delinea Secret Server.

Username (path)

Path to your secret key in the format <SECRET_URL_NUMBER>?key=<KEY> where <SECRET_URL_NUMBER> is the number found in the URL of your secret, and where <KEY> is one of the parameters of the secret in the Delinea interface. For example, if your secret URL is https://example.secretservercloud.com/app/#/secret/7/general, and if you created the secret with the Username parameter set, you would enter 7?key=Username.

Password (path)

Path to your secret key in the format <SECRET_URL_NUMBER>?key=<KEY> where <SECRET_URL_NUMBER> is the number found in the URL of your secret, and where <KEY> is one of the parameters of the secret in the Delinea interface. For example, if your secret URL is https://example.secretservercloud.com/app/#/secret/7/general, and if you created the secret with the Password parameter set, you would enter 7?key=Password.

Related documentation

Delinea publishes its own guide to this integration, covering the same setup from the Secret Server side:

The following are additional references used in this guide:

Last updated

Was this helpful?