> For the complete documentation index, see [llms.txt](https://docs.strongdm.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.strongdm.com/admin/access/secret-stores/delinea-secret-server.md). # Delinea Secret Server {% hint style="info" %} This feature is part of the Enterprise plan. If it is not enabled for your organization, please contact StrongDM at the [StrongDM Help Center](https://help.strongdm.com/hc/en-us). {% endhint %} ## Overview Delinea Secret Server is a service for securely storing and accessing secrets, such as API keys, passwords, certificates, and cryptographic keys. This guide describes how to integrate Secret Server with StrongDM. Secret store integrations allow you to use your existing third-party secret stores with StrongDM. Your credentials are stored in a service that is controlled by you, and those credentials are never transmitted to StrongDM in any form. If you would like to learn more about how the Secret Store integration works and why you might wish to use it, please read the [Secret Stores Reference](/admin/access/secret-stores.md). {% hint style="info" %} Delinea also publishes a guide to this integration from the Secret Server side. Please see [Integrating StrongDM with Secret Server](https://docs.delinea.com/online-help/integrations/strongdm/strong-dm-integration-secret-server.htm) and the linked Prerequisites and Configuration pages (see [Related documentation](#related-documentation)). {% endhint %} ## Prerequisites The following items are required to integrate Secret Server with StrongDM: * StrongDM account with the Administrator permission level * Healthy StrongDM gateway or relay to allow authentication with Secret Server * Delinea Secret Server account set up with a user's username and password, and at least one secret to a resource * Correct path(s) to the secret(s) stored in Secret Server {% hint style="info" %} If you plan to use Delinea Platform mode instead of standalone Secret Server, see [Authentication modes](#authentication-modes) for additional prerequisites. {% endhint %} ## Configuration To integrate StrongDM with Delinea Secret Server, follow the steps in this section to set up your Secret Server account and secrets, configure your gateway or relay, and create the secret store in StrongDM. ### Set up Secret Server account and secrets 1. Log in to your Secret Server account. For the purposes of this guide, we log in with the **Local Login** option. 2. Go to **Administration** > **Users, Roles, Access** > **User Management**. 3. Ensure that you have a user set up with which the StrongDM service can authenticate to Delinea. The user should have a username and password, which are the credentials needed to access secrets stored in Secret Server. Additionally, the user must have the **Application Account** option set to **Yes** in order for it to work with StrongDM. For background on Application Accounts, see [Creating Users](https://docs.delinea.com/online-help/secret-server/users-roles/users/creating-users/index.htm) in the Delinea documentation. 4. Go to the **Secrets** section. 5. Ensure that you have an existing secret. If you do not, click **Create Secret** to add one. 6. Select a secret and notice the URL in your web browser's address bar. It should look similar to `https://example.secretservercloud.com/app/#/secret/7/general`, with a number value, such as `7`. The number represents the key to the secret stored in Secret Server. Remember the URL for when you are done with configuration and want to [connect to a StrongDM resource](#connect-to-a-strongdm-resource). ### Authentication modes StrongDM auto-detects which Delinea authentication mode to use based on the Server Address that you provide. Please see the [Configure your gateway or relay](#configure-your-gateway-or-relay) section. Use **Secret Server mode** if you run standalone Secret Server Cloud or Secret Server On-Premises. Use **Delinea Platform mode** if your organization has upgraded to the Delinea Platform and wants to authenticate with a Platform-native service user instead of maintaining a separate Secret Server Application Account. #### Secret Server mode (default) Secret Server mode is used when the `DELINEA_SERVER_URL` (the Server Address) is a Secret Server Cloud or on-premises URL. `DELINEA_USERNAME` and `DELINEA_PASSWORD` are the Secret Server user account credentials. #### Delinea Platform mode Delinea Platform mode is used when `DELINEA_SERVER_URL` (the Server Address) is a Delinea Platform tenant URL (for example, `https://your-tenant.delinea.app`). In this mode: * `DELINEA_USERNAME` holds the Platform OAuth client ID. * `DELINEA_PASSWORD` holds the Platform OAuth client secret. StrongDM exchanges these for an access token via the tenant's identity service (`client_credentials` grant, `xpmheadless` scope), and then queries the tenant's Vault Broker to locate the backing Secret Server. Both lookups happen on the configured gateway or relay; no Delinea credentials are sent to StrongDM. **Prerequisites for Platform mode** * The Platform tenant must have Secret Server Cloud Platform Identity Integration enabled. See [Connecting to Secret Server Cloud](https://docs.delinea.com/online-help/delinea-platform/secrets-integration/secrets-cloud.htm#EnablePlatformIntegrationinSecretServer) in the Delinea documentation. * You must have a Platform OAuth client with the `xpmheadless` scope; the client ID and secret are what you supply via `DELINEA_USERNAME` and `DELINEA_PASSWORD`. To create this service user, see [Adding Users](https://docs.delinea.com/online-help/delinea-platform/users/add-users.htm) in the Delinea documentation. For background on the underlying token exchange, see [Using Secret Server APIs from Delinea Platform](https://docs.delinea.com/online-help/platform-api/secret-server-apis-from-platform.htm). ### Configure your gateway or relay To allow communication with Secret Server, StrongDM needs to know what credentials to use. You can configure your gateway or relay environment with properties as environment variables. The following table shows the environment variables that Delinea supports. Add all required environment variables on your relay or gateway. For `DELINEA_SERVER_URL` and `DELINEA_API_TENANT`, you must set one but not both. Open the environment file for editing. The default location is `/etc/sysconfig/sdm-proxy` for gateways and relays, or `/etc/sysconfig/sdm-worker` for proxy clusters. Add or edit the following environment variables: | Environment variable | Requirement | Description | | -------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `DELINEA_USERNAME` | Required |

Credential identifier that StrongDM uses to authenticate
to Delinea. In Secret Server mode, this is the Secret Server user account
username. In Delinea Platform mode, this is the Platform OAuth client ID.
See Authentication modes.

| | `DELINEA_PASSWORD` | Required |

Credential secret that StrongDM uses to authenticate to
Delinea. In Secret Server mode, this is the Secret Server user account
password. In Delinea Platform mode, this is the Platform OAuth client
secret. See Authentication modes.

| | `DELINEA_SERVER_URL` | Optional | URL of your Delinea instance. Two URL shapes are supported and auto-detected: A Secret Server URL (such as `https://example.secretservercloud.com` or `https://secretserver.example.com`), or a Delinea Platform tenant URL (such as `https://your-tenant.delinea.app`). When a Platform URL is supplied, StrongDM authenticates against the tenant's identity service and discovers the underlying Secret Server URL automatically. This is only needed if you are using an on-premises version of Delinea or Thycotic, where you are not logged in to any Software as a Service (SaaS) but you are logged in to your own server. It is used if you did not already set the server address in the Admin UI when adding the secret store. | | `DELINEA_API_TENANT` | Optional |

(Secret Server Cloud only): Your Delinea Secret Server Cloud tenant name, which you can find in your Secret Server URL (such as ), where the tenant name is "example."
Leave this blank when using a Delinea Platform tenant URL or an on-premises Secret Server URL. It is used if you did not already set the tenant name in the Admin UI when adding the secret store.

| {% hint style="info" %} For both `DELINEA_API_TENANT` and `DELINEA_SERVER_URL`, the properties set in the Admin UI take precedence over the environment variable. The environment variable is only used if the setting in the Admin UI is empty. See section [Create a secret store in StrongDM](#create-a-secret-store-in-strongdm). {% endhint %} ### Create a secret store in StrongDM 1. Log in to the StrongDM Admin UI. 2. Go to **Settings** > **Secrets Management** and to the **Secret Stores** tab. 3. Click **Add secret store**. 4. On the **Add Secret Store** form that displays, set all the required [secret store properties](#secret-store-properties). ![](/files/TKe8eselXOv20ntIItVC) 5. Click **Create secret store**. If you have configured the relay or gateway server correctly for Secret Server access and authorization, you can see the green online indicator. ### Secret store properties | Property | Requirement | Description | | ------------------ | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Display Name** | Required | The name for this secret store integration that is displayed throughout StrongDM | | **Type** | Required | The type of secret store; select **Delinea Secret Server** | | **Server Address** | Optional | The URL of your Delinea instance. Two URL shapes are supported and auto-detected: A Secret Server URL such as `https://example.secretservercloud.com` or `https://secretserver.example.com` or a Delinea Platform tenant URL such as `https://your-tenant.delinea.app`. When a Platform URL is supplied, StrongDM authenticates against the tenant's identity service and discovers the underlying Secret Server URL automatically. If you already set [environment variables on your gateway or relay](#configure-your-gateway-or-relay), the server address is the same property as the `DELINEA_SERVER_URL` environment variable; what you set in the Admin UI takes precedence over the environment variable | | **Tenant Name** | Optional |

(Secret Server Cloud only): Your Delinea Secret Server Cloud tenant name, which you can find in your Secret Server URL such as , where the tenant name is "example".
Leave this blank when using a Delinea Platform tenant URL or an on-premises Secret Server URL. If you already set environment variables on your gateway or relay, the tenant name is the same property as the DELINEA\_API\_TENANT environment variable; what you set in the Admin UI takes precedence over the environment variable

| Configuration is now complete. ## Connect to a StrongDM Resource Now that you have set up secret store integration, you can use the Delinea Secret Server secret store to connect to different StrongDM resources. 1. In the Admin UI, go to **Infrastructure > Datasources**. 2. Click **Add Resource**. 3. On the form that displays, set the properties for your database resource, including the [secret store properties](#secret-store-properties) 4. When all required fields are complete, click **Create**. When the resource is ready, the **Health** icon indicates a positive, green status. #### Delinea Secret Server properties | Property | Description | | ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Secret Store** | Type of secret store. Select **Delinea Secret Server**. | | **Username (path)** | Path to your secret key in the format `?key=` where \ is the number found in the URL of your secret, and where \ is one of the parameters of the secret in the Delinea interface. For example, if your secret URL is `https://example.secretservercloud.com/app/#/secret/7/general`, and if you created the secret with the Username parameter set, you would enter `7?key=Username`. | | **Password (path)** | Path to your secret key in the format `?key=` where \ is the number found in the URL of your secret, and where \ is one of the parameters of the secret in the Delinea interface. For example, if your secret URL is `https://example.secretservercloud.com/app/#/secret/7/general`, and if you created the secret with the Password parameter set, you would enter `7?key=Password`. | ### Related documentation Delinea publishes its own guide to this integration, covering the same setup from the Secret Server side: * [Integrating StrongDM with Secret Server](https://docs.delinea.com/online-help/integrations/strongdm/strong-dm-integration-secret-server.htm): Overview, supported deployment models, and use cases * [Prerequisites](https://docs.delinea.com/online-help/integrations/strongdm/prerequisites.htm): Delinea-side requirements for each deployment model * [Configuration](https://docs.delinea.com/online-help/integrations/strongdm/configuration.htm): Delinea-side setup steps, including creating the Platform role, group, and service user for Platform mode The following are additional references used in this guide: * [Creating Users](https://docs.delinea.com/online-help/secret-server/users-roles/users/creating-users/index.htm): Creating an Application Account in standalone Secret Server * [Adding Users](https://docs.delinea.com/online-help/delinea-platform/users/add-users.htm): Creating the Platform service user used for Platform mode * [Using Secret Server APIs from Delinea Platform](https://docs.delinea.com/online-help/platform-api/secret-server-apis-from-platform.htm): Details on the OAuth token exchange StrongDM performs in Platform mode * [Connecting to Secret Server Cloud](https://docs.delinea.com/online-help/delinea-platform/secrets-integration/secrets-cloud.htm#EnablePlatformIntegrationinSecretServer): Enabling Secret Server Cloud Platform Identity Integration * [Secret Stores Reference](/admin/access/secret-stores.md): How StrongDM secret store integrations work in general --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.strongdm.com/admin/access/secret-stores/delinea-secret-server.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.