> For the complete documentation index, see [llms.txt](https://docs.strongdm.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.strongdm.com/admin/access/secret-stores/delinea-secret-server.md). # Delinea Secret Server {% hint style="info" %} This feature is part of the Enterprise plan. If it is not enabled for your organization, please contact StrongDM at the [StrongDM Help Center](https://help.strongdm.com/hc/en-us). {% endhint %} ## Overview Delinea Secret Server is a service for securely storing and accessing secrets, such as API keys, passwords, certificates, and cryptographic keys. This guide describes how to integrate Secret Server with StrongDM. Secret store integrations allow you to use your existing third-party secret stores with StrongDM. Your credentials are stored in a service that is controlled by you, and those credentials are never transmitted to StrongDM in any form. If you would like to learn more about how the Secret Store integration works and why you might wish to use it, please read the [Secret Stores Reference](/admin/access/secret-stores.md). {% hint style="info" %} Delinea also publishes a guide to this integration from the Secret Server side. Please see [Integrating StrongDM with Secret Server](https://docs.delinea.com/online-help/integrations/strongdm/strong-dm-integration-secret-server.htm) and the linked Prerequisites and Configuration pages (see [Related documentation](#related-documentation)). {% endhint %} ## Prerequisites The following items are required to integrate Secret Server with StrongDM: * StrongDM account with the Administrator permission level * Healthy StrongDM gateway or relay to allow authentication with Secret Server * Delinea Secret Server account set up with a user's username and password, and at least one secret to a resource * Correct path(s) to the secret(s) stored in Secret Server {% hint style="info" %} If you plan to use Delinea Platform mode instead of standalone Secret Server, see [Authentication modes](#authentication-modes) for additional prerequisites. {% endhint %} ## Configuration To integrate StrongDM with Delinea Secret Server, follow the steps in this section to set up your Secret Server account and secrets, configure your gateway or relay, and create the secret store in StrongDM. ### Set up Secret Server account and secrets 1. Log in to your Secret Server account. For the purposes of this guide, we log in with the **Local Login** option. 2. Go to **Administration** > **Users, Roles, Access** > **User Management**. 3. Ensure that you have a user set up with which the StrongDM service can authenticate to Delinea. The user should have a username and password, which are the credentials needed to access secrets stored in Secret Server. Additionally, the user must have the **Application Account** option set to **Yes** in order for it to work with StrongDM. For background on Application Accounts, see [Creating Users](https://docs.delinea.com/online-help/secret-server/users-roles/users/creating-users/index.htm) in the Delinea documentation. 4. Go to the **Secrets** section. 5. Ensure that you have an existing secret. If you do not, click **Create Secret** to add one. 6. Select a secret and notice the URL in your web browser's address bar. It should look similar to `https://example.secretservercloud.com/app/#/secret/7/general`, with a number value, such as `7`. The number represents the key to the secret stored in Secret Server. Remember the URL for when you are done with configuration and want to [connect to a StrongDM resource](#connect-to-a-strongdm-resource). ### Authentication modes StrongDM auto-detects which Delinea authentication mode to use based on the Server Address that you provide. Please see the [Configure your gateway or relay](#configure-your-gateway-or-relay) section. Use **Secret Server mode** if you run standalone Secret Server Cloud or Secret Server On-Premises. Use **Delinea Platform mode** if your organization has upgraded to the Delinea Platform and wants to authenticate with a Platform-native service user instead of maintaining a separate Secret Server Application Account. #### Secret Server mode (default) Secret Server mode is used when the `DELINEA_SERVER_URL` (the Server Address) is a Secret Server Cloud or on-premises URL. `DELINEA_USERNAME` and `DELINEA_PASSWORD` are the Secret Server user account credentials. #### Delinea Platform mode Delinea Platform mode is used when `DELINEA_SERVER_URL` (the Server Address) is a Delinea Platform tenant URL (for example, `https://your-tenant.delinea.app`). In this mode: * `DELINEA_USERNAME` holds the Platform OAuth client ID. * `DELINEA_PASSWORD` holds the Platform OAuth client secret. StrongDM exchanges these for an access token via the tenant's identity service (`client_credentials` grant, `xpmheadless` scope), and then queries the tenant's Vault Broker to locate the backing Secret Server. Both lookups happen on the configured gateway or relay; no Delinea credentials are sent to StrongDM. **Prerequisites for Platform mode** * The Platform tenant must have Secret Server Cloud Platform Identity Integration enabled. See [Connecting to Secret Server Cloud](https://docs.delinea.com/online-help/delinea-platform/secrets-integration/secrets-cloud.htm#EnablePlatformIntegrationinSecretServer) in the Delinea documentation. * You must have a Platform OAuth client with the `xpmheadless` scope; the client ID and secret are what you supply via `DELINEA_USERNAME` and `DELINEA_PASSWORD`. To create this service user, see [Adding Users](https://docs.delinea.com/online-help/delinea-platform/users/add-users.htm) in the Delinea documentation. For background on the underlying token exchange, see [Using Secret Server APIs from Delinea Platform](https://docs.delinea.com/online-help/platform-api/secret-server-apis-from-platform.htm). ### Configure your gateway or relay To allow communication with Secret Server, StrongDM needs to know what credentials to use. You can pass credentials by either provisioning credentials to the StrongDM node (gateway, relay, or proxy worker), or you can configure your gateway or relay environment with properties as environment variables. #### Node credentials provisioning method (recommended) You can provision `DELINEA_USERNAME` and `DELINEA_PASSWORD` to the node instead of setting them as environment variables. On the gateway or relay, run: ```sh sdm nodesecrets set DELINEA_USERNAME sdm nodesecrets set DELINEA_PASSWORD ``` Each value is entered at a hidden prompt and never appears in the environment file. A provisioned credential takes precedence over an environment variable of the same name. This applies in both authentication modes. In Delinea Platform mode, the same two variables carry the Platform OAuth client ID and client secret. Note that `DELINEA_SERVER_URL` and `DELINEA_API_TENANT` are configuration, not credentials, and are read from the environment only. Environment variables remain fully supported and no migration is required. For more information, please see [Provision Node Credentials](/admin/access/secret-stores.md#provision-node-credentials). #### Environment variables method Use the following steps to configure your gateway or relay environment with properties as environment variables. To allow communication with Secret Server, StrongDM needs to know what credentials to use. You can pass credentials by either provisioning credentials to the StrongDM node (gateway, relay, or proxy worker), or you can configure your gateway or relay environment with properties as environment variables. #### **Node credentials provisioning method (recommended)** You can provision `DSV_CLIENT_ID` and `DSV_CLIENT_SECRET` to the node instead of setting them as environment variables. On the gateway or relay, run: ```sh sdm nodesecrets set DSV_CLIENT_ID sdm nodesecrets set DSV_CLIENT_SECRET ``` Each value is entered at a hidden prompt and never appears in the environment file. A provisioned credential takes precedence over an environment variable of the same name. You must still restart the service. Note that `DSV_TENANT` and `DSV_TLD` are configuration, not credentials, and they are read from the environment only. Alternatively, you can set them in the Admin UI, which takes precedence over the environment variable. Environment variables remain fully supported and no migration is required. See [Provision Node Credentials](/admin/access/secret-stores.md) for container support and how to migrate existing environment variables. #### **Environment variables method** Use the following steps to configure your gateway or relay environment with properties as environment variables. The table shown includes the environment variables that Delinea supports. Add all required environment variables on your relay or gateway. For `DELINEA_SERVER_URL` and `DELINEA_API_TENANT`, you must set one but not both. Open the environment file for editing. The default location is `/etc/sysconfig/sdm-proxy` for gateways and relays, or `/etc/sysconfig/sdm-worker` for proxy clusters. Add or edit the following environment variables: | Environment variable | Requirement | Description | | -------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `DELINEA_USERNAME` | Required |

Credential identifier that StrongDM uses to authenticate
to Delinea. In Secret Server mode, this is the Secret Server user account
username. In Delinea Platform mode, this is the Platform OAuth client ID.
See Authentication modes.

| | `DELINEA_PASSWORD` | Required |

Credential secret that StrongDM uses to authenticate to
Delinea. In Secret Server mode, this is the Secret Server user account
password. In Delinea Platform mode, this is the Platform OAuth client
secret. See Authentication modes.

| | `DELINEA_SERVER_URL` | Optional | URL of your Delinea instance. Two URL shapes are supported and auto-detected: A Secret Server URL (such as `https://example.secretservercloud.com` or `https://secretserver.example.com`), or a Delinea Platform tenant URL (such as `https://your-tenant.delinea.app`). When a Platform URL is supplied, StrongDM authenticates against the tenant's identity service and discovers the underlying Secret Server URL automatically. This is only needed if you are using an on-premises version of Delinea or Thycotic, where you are not logged in to any Software as a Service (SaaS) but you are logged in to your own server. It is used if you did not already set the server address in the Admin UI when adding the secret store. | | `DELINEA_API_TENANT` | Optional |

(Secret Server Cloud only): Your Delinea Secret Server Cloud tenant name, which you can find in your Secret Server URL (such as ), where the tenant name is "example."
Leave this blank when using a Delinea Platform tenant URL or an on-premises Secret Server URL. It is used if you did not already set the tenant name in the Admin UI when adding the secret store.

| {% hint style="info" %} For both `DELINEA_API_TENANT` and `DELINEA_SERVER_URL`, the properties set in the Admin UI take precedence over the environment variable. The environment variable is only used if the setting in the Admin UI is empty. See section [Create a secret store in StrongDM](#create-a-secret-store-in-strongdm). {% endhint %} ### Create a secret store in StrongDM 1. Log in to the StrongDM Admin UI. 2. Go to **Settings** > **Secrets Management** and to the **Secret Stores** tab. 3. Click **Add secret store**. 4. On the **Add Secret Store** form that displays, set all the required [secret store properties](#secret-store-properties). ![](https://4180056444-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FF7eka9SH5TT8nJm2ZfWj%2Fuploads%2Fgit-blob-638404a056b9a91772c4ab6306dd6fd04af576b5%2Fsecretstores-delinea.png?alt=media) 5. Click **Create secret store**. If you have configured the relay or gateway server correctly for Secret Server access and authorization, you can see the green online indicator. #### Secret store properties | Property | Requirement | Description | | ------------------ | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Display Name** | Required | The name for this secret store integration that is displayed throughout StrongDM | | **Type** | Required | The type of secret store; select **Delinea Secret Server** | | **Server Address** | Optional | The URL of your Delinea instance. Two URL shapes are supported and auto-detected: A Secret Server URL such as `https://example.secretservercloud.com` or `https://secretserver.example.com` or a Delinea Platform tenant URL such as `https://your-tenant.delinea.app`. When a Platform URL is supplied, StrongDM authenticates against the tenant's identity service and discovers the underlying Secret Server URL automatically. If you already set [environment variables on your gateway or relay](#configure-your-gateway-or-relay), the server address is the same property as the `DELINEA_SERVER_URL` environment variable; what you set in the Admin UI takes precedence over the environment variable | | **Tenant Name** | Optional |

(Secret Server Cloud only): Your Delinea Secret Server Cloud tenant name, which you can find in your Secret Server URL such as , where the tenant name is "example".
Leave this blank when using a Delinea Platform tenant URL or an on-premises Secret Server URL. If you already set environment variables on your gateway or relay, the tenant name is the same property as the DELINEA\_API\_TENANT environment variable; what you set in the Admin UI takes precedence over the environment variable

| Configuration is now complete. ## Connect to a StrongDM Resource Now that you have set up secret store integration, you can use the Delinea Secret Server secret store to connect to different StrongDM resources. 1. In the Admin UI, go to **Infrastructure > Datasources**. 2. Click **Add Resource**. 3. On the form that displays, set the properties for your database resource, including the [secret store properties](#secret-store-properties) 4. When all required fields are complete, click **Create**. When the resource is ready, the **Health** icon indicates a positive, green status. ### Delinea Secret Server properties | Property | Description | | ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Secret Store** | Type of secret store. Select **Delinea Secret Server**. | | **Username (path)** | Path to your secret key in the format `?key=` where \ is the number found in the URL of your secret, and where \ is one of the parameters of the secret in the Delinea interface. For example, if your secret URL is `https://example.secretservercloud.com/app/#/secret/7/general`, and if you created the secret with the Username parameter set, you would enter `7?key=Username`. | | **Password (path)** | Path to your secret key in the format `?key=` where \ is the number found in the URL of your secret, and where \ is one of the parameters of the secret in the Delinea interface. For example, if your secret URL is `https://example.secretservercloud.com/app/#/secret/7/general`, and if you created the secret with the Password parameter set, you would enter `7?key=Password`. | ## Related documentation Delinea publishes its own guide to this integration, covering the same setup from the Secret Server side: * [Integrating StrongDM with Secret Server](https://docs.delinea.com/online-help/integrations/strongdm/strong-dm-integration-secret-server.htm): Overview, supported deployment models, and use cases * [Prerequisites](https://docs.delinea.com/online-help/integrations/strongdm/prerequisites.htm): Delinea-side requirements for each deployment model * [Configuration](https://docs.delinea.com/online-help/integrations/strongdm/configuration.htm): Delinea-side setup steps, including creating the Platform role, group, and service user for Platform mode The following are additional references used in this guide: * [Creating Users](https://docs.delinea.com/online-help/secret-server/users-roles/users/creating-users/index.htm): Creating an Application Account in standalone Secret Server * [Adding Users](https://docs.delinea.com/online-help/delinea-platform/users/add-users.htm): Creating the Platform service user used for Platform mode * [Using Secret Server APIs from Delinea Platform](https://docs.delinea.com/online-help/platform-api/secret-server-apis-from-platform.htm): Details on the OAuth token exchange StrongDM performs in Platform mode * [Connecting to Secret Server Cloud](https://docs.delinea.com/online-help/delinea-platform/secrets-integration/secrets-cloud.htm#EnablePlatformIntegrationinSecretServer): Enabling Secret Server Cloud Platform Identity Integration * [Secret Stores Reference](/admin/access/secret-stores.md): How StrongDM secret store integrations work in general --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.strongdm.com/admin/access/secret-stores/delinea-secret-server.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.