Create a password vault

Use this task to register an external secret manager with DCT Compliance. The vault stores the connection details DCT Compliance uses to authenticate to the secret manager and fetch file connector credentials at runtime.

A vault alone is not enough for a connector to use vault-based authentication. After creating the vault, create at least one credential path that points to a secret inside it. See Create a credential path.

Prerequisites

Before configuring password vaults, ensure that a Job Orchestrator is configured and a Compliance Node is attached and online. Password vault authentication is performed by the Compliance Node during connection testing and job execution.

Steps

  1. Go to Compliance > Delphix Infrastructure > Password Vaults.

  2. Click + Password Vault.

  3. Enter a Name and, optionally, a Description.

  4. Select a Vault Type. The available options include: AZURE, CYBERARK, GCP, and HASHICORP. You cannot change this after saving.

  5. (Optional) Add tags: enter a Tag Key and Tag Value, then click + Tag.

  6. In the Configuration field, enter the vault connection details as JSON. See Vault type reference for the required keys. Click Format JSON to format the entry.

  7. Click Create.

Vault type reference

The Configuration field accepts a JSON object. The required keys vary by vault type. DCT encrypts and masks sensitive keys such as token, privateKey, secretId, serviceAccountIdJson, and clientSecret — so they appear as ****** after saving.

HashiCorp

Copy 
{
  "host": "vault.example.com",
  "port": 8200,
  "authType": "TOKEN",
  "token": "hvs.your-token"
}

Include the optional namespace key for HashiCorp Enterprise. It must match the namespace on the HashiCorp server.

CyberArk

Copy 
{
  "host": "cyberark.example.com",
  "port": 443,
  "appId": "MyApp",
  "authType": "CERTIFICATE",
  "certificate": "-----BEGIN CERTIFICATE-----\nMIa1ZqA=\n-----END CERTIFICATE-----",
  "privateKey": "-----BEGIN PRIVATE KEY-----\nMIa1ZqA=\n-----END PRIVATE KEY-----"
}

Provide certificates and private keys as a single line. To convert a certificate or private key to one line on Linux, run: awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}' file_name

Azure key vault

Copy 
{
  "host": "my-keyvault.vault.azure.net",
  "authType": "SECRETS",
  "clientId": "your-client-id",
  "tenantId": "your-tenant-id",
  "clientSecret": "your-client-secret"
}

To get clientId and tenantId, create an App Registration in your Azure account and associate it with the Azure Key Vault. See the Microsoft Azure Key Vault documentation.

GCP secret manager

Copy 
{
  "authType": "SERVICE_ACCOUNT",
  "serviceAccountIdJson": { ... }
}

The serviceAccountIdJson value is the full GCP service account key JSON. Get it from IAM & Admin > Service Accounts in the Google Cloud console by creating and downloading a JSON key.