Manage secrets using CyberArk Conjur

This topic explains how to integrate Deploy with CyberArk Conjur to dynamically retrieve secrets — such as service account usernames and passwords — at deploy time. Deploy never stores or caches secrets from Conjur; they are fetched live from the Conjur API during each deployment or infrastructure lookup.

Compatibility

The xld-cyberark-conjur plugin is compatible with both:

• CyberArk Dynamic Access Provider
• Conjur Open Source server

How It Works

Conjur organizes secrets in a hierarchical namespace. Every secret lives at a full path made up of two parts:

<policy path>/<variable name>

For example, a service account password stored at service-accounts/prod/db-svc/password has:

• Policy path: service-accounts/prod/db-svc
• Variable name (Variable ID in Deploy): password

The Deploy plugin mirrors this structure with three configuration items (CIs):

Deploy CI	Purpose	Example value
ConjurServer	Connection to the Conjur server (URL, account, credentials)	https://conjur.example.com
ConjurPolicy	A policy path prefix scoped under a server	service-accounts/prod/db-svc
ConjurDictionary or ConjurLookupValueProvider	Consumer that lists variable names to retrieve	username, password

At runtime, Deploy combines the policy path and variable name to build the full Conjur path, calls the Conjur API to retrieve the value, and either substitutes it into a deployment package placeholder or resolves it as a CI property value. For details on Conjur policies, see Understanding Conjur policy.

Choosing Between a Dictionary and a Lookup Value Provider

Use case	Use this
Inject secrets into a deployment package (for example, replace {{db-password}} in a config file)	ConjurDictionary assigned to an environment
Resolve a secret for a CI property field (for example, the password field of a host or cloud target)	ConjurLookupValueProvider referenced from the CI field

Both use a ConjurPolicy to scope which secrets are accessible.

User Access Control

Deploy provides controls to limit access to Conjur secrets, ensuring that:

• Developers are authenticated and authorized to read secrets
• Role-based access to secrets is supported
• Conjur policies control which credentials can be used and by whom

Install the Plugin

1. Download the Deploy CyberArk Conjur plugin from the distribution site.
2. Place the plugin inside the XL_DEPLOY_SERVER_HOME/plugins/ directory.
3. Restart Deploy.

For details, see Install or remove Deploy plugins.

End-to-End Example: Retrieve a Service Account From Conjur

This example walks through the complete setup for dynamically retrieving a service account username and password stored in Conjur.

Conjur secrets (already stored on your Conjur server):

service-accounts/prod/db-svc/username  →  "svc_db_prod"
service-accounts/prod/db-svc/password  →  "s3cr3t!"

Deployment package (config file with placeholders):

db.username={{username}}
db.password={{password}}

At deploy time, Deploy resolves {{username}} and {{password}} by fetching:

• service-accounts/prod/db-svc/username
• service-accounts/prod/db-svc/password

from Conjur and substituting the values inline. The steps below show how to configure this.

Step 1: Create a CyberArk Conjur Server Connection

The ConjurServer CI stores the connection details for your Conjur server.

1. Hover over Configuration, click , and select New > secrets > cyberark > conjur > ConjurServer.

2. In the Name field, enter a name for the connection.

3. In the Server Address field, enter the Conjur server URL (for example, https://conjur.example.com).

4. In the Account field, enter your Conjur account name.

5. Enter credentials based on your authentication method:

   • Username/password authentication — Enter a Username and Password.
   • Host authentication — Enter the Host Name and Host API Key.

6. Click Save or Save and close.

   

Step 2: Add a Policy Path to the Server Connection

A ConjurPolicy CI represents a path prefix in your Conjur secret hierarchy. It scopes which secrets a dictionary or lookup provider can access. One server can have multiple policies — for example, one per application or environment.

1. Expand the Configuration node.

2. Hover over the Conjur server connection, click , and select New > secrets > cyberark > conjur > ConjurPolicy.

3. In the Name field, enter a descriptive name (for example, prod-db-service-accounts).

4. In the Path field, enter the policy path as it exists on your Conjur server (for example, service-accounts/prod/db-svc). Leave this blank only if your variables are stored directly under the root policy.

5. Click Save or Save and close.

6. Repeat to create additional policies as needed.

   

The new policies appear listed under the server connection and in the Policy Paths field when you open the server CI.

Step 3: Create an External Dictionary (for Placeholder Substitution)

A ConjurDictionary resolves secrets from Conjur and substitutes them into {{placeholder}} references in your deployment packages. The Variable IDs you list are the variable names relative to the selected policy path — they are also the placeholder keys used in your package.

Using the example above:

• Policy path: service-accounts/prod/db-svc
• Variable IDs: username, password
• Deploy fetches: service-accounts/prod/db-svc/username and service-accounts/prod/db-svc/password
• Package placeholders resolved: {{username}} and {{password}}

To create an external dictionary:

1. Hover over Environments, click , and select New > secrets > cyberark > conjur > ConjurDictionary.

2. In the Name field, enter a name for the dictionary.

3. In the Conjur policy field, select the ConjurPolicy you created in Step 2.

4. In the Variable IDs field, enter each variable name as it appears under the policy path in Conjur (for example, username and password). These must exactly match the Conjur variable names and will be used as the placeholder keys in your deployment package.

5. Click Save or Save and close.

   

6. Assign this dictionary to an environment so it is available during deployments to that environment.

Step 4: Create a Lookup Value Provider (for CI Property Fields)

Use a ConjurLookupValueProvider when you need to resolve a secret directly into a CI property field — for example, a service account password for a host or cloud target — rather than into a deployment package placeholder.

1. Hover over Configuration, click , and select New > secrets > cyberark > conjur > lookup > ConjurLookupValueProvider.

2. In the Name field, enter a name for the lookup provider.

3. In the Conjur policy field, select the ConjurPolicy that contains the secrets you want to resolve.

4. Click Save or Save and close.

   

Step 5: Use the Lookup Value Provider on a CI

After creating a lookup value provider, you can use it to resolve a secret into any CI property field that supports external lookup. The Lookup provider key you enter is the variable name relative to the policy path — the same as a Variable ID in the dictionary.

For example, to resolve a service account password for a host:

1. Hover over Infrastructure, click , and select New > overthere > SshHost.
2. Complete the required fields for the CI.
3. In the SU password field, click and select the ConjurLookupValueProvider you created in Step 4.
4. In the Lookup provider key field, enter the variable name as it appears under the policy path in Conjur (for example, password). Deploy will fetch <policy path>/password from Conjur at runtime.
5. Click Save or Save and close.