Last active
May 31, 2024 20:10
-
-
Save dadecoza/54f3dca00141897405634b2d839c27f2 to your computer and use it in GitHub Desktop.
Python Script for Retrieving Password from CyberArk (9.9.5) Password Vault
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import requests | |
class RetrieveCyberArkPassword: | |
def __init__(self, url, username, password, verify_ssl=True): | |
self.username = username | |
self.password = password | |
self.cyberark_url = url | |
self.cert = None | |
self.verify_ssl = verify_ssl | |
self.getCert() | |
def getCert(self): | |
logon_url = "%s/auth/Cyberark/CyberArkAuthenticationService.svc/Logon" % ( | |
self.cyberark_url | |
) | |
credentials = {"username": self.username, "password": self.password} | |
r = requests.post( | |
logon_url, | |
json=credentials, | |
headers=headers, | |
verify=self.verify_ssl | |
) | |
j = r.json() | |
self.cert = j["CyberArkLogonResult"] | |
def logoff(self): | |
url = "%s/auth/Cyberark/CyberArkAuthenticationService.svc/Logoff" % ( | |
self.cyberark_url | |
) | |
headers = { | |
"Content-Type": "application/json", | |
"Authorization": self.cert | |
} | |
r = requests.post(url, headers=headers, verify=self.verify_ssl) | |
def getAccountIDs(self, safe, keyword): | |
url = "%s/PIMServices.svc/Accounts?Keywords=%s&Safe=%s" % ( | |
self.cyberark_url, keyword, safe | |
) | |
headers = { | |
"Content-Type": "application/json", | |
"Authorization": self.cert | |
} | |
r = requests.get(url, headers=headers, verify=self.verify_ssl) | |
j = r.json() | |
return [a["AccountID"] for a in j["accounts"]] | |
def getPassword(self, account_id): | |
url = "%s/PIMServices.svc/Accounts/%s/Credentials/" % ( | |
self.cyberark_url, | |
account_id | |
) | |
headers = { | |
"Content-Type": "application/json", | |
"Authorization": self.cert | |
} | |
r = requests.get(url, headers=headers, verify=self.verify_ssl) | |
return r.text | |
if __name__ == '__main__': | |
cyberark = RetrieveCyberArkPassword( | |
url="https://cyberark.company.corp/PasswordVault/WebServices", | |
username="user01", | |
password="passw0rd", | |
verify_ssl=False | |
) | |
account_id = cyberark.getAccountIDs("SAFE-1", "application keyword")[0] | |
password = cyberark.getPassword(account_id) | |
print("Password: %s" % password) | |
cyberark.logoff() |
Thanks @dadecoza for sharing this , I am new to this so I have some questions
- Can I use it with my SAML based authentication? If yes then what parameters I need to add in here?
- This will help in retrieving passwords from the safe so can I implement it directly in my code where earlier I used to fetch credentials from INI File? ( Please share the additional steps required to replace my ini file with this automated password retrieval process if you have)
@KarnGusain did you find the Radius Approach ?
Is there and SSO based authentication option?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Ah, ok ty so much!