Skip to content

PAM Integration

PAM Integration

Integrate SSH-KLM with Privileged Access Management (PAM) solutions.

Supported PAM Solutions

Solution	Integration Type	Status
CyberArk	Credential Provider	GA
BeyondTrust	API Integration	GA
HashiCorp Vault	Secrets Engine	GA
Delinea (Thycotic)	API Integration	Beta

CyberArk Integration

Configuration

# SSH-KLM PAM integration config
pam:
  provider: cyberark

  cyberark:
    appId: "SSH-KLM"
    safe: "SSH-Keys"
    credentialProviderUrl: "https://cyberark.example.com/AIMWebService"

    # Certificate authentication
    clientCert: /etc/ssh-klm/cyberark-client.pem
    clientKey: /etc/ssh-klm/cyberark-client-key.pem

Credential Retrieval

// SSH-KLM retrieves credentials from CyberArk
const credential = await client.pam.getCredential({
  safe: 'SSH-Keys',
  object: 'root-server01'
});

BeyondTrust Integration

Configuration

pam:
  provider: beyondtrust

  beyondtrust:
    apiUrl: "https://beyondtrust.example.com/api"
    apiKey: ${BEYONDTRUST_API_KEY}
    managedSystemId: "ssh-servers"

HashiCorp Vault Integration

Setup

# Enable SSH secrets engine
vault secrets enable ssh

# Configure SSH-KLM role
vault write ssh/roles/ssh-klm \
  key_type=ca \
  default_user=admin \
  ttl=1h

Configuration

pam:
  provider: vault

  vault:
    address: "https://vault.example.com:8200"
    authMethod: approle
    roleId: ${VAULT_ROLE_ID}
    secretId: ${VAULT_SECRET_ID}
    sshPath: ssh

Credential Sync

SSH-KLM can sync discovered keys to PAM:

// Sync discovered keys to PAM vault
await client.ssh.syncToPam({
  filter: { status: 'managed' },
  pamProvider: 'cyberark',
  safe: 'SSH-Keys-Managed'
});