REST API integration option for CyberArk CCP for Zurich feature - Support and Troubleshooting

REST API integration option for CyberArk CCP for Zurich feature Issue .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Set up new CyberArk CCP integration ==> "External Credential Storage and Management Application" (Store App) version 1.3.1 on a Zurich family

Release .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Zurich and above

Resolution .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } CyberArk CCP Integration – MID Server Configuration Update

On Certificate Requirements for MID Server Connectivity

When connecting to CyberArk CCP through a MID Server, a certificate must be uploaded as part of the authentication process. This is a ServiceNow requirement to authenticate the endpoint when the MID Server is used to connect to an external site. Note that this requirement does not apply when testing connectivity directly from a local machine using a PowerShell command.

Please refer to section 4 — "CCP Authentication Options (MID-side Setup)" — in the attached document "CyberArk CCP Setup on MID Server.pdf" . Under this section, either Step A or Step B is mandatory before proceeding to Step C, which covers the "Use Allowed Machines" configuration. We are updating the documentation to reflect this more clearly.

For additional context on the different authentication methods available — all of which are secure — please refer to the official CyberArk documentation: https://docs.cyberark.com/credential-providers/latest/en/content/cp%20and%20ascp/application-authentication-methods-general.htm#Allowedmachinesauthentication

Please update your MID Server config.xml file with the following recommended CCP configuration parameters:

/Accounts"/> "/> "/> "/> "/>

OPTION 1: On the Custom JAR Solution and Associated Risks

We have accommodated your request to implement a custom JAR as part of the CyberArk CCP integration. Please find the attached file: "mid-external-credential-storage-1.3.1-resolver.jar.zip" .

As this custom JAR falls outside of our standard, validated solution set, please be aware that our team is unable to perform security validation on this component. As a result, your organization will bear responsibility for monitoring and responding to any security-related incidents that may arise from its use in your environment.

To help mitigate potential risks, we strongly recommend ensuring the following security parameters are set to true in your MID Server config.xml :

OPTION 2 : On Using a Valid Certificate Not Configured in CyberArk

We have confirmed with our development team that it is possible to retrieve credentials from the CCP Server using a valid certificate that is not registered in CyberArk. The setup involves the following steps:

Use any valid self-signed PFX certificate on the MID Server, and configure the CCP IIS server HTTPS bindings with a self-signed certificate that includes the correct Subject Alternative Name (SAN) — populated with the DNS name and IP address if the customer is using an IP in the URL.

The CCP IIS server should be set to Anonymous Authentication: Enabled , and the following parameter must be set in the MID Server config.xml :

Important: With this configuration, no certificate-based authentication is taking place. This approach is solely intended to satisfy the MID Server's certificate requirement while bypassing certificate-based authentication. Please ensure your team understands this distinction before deploying in a production environment.