Set up automated password rotation workflow with PRA Vault credential injection

A workflow for Password Safe and Privileged Remote Access

Privileged account passwords that never change are a major security risk. If a password is stolen, an attacker can use it indefinitely. Automated password rotation in Password Safe changes passwords on a set schedule and after each use. When you combine this with credential injection in Privileged Remote Access (PRA), users connect to systems without ever seeing the password. This removes a key path for credential theft.

Scope of this guide

This workflow connects Password Safe's automated password rotation to a PRA Vault session. Password Safe manages and rotates the credential, and PRA injects the current credential into the session automatically. You set up this connection once, and both products handle it from that point on.

Prerequisites

• You have the IT Administrator role in BeyondInsight.
• Password Safe is licensed and installed.
• Privileged Remote Access is licensed and installed.
• The target system is reachable from the Password Safe server.
• A functional account exists on the target system that Password Safe can use to perform password changes.
• A Jump Client or Jumpoint (renamed to Gateway in SRA 26.2 and later) must be installed on and connected to the target system in PRA.

Steps

This workflow spans two products, so it is grouped into three phases. Each phase has its own numbered list starting at 1.

Step 1: Set up the managed account in Password Safe

1. To onboard accounts, see Onboard.

Step 2: Add a vault account in PRA

1. Sign in to the PRA administrative interface.
2. Select Vault > Connections.
3. Add a Password Safe Account.

   📘

   For more information on how to add a Password Safe account in PRA, see Create connection.

4. Select Vault >Discovery. Run discovery and import selected accounts.

   📘

   For more information about Password Safe Discovery, see Initiate a discovery job.

5. In the BeyondInsight URL field, enter your BeyondInsight URL.
6. In the Managed Account field, search for and select the managed account you set up in Step 1.
7. In the Jump Items section, select the Jump Item or Jump Group that represents the target system.
8. Select Save.

Step 3: Enable credential injection

1. In PRA, select Users & Security > Session Policies.
2. Select the session policy that applies to sessions on the target system. If no policy exists, select Add Session Policy to create one.
3. Under Credential Injection, enable Inject Credentials at Session Start.
4. Select Save.
5. Select Jump > Jump Items and find the Jump Item for the target system.
6. In the Jump Item settings, confirm that the session policy with credential injection is assigned to this Jump Item.
7. Select Save.

Verify the results

Start a test session to the target system through PRA. Confirm that PRA connects and signs in to the system automatically, without you entering a password. Then, in BeyondInsight, select Password Safe > Requests and confirm that a checkout event appears for the managed account. This event shows that PRA requested the credential from Password Safe and checked it back in after the session ended.

Next steps

• Configure a rotation policy in Password Safe -- Set the schedule and rules for how often passwords change.
• Set up an approval workflow for PRA sessions -- Require approval before a session can start.
• Review session recordings in PRA -- Watch recordings of sessions that used credential injection.

Related resources

• Password Safe documentation
• Privileged Remote Access documentation
• Credential injection overview