---
updatedAt: 2026-01-02T13:36:40.000Z
---

# CA Service Desk with Password Safe Ticket System | PS

Integrating CA Service Desk Manager with Password Safe ticket system does not require a BeyondInsight connector. There are two ways to configure CA Service Desk with Password Safe:

* Use a functional account that has permissions to access CA Service Desk Manager.
* Use a PKI certificate.

## Use a functional account for access

### Create the functional account

1. From the left sidebar in BeyondInsight, click **Configuration**.\
   The **Configuration** page displays.

2. Under **Privileged Access Management**, click **Functional Accounts**.\
   The **Functional Accounts** page displays.

3. Click **+ Create New Functional Account**.\
   The **Create New Functional Account** form displays in the right panel.

4. Under **Type**, select **Ticket System**.

5. Select **CA Service Desk** from the **Platform** list.

[block:image]{"images":[{"image":["https://files.readme.io/3eff3bb0c951d50524ec9f3702b1d675dc23532e8ce40d465c5986694df93251-image.png",null,"Create new functional account panel."],"align":"center","sizing":"400px","caption":"Create new functional account"}]}[/block]

6. Enter a **Username**.
7. Enter the full URL to the CA Service Desk Manager API in the **Domain** field.
8. Enter the CA Service Desk Manager credentials. The user requires the **Passwordsafe\_ticket\_system** role. The unique name to find this role is **x\_bets\_bi\_integrat.passwordsafe\_ticket\_system**.
9. Enter an **Alias** and a short **Description**, if desired.
10. Select a **Workgroup**.
11. Click **Create Functional Account** when done.

### Create the access policies

Create two access policies for the following scenarios:

* Users that need ticket validation (approval required)
* Emergency access (auto approve)

Use the following steps:

1. In the BeyondInsight Console, go to **Configuration > Privileged Access Management Policies > Access Policies**.
2. In the **Access Policies** pane, click **Create New Access Policy**.
3. Name the policy and save it.
4. Click **+** again to create the second policy and save it.
5. In the **Access Policy** pane, select the policy that requires approval.
6. In the **Schedule** tab, click **Create New Schedule**.
7. Configure the access schedule settings: **Time**, **Recurrence**, **Range**, and **Location**.
8. For each **Type**, under **Approvers**, select at least one from each list and then click **Create Schedule**.
9. In the **Access Policy** pane, select the policy that you created for emergency access and then click **Create New Schedule**.
10. Configure the access schedule settings: **Time**, **Recurrence**, **Range**, and **Location**.
11. For each **Type**, under **Approvers**, click the down arrow in each box until **Auto Approve** appears checked, and then click **Save**.

### Create the ticket system

1. From the left sidebar in BeyondInsight, click **Configuration**.\
   The **Configuration** page displays.
2. Under **Privileged Access Management**, click **Ticket Systems**.\
   The **Ticket Systems** page displays.
3. Click **Create New Ticket System +**.\
   The **New Ticket System Details** form displays in the right panel.
4. Select **CA Service Desk Ticket System** from the **Platform** list.
5. Select the functional account, and then enter a name for the system. **Access Policy Certificate Common Name** and **Access Policy Code** are not required.
6. Click the toggles to enable the features you want. The options are:
   * Auto Approve on Ticket Number Validation
   * Enable Emergency Approval Without Ticket Number
   * Make this ticket system the default
7. Click **Create Ticket System** when done.

> ℹ️
>
> * You need only to check the first box. The second and third boxes are optional.
> * The **Access Policy Certificate Common Name** and **Access Policy Code** fields are not used.
> * For any tickets being verified using this ticket system, you must ensure within the CA Service Desk Manager that the **Requester** is populated in the **Assignee** field. The User ID here must match the Password Safe User ID.

### Configure global settings

1. In the BeyondInsight Console, go to **Configuration > Privileged Access Management > Global Settings**.
2. Ensure the following options are enabled in the **Requests** section:
   * Require a ticket System and Ticket Number for requests
   * Reason is required for new requests
3. Select other settings as needed.
4. Click **Update Request Settings**.

## Use a PKI certificate access policy

An alternative way to set up access to CA Service Desk Manager is to use a PKI certificate.

### Import the PKI certificate

1. Enable PKI login in CA Service Desk Manager. Instructions are in **\Java\PKI\_loginServiceManaged\_JAVA\_steps.doc**, located on the CA SDM server.
2. Copy and install the certificate generated above to the Password Safe server.
   * Open the Microsoft Management Console (**mmc.exe**).
   * Add the **Certificates** snap-in.
   * Select computer account and local computer.
   * Expand the **Personal** folder, and then right-click the **Certificates** folder.
   * Select **All Tasks** > **Import**.
   * Click **Next** and browse to the certificate location.
   * Set file types to **All Files (\*.\*)**.
   * Select the certificate and open it.
   * On the **Private key protection** page, enter the certificate password and then check the **Mark this key as exportable** box. This allows you to back up or transport your keys at a later time.
   * On the **Certificate Store** page, select **Personal**.
   * Click **Finish**.
3. Assign **IIS\_IUSRS** permissions to use keys.
   * Right-click the certificate, and then select **All Tasks > Manage Private Keys**.
   * Add local computer **IIS\_IUSRS**.
   * Assign **Full Control**.

### Create the functional account

1. From the left sidebar in BeyondInsight, click **Configuration**.\
   The **Configuration** page displays.
2. Under **Privileged Access Management**, click **Functional Accounts**.\
   The **Functional Accounts** page displays.
3. Click **+ Create New Functional Account**.\
   The **Create New Functional Account** form displays in the right panel.
4. Under **Type**, select **Ticket System**.
5. From the **Platform** list, select **CA Service Desk**.
6. In the **Domain** box, enter the URL to the CA Service Desk web service.
7. Enter a username and password. The information is not used in this implementation, so it can be anything.
8. Enter an **Alias** and a short **Description**, if desired.
9. Select a **Workgroup**.
10. Click **Create New Functional Account** when done.

### Create the access policies

> ℹ️
>
> Two access policies are required, as documented above for functional account access.

### Create the ticket system

1. From the left sidebar in BeyondInsight, click **Configuration**.\
   The **Configuration** page displays.
2. Under **Privileged Access Management**, click **Ticket Systems**.\
   The **Ticket Systems** page displays.
3. Click **Create New Ticket System +**.\
   The **New Ticket System Details** form displays in the right panel.
4. Select **CA Service Desk Ticket System** from the **Platform** list.
5. Select the **Functional Account**, and then enter a name for the system.
6. Enter **ServiceDesk DEFAULT** in the **Access Policy Certificate Common Name** field.
7. Enter **DEFAULT** in the **Access Policy code** field.
8. Click the toggles to enable the features you want. The options are:

   * Auto Approve on Ticket Number Validation

   * Enable Emergency Approval Without Ticket Number

   * Make Ticket System the Default

   > ℹ️
   >
   > You need only to check the first box. The second and third boxes are optional.
9. Click **Create Ticket System** when done.