ASG remote desktop can read vault records from KeyHub. This includes the rotating password. The following steps will guide you through the process of configuring ASG remote desktop and KeyHub.
Prerequisite
-
A KeyHub group for the application.
You can either use an existing group or create a new one. The members of this group will be able to read their vaults using ASG remote desktop.
In the KeyHub console
Step 1
Create a new OIDC app.
-
Select MANAGE ACCESS.
-
Click ADD.
-
Select OAuth2/OIDC from the Type dropdown.
Step 2
-
Choose an appropriate name (eg. ASG remote desktop).
-
Choose the technical administration group (can be the group you chose earlier).
-
Choose the ownership group (can be the same group).
-
In the Application URIs you need to add "http://localhost:3017".
-
In scope you need to select Profile and Access your vaults.
-
Click SAVE.
| You need to copy the Secret to add to ASG remote desktop now. It will not be visible again. |
You can also make note of the Client identifier. You will need it later.
Step 3
-
Select the group tab.
-
Add the KeyHub group you want to use.
-
Done!
In ASG Remote desktop manager
Step 1
-
Select Tools.
-
Select Settings.
Step 2
-
Under Environment choose Extensions.
-
Select Topicus KeyHub integration.
-
Click OK.
-
A popup will notify you that ASG needs to restart. Click Yes.
Step 3
-
Navigate back to Tools, Settings and select Topicus KeyHub.
-
Fill in your KeyHub host URL (in our case "https://test.topicus-keyhub.com").
-
Fill in the Client ID noted earlier.
-
Fill in the Client secret noted earlier.
-
Click OK.
Step 4
-
Create a new private folder.
-
Right click the created folder and select Properties.
-
Select Topicus KeyHub.
-
Click Synchronize now.
A browser tab will open.
-
Log in to KeyHub.
-
Approve the access.
| You can ignore the unreachable webpage that pops up. |
ASG will show a popup that the synchronization has finished.
-
Click OK twice.
You will see that the vaults you are allowed to access in KeyHub now show up in the created folder.
Step 5
Create a credential for your KeyHub rotating password.
-
Right click the created folder and select New, Credential.
-
In General you only need to fill in a name.
-
In Options you will need to fill in your KeyHub username.
-
You will also need to fill in a password.
This can be anything as it will be overwritten by the rotating password on synchronization. -
For domain accounts you will also need to fill in the domain name.
-
In Topicus KeyHub you need to select Use rotating password option.
-
Click OK.
-
Rightclick the folder containing this credential and select Get Rotating Password.
| You can ignore the unreachable page. |
ASG will show a popup that the synchronization has finished.
-
All done!