Skip to content

Delinea to Azure Key Vault Syncing

Purpose

The goal of synchronizing Delinea with Azure Key Vault are as follows:

  1. Allow simpler secrets management and rotation. For secrets that are managed by third parties (e.g. SQL server passwords, API keys), Children's National uses Delinea to host and manage access to secrets. This allows resource owners to regularly or automatically update passwords on applications. By performing synchronization, the updated passwords can be pushed up to Azure Key Vault for use by Enterprise Cloud resources without for manual copy-pasting. They can even be pushed to multiple Key Vaults from Delinea, further reducing manual effort.
  2. Create backups of secrets. Secrets that were managed in Key Vault previously now have the ability to remain in Delinea and be pushed up to new Key Vaults as needed. In the case of a loss or need to recreate secrets in a Key Vault, Delinea can be used to securely store them while they are changed over.

Overview

This guide assumes you are familiar with using Delinea, Azure Key Vault, Entra applications, and RBAC.

Part 1: Registering a Delinea-interfacing Application

  1. Log into https://portal.azure.com
  2. Activate any relevant roles you may have in Privileged Identity Management (PIM)
  3. In the search bar, type "App Registrations" and click the page.
  4. Either create an application or choose one we have from the list. We are currently using "Delinea Secret Server Azure Integration".
  5. On the side, click "Manage" and then "Certificates & secrets"
  6. Click the "Client secrets" tab and then "New client secret"
  7. Copy the Secret ID and Value.

Warning

Remember to copy the Value! You will not be able to see it again without recreating the client secret.

Part 2: Assigning Role-based Access Control (RBAC) and Firewall Rules

  1. Search for the Key Vault you want to sync with Delinea and go to its Overview page
  2. Click "Access control (IAM)" on the left side
  3. Click "Add" and "Add role assignment"
  4. Search for "Key Vault Secrets Officer" in the list of roles and click on it. Then click "Next"
  5. Click "Select members" and choose the name of the app that interfaces with Delinea. For us, it should be "Delinea Secret Server Azure Integration". Then click "Select" and then "Review + assign"
  6. On the final page, look over all the information, then click "Review + assign"
  7. Click "Settings" and "Networking" on the left side
  8. In the Firewall section, add the following two IP ranges:
  9. 20.228.138.112/29 (Delinea egress)
  10. 52.190.184.16/29 (Disaster Recovery)

Part 3: Linking Secret Server to Azure

  1. Log into https://cnh.delinea.app
  2. Create a secret with the Azure Application Registration template:
    1. Secret Name: Follow the naming guidelines.
    2. ClientId: Copy the Secret ID from the Azure app secret
    3. ClientSecret: Copy the Value from the Azure app secret
    4. Tenant ID: Copy the Tenant ID from the Azure subscription. You can find this by searching for "Tenant properties" in Azure.
    5. Site: Keep the "Default" value

link-app-to-akv

  1. On the left, hover over "Secret Server" and then click "External secrets" in the list
  2. Click "Create external vault link":
    1. Type: Azure Key Vault
    2. Credential Secret: Choose the name from the list of the secret created in the previous part
    3. Input type: Click "Automatic List" and choose the Key Vault(s) you need from the list
  3. Sync the vault to pull the names of secrets down into Delinea
    1. You can use the "External secrets" page from before to view a list of these secrets, but the filter must be set to "Synchronization: All states" to see them as the secrets will not be linked to Key Vault initially

Sources:

  1. https://docs.delinea.com/online-help/secret-server/secret-operations/secret-management/external-secrets/akv/index.htm?cshid=AKV
  2. https://docs.delinea.com/online-help/secret-server//networking/general/secret-server-ports/index.htm#secretservercloudcom