All Collections
Integrations
HRIS (Human Resources Information System)
CyberArk - OAuth
CyberArk - OAuth

Set up steps to link a CyberArk account!

Collin Peterson avatar
Written by Collin Peterson
Updated over a week ago

This article is intended for HelloTeam users with ADMIN Access Level

Step 1: Log in to your CyberArk Admin Portal

  • Log in to your CyberArk portal via your organization’s tenant URL.
    The portal home page should look something like this:

  • Switch to the admin portal view by clicking on the grid symbol next to “Identity User Portal” and selecting Admin Portal:

  • Now your web page’s top left corner should look like this:

Step 2: Create a SCIM Client Role

  1. Navigate to Core Services > Roles:

  2. Click Add Role in the top left corner

  3. Name your role “SCIM Client” and click Save. You will be automatically redirected to the settings page for the new role.

  4. Under Administrative Rights, click Add, search/select the User Management right, and click Save.

    1. Note that you need to select User Management, NOT Read Only User Management.

  5. Click Save.

Step 3: Create a Custom OAuth Client

  1. Navigate to Apps & Widgets > Web Apps:

  2. Click Add Web Apps in the top right corner.

  3. On the Custom tab, next to the OAuth2 Client entry, click Add:

  4. In the Add Web App screen, click Yes to add the application.

  5. Click the Close button of the Add Web Apps modal. You will be redirected to a screen for configuring your OAuth2 client.

  6. On the Settings page, complete the following fields:

    1. Application ID: any arbitrary value you choose, e.g. scim_oauth_client

      1. This is a unique key used to build the OAuth2 endpoint URL.

      2. This is the Application ID that will need to be entered during the linking flow.

  7. On the General Usage page, complete the following fields to specify the types of credentials that can be used to authorize with this server:

    1. Client ID Type: Check the boxes “Confidential” and “Must be OAuth Client”

  8. On the Tokens page, complete the following fields:

    1. Token Type: JwtRS256

    2. Auth methods: Client Creds

    3. Access token lifetime: 5 hours

  9. On the Scope page, click Add and create a new scope as follows:

    1. Name: SCIMAPIScope

    2. Allowed REST APIs:

      1. click Add

      2. add an entry with the text scim

      (Please enter these fields exactly as shown)

  10. On the Permissions page, add the SCIM client role that we set up in Section 1 and make sure the Run permission box is checked.

  11. Click Save at the bottom of the page.

Step 4: Create a CyberArk Service User

  1. Navigate to Core Services > Users

  2. Click Add User in the top right corner

  3. Complete the following fields:

    1. Login name

      1. This field combined with the @ symbol and chosen suffix will become your username and Client ID. In the below example that full value is “CLIENT_ID_PREFIX@merge”.

    2. Display name (set to whatever you like)

    3. Password (This field will become your password and Client Secret.)

    4. Check the box under the Status section labeled “Is OAuth confidential client”. Upon clicking this box you should see the email field grayed out and the “is service user” box checked automatically.

  4. Navigate back to Core Services > Roles and open the SCIM client role we created in Section 1.

  5. Under the Members section, click Add and then add your newly created user.

  6. Click Save.

Step 5: Enter information in the Linking Flow

  1. Back in the linking flow enter the URL used to log into the CyberArk portal

  2. Next enter the Application ID you created from step 3.6 above

  3. On the following page, enter your Client ID and Secret/Password from step 4.3

  4. The linking flow should complete!

To ensure you are viewing the most current information
regarding this specific HRIS, please visit:

https://help.merge.dev/en/articles/8545851-cyberark-oauth

Did this answer your question?