CyberArk - PSM Connection Component - SmartConsole + Gaia

[Norbert_Bohusch]

I managed to automate login for SmartConsole and Gaia for the CyberArk PSM. I developed it with R80.20.M2 but I assume it should work for all R80.x versions.

It writes login information into a temporary file of the PSM Shadow User and uses the CLI parameter -p to read this file. The temporary file is deleted directly after logon. (reference: Command Line Arguments to R80.10 SmartConsole.exe)

It should be remembered that everybody with access to the PSM and the rights needed to open the PSM Shadow Users Temp directory, might see the credentials during the logon process!

The platform which uses the connection needs the following parameters:

- username = SmartConsole User

- address = IP/FQDN of Check Point Management

- domain (optional) = Domain for MDM

If the SmartConsole User is configured to use "OS Password" and is configured on Gaia, the CyberArk preintegrated CPM plugin for Gaia-SSH can be also used to manage this account!

I also configured a PSM-WebApp for Chrome by using the following WebForm Settings:

LogonURL = "https://{address}:{WebUI_Port}"

WebFromFields:

txtUserName > {Username}

txtPwd > {Password}

login_button > (Button)

top_panel_user_name1 > (Validation)

Some things are to consider for the SmartConsole login procedure:

1. Fingerprint on first login

Currently I am blocking user input on logon. As the window with fingerprint can not be differentiated from the normal loading sequence, I am waiting 10 seconds before discovering the window and then press "Enter" to accept the fingerprint (if it is there).

This is OK in my tests but might cause troubles with slow connections.

Another solution would be to unblock the user input and let the user choose. 

Or even better, if there was a way to put the fingerprint into the account in CyberArk and put it automaticall in the LoginParms file to only allow login to a management with correct fingerprint. -> question is: is this possible?

2. MDM

As the user input is blocked, someone is not able to choose the "Login Domain". Therefor it has to be supplied on the account with the "domain" parameter beforehand.

There are 2 possibilites to achieve this:

1. have multiple accounts in CyberArk with different "domain" parameters. So one with MDS, one with Global, and others with the domain names. And then put them in a group and manage the whole group through CyberArk.
2. allow user input in CyberArk to choose the domain like for Windows Domain accounts with the target machine
3. unblock user input and let the user choose, considering the component might timeout in this process

change from 30.1.:

I found an issue with MDM part and fixed it.

I also integrated the possiblity to use PSMRemoteMachine parameter instead of domain parameter, so a picker can be used to choose the domain.

[Aleksandr]

Hello Norbert !

Very helpful article and also connector... We need to test it for one of our implementation... But after we tried to use it, we found that 4 addition scripts required: PSMGenericClientWrapper.au3; BlockInputEx.au3; File.au3; FileConstants.au3... We didn`t see them in archive "SmartConsole-R80.20.M2.au3.zip " which u provided... So where we can find them? Connector failed to work without them.

Thank you in advance!

Kind regards,

Rozdaibida Aleksandr

[Aleksandr]

Hello Norbert !

Sorry, I was mistaken, BlockInputEx.au3 was missed in my components folder. Everything working perfectly. Many thanks

Kind regards,

Rozdaibida Oleksandr

[haniffnordin]

Hi Aleksandr,

May I know where you got these BlockInputEx.au3; File.au3; FileConstants.au3 files?

and how you import SmartConsole-R80.20.M2.au3.zip connector inside Cyberark?

best regards.

[Bart_Leysen]

Hi Norbert,

I'm using R80.30, and it's almost working.

PSM is giving me an error

PSMSR126E [ff51ee50-b91d-4b96-95f4-7c3ff1d98f4b] Failure occurred while handling session. PSMSR605E [ff51ee50-b91d-4b96-95f4-7c3ff1d98f4b] Error occurred while waiting for the dispatcher to communicate (Error details: [PSMSR606E [ff51ee50-b91d-4b96-95f4-7c3ff1d98f4b] Timeout occurred while waiting for a specific component to end])

Any idea what the issue could be?

Thank you

Bart

[Norbert_Bohusch]

Hi Bart,
what would you expect for other files?
It is not a platform to be imported as is but manual work needed to implement it in current state...

[Bart_Leysen]

Hi Norbert,

Sorry for the confusion, i managed to have almost working.

It seems that the PSM is generating an error. It looks like a timeout.

We are using R80.30.

PSMSR126E [adaa7407-d8cc-4b10-88d3-b2caa9461fa2] Failure occurred while handling session. PSMSR605E [adaa7407-d8cc-4b10-88d3-b2caa9461fa2] Error occurred while waiting for the dispatcher to communicate (Error details: [PSMSR606E [adaa7407-d8cc-4b10-88d3-b2caa9461fa2] Timeout occurred while waiting for a specific component to end])

Any idea?

Thank you

Bart

[Norbert_Bohusch]

there are many things to consider:
- paths of installed SmartConsole
- applocker if configured
and so on...

[Bart_Leysen]

The path is correct, because the application is opening.

Also applocker is not yet configured.

[Bart_Leysen]

What i did notice is that the tooltop below stays at the screen for a very long time.

ToolTip ("Starting " & $DISPATCHER_NAME & "...")

[Norbert_Bohusch]

The issue is that with R80.20.M2 the window title was in different layout then it is now.
Please change the following in the function "LoginProcess":

Spoiler

Local $TITLE2 = "SmartConsole (" & $TargetAddress & ")"
if ($TargetDomain <> "") Then
$TITLE2 = "SmartConsole - " & $TargetDomain
AutoItSetOption("WinTitleMatchMode", 1) ; Match partial from the start
EndIf

to:

Spoiler

Local $TITLE2 = $TargetAddress & " - SmartConsole"
if ($TargetDomain <> "") Then
$TITLE2 = $TargetDomain & " (" & $TargetAddress & ") - SmartConsole"
AutoItSetOption("WinTitleMatchMode", 1) ; Match partial from the start
EndIf

[Bart_Leysen]

Hi Norbert,

Thank you for this, but it was still failing.

It was pointing me into the direction to get it working.

I commented everything for $TITLE2

So my loginProcess function now looks like below.

This is working for me.

Func LoginProcess()
LogWrite("START -> LoginProcess()")

; Titles
Local $TITLE1 = "Check Point SmartConsole"
;~ Local $TITLE2 = $TargetAddress & " - SmartConsole"
;~ if ($TargetDomain <> "") Then
;~ $TITLE2 = $TargetDomain & " (" & $TargetAddress & ") - SmartConsole"
;~ AutoItSetOption("WinTitleMatchMode", 1) ; Match partial from the start
;~ EndIf

;Local $TITLE2 = "SmartConsole (" & $TargetAddress & ")"
;if ($TargetDomain <> "") Then
; $TITLE2 = "SmartConsole - " & $TargetDomain
; AutoItSetOption("WinTitleMatchMode", 1) ; Match partial from the start
;EndIf

; Check for fingerprint information
LogWrite("Check for fingerprint information")
sleep(10000)
WinActivate($TITLE1)
sleep($sleep)
Local $hwind1 = WinWaitActive($TITLE1,"",20)
If ($hwind1 <> 0) Then
ControlSend($TITLE1, "", "", "{ENTER}")
endIf

; delete login parameter file
LogWrite("deleting login parameters file")
FileDelete($LOGIN_PARMS_FILE)

LogWrite("Wait for application to load")
; SmartConsole - Login Windows
;~ WinActivate($TITLE2);
;~ sleep($sleep)
;~ WinWaitActive($TITLE2);

;~ $ConnectionClientPID = WinGetProcess($TITLE2)

LogWrite("END -> LoginProcess()")
EndFunc

[Norbert_Bohusch]

If you commented that out, then you have no capturing of the PID of the last window and sending wrong pid to PSM for recording...
I assume then recording will not work 😉

[Bart_Leysen]

The funny thing is, recording is working.

I can do a live view, of my work 🙂