Delinea Secret Server Setup

From V8.4.2, rConfig can retrieve device credentials from Delinea Secret Server (formerly Thycotic) at connection time. rConfig signs in to the Secret Server REST API as a dedicated API user, reads the secret by its ID, logs in to the device with the returned fields, and discards them when the operation ends. Rotate a password in Secret Server and the next backup uses it.

The integration works with self-hosted Secret Server and with Secret Server Cloud.

Early access

This integration is built from Delinea’s published Secret Server REST API documentation and follows its documented request and response formats. As with any new integration, environments vary, so we’d welcome your feedback as you roll it out. If anything behaves differently in your deployment, contact rConfig support and we’ll work through it with you.

When to Use This Page

Use this page when your network device passwords already live in Secret Server and you want rConfig to fetch them on demand instead of storing them. Set up the connection once per rConfig instance, then create a vault credential set for each secret your devices use.

Caution

You need working knowledge of your Secret Server environment, or help from its administrator, to create the API user and share secrets with it. rConfig support for Secret Server-side configuration is limited.

Prerequisites

• Secret Server reachable from the rConfig server over HTTPS
• A user for rConfig that can sign in to the REST API without MFA (an application account suits this)
• The device credentials stored as secrets, shared with that user with View permission
• An rConfig V8 user with permission to update integrations

Prepare Secret Server

Step 1: Create the API user

Create a dedicated user, for example rconfig-api. rConfig signs in with the OAuth2 password grant (POST /oauth2/token), so the user must not require multi-factor authentication. For an Active Directory account, note the domain name.

Step 2: Share the device secrets

Give rconfig-api View permission on each secret, or on the folder that holds them. rConfig only reads secrets. It never edits them.

Step 3: Find each secret’s ID

Open the secret in Secret Server. The ID is the number in the address bar, for example 1234 in .../app/#/secrets/1234/general.

Secret Structure

Secret Server returns a secret as a list of fields. rConfig turns them into keys you can map, using each field’s slug and its display name:

Field (display name)	Slug	Typical use
Username	username	Device username
Password	password	Device password
Enable Password	enable-password	Enable password, if your template has one

The defaults rConfig maps are username, password and enable-password. Templates differ, so check your template’s slugs. To see them for one secret, request it with a token:

TOKEN=$(curl -s https://ss.example.com/SecretServer/oauth2/token \
  -d grant_type=password -d username=rconfig-api -d 'password=...' | jq -r .access_token)

curl -s -H "Authorization: Bearer $TOKEN" \
  https://ss.example.com/SecretServer/api/v1/secrets/1234 | jq '.items[] | {fieldName, slug}'

File attachments are skipped. A device with no enable password works with the default: a missing key resolves to an empty enable password.

Configure rConfig V8

Step 1: Open the Delinea Secret Server page

Navigate to Platform → Integrations. In the Device Credentials section, click Configure next to Delinea Secret Server.

Step 2: Enter the connection settings

Field	Required	Notes
Secret Server URL	Yes	Self-hosted installs usually end in /SecretServer, for example https://ss.example.com/SecretServer. For Secret Server Cloud, use your tenant URL, for example https://yourtenant.secretservercloud.com.
API username	Yes	The API user from Step 1.
API password	Yes	The API user’s password. Once saved, the box shows Saved. Leave blank to keep it. and the password is never sent back to the browser.
Domain	No	Domain for an Active Directory user. Leave blank for a local user.
Timeout (seconds)	No	How long to wait for Secret Server. Defaults to 30.
Verify TLS certificate	No	On by default. Turn off only for a lab server with a self-signed certificate.
CA bundle (PEM)	No	Paste the CA chain if Secret Server’s certificate is signed by an internal CA.

Turn on Use this vault for credential sets. rConfig won’t save it switched on until the URL, username and password are filled in.

rConfig caches the API access token, encrypted, until shortly before it expires, so it doesn’t sign in for every device. Saving the page clears the cached token, so a changed password or URL takes effect straight away.

Step 3: Test, then save

Click Test Connection. rConfig signs in with the values in the form, including any you haven’t saved yet, and asks Secret Server for its version. A success shows the version number.

Click Save.

Upgrading from .env settings

If you set up this integration in .env (VAULT_SERVICE_NAME=delinea and the VAULT_DELINEA_* settings) on an early V8.4.2 build, it keeps working. The page shows a notice that its settings are read from .env. Click Save to store them in rConfig. After that, the VAULT_DELINEA_* lines are ignored.

Create a Vault Credential Set

1. Navigate to System Settings → Security & Access → Device Credentials.
2. Click Add Vault Credential Set. If more than one vault is switched on, pick Delinea Secret Server in the Vault dropdown.
3. Fill in the form:
   • Credential Name: for example Branch routers - Delinea.
   • Vault Endpoint: the secret ID, for example 1234. Only numbers are accepted.
   • Field Mapping: defaults to username, password and enable-password. Use your template’s slugs or field display names.
4. Click Add.

Then edit a device, choose the new set in the Credential Set dropdown and save. Run a backup or the debug command to confirm rConfig can log in.

Troubleshooting

Errors are written to Settings → Application Logs with the message Secret Server returned. rConfig never logs secret values or the API password.

Sign-in fails. Check the username, password and domain. Confirm the user can sign in without MFA, isn’t locked out, and that the URL is right (self-hosted installs usually need /SecretServer). Try the token curl above from the rConfig server.

Access denied, or the secret isn’t found. The API user can’t view that secret, or the ID is wrong. Share the secret or its folder with the user.

The secret needs check out, a comment or approval. rConfig can’t complete those steps, so it can’t read the secret. Use secrets without these requirements for rConfig, or ask your administrator for a policy that exempts the API user.

Device login fails after a successful read. The Field Mapping doesn’t match the template. Compare it with the slugs from the curl request above.

Backups say the vault is turned off. Use this vault for credential sets is off on the integration page, or a required setting is missing.

Common Gotchas

Common gotchas

• The vault endpoint is the numeric secret ID, not the secret name or a folder path.
• One API user serves every Delinea credential set in the instance, so it needs View access to all of them.
• Secret Server password policies can expire the API user’s password. When it changes, enter the new one in API password and click Save.

Related Documentation

• Vault Credentials Overview - how vault credentials fit with other credential sets
• Idira (CyberArk) Setup and HashiCorp Vault Setup - the other supported vaults