Integrate account creation with onpremise HashicorpVault

[zzz1qaz]

when saviynt has created an ad account (mainly service account), I wish to save the password into our onpremise hashicorp vault and include the response into the email notification. how to do so?
we previously put clear password into the email but want to replace it with calling hashicorp vault api and include response into email.

should I first create a rest connector? but how can I tell saviynt to use sc2 client server to reach the vault onpremise? I believe by default, saviynt will try to reach the url via internet, won't it?

[rushikeshvartak]

• This seems not possible. As once account is created and password sent over there is no way to decrypt by any API

[zzz1qaz]

Hi Rushikesh, thanks for quick reply, no I didn't mean decrypt, I meant, after the password has been generated, saviynt make a vault api call to and get the response, put the response content into the email and send. 

[rushikeshvartak]

How password will be stored in vault ?

[zzz1qaz]

There are some ideas I'm thinking, 

1. use vault kv engine 

2. use vault ldap engine to enable password rotation

3. use vault to encrypt the password and let user get decrypted password from vault

but anyway, all of these are just a one line method. 
there should not be any difference to saviynt if saviynt call vault rest connector at account creation stage

[rushikeshvartak]

• Once new account is created 
• password will be generated 
• now how this password can be pushed to vault ? ( this needs to be done manually)

[zzz1qaz]

what is the 'Password management Connectio' under the security system configuration? Can I set anything in security system config or endpoint config to call custom api?

[rushikeshvartak]

Its used to generate password using policy defined