The CyberArk Central Credential Provider (CCP) is specifically designed for this use case. It allows applications to retrieve credentials securely at runtime without ever handling or seeing the actual password, maintaining security while enabling automation. Conjur is a different product suite, local files are insecure, and manual management defeats the purpose of a PAM solution.

Automatic password rotation is controlled at the platform level. If password management (change, verify, reconcile) is disabled or incorrectly configured in the platform definition for these firewall devices, the Vault will manage the checkout process but will never trigger the automatic change of the password on the target system.

The ‘Request Access’ button is used to gain authorization for an account you don’t yet have permission to use. If the button is grayed out but the account is shown as available, it typically means the user already has permission to access it. The most common reason they can’t check it out at that moment is because it is already checked out and locked by another user, which is indicated elsewhere in the interface.

The ‘Retain password for’ setting in the platform management properties dictates how long the password is kept in the Vault after checkout before the CPM automatically changes it. Setting this to ‘Immediate Change’ ensures the password is rotated as soon as it is checked in, enforcing the policy regardless of session length.

PSM is the ideal solution for this scenario. It allows the contractor to establish a session (e.g., SSH) without ever knowing the privileged account’s password. The session can be isolated, monitored, recorded, and restricted (e.g., command filtering for read-only). It also provides a clear, time-bound audit trail without creating permanent accounts or sharing credentials.

The reconcile account is used by the CPM to reset the password on the target if the Vault’s version is correct but the local version is not. If the managed account *is* the reconcile account and its password is wrong, the CPM cannot log in to fix it, creating an unrecoverable failure. A separate, dedicated reconcile account with appropriate permissions is the secure best practice.

For non-standard targets like custom web applications, the platform uses a connection component (a script or connector) to automate the password change process. If this component does not accurately mimic the exact steps, clicks, or API calls required by the application’s specific interface, the change will fail even with the correct permissions. Reviewing and debugging this component is the logical next step.

For automated processes (scripts, services, applications), the AIM/CCP solution is designed to provide secure, API-based credential retrieval without human intervention or password exposure. The script calls the AIM/CCP, which authenticates the script itself (not a user) and returns the credential for use, enabling full automation while maintaining security and auditability.

The ‘Exclusive’ account property is designed for this exact scenario. When checked out, the account is locked for use by that single user/session. The ‘Auto-Expire’ setting automatically checks the account back in after a defined period, preventing it from being locked indefinitely if a user forgets to release it. This manages the single-connection limit effectively.

The CyberArk Central Credential Provider (CCP) is specifically designed for this use case. It allows applications to retrieve credentials securely at runtime without ever handling or seeing the actual password, maintaining security while enabling automation. Conjur is a different product suite, local files are insecure, and manual management defeats the purpose of a PAM solution.0