Create locker - Create a locker to group similar credentials to share with other users.

Automation 360

Create a locker to group similar credentials to share with other users.

Before you begin

  • You must either have the AAE_Locker Admin role or Manage my credentials and lockers permission.
  • You must have the View Users and Roles basic information permission to view other users to add them as locker owners, managers, or participants. Without this permission, an "Access denied" error appears. See RBAC for Credential Vault credentials management.
Note:
  • Do not start a locker name with oauth_ (case insensitive, for example, OAuth_ or oAuth_). This prefix is a reserved namespace.
  • There is no limit on the number of credentials that can be stored in a locker. A credential can only belong to one locker. See Create credential.

Procedure

  1. Navigate to Manage > Credentials, and then click the Lockers tab.
  2. Click Create locker or the plus icon icon.
  3. Enter the Name.
  4. Optional: Enter a Description.
  5. Select the Credentials to add to the locker or select External key vault.
  6. If you have selected External key vault, enter the external key vault details.
    If integrating with an external key vault, such as AWS, Azure, CyberArk, or HashiCorp, enter the details for your vault:
    AWS
    Enter the prefix of secrets stored in the locker.
    CyberArk
    Enter the safe name where the credential lockers are stored. Optionally, enter the property set for your CyberArk username. The $$attribute$$ property is used to retrieve information from the CyberArk object property. You can create a property set by combining multiple CyberArk object properties.

    The following examples show how to create property sets in different scenarios:

    • To use a username in the format - domain\username, where the domain is in the CyberArk property Address, and the username is in the UserName, enter $$Address$$\$$UserName$$ in the credential attribute. Use this attribute in your bot automation.
    • If you want to use a username in the format username@example.com where the username is stored in the CyberArk property called UserName and the address (example.com) is stored in the CyberArk property called Address, then enter the property set in the format $$UserName$$@$$Address$$ in the credential attribute and use this attribute in your bot automation.
    Azure
    Enter the prefix stored in the locker.
    HashiCorp
    Enter the prefix of secrets stored in the locker. For example, enter the prefix prfusr1 for a secret that is stored as prfusr1_obj1_usr1.
  7. Click Next.
  8. Add the Owners.
    A locker must have at least one owner. The locker owner can view, edit, and delete a locker, and can add or remove other owners.
  9. Click Next.
  10. Optional: Add the Managers.
    The locker manager can view, edit, and delete the locker, and add participants, but cannot add owners or managers.
  11. Click Next.
  12. Optional: Add the Participants.
    A locker participant has access to view a locker and add their own credentials to a locker.
    Note: A locker participant does not have access to or visibility of credentials created by other users.
  13. Click Next.
  14. Add the Consumers.
    Select one or more roles. Users with these roles have access to the locker. System-created roles are not shown in the Consumers list.
    TypePermission
    Standard Locker consumers can view the locker and all the credentials inside the locker. All consumers see the same credential value set by the credential owner.
    User-provided Locker consumers can input their information in user-provided credentials with user-provided attributes.
  15. Click Create locker.

Results

The locker is created. If email notifications are turned on, users receive an email confirming the credential locker name and their permissions.