---
sourceDocument: Zurich Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/platform-security

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# CyberArk credential storage integration

# CyberArk credential storage integration {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of CyberArk credential storage integration

The CyberArk credential storage integration enables ServiceNow® Orchestration, Discovery, and Service Mapping to securely access and use credentials without storing them on the ServiceNow instance.
This integration leverages the CyberArk Application Identity Management (AIM) solution, which centrally stores, manages, and logs privileged credentials in the CyberArk vault, ensuring compliance with security policies and regulatory requirements.
Show full answer Show less  
The integration requires the ServiceNow External Credential Storage plugin and the installation of the MID Server and CyberArk AIM/API client on the same machine. It supports multiple credential types and network protocols, facilitating secure and seamless credential retrieval for automation and discovery tasks.

## Key Features

* **Centralized Credential Management:** Credentials are stored and managed securely in CyberArk, eliminating the need to embed passwords in scripts or configuration files.
* **Supported Credential Types:** Includes GCP, Azure, CIM, JMS, SNMP, SNMPv3, Basic Auth, SSH Key Pair, SSH Private Key, VMware, Windows, and Applicative Credentials.
* **Network Protocol Support:** Works with protocols such as SOAP, REST, JDBC, SSH, PowerShell, SFTP, and JMS, supporting ServiceNow workflow and orchestration activities that use these protocols.
* **Secure MID Server Integration:** The MID Server uses credential identifiers and types from the ServiceNow instance to query CyberArk vault for credentials, supporting hostname and reverse DNS lookups.
* **Business Rule Automation:** The External Credential Storage business rule manages credential views and cache refreshes when credentials are modified, ensuring up-to-date access.
* **Configuration Controls:** The system property *Enable External Credential Storage* controls activation of the integration and manages credential record states upon enabling or disabling.
* **Credential Resolution Logic:** For Windows accounts, the MID Server matches credentials by ID or IP address, with configurable options to refine matches when multiple credential types share an IP.
* **Upgrade Path for CyberArk Library:** Provides steps to upgrade the CyberArk client library on the MID Server to support secure configuration parameters.

## Practical Implications for ServiceNow Customers

* Enables secure orchestration and discovery workflows without exposing sensitive credentials on the ServiceNow platform.
* Supports compliance by leveraging CyberArk's centralized password rotation and auditing capabilities.
* Requires installation and configuration of both ServiceNow plugins and CyberArk components on the same MID Server host.
* Ensures credential management is simplified and secure, reducing operational risk associated with credential sprawl.
* Allows manual control over credential activation status when toggling external credential storage features.
* Supports upgrading CyberArk client libraries to maintain compatibility and security enhancements.  
The MID Server integration with the CyberArk vault
enables ServiceNow®
Orchestration, ServiceNow®
Discovery, and ServiceNow®
Service Mapping to run without storing any credentials on the
instance.

## Introduction to CyberArk {#c_CyberArkCredStorageIntegrate__section_fyy_3mh_qbb}

CyberArk Application Identity Management (AIM) product uses the Privileged
Account Security solution to eliminate the need to store application passwords embedded in
applications, scripts or configuration files, and allows these highly sensitive passwords to
be centrally stored, logged, and managed within the CyberArk vault. This
approach enables organizations to comply with internal and regulatory requirements of
periodic password replacement and to monitor activities associated with all types of
privileged identities, whether on-premise or in the cloud.

The instance maintains a unique identifier for each credential, the credential type (such as SSH, SNMP, or Windows), and any credential affinities. The MID Server obtains the credential identifier, credential type, and IP address from the instance, and then uses the CyberArk vault to resolve these elements into a usable credential. The credential resolver can also look up the hostname, fqdn, and use reverse DNS lookup to get fqdn.

The CyberArk integration requires the ServiceNow®
[External Credential Storage
plugin](https://www.servicenow.com/docs/QGUnp5sVAfgFK9wbpet~oA "The External Credential Storage plugin is available by request."), which is available in System DefinitionsPlugins. The MID Server and CyberArk
AIM/API client must be installed on the same machine. CyberArk Application Access
Manager (AAM) Credential Providers version 12.0.1 and later is supported.

## Installed with CyberArk {#c_CyberArkCredStorageIntegrate__section_clq_mmh_qbb}

* Business rule: The External Credential Storage business rule performs the following tasks when an administrator makes any change to the external credential storage property:
  * Changes the view for the Credentials record list and form to the External Storage view. This view enables users to see the Credential ID column in the list.
  * Instructs the MID Server to refresh its non-external credentials cache in preparation for a change in the way that credentials are obtained.
  {#c_CyberArkCredStorageIntegrate__ul_w3g_jln_vs}
* System property: A property called Enable External Credential Storage \[com.snc.use_external_credentials\] enables or disables the External Credential Storage plugin after it is activated. This property is located in Discovery DefinitionProperties and OrchestrationMID Server Properties, and is enabled when you activate the plugin.  
  Note:  
  If you disable external credential storage with the system property, the system automatically sets all the external credentials to inactive in the instance. If you re-enable the feature with this property, the system does not reset the external credential records to active. You must reactivate each credential record manually.
{#c_CyberArkCredStorageIntegrate__ul_sd1_tmh_qbb}

## Supported credential types {#c_CyberArkCredStorageIntegrate__section_rbm_zmh_qbb}

The CyberArk integration supports these ServiceNow credential types:

* GCP
* Azure
* CIM
* JMS
* SNMP forum
* SNMPv3
* Basic Auth
* SSH Key Pair
* SSH Private Key (with key and password)  
  Note:  
  CyberArk returns the decrypted private key; passphrase is not required.
* VMware
* Windows
* Applicative Credentials
{#c_CyberArkCredStorageIntegrate__ul_dx4_514_vs}  
Note:  
To use CyberArk integration with the GCP credential type, you must modify the external credential storage jar. For details see [ServiceNow GCP Credential Resolver using CyberArk](https://www.servicenow.com/community/itom-blog/servicenow-gcp-credential-resolver-using-cyberark/ba-p/2272452).

ServiceNow AI Platform features that use these network protocols also support the use of
credentials stored on a CyberArk vault.  
{#c_CyberArkCredStorageIntegrate__table_bxs_xdy_3qb__entry__3}

| Network protocol | ServiceNow® Workflow Studio support | Orchestration support |
|-|-|-|
| SOAP | SOAP Step | [Create a SOAP web service activity](https://www.servicenow.com/docs/access?context=t_CreateASOAPWebServiceActivity&version=zurich&pubname=zurich-servicenow-platform&ft:locale=en-US) with basic authentication overrides |
| REST | REST Step | [Create a REST web service activity](https://www.servicenow.com/docs/access?context=t_CreateARESTWebServiceActivity&version=zurich&pubname=zurich-servicenow-platform&ft:locale=en-US) with basic authentication overrides |
| JDBC | JDBC Step | JDBC activity |
| SSH | SSH Step | SSH activity |
| PowerShell | PowerShell Step | PowerShell activity |
| SFTP | SFTP Step | SFTP activity |
| JMS |   | JMS activity |
[Table 1. Credentials supported by network protocol]

{#c_CyberArkCredStorageIntegrate__table_bxs_xdy_3qb}  
Important:  
You cannot manage credentials stored on a CyberArk vault and a custom [external credential
storage](https://www.servicenow.com/docs/qQUh4MVGNz6JoBxaVsn8gA "An instance can store credentials used by Discovery, Orchestration, and Service Mapping in an external credential repository rather than directly in a ServiceNow credentials record.") system using the same MID Server. The MID Server and CyberArk AIM/API client must be installed on the same machine.

## CyberArk architecture {#c_CyberArkCredStorageIntegrate__section_hlc_dnh_qbb}

Figure 1. CyberArk storage architecture  
Note:  
CyberArk uses the base system mid.jar file for resolving credentials.

## How the MID Server handles Windows accounts {#c_CyberArkCredStorageIntegrate__section_ch2_lnh_qbb}

Credential lookup initially attempts to match the specified credential ID to an existing
value in the CyberArk vault Name field. If a match is
found, that credential is returned. If no match is found, the credential lookup attempts to
find a match using the IP address. If the IP address lookup matches more than one
credential, such as Windows and Tomcat on the same server, the
lookup fails. To avoid this issue, set the ext.cred.type_specifier
parameter in the MID Server config.xml file to true to
force CyberArk to return credentials that match both the credential type and
the IP address. For example, if an IP address is shared by both Windows and
Tomcat, a credential type of Windows returns the Windows credential only.

## Upgrade the CyberArk library {#c_CyberArkCredStorageIntegrate__section_dns_k1s_1bc}

You can upgrade the CyberArk library if a secured configuration parameter is needed.

Check the following configuration parameter in the config.xml: `<parameter name="mid.secure_config.provider"
value="com.service_now.mid.services.config.CyberArkSecuredConfigProvider"/>`  
Perform the following steps to perform the upgrade if a secured config parameter provider is configured.

1. Rename the CyberArk client version to `JavaPasswordSDK_MajorVersion_minorVersion_patchNum.jar`.
2. Create a new jar entry in the `ecc_agent` table where the rename jar can be attached. This new entry downloads to the MID Server. This step results in two jar (Passworsdk.jar and JavaPasswordSDK _12_X_X.jar).
3. Delete old ecc_agent entry from instance. This step deletes Passworsdk.jar from the MID Server, and the JavaPasswordSDK _12_X_X.jar remains in the system.
{#c_CyberArkCredStorageIntegrate__ol_sjw_x1s_1bc}
* **[CyberArk integration configuration](https://www.servicenow.com/docs/MeWz2f2BHE282zPwaWXsnA)**   
  These procedures include both CyberArk and ServiceNow configuration tasks, including references to the appropriate CyberArk documentation.

*[\>]: and then