CyberArk account recovery

Connect CyberArk Workforce Identity to Nametag to let your users securely reset their own multifactor authentication (MFA) and passwords, and unlock their accounts, after verifying their identity. The steps below cover connecting the provider. For the rest of the setup — self-service permissions, the self-service site, and monitoring — see the self-service account recovery administrator’s guide.

CyberArk includes settings options for resetting multifactor authentication, setting a temporary password, and unlocking a locked account.

The first thing you’ll need to do is configure self-service permissions.

Create an OAuth 2.0 client in CyberArk

Nametag calls the CyberArk Identity REST APIs using an OAuth 2.0 confidential client (client-credentials grant) that you create in your own tenant. The credential is CyberArk’s, not a Nametag key.

1. Sign in to the CyberArk Identity Administration portal for your tenant.
2. Go to Web Apps → Add Web Apps → Custom and add an OAuth2 Client.
3. In Settings, set a client ID and check Is OAuth confidential client; set a client secret.
4. In Tokens, allow the Client Credentials grant type.
5. In Scope, define a scope whose allowed REST APIs are limited to what Nametag needs: /UserMgmt/.*, /CDirectoryService/.*, and /scim/.*.
6. Under Permissions, assign a role permitted to authorize against the OAuth 2.0 server.
7. Note the app’s Application ID, your tenant URL (for example example.id.cyberark.cloud), and the client ID and client secret.

Note: Nametag uses only the scopes you grant, stores the client secret encrypted, and never writes any personal data back into CyberArk. It looks a user up, then performs the reset/unlock actions you enable.

Configure Nametag

1. Sign in to the Nametag console.
2. Select Integrations in the left-hand navigation.
3. Select New integration.
4. Choose CyberArk Workforce Identity from the list of providers.
5. Enter the Tenant URL, Client ID, Client secret, and (optionally) the Application ID you obtained above.
6. Press Connect to CyberArk.

Nametag validates the credentials by fetching a token and listing a user, then reaches the connected state. Once connected, choose which recovery actions your users may perform (reset MFA, set a temporary password, and/or unlock) in self-service permissions.