QUESTION: Are also ssh keys supported as stored credentials?

A) Yes, SSH keys are supported

QUESTION: We use Thycotec Secret Server which is not in the list you have provided. Is the integration between EM and Thycotec supported?

A) We have developed a generic credential framework that works with any of the PAM providers in the market.

So your provider Thycotec is also supported as long as you register the script in EM and then EM will be able to retrieve the credentials from your Thycotec.

QUESTION: Given you can use a PAM based credential for a corrective action, what happens if the PAM storage is unavailable (e.g. maintenance)?

A) As the PAM is unavailable , the PAM based credential will be failed to retrieve the credentials from PAM and Corrective action will fail with Invalid Password Issue.

QUESTION: what version of OEM has the PAM capability, and can it be used for server credentials used by OEM to push Gold Agent Images.A) with 13.5 and up.

A) 13.5 RU 09 and above can utilize the PAM capability and can be used for push Gold Agent Image

QUESTION: Does PAM integration require an extra license?

A)No, Its not required

QUESTION: what OEM version this PAM integration work? and patch level ?

A) Starting with EM13.5 RU9 and above PAM is integrated with EM and we recommend you to use the latest RU (RU14) as of today.

QUESTION: When our own get_password.sh captures exceptions and errors to STDERR, then does OEM will display popup message on the screen or in the OEM job logs?

A)Yes, It does display the error in popup messages

QUESTION: Is there any difference between using -k or -credkey on none at all? Are those 3 options work the same?

A) No, This is just an example. No restrictions. Only mandatory is pass the credkay as a parameter.  

QUESTION: if PAM Tool (CyberARC) requires MFA – multi factor authentication (PingID) to checkout/fetch passwords – how does OEM handle?

A) MFA is used for user login and for APIs the mode of access is different which uses token generated by CyberArk for API calls.

QUESTION: When oracle.sysman.core.security.auth.cred_provider_prop1 takes multiple values of AuthTokens, which one will be chosen?

A) If you have used prop1 to set multiple auth tokens then EM passes all the tokens as input parameters to script which then needs to parsed within the script. So we have two ways to manage it

1. Use one user for all API calls and token generates on the go by API call and uses it without setting token in EM

2. Use different CyberArk Users to be passed as input parameters to the script

QUESTION: Which new features of PAM based credential has been approved and will be introduced in future RU.

such as check-in , PAM credential creation in GUI, monitoring user taking PAM based credentials, etc.?

A) Check-in is something, we are looking into it but currently RU is not mapped yet. The GUI way to creating Creds is something we are working on and it should be coming up in the future RUs.

QUESTION: This presentation is about using PAM as an external credential store. Is there any ability in this scenario to rotate passwords?

A) PAM has the ability to rotate the passwords at certain frequency and EM gets the latest password each time the PAM based credentials used.

A2) The PAM itself will rotate the password on a given frequency and whenever EM requires the password it will pick the latest available password from PAM and EM will use it in the workflow. Also, we are not storing in the repository and we fetch the password in real time

A3) For your information, if you are looking for EM to rotate the passwords for DB monitoring users and non monitoring users we do have jobs built to manage it

QUESTION: Is there step-by-step documentation on this topic outside of this webinar? The emcli verb reference docs are lacking in some of the details.

A) Yes, Below documents 

Customer RecommendedHow To Integrate third party PAM Users to OEM Credentials (Doc ID 2907588.1)

QUESTION: Do you supply script templates, e.g. for CyberArk ?

A) We have plans to publish a MOS note with the sample reference script for providers like CyberArk, HashiCorp. The script can be used as a reference to build your own script for the integration with EM.

QUESTION: Based on the presentation, it looks like all the creation is done at command level using emcli unlike what we do now in "Security/Named Credentials" option within EM! Is there a plan to incorporate the same in EM module in future?

A) Yes, In future release in EM UI this functionality will be available  

QUESTION: Are there timout mechanisms in place how long OEM will wait for script execution or has the script to make sure, it replies in a timely manner (with error if needed)?

A) As of today we have no timeout parameters in EM to control, In Future release we will had the parameter which will suffice the timeout process 

A2)Meantime, in Customer script it can be handled by customer

QUESTION: Is there a template script available that can be customized for individual needs?

A) Currently not available but we plan to publish a MOS note with the reference scripts.

QUESTION: For SYS, is it feasible to have PAPM (CyberArk) to reset password or only use PAPM as password vault to store password only?

A) PAM - CyberArk has ability to rotate the password and can be configured to rotate host and DB credentials as required and PAM feature in EM enables to integrate with CyberArk and gets the latest password each time when PAM based credential is used in EM jobs or active management.

QUESTION: Are there any plans on the road map to execute the script from a directive in the software library rather than the OS filesystem to prevent duplication across nodes?

A) We have it in the roadmap to support the script through software library directives

A2) We are validating use of software library for the script and if its feasible we will include it in next RU

QUESTION: Can we still use alter user to change SYS password or need to use orapwd?

A) PAM Integration doesn't do any alter of passwords. It does only fetch the password from PAM system and will use it OEM

QUESTION: if we use CyberArk to rotate sys user password, what should we do in CyberArk end? Assuming this is different from normal db accounts

A) Usually PAM is used to store privileged accounts and in case you want store normal DB accounts its possible and also PAM allows to enable and disable password rotations for certain accounts. It depends on different PAM solutions in market - CyberArk, Hashicorp and Centrify

QUESTION: Have you tested the mechanism with a job against many targets - e.g. an EM Job running against 2000 DBs? ie using preferred creds, so every target has its own credential !

We have done performance testing to retrieve Creds for multiple hosts & databases from PAM and use it as named credentials in EM.

** There were some additional questions asked that we are still waiting for DEV input to and once we have those answers we will post those to the Community thread as well.