ARCON Additional Information

Helpful Tips

  • Tenable One Vulnerability Management or Tenable Security Center passes the policy and credential values down to Tenable Nessus. This includes the ARCON host, port, API credentials, authentication URL, engine URL, and checkout duration.

  • The Tenable Nessus scanner authenticates to the ARCON API and retrieves the username and password for the target system.

  • The scanner uses these values for target authentication.

Digital Vault vs Legacy API: The integration automatically detects which ARCON API variant to use based on the Authentication URL. If the URL contains dv/api/sdk, the Digital Vault API is used. Otherwise, the Legacy API is used. Consult your ARCON administrator to determine which API variant your deployment uses and configure the URLs accordingly.

Testing Integration Connectivity

Use the following examples to verify connectivity to the ARCON API. Replace placeholder values with your actual configuration. Both examples require jq to parse the token from the response, and curl version 7.67.0 or later.

Digital Vault API

The Digital Vault Authentication URL and Engine URL are path values — the host and port come from the PAM Host and PAM Port fields. The typical path is /dv/api/sdk; consult your ARCON administrator for the correct path in your deployment. The Engine URL can be set to the same value as the Authentication URL.

Step 1 — Obtain a session token:

Copy 
token="$(curl --no-progress-meter -f -k -X POST \
  -H "Content-Type: application/json" \
  -d "{\"Username\": \"<api-user>\", \"Password\": \"<api-key>\"}" \
  https://<arcon-host>:<port>/dv/api/sdk/GetToken | jq -r .Result.accessToken)"

Step 2 — Retrieve a credential:

Copy 
curl --no-progress-meter -f -k -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${token}" \
  -d "[{\"UserName\": \"<username>\", \"ServerIp\": \"<target-ip>\", \"TargetType\": \"Linux\", \"OpenForHours\": \"1\"}]" \
  https://<arcon-host>:<port>/dv/api/sdk/GetTargetDevicePassKey | jq -r .Result[].Password

Where TargetType is Linux, Windows, oracle, mssql, mysql, etc.

Legacy API

The Legacy Authentication URL is the full token path (for example, /arconToken). The Engine URL is the base API path (for example, /api). API user credentials are Base64-encoded in the request body.

Step 1 — Obtain a session token:

Copy 
token="$(curl --no-progress-meter -f -k -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=password&username=$(echo -n <api-user> | base64)&password=$(echo -n <api-key> | base64)" \
  https://<arcon-host>:<port>/arconToken | jq -r .access_token)"

Step 2 — Retrieve a credential:

Copy 
curl --no-progress-meter -f -k -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${token}" \
  -d "[{\"UserName\": \"<username>\", \"ServerIp\": \"<target-ip>\", \"TargetType\": \"Linux\", \"OpenForHours\": \"1\"}]" \
  https://<arcon-host>:<port>/api/ServicePassword/GetTargetDevicePassKey | jq -r .Result[].Password

Optional — List available target types (Legacy only):

Copy 
curl --no-progress-meter -f -k -X GET \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${token}" \
  https://<arcon-host>:<port>/api/ServicePassword/GetAllTargetTypes | jq -r .Result[]

This can help confirm the correct TargetType string to use when configuring the PAM Platform field.