🔐 CyberArk Identity Export Tool

Step 1: Configure Security Settings

1. Log into your CyberArk Identity tenant as an administrator
2. Navigate to Settings → Authentication → Security Settings
3. In the "Specify Trusted DNS Domains for API Calls" section, add:
export.cybrdemo.eu
4. Save the settings

Step 2: Create Web Application

1. Navigate to Apps & Widgets → Web Apps
2. Click "Add Web Apps"
3. Click the "Custom" tab
4. Click "Add" next to "OpenID Connect"
5. Click "Yes" when asked "Do you want to add this application"
6. Click "Close"

Step 3: Configure Application Settings

Settings Tab:

1. Application ID: Enter a unique identifier (this becomes your oauthAppName parameter)
Example: OAuth_Demo
2. Name: Enter a display name for the application
Example: Export Tool

Step 4: Configure Trust Settings

Trust Tab:

1. Client Secret: Enter any random value (PKCE is used, so this isn't important)
2. Service Provider Configuration: Select "Login initiated by the relying party (RP)"
3. Authorized Redirect URIs: Add the static redirect URI:
https://export.cybrdemo.eu/?callback=true
4. Note: Copy the OpenID Connect Client ID (this becomes your clientId parameter)

Step 5: Enable Refresh Tokens

Tokens Tab:

1. Enable "Issue refresh tokens"

Step 6: Configure Scopes

Scopes Tab:

1. Click "Add" to create a new scope
2. Name: Enter a scope name (this becomes part of your scope parameter)
Example: all
3. Allowed REST APIs: Click "Add" and add these patterns:
/uprest/.*
/Folder/.*
4. Save the scope

Step 7: Set Permissions

Permissions Tab:

1. Add users or groups who should be able to export their credentials
2. Grant appropriate permissions for the export functionality

Step 8: Save Configuration

1. Click "Save" at the bottom of the page
2. Make note of the configuration values for creating bookmarks

📌 Create User Bookmarks

Once configured, users can access the tool with a bookmark like:

Parameters:

• tenantId: Your CyberArk tenant identifier
• clientId: OpenID Connect Client ID from Step 4
• oauthAppName: Application ID from Step 3
• scope: "openid" + your custom scope from Step 6