8.3 PSM Universal Connector Framework & Custom Integrations

8.3 PSM Universal Connector Framework & Custom Integrations

Quick Answer: The PSM Universal Connector framework (formerly PSM Custom Dispatcher) enables organizations to extend jump-host isolation, transparent credential injection, and session recording to proprietary, legacy, or third-party thick-client applications. Built on the lightweight AutoIt scripting engine and CyberArk's PSMGenericClientDriver.au3 wrapper, custom dispatchers automate window detection and credential entry using GUI tools like Au3Info.exe. Compiled dispatchers are placed in the PSM Components folder, whitelisted in Windows AppLocker via PSMConfigureAppLocker.xml, and registered in PVWA. Pre-built connectors can also be imported directly from the CyberArk Marketplace.

---

The Universal Connector Framework Architecture

Enterprise IT environments rely heavily on specialized administrative thick clients that lack native PAM integrations:

• Industrial SCADA and building automation software.
• Proprietary banking, financial, and healthcare client/server applications.
• Enterprise Resource Planning (ERP) fat clients (such as SAP GUI).
• Specialized firewall and network management consoles (such as Cisco ASDM).
• Mainframe terminal emulators (TN3270 / TN5250 clients).

Without a custom integration mechanism, administrators would access these systems directly from unmanaged endpoints with static, visible passwords.

The Universal Connector framework addresses this challenge by encapsulating arbitrary Win32 and x64 executables into CyberArk's secure session architecture. When a session initiates, PSM executes a compiled custom dispatcher that queries session parameters from the Vault, launches the client application, detects the authentication dialog, injects credentials directly into UI controls, and registers the application process ID (PID) with PSM for active surveillance and video recording.

---

The AutoIt Scripting Engine and PSMGenericClientDriver Wrapper

CyberArk selected AutoIt as the scripting engine for Universal Connectors. AutoIt interacts natively with the Windows Messaging API, manipulates window controls with minimal overhead, and compiles into standalone binaries without requiring external runtimes on the hardened PSM host.

Core Wrapper Functions (PSMGenericClientDriver.au3)

CyberArk provides the PSMGenericClientDriver.au3 library to standardize communication between the dispatcher script and the PSM service:

1. PSMGenericClient_Init(): Establishes communication with the PSM service, parses command-line parameters, and prepares shared memory.
2. PSMGenericClient_GetSessionProperty($propName): Securely retrieves account properties from the Vault, such as "Address", "UserName", "Password", and custom platform file attributes.
3. Target Execution (Run): Launches the target client executable and captures its process identifier.
4. PSMGenericClient_SendPID($PID): Essential exam concept. Passes the target application's Process ID back to the PSM service. This registration enables PSM to bind session recording (video and keystroke capture) and enforce LockApplicationWindow. If omitted, PSM cannot track the session and closes prematurely.
5. PSMGenericClient_Term(): Notifies PSM of successful injection and terminates the dispatcher process, leaving the target application under PSM monitoring.
6. PSMGenericClient_LogMessage($msg, $level): Emits structured diagnostic messages to PSM log files ($LOG_LEVEL_INFO, $LOG_LEVEL_ERROR).

Secure Scripting Standards

• Never Log Secrets: Plaintext passwords and private keys must never be passed to PSMGenericClient_LogMessage() or written to temporary files.
• Variable Cleansing: Plaintext variables must be wiped from memory immediately after injection (e.g., $Password = "").
• Fail-Safe Timeouts: All window wait operations must include explicit timeouts to prevent hung dispatcher processes on the PSM host.

---

Window Identification, Control Automation, and UI State Management

Accurate GUI element detection is critical for reliable credential injection into non-standard dialogs:

Element Discovery with Au3Info.exe

Developers use the AutoIt Window Info Tool (Au3Info.exe) to inspect target login dialogs:

• Window Matching: Captures window title and class (e.g., [CLASS:#32770]). Setting AutoItSetOption("WinTitleMatchMode", 2) allows partial substring matching.
• Control Identifiers: Captures control properties, such as Control ID ([ID:1001]), ClassNameNN (Edit1, Button2), or window handle (HWND).

Control Injection: ControlSetText vs. Send

• Risks of Send(): Simulates raw keystrokes to whichever control holds active focus. If a background window or notification steals focus, keystrokes are lost or typed into the wrong window.
• Advantages of ControlSetText(): Targets specific UI controls directly using control identifiers. It writes text near-instantaneously without requiring active focus, eliminating race conditions.

; Example AutoIt injection workflow
AutoItSetOption("WinTitleMatchMode", 2)
$hWnd = WinWaitActive("Console Login", "", 15)
If $hWnd = 0 Then
    PSMGenericClient_LogMessage("Login window not found", $LOG_LEVEL_ERROR)
    PSMGenericClient_Term()
    Exit
EndIf

ControlSetText($hWnd, "", "Edit1", $Username)
ControlSetText($hWnd, "", "Edit2", $Password)
ControlClick($hWnd, "", "Button1")

---

CyberArk Marketplace Integration and Community Connectors

Before developing a custom connector from scratch, administrators should search the CyberArk Marketplace. The Marketplace hosts hundreds of pre-built, community-tested, and CyberArk-certified connection components.

Marketplace packages are distributed as .zip archives containing:

• Connection Component XML: Contains component parameters, Target Settings, and client arguments.
• Compiled Dispatcher / Source Code: The compiled .exe or .au3 script ready for deployment.
• AppLocker Configuration Snippet: XML rules for whitelisting the connector.
• Implementation Guide: Prerequisites, client installation instructions, and configuration parameters.

Packages can be imported directly into PVWA via Administration > Options > Import Connection Component, significantly reducing development effort.

---

Deployment Pipeline, AppLocker Lockdown, and Troubleshooting

Deploying a custom connector requires following a strict implementation workflow:

1. Compile Binary: Compile the .au3 script to an executable using Aut2Exe.exe, ensuring the architecture (x86 vs x64) matches the target client.
2. Deploy Files: Copy the compiled dispatcher executable and client dependencies to C:\Program Files (x86)\CyberArk\PSM\Components\.
3. Update AppLocker: Add path or hash rules to PSMConfigureAppLocker.xml for both the dispatcher and target client binaries:

   <Application Name="CustomDispatcher" Type="Exe" Path="C:\Program Files (x86)\CyberArk\PSM\Components\CustomDispatcher.exe" Method="Path" />
   <Application Name="TargetApp" Type="Exe" Path="C:\Program Files\Vendor\App\client.exe" Method="Path" />
   

4. Apply AppLocker Policy: Execute .\PSMConfigureAppLocker.ps1 in an elevated PowerShell session to update Windows Local Security Policy.
5. Configure PVWA: Register the Connection Component in PVWA, set LockApplicationWindow = Yes, and link the component to the appropriate Platform.
6. Validate & Test: Perform end-user test connections and verify session recordings in PVWA.

Diagnostic Troubleshooting Matrix