3.1 PVWA Web Portal Architecture & Interface Configuration

3.1 PVWA Web Portal Architecture & Interface Configuration

Password Vault Web Access (PVWA) is the primary presentation tier and operational interface for CyberArk Privileged Access Manager (PAM). Through this centralized portal, users check out privileged credentials, initiate isolated administrative sessions via Privileged Session Manager (PSM), and submit approval workflows. Simultaneously, administrators configure platforms, onboard accounts, govern Safe permissions, and monitor active session telemetry. For the CyberArk Defender (PAM-DEF) exam, candidates must master the underlying Microsoft Internet Information Services (IIS) infrastructure, Vault-resident configuration architecture, and interface customization techniques.

---

The Multi-Tier Architecture of PVWA

PVWA operates as a multi-tier web application built on Microsoft Windows Server. Rather than storing application logic, session state, or credentials locally on the web server's filesystem, PVWA acts as an intelligent proxy between web clients and the CyberArk Digital Vault.

Network Communication & Protocol Flows

PVWA bridges two distinct network boundaries:

• Client-to-PVWA (Ingress): End users and administrators connect to PVWA over standard HTTPS (TCP port 443) using modern web browsers. All communication is encrypted via Transport Layer Security (TLS).
• PVWA-to-Vault (Egress): PVWA communicates directly with the primary Digital Vault engine using the proprietary CyberArk Vault protocol over TCP port 1858. All queries for account metadata, authorization checks, and configuration files flow across this single port.
• PVWA-to-Session Components: When launching privileged sessions, PVWA either generates an encrypted .rdp bootstrap file for desktop PSM connections or proxies the session via the clientless HTML5 Gateway over HTTPS (TCP port 443).

High Availability & Load Balancing Topologies

In enterprise environments, high availability is achieved by deploying multiple PVWA web servers behind a Network Load Balancer (such as F5 BIG-IP or AWS Application Load Balancer). Because PVWA stores minimal persistent state locally, any node can process incoming requests if session persistence (cookie-based sticky sessions) is enabled. Session affinity prevents user sessions from bouncing between differing IIS worker processes, avoiding ASP.NET session state invalidation.

---

Microsoft IIS & Application Pool Architecture

PVWA is deployed inside Microsoft IIS (typically IIS 10 on Windows Server 2019/2022). Understanding its virtual directory layout and application pool behavior is essential for deployment and maintenance.

Virtual Directories and Applications

The PVWA installation registers a web application under the IIS Default Web Site, structured around specific URIs:

• /PasswordVault: The root application directory hosting the web application framework, static assets, and client resources.
• /PasswordVault/v10: The modern Angular-based single-page application interface, providing optimized account views and streamlined navigation.
• /PasswordVault/API: The REST API endpoint framework, enabling programmatic administrative operations and third-party integrations.

Application Pool Configuration

PVWA runs inside a dedicated IIS application pool named PasswordVaultWebAccessPool:

• .NET CLR Version: Runs in .NET CLR Version v4.0 with Integrated Managed Pipeline Mode.
• Architecture: Configured as a 64-bit process (Enable 32-Bit Applications = False).
• Application Pool Identity: Defaults to ApplicationPoolIdentity, running under the least-privileged virtual service account context created by IIS.
• Worker Process Management: Hosted by w3wp.exe. System administrators must coordinate worker process recycling during maintenance windows to avoid dropping active administrative workflows.

---

Configuration Storage: PVWAConfig and PVWAPrivateUserPrefs Safes

A core design principle of CyberArk PAS is that no enterprise configuration is stored locally on the PVWA web server. If a PVWA server fails, an administrator can deploy a replacement server, run the PVWA installer, and instantly rejoin the cluster without manual reconfiguration because configurations reside centrally inside Vault Safes.

The PVWAConfig Safe

The PVWAConfig Safe is the central configuration repository for all PVWA servers in the environment. It contains core XML configuration objects that govern the visual interface, policy behaviors, and system options:

• PVConfiguration.xml: Governs global UI parameters, system-wide options, search property configurations, authentication method displays, platform view assignments, and branding elements.
• Policies.xml: Houses definitions of all active and inactive platforms, specifying credential management parameters, account properties, and CPM operational rules.

Configuration Caching & ConfigurationRefreshInterval

To eliminate database overhead on the Digital Vault, PVWA caches PVConfiguration.xml and associated parameters in the local memory of the IIS worker process (w3wp.exe).

The synchronization of this cache is controlled by the ConfigurationRefreshInterval parameter defined inside PVConfiguration.xml (under Administration -> Configuration Options -> Options -> General). By default, this value is set to 20 minutes (1,200 seconds). When an administrator updates UI settings in PVWA, other cluster nodes may not reflect updates until their interval expires. To force an immediate refresh, administrators can run iisreset or recycle PasswordVaultWebAccessPool in IIS.

The PVWAPrivateUserPrefs Safe & Service Accounts

While PVWAConfig contains global parameters, the PVWAPrivateUserPrefs Safe stores individualized user preferences—including customized grid column ordering, favorite Safes, default search filters, and dashboard widget layouts. Each user's settings are stored in unique objects indexed by user ID.

During installation, the installer provisions two specialized Vault service accounts:

1. PVWAUser: Used by the web application to query and write data to the Vault on behalf of authenticated human sessions.
2. PVWAGWUser (Gateway User): Used to establish the initial anonymous connection between IIS and the Vault before user authentication takes place. It verifies system availability and retrieves login screen parameters.

Both accounts authenticate using credential files (pvwauser.ini and pvwagwuser.ini) stored securely on the PVWA host and protected by the machine's local encryption keys.

---

Web Interface Customization & UI Navigation

Administrators can customize the PVWA interface for branding and compliance:

• Corporate Branding: Logos and banners can be uploaded via Administration -> Configuration Options to replace default emblems.
• Security Disclaimers: Organizations frequently mandate legal disclaimers. Setting DisplayDisclaimer=Yes and populating DisclaimerText in PVConfiguration.xml forces users to acknowledge terms before logging in.
• Search Property Indexing: The Accounts search engine allows users to locate credentials by username, address, or custom file categories. Adding custom account properties to the indexed search properties list in PVConfiguration.xml accelerates queries across large vaults.

The modern PVWA v10 interface organizes operations into four core workspaces:

• Accounts: Inventory view for credential check-outs, rotations, and PSM connections.
• Safes: Administrative console for Safe permissions, CPM assignments, and retention rules.
• Administration: Governance hub for Platform Management, User Management, and System Options.
• Monitoring: Live auditing workspace for session shadowing, keystroke monitoring, and termination.

---

PVWA Architectural Artifacts Comparison