CyberArk Privileged Access Manager

CyberArk Privileged Access Manager (PAM) protects your most sensitive accounts and credentials. Pairing it with BlokSec removes passwords from the authentication step entirely — users access the vault by approving a push notification or scanning a QR code, with authentication backed by hardware-bound cryptographic keys.

BlokSec supports two integration protocols for CyberArk PAM: OIDC and SAML 2.0. Choose whichever your environment supports — the end-user experience is identical.

Prerequisites

Before you begin, make sure you have:

• A BlokSec admin account with permission to create applications
• Administrator access to your CyberArk PVWA (Password Vault Web Access)
• At least one user with the BlokSec authenticator app installed and their account provisioned in BlokSec

---

OIDC integration

1. BlokSec setup

Create the CyberArk OIDC application

1. In the BlokSec admin console, go to Applications and click Add Application → Create From Template
2. Select the CyberArk OIDC template
3. Configure the application:

Field	Value
Name	Any name meaningful to your organization
Session length	60 minutes (default)
Redirect URI	https://[CyberArk_PVWA_FQDN]/PasswordVault/api/Auth/OIDC/BlokSec/Token

4. Click Save, then click Generate App Secret
5. Note the Application ID and App Secret — you’ll need both in the next step

Screenshot pending

/screenshots/admin/integrations/cyberark/oidc-app-config.png

BlokSec admin console showing the CyberArk OIDC application configuration

2. CyberArk setup

Configure OIDC authentication in PVWA

1. In your CyberArk PVWA, navigate to Administration → OIDC Authentication
2. Enter the following values:

Field	Value
Display name	Passwordless Login (customizable)
Provider ID	BlokSec (customizable)
Discovery URL	https://api.bloksec.io/oidc/.well-known/openid-configuration
Client ID	Application ID from BlokSec
Client Authentication method	Basic
Client Secret	App Secret from BlokSec
User name claim	preferred_username

3. Enable the OpenID provider and click Save
4. Under AllowedReferrers, add an entry with Base URL https://api.bloksec.io
5. In Configuration Options, enable the OIDC authentication method

Screenshot pending

/screenshots/admin/integrations/cyberark/oidc-pvwa-config.png

CyberArk PVWA OIDC authentication configuration screen

---

SAML integration

1. BlokSec setup

Create the CyberArk SAML application

1. In the BlokSec admin console, go to Applications and click Add Application → Create From Template
2. Select the CyberArk (SAML) template
3. Configure the application:

Field	Value
Assertion Consumer Service (ACS) URL	https://[resource_name]/PasswordVault/api/auth/saml/logon
Name ID Format	EmailAddress

4. Click Save, then download the BlokSec SAML metadata file — you’ll need it in the next step

Screenshot pending

/screenshots/admin/integrations/cyberark/saml-app-config.png

BlokSec admin console showing the CyberArk SAML application configuration

2. CyberArk setup

Configure SAML authentication in PVWA

1. Under AllowedReferrers, add an entry with Base URL https://api.bloksec.io
2. In Configuration Options, enable the SAML authentication method
3. Create a saml.config file from the CyberArk template and populate it with the values from the BlokSec metadata file you downloaded

Screenshot pending

/screenshots/admin/integrations/cyberark/saml-pvwa-config.png

CyberArk PVWA SAML authentication configuration screen

Tip

The values you need from the BlokSec metadata file are the Entity ID, SSO URL, and the signing certificate. CyberArk’s saml.config template labels these fields clearly.

---

Enforce passwordless-only authentication

Once the integration is verified, you can require passwordless login exclusively by disabling all other authentication methods in CyberArk’s Configuration Options. This prevents users from falling back to passwords.

Test before enforcing

Verify that at least one admin account can successfully authenticate via BlokSec before disabling alternative methods. Locking out all authentication methods will require direct database access to recover.

Verifying the integration

1. Open a private/incognito browser window
2. Navigate to your CyberArk PVWA login page
3. Select the BlokSec / Passwordless Login option
4. Approve the sign-in on the BlokSec mobile app
5. Confirm you are granted access to the vault

Test before rolling out

Verify the integration with a single user account before communicating the change to your team. Make sure the test user has the BlokSec app installed and their account fully provisioned.