Skip to main content
Lumos supports 2 integrations for Delinea Secret Server: Delinea Secret Server (on-premise, via the Lumos on-premise agent, read-only) and Delinea Secret Server (Cloud) (covered in this article), which connects directly and supports provisioning.

​
After this article

You will be able to connect Delinea Secret Server Cloud to Lumos to sync users, secret permissions, user groups, and user roles, and to provision and deprovision access.

​
Capabilities

Provisioning behavior:
  • Create: requires a username, password, display name, and email. Lumos first searches Delinea for the username (the lookup also matches display name and email). If a matching user already exists, Lumos links that account instead of creating a duplicate. New users are created enabled.
  • Secret and folder permissions: Lumos grants access at the access level encoded in the entitlement (for example View or Edit). Folder grants set the same level for the folder and the secrets inside it. When revoking, Lumos looks up the permission record first. If it’s already gone, the revoke is a safe no-op.
  • Groups and roles: Lumos adds or removes the user directly on the user’s group and role lists.
  • Reactivate: Lumos re-enables a deactivated user by setting enabled back to true.

​
Required plan and roles

  • Availability: this integration is in Early Access. Reach out to Lumos support to enable it for your tenant.
  • Delinea account: a dedicated service user, authenticated via the OAuth2 password grant flow (Lumos exchanges the username/password for API access tokens).
  • Secret Server role permissions (assign a role with all of these to the service user):
    • Administer Users: sync and provision user accounts
    • Administer Groups: sync and provision group membership
    • Administer Role Assignment: sync and provision role assignments
    • Administer Folders: read folder structure for secret permissions
    • View Secret: read secrets for permission sync
    • Bypass Direct API Authentication Restriction: required for non-interactive API login
  • Folder access: the service user needs Owner access on the Root Folder, propagated to all subfolders and secrets.
  • Permission scoping: this connector provisions as well as syncs, so the Administer permissions above are required. There is no read-only variant of the Cloud connector (use the on-premise integration for read-only).
  • Product scope: this connector works with Delinea Secret Server Cloud (Delinea’s classic PAM). The newer Delinea Platform identity-security product is not supported.

​
Instructions

Phase 1: Create the service user in Delinea
  1. In the Platform UI, go to Access → Users, click More (top-right) → Add service user. Fill in the Username, Display name, and Set password fields, assign the user to the appropriate group, and save.
  2. In Secret Server, go to Admin → Roles and create a role with these permissions: Administer Users, Administer Groups, Administer Role Assignment, Administer Folders, View Secret, and Bypass Direct API Authentication Restriction. Assign this role to the service user.
  3. On the Root Folder → Permissions tab, add the service user with Owner access and select Set permissions on all subfolders and Set permissions on all secrets.
Phase 2: Connect in Lumos
  1. Find the Delinea Secret Server (Cloud) card in your Lumos integrations (Early Access, contact support if you don’t see it).
  2. Enter the Account Name (your unique identifier, e.g. your company or environment name), the service user’s Username, and its Password.
  3. Click Connect.

​
API Endpoints Used

​
Troubleshooting

“Failed to connect” even though users synced. A connection failure reported after a successful user sync usually means the entitlement (folder/secret permission) sync step failed, not the credentials. This was historically a connector-side defect in the folder-permissions call (since fixed, with no customer configuration change required). If it recurs, verify the service user’s role permissions and Root Folder Owner access, then contact Lumos support. API login fails for the service user. Ensure the role assigned to the service user includes Bypass Direct API Authentication Restriction. Without it, non-interactive API login is blocked. You are on Delinea Platform. The connector supports Secret Server Cloud only. Delinea Platform is not supported, even where connector wording may hint at it. Secret permissions missing from sync. Confirm the Root Folder Owner permission was propagated with both Set permissions on all subfolders and Set permissions on all secrets selected.