Creating a Web App

In order to connect to CyberArk you must first create a new Web App connection for Trelica.

In the Identity Administration section, go to Apps & Widgets > Web Apps and click Add Web Apps:

Choose Custom and then OpenID Connect:

Click Yes to confirm you want to add the new Web App. 

The application will be added, but you need to close the Add Web Apps dialog to see it.


  1. Enter trelica_integration for the Application ID
  2. For the Name, also enter 'Trelica Integration'
  3. You can download a logo here:

Click Save and move to the Trust tab. 


  1. Generate and enter a strong secret in the OpenID Connect client secret field.
  2. Choose Login initiated by the relying party (RP).
  3. Add a redirect URI. 
    • If your Trelica instance is hosted in the US use:
    • In the EU use:
  4. Leave Enable full url match checked.

You will need the OpenID Connect client ID and OpenID Connect client secret when connecting to Trelica. You can copy these to the clipboard from the Trust tab.

Click Save and move to the Tokens tab.


  1. First of all check Generate access and ID tokens with new structure.
  2. Set the Access and ID token lifetime to 1 hour.
  3. Check the Issue refresh tokens checkbox.
  4. Set the Refresh token lifetime to 365 days.

Click Save and move to the Scope tab.


  1. Leave Prompt the user for consent to authorization request unchecked.
  2. Click Add.
  3. Enter trelica as the scope Name.
  4. Ensure Define the scopes to access APIs is selected and then click Add to add the following REST Regex entries:
    • Redrock/Query
    • Org/ListAll
    • Roles/GetRoleMembers
    • UPRest/GetResultantAppsForUser
  5. If you want to use onboarding features (creating users, assigning users to roles, or temporarily exempting users from MFA) then create a scope called onboarding and assign the following REST Regex entries:
    • CDirectoryService/CreateUser
    • CDirectoryService/GetUser
    • SaasManage/AddUsersAndGroupsToRole
    • CDirectoryService/ExemptUserFromMfa
  6. If you want to use offboarding features (suspending and deleting users, removing users from roles, or unassigning or removing mobile devices) then create a scope called offboarding and assign the following REST Regex entries:
    • CDirectoryService/SetUserState
    • UserMgmt/RemoveUsers
    • SaasManage/RemoveUsersAndGroupsFromRole
    • Mobile/DeleteDevice
    • Mobile/RemoveDeviceProfile

Click Save on the dialog, and then Save again on the page.

Move to the Permissions tab.


Click Add to open the Select User, Group, or Role dialog.

  1. Search for an administrator. 
  2. Check the box next to the user.
  3. Click Add.

Against the user you added, check the View, Run, and Automatically Deployed checkboxes.

Click Save - the Status of the application should change to Deployed:

You are now ready to connect to CyberArk from Trelica.

Connecting from Trelica

Go to Admin > Integrations > CyberArk and click Connect:   

Enter your CyberArk URL - this is the URL you will have been using when logged in to CyberArk configuring the Web app. 

The Client ID and Client Secret from the Trust tab.

Click Connect.

Was this article helpful?

0 out of 0 found this helpful



Please sign in to leave a comment.