Original reporting via devops.com, published May 2020.
Overview
One Identity, a provider of identity and access management (IAM) software, announced an integration with HashiCorp designed to reduce friction between enterprise privileged access management (PAM) workflows and the secrets management practices used by modern DevOps teams. The integration connects One Identity’s Safeguard PAM platform with HashiCorp Vault via a dedicated plugin.
What the Integration Does
According to Tyler Reese, a senior product manager at One Identity, the plugin allows developers to securely manage, monitor, record, and audit privileged and administrative access to secrets stored within Safeguard. Those secrets include:
- Vaulted tokens and passwords
- TLS/SSL certificates
- API keys
- Other application credentials
By routing HashiCorp Vault requests through the Safeguard plugin, developers can retrieve credentials on demand without requiring IT administrators to grant broad, standing access to the underlying PAM vault. This is particularly valuable when a custom application needs to authenticate against a packaged enterprise application — a scenario that previously required significant IT team involvement for each credential hand-off.
The Problem Being Solved
There has historically been a structural divide between two credential management worlds inside most enterprises:
- IT-managed credentials: Privileged accounts for packaged applications, governed by PAM tools and compliance requirements.
- Developer-managed secrets: API keys, service account tokens, and database passwords used inside CI/CD pipelines and custom applications, often managed in tools like HashiCorp Vault.
When DevOps teams need to integrate custom applications with packaged enterprise software, they must cross that divide. Without a secure bridge, the options are unappealing: grant developers direct access to the PAM vault (violating least-privilege principles), hard-code credentials (a security anti-pattern), or slow down development waiting for IT ticket resolution.
Reese described the goal of the integration as removing that friction entirely, so developers can retrieve the credentials they need through familiar Vault workflows while Safeguard enforces enterprise policy in the background.
How Safeguard Enforces Policy
Safeguard uses a transparent protocol proxy that inspects application-level traffic. Key capabilities include:
- Policy enforcement: Traffic that violates IT-defined policies is rejected at the proxy layer before it reaches protected systems.
- Real-time session monitoring: IT teams can observe privileged sessions as they happen and terminate a session immediately if anomalous behavior is detected.
- Automated password rotation: Privileged account passwords are rotated on a schedule to meet regulatory compliance requirements.
- Full audit trail: All access events are recorded, supporting forensic investigation and compliance reporting.
This architecture means that even though developers interact with HashiCorp Vault using their normal workflows, the Safeguard platform retains visibility and control over how credentials are actually used downstream.
DevSecOps Context: Why This Integration Matters
DevSecOps — the practice of embedding security controls directly into DevOps pipelines rather than treating security as a gate at the end of the development cycle — has been widely discussed but unevenly adopted. As of this announcement in 2020, most organizations acknowledged the goal of shifting security left toward developers, but had not yet provided the tooling to make that practical.
Secrets management is a clear example of the gap. Developers who want to follow security best practices need a fast, self-service way to obtain and rotate credentials. At the same time, security and compliance teams need auditability and policy enforcement. Without an integration like this one, those two needs pull in opposite directions: self-service access tends to reduce visibility, while strict IT control tends to slow development velocity.
The One Identity–HashiCorp plugin attempts to satisfy both sides simultaneously: developers use Vault’s API as usual, while Safeguard silently enforces the controls that security and compliance teams require.
The Broader Trend: Security Tooling Catching Up to CI/CD
This partnership reflects a wider movement in the security tooling market. Vendors across the identity, secrets management, vulnerability scanning, and policy enforcement spaces have been building integrations with CI/CD platforms such as Jenkins, GitLab CI, GitHub Actions, and others. As more security controls become available as pipeline steps or API-driven services, the cultural argument for DevSecOps gains practical support.
The end state most organizations are working toward is one where:
- Security teams define policies and verify compliance through automated tooling.
- Developers are responsible for implementing those controls as part of normal quality assurance — not as a separate security review phase.
- Audit evidence is generated automatically as a byproduct of the development workflow, rather than collected manually at release time.
Integrations like the One Identity–HashiCorp Vault plugin are practical steps toward that goal, lowering the bar for developer adoption of enterprise-grade secrets management without requiring developers to learn a new set of tools or processes.
Key Takeaways
- One Identity’s Safeguard PAM platform now integrates with HashiCorp Vault via a plugin, announced in May 2020.
- The integration lets developers retrieve enterprise credentials through Vault while Safeguard enforces policy, monitors sessions, and maintains an audit trail.
- The primary use case is securing access between custom-built applications and packaged enterprise applications that have IT-managed credentials.
- Safeguard’s transparent proxy inspects protocol traffic at the application layer, rejecting policy-violating requests before they reach protected systems.
- The partnership addresses a real gap in DevSecOps adoption: the tooling needed to let developers self-serve credentials securely, without burdening IT teams or bypassing compliance controls.