StrongDM 201 — Training Guide
0% complete
Interactive Training Guide

StrongDM 201 Certification

Master advanced authentication, secrets management, certificate authorities, and deployment architecture across two comprehensive modules.

🔐 Authentication
🗝️ Secrets Mgmt
📜 Certificate Auth
🌐 Deployment
🔀 Gateways & Relays
🗄️

Secret Stores

How StrongDM stores, manages, and retrieves encrypted credentials for resources across your infrastructure.

💡 StrongDM is vault/secret store agnostic. Users can continue using their existing 3rd-party secret stores and are not required to migrate to StrongDM.
How Credentials Flow Through StrongDM
👤 User
StrongDM Client
Node (Gateway/Relay)
Resource
↑ fetches from
Secret Store
Secret
An encrypted credential stored in a secret store, used by nodes to authenticate with resources.
Secret Engine
Defines how secrets are managed within a secret store, including rotation functionality.
Secret Path
A reference string used by resources to locate their credentials in the store (e.g., fse/secret/FSE-DB).
⚖️

Choosing Your Secret Store

Use this decision tree to determine the right option for your deployment.

Secret Store Decision Tree
Select Vault
Continue using existing vault?
YES
Use 3rd-Party Vault
NO → Need credential rotation?
YES
StrongDM Vault
NO
Store in StrongDM

StrongDM Native Options Compared

Feature Stored in StrongDM StrongDM Vault
Default option ✓ Yes ✗ No
Configuration required None needed Required
Credential rotation ✗ Not supported ✓ Supported
License requirement Any license Enterprise only
Stores passwords, certs, keys ✓ Yes ✓ Yes
Previously known as "Strong Vault"

Supported 3rd-Party Secret Stores

Cloud Providers

Cloud Secret Managers

  • AWS Secrets Manager
  • Azure Key Vault
  • GCP Secret Manager
Enterprise PAM

Enterprise Vaults

  • CyberArk Conjur Enterprise
  • CyberArk PAM Enterprise
  • Delinea Secret Server Enterprise
HashiCorp

HashiCorp Vault

  • HashiCorp Vault (Token)
  • HashiCorp Vault (App Role)
  • HashiCorp Vault (AWS EC2/IAM auth)

Secret Engines Deep Dive

TYPE 01 Rotatable Secret Engines

These secret engines can automatically rotate passwords on the resource AND update the secret store. Supported resource types:

  • Active Directory — Manages AD account passwords
  • PostgreSQL — Rotates database user credentials
  • MySQL — Rotates database user credentials
  • Microsoft SQL Server — Rotates database user credentials
ℹ️ The secret store must be created before the secret engine can be configured.
TYPE 02 Key-Value Secret Engine

Stores arbitrary secrets in the supported secret store without automatic rotation on a resource. Use when:

  • You need to store structured key-value data
  • Automatic credential rotation is not required
  • Working with resources not covered by rotatable engines
PATH Using Secret Paths in Resources (StrongDM Vault)

When a secret is created in StrongDM Vault (e.g., with path fse/secret/FSE-DB), you reference it from the resource configuration using key arguments:

// Username field in resource config: fse/secret/FSE-DB?key=username // Password field in resource config: fse/secret/FSE-DB?key=password
⚠️ These paths are exact — they are not placeholders. The ?key=username and ?key=password arguments are required by StrongDM Vault to reference individual fields.

Knowledge Check

Secret Stores
Question 1 of 3
Which secret store option supports credential rotation?
Question 2 of 3
What happens to credentials when a client connects to a resource via a 3rd-party secret store?
Question 3 of 3
In StrongDM Vault, secrets inherit their rotation settings from their secret engine. Can admins override this?
🔄

Secrets Management & Rotation

How StrongDM automates credential lifecycle management including retrieve, rotate, and validate operations.

ℹ️ Secrets management requires a StrongDM Enterprise license. All three actions (retrieve, rotate, validate) are governed by Cedar policies.
Credential Rotation Architecture
Admin UI / CLI
Node + Secrets Engine
generates new credential for
Resource (AD / DB)
also stores new credential in
Secret Store
⚠️ Credentials sent to the resource are never stored in StrongDM Vault — only the copy kept for user access is stored there.

The Three Actions

ACTION 01 Retrieve — Read the current secret

Fetches the current managed secret from the secret store so a user can view and copy it.

1

Node fetches secret from store

The secrets engine retrieves the managed secret from the secret store.

2

Validate against resource

The node authenticates against the resource (e.g., Active Directory) to confirm the secret is still valid.

3

Display to user

The secret is shown in a popup on the Admin UI. Users can copy it for use in other systems.

Both the policy evaluation and the actual read are logged — in Logs → Policies and Logs → Secrets respectively.

ACTION 02 Rotate — Generate and deploy a new secret

Replaces the existing credential on both the resource and in the secret store atomically.

1

Generate new secret

The node creates a new credential based on the password policy configured in the secret engine.

2

Update the resource

The new credential is written to the resource (e.g., AD account password is changed).

3

Update the secret store

The new credential is saved to the secret store so future retrievals return the current value.

💡 Rotation can be triggered manually or configured to run on an automatic interval via the Credential rotation interval setting on the secret engine.
ACTION 03 Validate — Verify the secret is still correct

Checks whether the stored secret still matches what the resource expects — useful if someone changed a password directly on the resource outside of StrongDM.

1

Retrieve from secret store

The current managed secret is pulled from the store.

2

Authenticate against resource

The node attempts to log in to the resource using the stored secret.

If validation succeeds: the stored secret is confirmed valid.
If validation fails: the credential was changed out-of-band — run a Rotate to re-sync.

Policy Enforcement for Secrets

Permit Pattern

Allow Secret Actions

@mfa("Who dat?") permit ( principal, action in [ "retrieve", "validate", "rotate"], resource is ManagedSecret ) when { resource.hasTag("admin") };
Forbid Pattern

Block Secret Actions

forbid ( principal, action in [ "retrieve", "validate", "rotate"], resource is ManagedSecret ) when { principal.hasTag( "forbidden_user") };
Scoped Pattern

Specific Secret Only

permit ( principal, action in ["retrieve"], resource == ManagedSecret:: "ms-163d0e..." ) when { principal.hasTag( "secret_tag") };
⚠️ As of the course writing date, secrets management policies must be written manually. The policy editor does not provide recommendations for secrets policies the way it does for resource policies. Use StrongDM::ManagedSecret::Action::"retrieve" as the action format and StrongDM::ManagedSecret as the resource type.

Knowledge Check

Secrets Management
Question 1 of 2
A developer changed an Active Directory password directly in AD, bypassing StrongDM. What action should be run first to detect this?
Question 2 of 2
Which three components are required for StrongDM credential rotation to function?
📜

Certificate Authorities

How StrongDM uses CAs to establish identity and enable certificate-based authentication for SSH and RDP.

CA Function 1

Verify Identities

Confirms an entity is who it claims to be — preventing attackers from impersonating servers or users.

CA Function 2

Issue Digital Certificates

Once verified, the CA issues a certificate bound to the entity via a public key. The certificate derives its trust from the CA.

CA Function 3

Revoke Certificates

Compromised or misused certificates can be added to a Certificate Revocation List (CRL) by the CA.

Certificate-Based SSH Authentication Flow
Client Server
Initiate SSH connection
Verify host key against trusted Host CA Send SSH Host Key Cert (signed by Host CA)
Send SSH User Key Cert (signed by User CA) Verify client key (optional)
Host key validated Accept connection
Establish Secure Channel

StrongDM Default Certificate Authorities

⚠️ The default StrongDM CAs use self-signed certificates. These are suitable for testing and evaluation but will generate browser/client warnings in production. Replace with certificates from a trusted CA for operational deployments.
Default CA 01

🌐 DNS Certificate Authority

Used for DNS-based resource connections. Tag: se-dnscert

Default CA 02

🖥️ RDP Certificate Authority

Used for Remote Desktop Protocol connections. Tag: se-rdpcert

Default CA 03

🔑 SAML Certificate Authority

Used for SAML-based authentication flows. Tag: se-samlcert

Default CA 04

🔒 SSH Certificate Authority

Used for SSH certificate-based authentication. Tag: se-sshcert

💡 Each StrongDM tenant includes all four default CAs automatically. They are managed under Settings → Secrets Management → Certificate Authorities.

Knowledge Check

Certificate Authorities
Question 1 of 2
Why are the default StrongDM CAs not recommended for production deployments?
Question 2 of 2
How many default Certificate Authorities does each StrongDM tenant include?
🏗️

Deployment — Advanced

Understanding how traffic flows from users to resources, and what makes a production-grade StrongDM deployment different from the lab environment.

User-to-Resource Flow — Four Stages
1. Log on to SDM Client
2. Get Connection Details
3. Connect to Resource
4. Use Resource
STAGE 01 Log on to the StrongDM Client

Logging on identifies the user to the StrongDM network. User identities are associated with one or more Roles, which determine accessible resources.

Users can authenticate using their StrongDM account credentials or via an integrated Identity Provider (IdP) such as Google, Okta, or Azure AD.

💡 In a properly configured StrongDM environment, no resources should be visible by default — consistent with zero-standing-privileges best practices.
STAGE 02 Get Connection Details (Access Request)

Users request access via Access → Request Access → Catalog in the StrongDM console. After approval, the resource appears in the SDM client with a local address (e.g., 127.0.0.1:10006).

Users connect using their normal tools (SSH client, database client, browser) to that local address — StrongDM handles the rest transparently.

STAGE 03 Connect to Resource (Routing)

StrongDM uses a proprietary routing protocol hosted in the control plane to find the best path through the proxy network. Three routing modes exist:

Mesh / Legacy Routing
Default. Clients can connect to any Gateway; any Gateway can route to any Relay. Also called "Active Linking."
Explicit Routing
Admins pre-specify preferred routes. Better for large environments to avoid sub-optimal paths.
Proxy Clusters
For large environments needing tightest routing control. Uses Proxy Workers and Bridge Workers with a different routing model.
STAGE 04 Use Resource (Policy & Logging)

StrongDM's security role doesn't end at access — it continues monitoring with:

  • Cedar Policies: An additional security layer governing what actions users can perform on resources.
  • PBAC (Policy-Based Action Controls): Inspects instructions and data sent to the resource in real time.
  • Session Logs: Generated by the node and uploaded to the control plane. StrongDM will only allow future traffic if previous session logs have been properly uploaded.
⚠️ The credentials the user logs in with are not the credentials used to access the resource. The Gateway/Relay handles resource authentication using leased credentials or identity aliases.

Why StrongDM-in-a-Box ≠ Production

Problem 1

Single Gateway

The lab uses only one Gateway — no high availability. Production requires multiple Gateways for redundancy.

Problem 2

No Relay Deployed

The lab has no Relay. Production environments separate the resource network from the DMZ using Relays behind firewalls.

Problem 3

Flat Network

Client, Gateway, and resources are all in the same network. Production uses separate subnets and security devices (firewalls, DMZ).

Knowledge Check

Deployment
Question 1 of 2
What routing mode allows clients to connect to any Gateway, and any Gateway to reach any Relay?
Question 2 of 2
What happens if a node fails to upload session logs to the control plane?
🔀

Gateways & Relays

How nodes work together to securely route traffic from users to resources across network boundaries without inbound firewall rules.

Gateway
A node deployed in the DMZ with a public-facing listener on TCP 5000. Accepts inbound connections from clients and maintains persistent connections to Relays.
Relay
A node deployed in the resource network (no public listener). Initiates outbound connections to Gateways — no inbound firewall rules needed.
Proxy Worker
Part of a Proxy Cluster; handles client-facing connections. The Gateway equivalent in Proxy Cluster architecture.
Bridge Worker
Part of a Proxy Cluster; handles resource-facing connections. The Relay equivalent in Proxy Cluster architecture.

The Key Insight: Relays Initiate, Not Resources

Network Topology — Gateway + Relay Deployment
User Network
👤 User
SDM Client
DMZ
Gateway
TCP 5000 listener
← INITIATE
ESTABLISH →
Firewall
(stateful)
Resource Network
Relay
Outbound only
Resource
💡 Because the Relay initiates the connection to the Gateway (not the other way around), no inbound firewall rules are needed on the resource network. The stateful firewall allows the return traffic from this outbound-initiated connection.

How Gateway–Relay Pairing Works

1

Both register with Control Plane

The Relay and Gateway both register with app.strongdm.com via TCP 443 and subscribe to a GRPC notification queue.

2

Control Plane publishes routing info

The control plane sends each node the list of relevant Gateways and Relays it should know about, including routing information.

3

Relay initiates TLS connection to Gateway

The Relay establishes a persistent outbound TLS tunnel to the Gateway on TCP 5000. The Gateway maintains this connection.

4

Client traffic flows through the tunnel

When a user connects, their traffic travels through the SDM client → Gateway → Relay → Resource via the established TLS tunnel. The final hop uses the resource's native protocol (SSH, SQL, RDP, etc.).

Protocol Encapsulation
User uses native protocol
(SSH / SQL / RDP)
SDM network uses
TLS
Final hop uses native protocol
(SSH / SQL / RDP)
Resource

Knowledge Check

Gateways & Relays
Question 1 of 2
Why does deploying a Relay eliminate the need for inbound firewall rules on the resource network?
Question 2 of 2
What protocol do Gateways and Relays use to communicate with each other within the StrongDM proxy network?