The simplest solution is to use Conjur Summon. This approach externalizes the secret retrieval process from the script's logic. The PowerShell script only needs a minimal modification to read the credential from a standard environment variable instead of a hard-coded value. The summon command-line tool is then used to execute the script, securely fetching the required secret from Conjur and injecting it into the script's runtime environment. This decouples the application logic from the secrets management implementation, resulting in a cleaner and simpler script.

A. This is a viable but more complex solution. It requires modifying the script to make specific calls to the CyberArk CLI SDK, tightly coupling the script to the Credential Provider's implementation.

B. Implementing SOAP web service calls directly within a PowerShell script is significantly more complex than using a dedicated SDK or tool, requiring manual request building and XML parsing.

C. WebSphere is an application server and is entirely irrelevant for running a PowerShell script on workstations. This technology does not apply to the scenario.

1. Conjur Open Source Documentation

Summon: The documentation describes Summon as a command-line tool that makes secrets available to a process as environment variables. It highlights the use of a secrets.yml file for declarative mapping

which simplifies configuration. The core principle is to run a command in a sub-process with the fetched secrets

abstracting the retrieval mechanism from the application code itself. (Reference: Conjur.org Documentation

"Tools"

"Summon" section).

2. CyberArk Application Access Manager Documentation

Command Line Password SDK: The official documentation for the Credential Provider details the usage of CLIPasswordSDK.exe. The examples show that the script itself must be modified to explicitly call this executable with specific parameters (e.g.

AppID

Safe

Object) and then process the standard output to retrieve the password. This method embeds the secret retrieval logic directly into the script

making it more complex than reading an environment variable. (Reference: CyberArk Credential Provider & ASCP Implementation Guide

Chapter on "Command Line Password SDK").