The Vendor Access Portal in Domum Remote Access lets third parties register, authenticate, and request time-limited access to the resources an administrator publishes for them.
The portal adds a self-service channel on top of the existing Domum flows. It does not remove or change how administrators grant access. Both models coexist.
Key terms
- Tenant: the organization that runs Domum Remote Access and operates the portal. To a third party, this is the customer they work for.
- Vendor organization: a group of third parties that an administrator configures, each with its own access limits.
- Third-party user: any Domum limited user, typically a vendor, MSP, or auditor, who self-registers, requests access, and connects to authorized resources.
Permissions and users
The portal separates who configures it from who decides who gets in. Three permissions carry that split:
- Domum.Portal.Configure: enables the portal, sets the network restrictions, and publishes resources.
- Domum.Portal.View: opens the portal settings without changing them.
- Domum.Portal.Review: reviews registrations (approves or rejects) and access requests (releases or rejects).
Two built-in roles carry those permissions and grant nothing beyond the portal:
- Portal Configuration: Domum.Portal.View and Domum.Portal.Configure.
- Portal Operator: Domum.Portal.View and Domum.Portal.Review.
Domum Administrator includes all three, along with the rest of the Domum module. Use it when one person does both jobs.
What the portal enables
- Self-registration: a third party registers through the portal address, instead of depending on the customer's team to create the account.
- Administrator approval: a new registration stays pending and cannot see resources or sign in until an administrator approves it. Approving is what creates the user account.
- Passwordless sign-in: an approved third party signs in with their email address and a sign-in code. There is no password to issue, rotate, or leak.
- Scoped catalog: after signing in, the user sees only the resources published for their organization.
- Structured access requests: the user requests a resource with a justification, a session duration within the limit set for that resource, and an optional ticket reference.
- Administrator triage: a request does not reach the approval workflow on its own. An administrator assigns the credential, the access window, and the session limit first.
- Mediated, recorded sessions: approved sessions open through the Segura® Web Proxy, with no direct connection to the target and full session recording.
How access flows
- An administrator enables the portal and publishes resources, then sets the limits for each vendor organization.
- The third party self-registers and waits for approval.
- An administrator reviews the registration, assigns it to a vendor organization, and approves it. Approving the registration creates the user account.
- The third party signs in and requests a resource from the catalog.
- An administrator triages the request, assigns the credential and the access window, and releases it. The request then follows whatever approval policy already applies to that vendor.
- Domum emails the access link.
- The third party opens it, completes their own multi-factor authentication, and starts the session from the third-party desktop through the Segura® Web Proxy. For the steps they follow, see How to access Domum as a third-party user.
Attention
A request nobody triages expires after 6 hours and cannot be revived.
The portal address
Segura® derives the portal address from the tenant's single sign-on host and provisions it when the portal is enabled. There is no separate portal domain to request, and no per-tenant portal URL to configure.
Security and audit
- Minimum disclosure: the portal never confirms whether an organization or email already exists, and blocked actions return generic messages. The detail goes to the audit trail instead.
- Mandatory recording: the platform records and audits sessions to the same standards as other Domum sessions. A session cannot start if recording is unavailable.
- Two audit trails: sessions opened from the portal are recorded with the other Domum sessions, marked with their origin. Portal events (registrations, approvals, requests, and blocked attempts) go to a separate high-volume trail forwarded to your SIEM. See Audit Vendor Access Portal activity.
- Automatic enforcement: the portal refuses connections from outside the IP ranges and the locations you allow. It checks both when a third party signs in and when one registers, and records every block in the audit trail.