This document provides information about the Credential profile registration form screen, where it is possible to register the profiles to be used in the credential..
Path to access
- On Segura®, in the navigation bar, hover over the Products menu and select PAM Core.
- In the side menu, select Management > Credentials > Credentials profile > Add.
Settings Tab
| Item | Type | Required | Description |
|---|---|---|---|
| Name* | Text field | Yes | Name of the credential profile that will be associated with the credential. |
| Password policy* | Dropdown menu | Yes | Type of password policy for credentials used in the profile. |
| Status* | Toggle button | Yes | Profile status, options are Active and Inactive. |
Execution settings tab
Section Credential password change settings
| Item | Type | Required | Description |
|---|---|---|---|
| Configure execution for automatic switching | Toggle button | Yes | Select to enable automatic credential switching. |
| Change plugin | Dropdown menu | No | Select the plugin used to connect and perform the switch on the device. This plugin is linked to several connection protocols, there is no validation that the device has active connectivity. |
| Change template | Dropdown menu | No | Select the template that will be executed by the executor plugin. In the PAM solution, the user has access to a wide variety of templates developed and regularly updated. |
Section Authentication settings
| Item | Type | Required | Description |
|---|---|---|---|
| Use own credential to connect* | Toggle button | Yes | Select to use your own credentials to connect to the device and change the password. |
| Authentication credential | Dropdown menu | No | If you do not use your own credential to change the automated password, select which credential will be used to connect to the device. |
Section Reconciliation credential settings
| Item | Type | Required | Description |
|---|---|---|---|
| Configure execution for reconciliation* | Toggle button | Yes | Enables automated credential reconciliation. |
| Reconciliation credential | Dropdown menu | No | Reconciliation credential |
| Reconciliation plugin | Dropdown menu | No | Reconciliation plugin. |
| Reconciliation template | Dropdown menu | No | Reconciliation template. |
JIT settings tab
| Item | Type | Required | Description |
|---|---|---|---|
| Just In Time settings* | Radio button | Yes | Option for the credential to have JIT configuration. Select Enabled or Disabled. |
| Just in time type | Dropdown menu | No | Select one of the two options: Privilege grant or Ephemeral credential. Each option has its own section. |
| JIT execution | Radio button | No | Defines which device runs the JIT automation, for both JIT types. Domain device runs JIT automation on the domain. Target device runs JIT automation on the device where the session is started. The default is Domain device. The field is always displayed, and its options are enabled when Just In Time settings is Enabled and a JIT type is selected. Target device applies only to a credential that has a domain and a non-local password type. For other credentials, the automation runs on the credential's own device. |
Authentication settings section
| Item | Type | Required | Description |
|---|---|---|---|
| Authentication type | Selection field | No | Defines which credential authenticates in the JIT step. The options are Use own credential to connect, Select an existing credential, and Enter a credential name manually. A disabled account cannot authenticate its own enablement. With Privilege grant, if the template enables a disabled account, choose another credential. |
| Authentication credential | Dropdown menu | No | Indicate which credential will authenticate in the JIT step. |
Privilege grant section
The section displays the following note: Grants privilege on the configured credential before the session starts (for example, activating the credential, elevating privilege, or adding it to a privileged group) and revokes it when the session ends. No new credential is created.
| Item | Type | Required | Description |
|---|---|---|---|
| Privilege grant plugin | Dropdown menu | No | Choose one of the plugins that grant privilege on the JIT credential. |
| Privilege grant template | Dropdown menu | No | Choose one of the templates that grant privilege on the JIT credential before the session starts. |
| Privilege revocation plugin | Dropdown menu | No | Choose one of the plugins that revoke privilege from the JIT credential. |
| Privilege revocation template | Dropdown menu | No | Choose one of the templates that revoke privilege from the JIT credential when the session ends. |
Ephemeral credential section
The section displays a note that summarizes the type: Segura® creates a new credential with a random username for each session and removes it when the session ends.
| Item | Type | Required | Description |
|---|---|---|---|
| Credential creation plugin | Dropdown menu | No | Choose one of the creation plugins for the JIT credential. |
| Credential creation template | Dropdown menu | No | Choose one of the creation templates for the JIT credential. |
| Credential removal plugin | Dropdown menu | No | Choose one of the removal plugins for the JIT credential. |
| Credential removal template | Dropdown menu | No | Choose one of the removal templates for the JIT credential. |
More information in How to configure a JIT credential.
Review Tab
This section provides summary information about the choices made in the previous steps. The information is grouped by each tab respectively.