The Segura® Platform offers the possibility of using Just-In-Time (JIT) credentials. This configuration manages the use time of services, such as when an account is created or activated or needs specific permissions added during a period to perform actions.
Be aware that after this access, the account is deleted, inactivated, or removed.
JIT access configuration is done when you register or edit a credential. If you are registering a credential, access the documentation on How to configure a credential in Segura®. In case you are editing a credential, follow these steps:
- On Segura® Platform, in the navigation bar, hover over the Products menu and select PAM Core.
- In the side menu, select Credentials > All credentials.
- In the list of credentials, locate the credential you want to edit and in the Action column, click on the Edit option from the drop-down menu.
Before you register a JIT credential, configure the templates for the JIT type you plan to use: the privilege grant and privilege revocation templates, or the credential creation and credential removal templates. You select these templates in the credential, and Segura® uses them when the proxy session starts. For more information, see Templates.
The user cannot register plugins.
In the Credential form, go to the JIT settings tab and fill in the following fields:
- Just In Time settings: select Enabled.
- In the Just in time type drop-down menu, select the type that matches the credential the privileged session must use:
- Privilege grant: the session uses the credential configured here. Segura® runs the privilege grant template on this credential before the session starts, and the privilege revocation template when the session ends. No new credential is created. Use this type to activate the credential, elevate its privilege, or add it to a privileged group only for the duration of the session.
- Ephemeral credential: Segura® creates a new credential with a random username for each session and starts the session with it, instead of the credential configured here. The ephemeral credential is removed when the session ends.
- In the JIT execution field, select where the JIT automation runs: Domain device or Target device. This field appears only for a domain credential. For what each option does, see Where the JIT automation runs.
- In the Authentication settings section, select Use own credential to connect to connect with this credential. Otherwise, clear it and select a credential in the Authentication credential drop-down menu.
- With Privilege grant, if the template enables a disabled account, use another credential. A disabled account cannot authenticate its own enablement.
Each JIT type has its own section in the form, with a note that describes what the type does. Fill in the section for the type you selected.
In case you selected Privilege grant, fill in the following fields:
- In the Privilege grant plugin drop-down menu, select one of the registered plugins.
- In the Privilege grant template drop-down menu, select one of the registered templates.
- In the Privilege revocation plugin drop-down menu, select one of the registered plugins.
- In the Privilege revocation template drop-down menu, select one of the registered templates.
In case you selected Ephemeral credential, fill in the following fields:
- In the Credential creation plugin drop-down menu, select one of the registered plugins.
- In the Credential creation template drop-down menu, select one of the registered templates.
- In the Credential removal plugin drop-down menu, select one of the registered plugins.
- In the Credential removal template drop-down menu, select one of the registered templates.
Click the Continue button and Save.
Where the JIT automation runs
For a domain credential, Segura® runs the JIT templates on one of two devices. The JIT execution field decides which one, for both JIT types:
- Domain device: the automation runs on the device linked to the credential. This is the default. Active Directory grants the privilege in the domain and replicates it to the target device.
- Target device: the automation runs on the device the session targets.
- With Privilege grant, the privilege grant template runs on that device when the session opens, and the privilege revocation template runs there when the session ends.
- With Ephemeral credential, the credential creation template runs on that device. For example, it grants the ephemeral account membership in the device's local administrators group when the session opens. The credential removal template revokes it when the session ends.
In a domain distributed across regions, replication can take long enough that the privilege does not yet exist on the target device when the session starts. Target device grants the privilege where it is used, for the duration of the session, without waiting for replication.
JIT execution appears only for a domain credential. A local credential already runs its automation on its own device.
The choice applies to both templates of the selected JIT type. Selecting it changes nothing for credentials you have already configured.
Requirements for Target device
With Target device, Segura® opens a direct WinRM connection to each target device and runs the template there. Every device you target this way must be reachable over WinRM.
Over WinRM HTTP on port 5985, the Windows RM execution template must include !unsecure. Confirm that the template you select carries this line before you use it.
If the template does not include !unsecure on port 5985, provisioning fails on an SSL handshake. The operator sees the message An error occurred while provisioning the credential. The session does not open, and the matching removal is recorded as canceled.
Simultaneous sessions with a JIT credential
How many privileged sessions a JIT credential accepts at the same time depends on the JIT type and on where the automation runs:
| JIT type | JIT execution | Simultaneous sessions |
|---|---|---|
| Privilege grant | Domain device | One session per credential at a time. Enabling the domain account affects every device, so ending one session would revoke the privilege from the others. |
| Privilege grant | Target device | One session per credential on each device. Sessions with the same credential on different devices can run at the same time. Ending a session revokes the privilege only on its own device. |
| Ephemeral credential | Any | Each user can hold one session per credential on the same device. Different users can open sessions at the same time with the same credential and device, each with their own ephemeral credential. |
Two settings outside JIT also limit simultaneous sessions:
- Allow simultaneous session?, in the credential policy, on the Information tab. When it is set to No, Segura® blocks a new session while another one with the credential is active. More information in Policies.
- Number of simultaneous user sessions (zero indicates unlimited), in Settings > System parameters > Global, in the Remote session section. It limits the remote sessions of each user. With Ephemeral credential, Segura® also applies this number to the JIT sessions of each credential. More information in System parameters.
For how JIT access is released when a session ends or is abandoned, see JIT credential models and session lifecycle.
Do you still have questions? Reach out to the Segura® Community.