Once you have set up your JIT credential, you can access it by following these steps:
- On Segura® Platform, in the navigation bar, hover over the Products menu and select PAM Core.
- In the side menu, select Credentials > Just In Time.
- In the list, identify the previously configured JIT credential and click Start session, in the Actions column.
- A new window or tab will open in your browser with the following message: Connected to Segura®. Provisioning the credential on the device.
- In case of success, you'll be redirected to the session on the configured device.
- Otherwise, Segura® displays the message An error occurred while provisioning the credential. With the Target device option, this message also appears when the execution template does not meet the WinRM requirements. More information in How to configure a JIT credential.
With the Privilege grant type, the credential you configure is the target of the privilege grant and privilege revocation templates. Use another credential to authenticate at the JIT stage: when the template enables a disabled account, that account cannot authenticate its own enablement.
With the Ephemeral credential type, the credential where the JIT is configured is not the target of the template. Segura® creates a new dynamic credential with the senseg9999999 pattern (senseg prefix followed by 7 digits). In this case, the credential itself can authenticate on the target device.
For a domain credential, the JIT execution field decides where Segura® runs the JIT automation, for both types. Domain device runs the automation in the domain, through the device linked to the credential. Target device runs it on the device where the session starts. More information in How to configure a JIT credential.
Start a JIT session again
If a JIT session did not open, or you closed the waiting screen before it opened, start the session again from Credentials > Just In Time. You do not need to wait or ask an administrator to release the previous access:
- With Ephemeral credential, Segura® releases your previous access immediately and removes the ephemeral credential it created. The new session receives a new ephemeral credential.
- With Privilege grant, Segura® reuses the access already granted to you, without granting the privilege again. The privilege is revoked when your session ends.
This applies to sessions started from the web and from the native proxies.
If another user abandoned a Privilege grant access on the same device and nobody is connected to it, start a session with that credential to take over the access. The account stays enabled, and Segura® revokes the privilege when your session ends. You do not need to wait for the automatic check.
If someone is connected to that device with the credential, Segura® blocks your request, and the session in use is not affected.
In the web interface, Segura® displays the message There is an active session for this credential and it is not possible to start a new one until the first session is active. In native proxies, the message is Simultaneous temporary-session limit reached for this credential.
Links to a closed JIT access
A link to a JIT access that has already been closed does not open a session. Segura® displays the message This JIT access has already been closed. Start a new session. Start a new session from Credentials > Just In Time.
When provisioning fails
If Segura® cannot create the ephemeral credential or grant the privilege, the waiting screen displays the error and Segura® runs the removal or revocation template for what it had already granted. Segura® does not retry automatically. Start the session again to request a new access.
If the target device is unreachable, the error is displayed and the access is closed with an error.
Abandoned JIT accesses
Segura® checks for abandoned JIT accesses every 5 minutes. It releases an access 30 minutes after its session ended or expired, or, if no session was opened, 30 minutes after provisioning was scheduled. It then runs the removal or revocation template. The check never closes a session in progress.
If an operator cancels a JIT removal in Executions > Password operations > All operations, the next session request for that access releases it and runs the removal again. A removal that was scheduled but never ran is rescheduled by the automatic check.
Released accesses appear in the JIT Sessions report, with the date and the reason they were released.
Do you still have questions? Reach out to the Segura® Community.