This document provides information about the JIT Sessions report, which displays the just-in-time (JIT) accesses granted for privileged sessions. For each access, the report shows the user, the device, and the operations that provisioned and removed it. When Segura® released the access automatically, the report also shows why. More information in JIT credential models and session lifecycle.
Path to access
- On Segura® Platform, in the navigation bar, hover over the Products menu and select PAM Core.
- In the side menu, select Audit > Sessions > JIT Sessions.
To view the report, your access profile needs the same permission as the Remote sessions report. To open the provisioning and deprovisioning operations from the report, it also needs access to the operations in Executions.
Search fields
| Item | Type | Description |
|---|---|---|
| User | Text field | Filters by the user who requested the access. |
| Device | Text field | Filters by the device of the session. |
| Credential | Text field | Filters by the JIT credential. |
| Only active sessions | Dropdown menu | Shows only accesses whose session is in progress. The options are Yes and No. The default is No. |
| Provisioning operation | Dropdown menu | Filters by the status of the operation that granted the access. |
| Deprovisioning operation | Dropdown menu | Filters by the status of the operation that removed the access. |
| Session date | Date picker | Filters by the session date range. The default is the current day. |
Report fields
| Column | Description |
|---|---|
| ID | Identification code of the JIT access. |
| User | User who requested the access. |
| Device | Device of the session. |
| Credential | JIT credential used in the session. |
| Start | Date and time the session started. |
| End | Date and time the session ended. |
| Session status | In progress or Finished. |
| Provisioning operation | Operation that created the ephemeral credential or granted the privilege. |
| Creation executor device | Device that ran the provisioning automation. |
| Deprovisioning operation | Operation that removed the ephemeral credential or revoked the privilege. |
| Removal executor device | Device that ran the deprovisioning automation. |
| Reconciled at | Date and time when Segura® released the access automatically. |
| Reconciliation reason | Why Segura® released the access. See Reconciliation reasons. |
| Actions | Session opens the session. View provisioning operation and View deprovisioning operation open the matching operation in Executions. |
The Actions menu at the top of the report offers Print report, Export CSV, and Schedule report.
Reconciliation reasons
Segura® releases a JIT access that is no longer in use in two situations:
- An automatic check runs every 5 minutes. It releases an access 30 minutes after its session ends or expires. If no session was opened, it releases the access 30 minutes after provisioning was scheduled.
- A new session request releases the requester's previous access at once, without waiting 30 minutes. With Privilege grant, a new request can also replace another user's open access.
Segura® never releases an access while its session is in progress, while its provisioning can still run, or while its removal is pending.
| Reason | When it is recorded |
|---|---|
| Abandoned before the session | The access never got a session, and its removal was not triggered. |
| Session never started | The access got a session that never started, and its removal was not triggered. |
| Removal not triggered | The session ended, but the removal operation was never triggered. |
| Removal cancelled | The removal operation was canceled or expired. Segura® schedules the removal again. |
| Removal task lost | The removal operation stayed scheduled, or running, for 30 minutes without a new attempt. Segura® schedules the removal again. |
| Removal result not recorded | The removal operation finished, successfully or with an error, but the access did not record the result. Segura® closes the access with that result. |
| Replaced by a new session | Privilege grant only. A user started a session with the same credential, on the same device when the credential uses Target device. Another user's access, or an access waiting for deprovisioning, was open and not in use. The new session took over that access. |