Turn on Self-service so users can request roles, access policies, and credentials from the Self-service panel. You choose which request types users see and who approves them.
Requirements
- A user with permission to change the Self-service settings, such as a user with the System Administrator role.
- For Role request and for access policy requests decided by global approvers: at least one user configured as an approver. More information in Approvers.
- For PAM Core access policy requests in the static access policy model, and for Access policy administration request: access policies with at least one administrator.
Enable Self-service
- In Segura™, on the navigation bar, hover over the Product Menu and select Settings.
- In the side menu, select Access control > Access Self-service > Settings.
- Turn on Active self-request.
- In Expiration time, set how long a request can wait for a decision. Enter a whole number from 1 to 100 and select a unit: Minutes, Hours, Days, or Months.
Choose the request types
In Request types, turn on each type users can request. Each enabled type appears as a card on the Self-service panel.
- Enable roles requests: users request roles.
- Enable credential request: users request a new domain credential.
- Enable AD Account Provisioning request: users request a new Active Directory account. To configure it, see Configure AD account provisioning in Self-service.
Choose the access policies users can request
- In Access policy request types, turn on Enable access policies requests.
- Turn on the toggle of each product whose access policies users can request: Enable PAM Core access policies requests, Enable Cloud IAM access policies requests, Enable DevOps Secret Manager access policies requests, Enable Task Manager access policies requests, or Enable Certificate Manager access policies requests.
- In Access policies, in the table of each product you turned on, select the access policies users can request.
- Optional: in the static access policy model, turn on Enable access policy administration requests and Enable handover access policy administration requests.
A product card appears on the panel only when at least one of its access policies is selected.
Define the roles users can request
Skip this section if Enable roles requests is off.
- In List of roles available for request, click Add.
- In the Roles modal, select the roles users can request.
- Confirm the selection.
Define the global approvers
Global approvers decide every Role request and the access policy requests that do not go to the policy administrators. They also receive an email for each AD Account Provisioning request.
- In List of global approvers, click Add.
- In the Global approvers modal, select the approvers.
- Confirm the selection.
Save the settings
Click Save.
Give approvers the Self-service Approver role
Global approvers approve role requests only when they hold the Self-service Approver role. Assign this role to each global approver who decides role requests. Access policy administrators and the users chosen in a handover do not need it. More information in How to manage users.
Verify your results
Sign in as a regular user and open Desktop > Access Self-service > Panel. The panel shows one card for each request type you enabled.