On the Self-request settings screen, you can set the rules and permissions for the requests that users make directly in Segura™.
More information in Self-service requests and Configure Self-service.
Access path
- In Segura, on the navigation bar, hover over the Product Menu and select Settings.
- In the side menu, select Access control > Access Self-service > Settings.
Self-request Configuration
| Item | Type | Required | Description |
|---|---|---|---|
| Active self-request | Toggle button | Yes | Enables or disables Self-service for all users. When disabled, the Access Self-service menu is hidden. |
| Expiration time | Quantity picker and Dropdown menu | Yes | Selects how long a request can wait for a decision. Enter a whole number from 1 to 100 and select Minutes, Hours, Days, or Months. When the period ends, the request expires and can no longer be approved. |
Request types
Each enabled request type appears as a card on the Self-service panel.
| Item | Type | Required | Description |
|---|---|---|---|
| Enable roles requests | Toggle button | Yes | Shows the Role request card. Users request roles from the List of roles available for request. |
| Enable credential request | Toggle button | Yes | Shows the Credential request card. Users request a new domain credential, which is approved automatically. |
| Enable AD Account Provisioning request | Toggle button | Yes | Shows the AD Account Provisioning card and the AD Provisioning fields. Users request a new Active Directory account, which is approved automatically. Disabled by default. |
Access policy request types
Users request membership in an access policy of PAM Core, Cloud IAM, DevOps Secret Manager (DSM), Task Manager, or Certificate Manager. Each product has its own toggle and its own card on the panel.
| Item | Type | Required | Description |
|---|---|---|---|
| Enable access policies requests | Toggle button | Yes | Turns access policy requests on or off for all products. When it is off, the product toggles are turned off and unavailable. Turning it back on does not turn the product toggles on. |
| Enable PAM Core access policies requests | Toggle button | Yes | Shows the PAM Core access policy request card. |
| Enable Cloud IAM access policies requests | Toggle button | Yes | Shows the Cloud IAM access policy request card. |
| Enable DevOps Secret Manager access policies requests | Toggle button | Yes | Shows the DevOps Secret Manager access policy request card. |
| Enable Task Manager access policies requests | Toggle button | Yes | Shows the Task Manager access policy request card. |
| Enable Certificate Manager access policies requests | Toggle button | Yes | Shows the Certificate Manager access policy request card. |
| Enable access policy administration requests | Toggle button | Yes | Shows the Access policy administration request card. Users request administration rights on a PAM Core access policy they are a member of. |
| Enable handover access policy administration requests | Toggle button | Yes | Shows the Handover of access policy administration card. Users transfer their administration rights on a PAM Core access policy to another user. |
A product card appears only when its toggle is on and you select at least one of its access policies in Access policies. When global approvers decide the request, the card also needs a global approver other than the user who opens the panel.
Enable access policy administration requests and Enable handover access policy administration requests are available only in the static access policy model. In the dynamic model, the settings screen hides them.
Access policies
Defines which access policies users can request. Each product with its toggle on shows a table of its access policies. Select the access policies users can request. The selection is kept when you turn a product toggle off.
The table lists only active access policies that do not have Block During Freezing? enabled. For PAM Core, it lists the access policies created in the access policy registration. A policy that stops meeting these rules leaves the table and is no longer offered.
List of roles available for request
Defines the roles that users can request with Role request.
| Item | Type | Required | Description |
|---|---|---|---|
| Add | Button | No | Opens the Roles modal. |
| Roles table | Table | No | Each role's data includes the fields Checkbox, Role, Built-In, and Description. |
List of global approvers
Defines who approves Role request requests and access policy requests. In the static access policy model, requests for a PAM Core access policy go to that policy's administrators instead.
Also:
- Global approvers receive an email for each AD Account Provisioning request.
- To approve role requests, global approvers need the Self-service Approver role.
- Without global approvers, the access policy cards they decide do not appear on the panel.
The Global approvers modal lists the users configured as approvers in Approvers.
| Item | Type | Required | Description |
|---|---|---|---|
| Add | Button | No | Opens the Global approvers modal. |
| Approvers table | Table | No | Data for each approver with fields checkbox, ID, Name, Username, Email, Department, and Level. |
AD Provisioning
Configures the AD Account Provisioning request type. These fields appear only when Enable AD Account Provisioning request is on. Segura creates the Active Directory account from the Username mask. Each entry in the Variables table becomes an Identification option that the user picks when requesting an account. More information in Configure AD account provisioning in Self-service.
| Item | Type | Required | Description |
|---|---|---|---|
| Credential type | Dropdown menu | No | Selects the credential type to create. |
| Domain | Dropdown menu | Yes | Defines the domain of the credential. |
| Target device | Dropdown menu | Yes | Selects the device where Segura creates the credential. |
| Change plugin | Dropdown menu | No | Determines the plugin used for password or credential swapping. Required when you select a Credential creation template. |
| Credential creation template | Dropdown menu | No | Selects the default template for credential creation. The template must belong to the selected Change plugin. |
| Authentication credential | Dropdown menu | Yes | Selects the credential that Segura uses to authenticate when it creates the new credential. |
| Username mask | Text field | Yes | Defines the format of the account username. Use [#VARIABLE#] for the value the user picks as Identification, and [#USERNAME#] for the requester's username. Segura replaces each marker when it creates the account. |
| Add | Button | No | Adds a new entry to the Variables table. |
| Variables | Table | No | Values for the [#VARIABLE#] marker of the username mask. Each variable is offered to the user as an Identification option. Variables cannot be empty or repeated. |