A just-in-time (JIT) credential gives a privileged session the access it needs only while the session lasts. Segura® grants the access when the session starts and removes it when the session ends, so no account keeps standing privilege between sessions.
Key concepts
- Privilege grant: a JIT type in which the session uses the credential configured in Segura®. A template grants privilege on that credential before the session and another template revokes it afterward. No new credential is created.
- Ephemeral credential: a JIT type in which Segura® creates a new credential with a random username for each session and starts the session with it. The credential configured in Segura® is not used to access the asset.
- JIT execution: the setting that decides which device runs the JIT templates for a domain credential. Domain device runs them on the domain. Target device runs them on the device where the session starts.
How it works
The two JIT types differ in which credential the privileged session uses:
- Privilege grant keeps the identity of an existing account. Use it when people must work with their own personal credential and only need more privilege for the session. The templates can activate the credential, elevate its privilege, or add it to a privileged group.
- Ephemeral credential gives each session a new, disposable account. Use it when no one should reuse an account between sessions.
For a domain credential, JIT execution decides where the templates run. With Domain device, Active Directory applies the change and replicates it to the other devices. With Target device, the change happens directly on the device the session uses, so the session does not wait for replication.
Simultaneous sessions
The JIT type and the execution location determine how many sessions a credential accepts at once:
- Privilege grant with Domain device: one session per credential. Revoking the privilege of the domain account would end it on every device.
- Privilege grant with Target device: one session per credential on each device. Sessions on different devices run in parallel, and each revocation affects only its own device.
- Ephemeral credential: each user can hold one session per credential on the same device. Different users can work at the same time, each with their own ephemeral credential.
The credential policy can still forbid simultaneous sessions. The system limit of simultaneous sessions applies to each user and, with Ephemeral credential, also to each credential.
How Segura® releases abandoned access
A JIT access can be left behind when a user closes the waiting screen, a session never starts, or a removal does not complete. Segura® releases these accesses so they do not block new sessions or keep privilege in place:
- A new session request from the same user releases or reuses that user's previous access immediately.
- An automatic check runs every 5 minutes and releases accesses unused for 30 minutes. It never closes a session in progress.
- When provisioning fails, Segura® removes whatever it had already granted.
Each released access is recorded with its date and reason in the JIT Sessions report.