Page Comparison

In EmpowerID, EmpowerID provides an Onboard Credentials wizard workflow designed to simplify and secure the process of vaulting computer and non-computer credentials are vaulted user names and passwords that . Credential management can be requested and checked out by users to access the specific applications and other resources authorized by those credentials. When you vault a non-computer credential, you specify the type of credential you are vaulting and link it to the Shared Credential policy for that credential type. EmpowerID encrypts the user name, password and notes information for all credential types.When a request for a non-computer credential is approved, users check out the credential to access the resources authorized by the credential. When the user is done with the credential – or the allocated time frame for using the credential has expired – the credential is checked in. Depending on the policy associated with the credential, the password may or may not be reset by the EmpowerID systema challenging and risky task, as it involves storing sensitive information, such as usernames, passwords, and certificates. Onboard Credentials addresses these challenges by providing a guided, intuitive, and automated approach to credential vaulting, which ensures that all credentials are properly secured and easily accessible when needed. With Onboard Credentials, users can quickly and easily vault both computer and non-computer credentials, including Active Directory (AD) accounts, service accounts, SSH keys, API keys, and more, without having to navigate complex interfaces or processes. This wizard workflow is a valuable tool for organizations looking to streamline their credential management and improve their overall security posture.

Info
To initiate any credential vaulting

...

, users need to have the

...

appropriate Management Roles for the type of credential being vaulted. For a complete list of the Management Roles associated with shared credentials, please see PAM Management Roles.

Onboard a credential

UI-Shared-Credential-Object-Administration – This Management Role grants access to the user interfaces and workflows for managing shared credentials.
VIS-Shared-Credential-All – This Management Role grants visibility for all vaulted credentials.
VIS-Shared-Credential-MyLocations – This Management Role grants visibility for vaulted credentials in a person's locations. This role would be assigned if the person should have visibility for vaulted credentials in their locations only.
VIS-Shared-Credential-MyOrg – This Management Role grants visibility for vaulted credentials in a person's organizations. This role would be assigned if the person should have visibility for all vaulted credentials in their organizations.
ACT-Shared-Credential-Create-All – This Management Role grants people with the role the ability to create a shared credential anywhere.
ACT-Shared-Credential-Create-MyLocations – This Management Role grants people with the role the ability to create a shared credential in a person's locations. This role would be assigned if the person should be able to create a shared credential in their locations only.
ACT-Shared-Credential-Create-MyOrg – This Management Role grants people with the role the ability to create a shared credential in a person's organization. This role would be assigned if the person should be able to create a shared credential in their organization only.
ACT-Shared-Credential-Create-All – This Management Role grants people with the role the ability to create a shared credential anywhere.
ACT-Shared-Credential-Create-MyLocations – This Management Role grants people with the role the ability to create a shared credential in a person's locations. This role would be assigned if the person should be able to create a shared credential in their locations only.
ACT-Shared-Credential-Create-MyOrg – This Management Role grants people with the role the ability to create a shared credential in a person's organization. This role would be assigned if the person should be able to create a shared credential in their organization only.
ACT-Shared-Credential-Object-Administration-All – This Management Role grants people with the role the ability to create, edit and delete a shared credential anywhere.
ACT-Shared-Credential-Object-Administration-MyLocations – This Management Role grants people with the role the ability to create, edit and delete a shared credential in their locations. This role would be assigned if the person should be able to create, edit and delete a shared credential in their locations only.
ACT-Shared-Credential-Object-Administration-MyOrg – This Management Role grants people with the role the ability to create, edit and delete a shared credential in their organization. This role would be assigned if the person should be able to create, edit and delete a shared credential in their organization only.

Users who vault credentials are the owners or Access Managers for those credentials. Access Managers can approve or deny access requests for the credentials they own.

Vault a non-computer credential

...

On the navbar, expand Privileged Access and select Shared Credentials.

Select the All Shared Credentials tab and then click the Add button.

...

Enter a name for the shared credential in the Name and Display Name fields.

...

Sign-in to the Resource Admin portal.
Select Credentials from the Resource Type dropdown.
Select the Workflows tab and click Onboard a Credential.
Image Added

This opens the Onboard Credential wizard workflow.
Image Added
Enter the following credential information:
- Name
- Display Name
- Credential Type – Select the appropriate type of credential. Options include the following:
  - Azure Application Certificate – Select this credential type to vault a certificate for an Azure application managed by EmpowerID.
  - Azure Application Secret – Select this credential type to vault a secret for an Azure application managed by EmpowerID.
  - Default Credentials – Select this credential type to vault any set of credentials that has significance in your environment.
  - Domain Admin – Select this credential type to vault credentials for the administrator account in a domain managed in EmpowerID. Approved users are granted domain administrator permissions for all computers in the domain that you link to the credential.
  - Domain User – Select this credential type to vault credentials for a non-administrator account in a domain managed in EmpowerID. Approved users are granted user account permissions for each computer in the domain that you link to the credential.
  - Local Admin – Select this credential type to vault credentials for an administrator account on a local computer managed in EmpowerID. Approved users are granted administrator permissions on the local computer.
- Personal Credential – Select this option if the credentials are personal to a specific user.
- User Name – Enter the user name portion of the credentials.
- Inventoried User Account – Search for and select the inventoried user account associated with the credentials. This field appears for Domain Admin, Domain User, and Local Admin credential types only.
- Password – Enter the password portion of the credentials. This field is not used when using SSH Keys.
- SSH Key – If onboarding credentials for a Linux system, select this option and then upload the SSH public key file.
- Encrypted Notes – Optionally, enter any notes.
- Description – Optionally, enter a description.
- Location – Click the Select a Location link, then select a location for the credential and click Save.
  This field does not appear when onboarding Personal Credentials.
  Image Added
- Enabled – Select this option to enable usage of the credentials.
Click Next to proceed to the Access Request Settings configuration step.
Insert excerpt
IL:IAM Shop Snippets
IL:IAM Shop Snippets
name PersonalCredentials
nopanel true
Under Owners and Policies, configure the following settings:
- Access Request Policy – Select the Access Request policy appropriate for the credential. All of the below default policies are linked to the Owner Approval Approval Flow policy, which means that the owner of the credential must approve access requests.
  - Computer Creds - Allow Multi-Check-Out - No Password Reset – Select this policy when creating credentials that initiate an RDP or SSH session where more than one session (credential check out) is allowed, and you do not want EmpowerID to reset the password for the account when a user checks in the credentials. This policy is configured with the Owner Approval Approval Flow policy.
  - Computer Creds - No Multi-Check-Out - Password Reset – Select this policy when creating credentials that initiate an RDP or SSH session where more than one session is not allowed, and you do want EmpowerID to reset the password for the account when the user checks in the credentials.
  - MFA - Computer Creds - Allow Multi- Check-Out - No Password Reset – Select this policy when creating credentials that initiate an RDP or SSH session where multi-factor authentication is required, more than one session (credential check out) is allowed, and you do want EmpowerID to reset the password for the account when the user checks in the credentials.
  - Non-Computer Creds - Multi-Check-Out - No Password Reset – Select this policy

...

- - when creating credentials for an account where more than one check out is allowed, and you do not want EmpowerID to reset the password when a user checks in the credentials.
  - Non-Computer Creds - No Approval, No Multi Check-Out with Password Reset – Select this policy

...

- - when creating credentials for an account where more than one check out is not allowed, no approval is required, and you want EmpowerID to reset the password when a user checks in the credentials.
  - Non-Computer Creds - No Multi-Check-Out with Password Reset – Select this policy

...

Underneath Location, click Select a Location, then select a location for the credential and click Save.

...

Enter a description in the Description field.

...

In the User Name field, enter the user name for the account you are vaulting.

...

In the Password field, enter the password for the account you are vaulting.

...

Optionally, enter any notes in the Notes field.

...

Select Enabled.

...

Click Save.

...

If you have not yet entered your master password for this session, EmpowerID prompts you to do so. Enter your master password and click OK.

...

If you have not yet created a master password for yourself, EmpowerID prompts you to do so. Enter a password in the Password and Confirm Password fields and click OK.

...

- - when creating credentials for an account where more than one check out is not allowed, and you want EmpowerID to reset the password when a user checks in the credentials. Please note that this policy type is only valid for use with user accounts with passwords that have been vaulted in EmpowerID. The user account must belong to a domain or account store that has been inventoried by EmpowerID.

...

Service Account with Scheduled Password Reset – Select this policy for credentials for a Windows Service account or IIS App pool identity.
When you select this policy, EmpowerID resets the password against all Windows servers in your environment that have Windows Services or App Pools. Please note that this policy type is only valid for use with service accounts with passwords that have been vaulted in EmpowerID. The service account must belong to a domain or account store that has been inventoried by EmpowerID.

- Responsible Party – Search for and select the person responsible for the credentials.
- Credential Owner – Search for and select the owner of the credentials.
Under Configure Eligibility, add any eligible users for the credential as needed. Users must have a form of eligibility to request access to the credentials in the IAM Shop.

Expand

title	Eligible Assignees

This setting allows you to specify who is eligible to request the credential. Eligible assignees can include the following:

Person – You can assign eligibility to individual people within your organization.
Group – You can assign eligibility to groups. When selected, members of those groups can request access.
Set Group – You can assign eligibility to Set Groups. When selected, members of those Set Groups can request access.
Management Role – You can assign eligibility to Management Roles. When selected, members of those Management Roles can request access.
Management Role Definition – You can assign eligibility to Management Role Definitions. When selected, all members of Management Roles derived from the Management Role Definition can request access.
Business Role and Location – You can assign eligibility to Business Roles and Locations. When selected, members of those Business Roles and Locations can request access.

To add eligible assignees, do the following:

Under Eligible Assignees, select the assignee type from the Choose Type dropdown.
Search for and select the appropriate assignee. For example, if assigning eligibility to a Management Role, search for and select the specific role.
Click Add.
Repeat the above steps to add other eligible assignees as needed.

Expand

title	Pre-Apprioved Assignees

This setting allows you to specify who is pre-approved for the credential. Users who are pre-approved need to activate their membership. No further approvals are needed. Pre-approved assignees can include the following:

Person – You can assign pre-approval status to individual people within your organization.
Group – You can assign pre-approval status to groups. When selected, all members of those groups are pre-approved.
Set Group – You can assign pre-approval status to Set Groups. When selected, all members of those Set Groups are pre-approved.
Management Role – You can assign pre-approval status to Management Roles. When selected, all members of those Management Roles are pre-approved.
Management Role Definition – You can assign pre-approval status to Management Role Definitions. When selected, all members of Management Roles derived from the Management Role Definition are pre-approved.
Business Role and Location – You can assign pre-approval status to Business Roles and Locations. When selected, all members of those Business Roles and Locations are pre-approved.

To add pre-approved assignees, do the following:

Under Pre-Approved Assignees, select the assignee type from the Choose Type dropdown.
Search for and select the appropriate assignee. For example, if assigning pre-approval status to a Business Role and Location, search for and select the specific role and location.
Click Add.

Expand

title	Suggested Assignees

This setting allows you to specify who sees the credential as suggested in the IAM shop. Suggested assignees who request access to the credential route through the regular approval process set by the Access Request policy for the credential. Suggested assignees can include the following:

Person – You can assign suggested eligibility to individual people within your organization.
Group – You can assign suggested eligibility to groups. When selected, all members of those groups can request access.
Set Group – You can assign suggested eligibility to Set Groups. When selected, all members of those Set Groups can request access.
Management Role – You can assign suggested eligibility to Management Roles. When selected, all members of those Management Roles can request access.
Management Role Definition – You can assign suggested eligibility to Management Role Definitions. When selected, all members of Management Roles derived from the Management Role Definition can request access.
Business Role and Location – You can assign suggested eligibility to Business Roles and Locations. All members of those Business Roles and Locations can request access when selected.

To add suggested assignees, do the following:

Select the assignee type from the Choose Type dropdown.
Search for and select the appropriate assignee. For example, if assigning eligibility to a Set Group, search for the specific Set Group.
Click Add.
Repeat the above steps to add other suggested assignees as needed.

8. Click Next.

9. Review the Operation Execution Summary and click Submit to exit the workflow.

Versions Compared

Old Version 1

New Version 2

Key

Onboard a credential

Vault a non-computer credential

See Also