Versions Compared

Old Version 1

changes.mady.by.user Phillip Hanegan

Saved on

compared with

New Version Current

changes.mady.by.user Phillip Hanegan

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

EmpowerID restricts access to PAM and PSM through the use of Management Roles. To work with PAM and PSM, users must be assigned to the appropriate roles. Management Roles are prefixed by their function in EmpowerID and include the following:

  • UI – Management Roles prefixed with UI grant users access to specific UI elements in the EmpowerID Web interface. An example of this type of role for PAM is UI-Computer-PAM-User-Full-Access. This role grants access to the user interfaces and workflows for requesting PSM access to computers.

  • VIS – Management Roles prefixed with VIS grant users the ability to see specific objects in EmpowerID. An example of this type of role for PAM is VIS-Computer-MyLocations. This role grants access to see computers that belong to the same location as the person with the role.

  • ACT – Management Roles prefixed with ACT grant users the ability to manage specific objects in EmpowerID. An example of this type of role for PAM is ACT-Computer-Shared-Credential-Assigner-MyLocations. This role grants users with the role the ability to assign and unassign shared credentials to computers in the person's locations.

Roles needed to use credentials and access computers

To use vaulted credentials and access computers, users need to be a member of one of the below Management Roles (based on the needed scope):

Expand
titleView Roles

Management Role

Access Granted

PAM User for All Creds and Computers (Role Bundle)

This Management is a role bundle that grants people with the role membership in the below Management Roles:

  • UI-Shared-Credential-PAM-User-Self-Service

    • Grants access to the user interfaces and workflows to request and use vaulted credentials

  • UI-IT-Shop-MS-Computer

    • Grants access to shop for access to servers in the IAM Shop microservice app

  • UI-Computer-PSM-User-Self-Service

    • Grants access to the user interfaces and workflows to request PSM access to computers

  • UI-IT-Shop-MS-Shared-Credential

    • Grants access to shop for Shared Credentials in the IAM Shop microservice app

  • ACT-Shared-Credential-Use-All

    • Grants access to check-out all shared credentials

  • ACT-Computer-Shared-Credential-Login-All

    • Grants access to use a shared credential to initiate a Privileged Session to any computer

  • VIS-Computer-All

    • Grants access to see all computers

  • VIS-Shared-Credential-All

    • Grants access to see all vaulted credentials

  • IAM Shop, My Tasks, and My Identity Self-Service Basic UI Access Only - no resource types

    • Grants access for the UI to use the IAM Shop, My Tasks, My Identity microservices but does not grant visibility to objects or the UI- roles for each resource type.

PAM User for Creds and Computers in My Locations (Role Bundle)

This Management is a role bundle that grants people with the role membership in the below Management Roles:

Easy html macro
theme{"label":"solarized_dark","value":"solarized_dark"}
contentByMode{"html":"<!doctype html>\r\n<link href=\"https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css\" rel=\"stylesheet\" integrity=\"sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC\" crossorigin=\"anonymous\">\r\n<link href=\"https://docs.empowerid.com/new_docs.css\" rel=\"stylesheet\">\r\n<script src=\"https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js\" integrity=\"sha384-MrcW6ZMFYlzcLA8Nl+NtUVF0sA7MsXsP1UyJoMp4YLEuNSfAP+JcXn/tWtIaxVXM\" crossorigin=\"anonymous\"></script>\r\n <p class = \"bd-callout bd-callout-info\">All access is scoped to credentials and computers \r\n in the person's locations.</p>","javascript":"","css":""}
  • UI-Shared-Credential-PAM-User-Self-Service
    • Grants access to the user interfaces and workflows to request and use vaulted credentials
  • UI-IT-Shop-MS-Computer
    • Grants access to shop for access to servers in the IAM Shop microservice app
  • UI-Computer-PSM-User-Self-Service
    • Grants access to the user interfaces and workflows to request PSM access to computers
  • UI-IT-Shop-MS-Shared-Credential
    • Grants access to shop for Shared Credentials in the IAM Shop microservice app
  • ACT-Shared-Credential-Use-MyLocations
    • Grants access to check-out shared credentials in the person’s locations
  • ACT-Computer-Shared-Credential-Login-MyLocations
    • Grants access to use a shared credential to initiate a Privileged Session to computers in the person’s locations
  • VIS-Computer-MyLocations
    • Grants access to see computers in the person’s locations
  • VIS-Shared-Credential-MyLocations
    • Grants access to see vaulted credentials in the person’s locations
  • IAM Shop, My Tasks, and My Identity Self-Service Basic UI Access Only - no resource types
    • Grants access for the UI to use the IAM Shop, My Tasks, My Identity microservices but does not grant visibility to objects or the UI- roles for each resource type.
PAM User for Creds and Computers in My Org (Role Bundle)
This Management is a role bundle that grants people with the role membership in the below Management Roles:
 Easy html macro
theme{"label":"solarized_dark","value":"solarized_dark"}
contentByMode{"html":"<!doctype html>\r\n<link href=\"https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css\" rel=\"stylesheet\" integrity=\"sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC\" crossorigin=\"anonymous\">\r\n<link href=\"https://docs.empowerid.com/new_docs.css\" rel=\"stylesheet\">\r\n<script src=\"https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js\" integrity=\"sha384-MrcW6ZMFYlzcLA8Nl+NtUVF0sA7MsXsP1UyJoMp4YLEuNSfAP+JcXn/tWtIaxVXM\" crossorigin=\"anonymous\"></script>\r\n <p class = \"bd-callout bd-callout-info\">All access is scoped to credentials and \r\n computers in the person's organizations.</p>","javascript":"","css":""}
  • UI-Shared-Credential-PAM-User-Self-Service
    • Grants access to the user interfaces and workflows to request and use vaulted credentials
  • UI-IT-Shop-MS-Computer
    • Grants access to shop for access to servers in the IAM Shop microservice app
  • UI-Computer-PSM-User-Self-Service
    • Grants access to the user interfaces and workflows to request PSM access to computers
  • UI-IT-Shop-MS-Shared-Credential
    • Grants access to shop for Shared Credentials in the IAM Shop microservice app
  • ACT-Shared-Credential-Use-MyOrg
    • Grants access to check-out shared credentials in the person’s organizations
  • ACT-Computer-Shared-Credential-Login-MyOrg
    • Grants access to use a shared credential to initiate a Privileged Session to computers in the person’s organizations
  • VIS-Computer-MyOrg
    • Grants access to see computers in the person’s organizations
  • VIS-Shared-Credential-MyOrg
    • Grants access to see vaulted credentials in the person’s organizations
  • IAM Shop, My Tasks, and My Identity Self-Service Basic UI Access Only - no resource types
    • Grants access for the UI to use the IAM Shop, My Tasks, My Identity microservices but does not grant visibility to objects or the UI- roles for each resource type.
PAM User for Creds and Computers I Own
This Management is a role bundle that grants people with the role membership in the below Management Roles:
 Easy html macro
theme{"label":"solarized_dark","value":"solarized_dark"}
contentByMode{"html":"<!doctype html>\r\n<link href=\"https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css\" rel=\"stylesheet\" integrity=\"sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC\" crossorigin=\"anonymous\">\r\n<link href=\"https://docs.empowerid.com/new_docs.css\" rel=\"stylesheet\">\r\n<script src=\"https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js\" integrity=\"sha384-MrcW6ZMFYlzcLA8Nl+NtUVF0sA7MsXsP1UyJoMp4YLEuNSfAP+JcXn/tWtIaxVXM\" crossorigin=\"anonymous\"></script>\r\n <p class = \"bd-callout bd-callout-info\">All access is scoped to credentials and \r\n computers the person owns.</p>","javascript":"","css":""}
  • UI-Shared-Credential-PAM-User-Self-Service
    • Grants access to the user interfaces and workflows to request and use vaulted credentials
  • UI-IT-Shop-MS-Computer
    • Grants access to shop for access to servers in the IAM Shop microservice app
  • UI-Computer-PSM-User-Self-Service
    • Grants access to the user interfaces and workflows to request PSM access to computers
  • UI-IT-Shop-MS-Shared-Credential
    • Grants access to shop for Shared Credentials in the IAM Shop microservice app
  • ACT-Shared-Credential-Login-Responsible
    • Grants access to use a shared credential to initiate a privileged session to the computer where the person is assigned as the responsible person
  • IAM Shop, My Tasks, and My Identity Self-Service Basic UI Access Only - no resource types
    • Grants access for the UI to use the IAM Shop, My Tasks, My Identity microservices but does not grant visibility to objects or the UI- roles for each resource type.
Roles needed to manage credentials and computers
To manage credentials and computers, users need to be a member of one of the below Management Roles (based on the needed scope):
 Expand
titleView Roles
Management Role
Access Granted
PAM Administrator for All Credentials and Computers
This Management is a role bundle that grants people with the role membership in the below Management Roles: 
  • ACT-Shared-Credential-Object-Administration-All
    • Grants access to create, edit and delete all shared credentials
  • UI-IT-Shop-MS-Computer
    • Grants access to shop for access to servers in the IAM Shop microservice app
  • VIS-Groups-LocalWindows
    • Grants access to see all Local Windows Server groups
  • UI-Shared-Credential-PAM-User-Full-Access (Feature Set (UI))
    • Grants access to the user interfaces and workflows for managing shared credentials.
  • UI-IT-Shop-MS-Shared-Credential
    • Grants access to shop for Shared Credentials in the IAM Shop microservice app
  • VIS-Location-All
    • Grants access to see all locations
  • VIS-Accounts-AD
    • Grants access to see all Active Directory accounts
  • UI-Computer-PAM-Local-Identity-Administration
    • Grants access to the user interfaces and workflows for managing local computer users, group, IIS App Pools, and Windows services
  • ACT-Computer-Shared-Credential-Login-All
    • Grants access to use a shared credential to initiate a Privileged Session to any computer
  • VIS-Computer-All
    • Grants access to see all computers
  • VIS-Groups-Linux
    • Grants access to see all Linux groups
  • VIS-Accounts-Linux
    • Grants access to see all Linux accounts
  • UI-IT-Shop-MS-Shared-Credential
    • Grants access to shop for Shared Credentials in the IT Shop microservice app
  • VIS-Accounts-LocalWindows
    • Grants access to see all Local Windows Server User accounts
  • VIS-Shared-Credential-All
    • Grants access to see all vaulted credentials
  • IAM Shop, My Tasks, and My Identity Self-Service Basic UI Access Only - no resource types
    • Grants access for the UI to use the IAM Shop, My Tasks, My Identity microservices but does not grant visibility to objects or the UI- roles for each resource type.
PAM Administrator for Credentials and Computers in Person’s Locations
This Management is a role bundle that grants people with the role membership in the below Management Roles: 
 Easy html macro
theme{"label":"solarized_dark","value":"solarized_dark"}
contentByMode{"html":"<!doctype html>\r\n<link href=\"https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css\" rel=\"stylesheet\" integrity=\"sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC\" crossorigin=\"anonymous\">\r\n<link href=\"https://docs.empowerid.com/new_docs.css\" rel=\"stylesheet\">\r\n<script src=\"https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js\" integrity=\"sha384-MrcW6ZMFYlzcLA8Nl+NtUVF0sA7MsXsP1UyJoMp4YLEuNSfAP+JcXn/tWtIaxVXM\" crossorigin=\"anonymous\"></script>\r\n <p class = \"bd-callout bd-callout-info\">All access is scoped to credentials and computers \r\n in the person's locations.</p>","javascript":"","css":""}
  • UI-IT-Shop-MS-Computer
    • Grants access to shop for access to servers in the IAM Shop microservice app
  • UI-Shared-Credential-PAM-User-Full-Access (Feature Set (UI))
    • Grants access to the user interfaces and workflows for managing shared credentials.
  • VIS-Location-MyLocationsAndBelow
    • Grants access to see locations in the person’s location and below
  • ACT-Computer-Shared-Credential-Login-MyLocations
    • Grants access to use a shared credential to initiate a Privileged Session to computers in the person’s locations
  • UI-Computer-PAM-Local-Identity-Administration
    • Grants access to the user interfaces and workflows for managing local computer users, group, IIS App Pools, and Windows services
  • ACT-Shared-Credential-Object-Administration-MyLocations
    • Grants access to create, edit and delete shared credentials in the person’s locations
  • ACT-Shared-Credential-Use-MyLocations
    • Grants access to check-out shared credentials in the person’s locations
  • VIS-Computer-MyLocations
    • Grants access to see computers in the person’s locations
  • VIS-Shared-Credential-MyLocations
    • Grants access to see vaulted credentials in the person’s locations
  • ACT-Computer-Object-Administration-MyLocations
    • Grants access to create, edit, and delete computers in the person’s locations
  • UI-Computer-PSM-User-Full-Access
    • Grants access to the user interfaces and workflows for managing computer objects for PSM
  • UI-IT-Shop-MS-Shared-Credential
    • Grants access to shop for Shared Credentials in the IAM Shop microservice app
  • IAM Shop, My Tasks, and My Identity Self-Service Basic UI Access Only - no resource types
    • Grants access for the UI to use the IAM Shop, My Tasks, My Identity microservices but does not grant visibility to objects or the UI- roles for each resource type.
...
  • ACT-Computer-Shared-Credential-Assigner-MyLocations
    • Grants access to assign and unassign shared credentials to computers in the person's locations
PAM Administrator for Credentials and Computers in Person’s Organization
This Management is a role bundle that grants people with the role membership in the below Management Roles: 
 Easy html macro
theme{"label":"solarized_dark","value":"solarized_dark"}
contentByMode{"html":"<!doctype html>\r\n<link href=\"https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css\" rel=\"stylesheet\" integrity=\"sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC\" crossorigin=\"anonymous\">\r\n<link href=\"https://docs.empowerid.com/new_docs.css\" rel=\"stylesheet\">\r\n<script src=\"https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js\" integrity=\"sha384-MrcW6ZMFYlzcLA8Nl+NtUVF0sA7MsXsP1UyJoMp4YLEuNSfAP+JcXn/tWtIaxVXM\" crossorigin=\"anonymous\"></script>\r\n <p class = \"bd-callout bd-callout-info\">All access is scoped to credentials and computers \r\n in the person's organization.</p>","javascript":"","css":""}
  • UI-IT-Shop-MS-Computer
    • Grants access to shop for access to servers in the IAM Shop microservice app
  • UI-Shared-Credential-PAM-User-Full-Access (Feature Set (UI))
    • Grants access to the user interfaces and workflows for managing shared credentials.
  • VIS-Location-MyLocationsAndBelow
    • Grants access to see locations in the person’s location and below
  • ACT-Computer-Shared-Credential-Use-MyOrg
    • Grants access to use a shared credential to initiate a Privileged Session to computers in the person’s locations
  • UI-Computer-PAM-Local-Identity-Administration
    • Grants access to the user interfaces and workflows for managing local computer users, group, IIS App Pools, and Windows services
  • UI-Computer-PSM-User-Full-Access
    • Grants access to the user interfaces and workflows for managing computer objects for PSM
  • ACT-Computer-Shared-Credential-Assigner-MyOrganization
    • Grants access to assign and unassign shared credentials to computers in the person's organization
  • UI-IT-Shop-MS-Shared-Credential
    • Grants access to shop for Shared Credentials in the IAM Shop microservice app
  • VIS-Shared-Credential-MyOrg
    • Grants access to see vaulted credentials in the person’s organization
  • VIS-Computer-MyOrg
    • Grants access to see computers in the person’s organization
  • IAM Shop, My Tasks, and My Identity Self-Service Basic UI Access Only - no resource types
    • Grants access for the UI to use the IAM Shop, My Tasks, My Identity microservices but does not grant visibility to objects or the UI- roles for each resource type.
  • ACT-Computer-Shared-Credential-Login-MyOrg
    • Grants access to use a shared credential to initiate a Privileged Session to any computer in person's organization
  • ACT-Shared-Credential-Object-Administration-MyOrg
    • Grants access to create, edit and delete shared credentials in the person’s organization
  • ACT-Computer-Object-Administration-MyOrg
    • Grants access to create, edit, and delete computers in the person’s organization
Roles needed to administer PAM Settings
To use PAM credentials and computers, users need to be a member of the below Management Role:
 Expand
titleView Role
Management Role
Purpose of Management Role
PAM Settings Admin
Grants access to user interfaces and workflows for managing Privileged Access Settings and Policies.
...
stylefloat:left; position:fixed;
idarticleNav
IN THIS ARTICLE
...
 Insert excerpt
IL:External Stylesheet
IL:External Stylesheet
nopaneltrue
 Insert excerpt
IL:External Stylesheet
IL:External Stylesheet
nopaneltrue