Access to PAM Features

EmpowerID restricts access to PAM and PSM through the use of Management Roles. To work with PAM and PSM, users must be assigned to the appropriate roles. Management Roles are prefixed by their function in EmpowerID and include the following:

UI – Management Roles prefixed with UI grant users access to specific UI elements in the EmpowerID Web interface. An example of this type of role for PAM is UI-Computer-PAM-User-Full-Access. This role grants access to the user interfaces and workflows for requesting PSM access to computers.
VIS – Management Roles prefixed with VIS grant users the ability to see specific objects in EmpowerID. An example of this type of role for PAM is VIS-Computer-MyLocations. This role grants access to see computers that belong to the same location as the person with the role.
ACT – Management Roles prefixed with ACT grant users the ability to manage specific objects in EmpowerID. An example of this type of role for PAM is ACT-Computer-Shared-Credential-Assigner-MyLocations. This role grants users with the role the ability to assign and unassign shared credentials to computers in the person's locations.

Roles needed to use credentials and access computers

To use vaulted credentials and access computers, users need to be a member of one of the below Management Roles (based on the needed scope):

Management Role Access Granted PAM User for All Creds and Computers (Role Bundle) This Management is a role bundle that grants people with the role membership in the below Management Roles: UI-Shared-Credential-PAM-User-Self-Service Grants access to the user interfaces and workflows to request and use vaulted credentials UI-IT-Shop-MS-Computer Grants access to shop for access to servers in the IAM Shop microservice app UI-Computer-PSM-User-Self-Service Grants access to the user interfaces and workflows to request PSM access to computers UI-IT-Shop-MS-Shared-Credential Grants access to shop for Shared Credentials in the IAM Shop microservice app ACT-Shared-Credential-Use-All Grants access to check-out all shared credentials ACT-Computer-Shared-Credential-Login-All Grants access to use a shared credential to initiate a Privileged Session to any computer VIS-Computer-All Grants access to see all computers VIS-Shared-Credential-All Grants access to see all vaulted credentials IAM Shop, My Tasks, and My Identity Self-Service Basic UI Access Only - no resource types Grants access for the UI to use the IAM Shop, My Tasks, My Identity microservices but does not grant visibility to objects or the UI- roles for each resource type. PAM User for Creds and Computers in My Locations (Role Bundle) This Management is a role bundle that grants people with the role membership in the below Management Roles: UI-Shared-Credential-PAM-User-Self-Service Grants access to the user interfaces and workflows to request and use vaulted credentials UI-IT-Shop-MS-Computer Grants access to shop for access to servers in the IAM Shop microservice app UI-Computer-PSM-User-Self-Service Grants access to the user interfaces and workflows to request PSM access to computers UI-IT-Shop-MS-Shared-Credential Grants access to shop for Shared Credentials in the IAM Shop microservice app ACT-Shared-Credential-Use-MyLocations Grants access to check-out shared credentials in the person’s locations ACT-Computer-Shared-Credential-Login-MyLocations Grants access to use a shared credential to initiate a Privileged Session to computers in the person’s locations VIS-Computer-MyLocations Grants access to see computers in the person’s locations VIS-Shared-Credential-MyLocations Grants access to see vaulted credentials in the person’s locations IAM Shop, My Tasks, and My Identity Self-Service Basic UI Access Only - no resource types Grants access for the UI to use the IAM Shop, My Tasks, My Identity microservices but does not grant visibility to objects or the UI- roles for each resource type. PAM User for Creds and Computers in My Org (Role Bundle) This Management is a role bundle that grants people with the role membership in the below Management Roles: UI-Shared-Credential-PAM-User-Self-Service Grants access to the user interfaces and workflows to request and use vaulted credentials UI-IT-Shop-MS-Computer Grants access to shop for access to servers in the IAM Shop microservice app UI-Computer-PSM-User-Self-Service Grants access to the user interfaces and workflows to request PSM access to computers UI-IT-Shop-MS-Shared-Credential Grants access to shop for Shared Credentials in the IAM Shop microservice app ACT-Shared-Credential-Use-MyOrg Grants access to check-out shared credentials in the person’s organizations ACT-Computer-Shared-Credential-Login-MyOrg Grants access to use a shared credential to initiate a Privileged Session to computers in the person’s organizations VIS-Computer-MyOrg Grants access to see computers in the person’s organizations VIS-Shared-Credential-MyOrg Grants access to see vaulted credentials in the person’s organizations IAM Shop, My Tasks, and My Identity Self-Service Basic UI Access Only - no resource types Grants access for the UI to use the IAM Shop, My Tasks, My Identity microservices but does not grant visibility to objects or the UI- roles for each resource type. PAM User for Creds and Computers I Own This Management is a role bundle that grants people with the role membership in the below Management Roles: UI-Shared-Credential-PAM-User-Self-Service Grants access to the user interfaces and workflows to request and use vaulted credentials UI-IT-Shop-MS-Computer Grants access to shop for access to servers in the IAM Shop microservice app UI-Computer-PSM-User-Self-Service Grants access to the user interfaces and workflows to request PSM access to computers UI-IT-Shop-MS-Shared-Credential Grants access to shop for Shared Credentials in the IAM Shop microservice app ACT-Shared-Credential-Login-Responsible Grants access to use a shared credential to initiate a privileged session to the computer where the person is assigned as the responsible person IAM Shop, My Tasks, and My Identity Self-Service Basic UI Access Only - no resource types Grants access for the UI to use the IAM Shop, My Tasks, My Identity microservices but does not grant visibility to objects or the UI- roles for each resource type.

Roles needed to manage credentials and computers

To manage credentials and computers, users need to be a member of one of the below Management Roles (based on the needed scope):

Management Role Access Granted PAM Administrator for All Credentials and Computers This Management is a role bundle that grants people with the role membership in the below Management Roles: ACT-Shared-Credential-Object-Administration-All Grants access to create, edit and delete all shared credentials UI-IT-Shop-MS-Computer Grants access to shop for access to servers in the IAM Shop microservice app VIS-Groups-LocalWindows Grants access to see all Local Windows Server groups UI-Shared-Credential-PAM-User-Full-Access (Feature Set (UI)) Grants access to the user interfaces and workflows for managing shared credentials. UI-IT-Shop-MS-Shared-Credential Grants access to shop for Shared Credentials in the IAM Shop microservice app VIS-Location-All Grants access to see all locations VIS-Accounts-AD Grants access to see all Active Directory accounts UI-Computer-PAM-Local-Identity-Administration Grants access to the user interfaces and workflows for managing local computer users, group, IIS App Pools, and Windows services ACT-Computer-Shared-Credential-Login-All Grants access to use a shared credential to initiate a Privileged Session to any computer VIS-Computer-All Grants access to see all computers VIS-Groups-Linux Grants access to see all Linux groups VIS-Accounts-Linux Grants access to see all Linux accounts UI-IT-Shop-MS-Shared-Credential Grants access to shop for Shared Credentials in the IT Shop microservice app VIS-Accounts-LocalWindows Grants access to see all Local Windows Server User accounts VIS-Shared-Credential-All Grants access to see all vaulted credentials IAM Shop, My Tasks, and My Identity Self-Service Basic UI Access Only - no resource types Grants access for the UI to use the IAM Shop, My Tasks, My Identity microservices but does not grant visibility to objects or the UI- roles for each resource type. PAM Administrator for Credentials and Computers in Person’s Locations This Management is a role bundle that grants people with the role membership in the below Management Roles: UI-IT-Shop-MS-Computer Grants access to shop for access to servers in the IAM Shop microservice app UI-Shared-Credential-PAM-User-Full-Access (Feature Set (UI)) Grants access to the user interfaces and workflows for managing shared credentials. VIS-Location-MyLocationsAndBelow Grants access to see locations in the person’s location and below ACT-Computer-Shared-Credential-Login-MyLocations Grants access to use a shared credential to initiate a Privileged Session to computers in the person’s locations UI-Computer-PAM-Local-Identity-Administration Grants access to the user interfaces and workflows for managing local computer users, group, IIS App Pools, and Windows services ACT-Shared-Credential-Object-Administration-MyLocations Grants access to create, edit and delete shared credentials in the person’s locations ACT-Shared-Credential-Use-MyLocations Grants access to check-out shared credentials in the person’s locations VIS-Computer-MyLocations Grants access to see computers in the person’s locations VIS-Shared-Credential-MyLocations Grants access to see vaulted credentials in the person’s locations ACT-Computer-Object-Administration-MyLocations Grants access to create, edit, and delete computers in the person’s locations UI-Computer-PSM-User-Full-Access Grants access to the user interfaces and workflows for managing computer objects for PSM UI-IT-Shop-MS-Shared-Credential Grants access to shop for Shared Credentials in the IAM Shop microservice app IAM Shop, My Tasks, and My Identity Self-Service Basic UI Access Only - no resource types Grants access for the UI to use the IAM Shop, My Tasks, My Identity microservices but does not grant visibility to objects or the UI- roles for each resource type. ACT-Computer-Shared-Credential-Assigner-MyLocations Grants access to assign and unassign shared credentials to computers in the person's locations PAM Administrator for Credentials and Computers in Person’s Organization This Management is a role bundle that grants people with the role membership in the below Management Roles: UI-IT-Shop-MS-Computer Grants access to shop for access to servers in the IAM Shop microservice app UI-Shared-Credential-PAM-User-Full-Access (Feature Set (UI)) Grants access to the user interfaces and workflows for managing shared credentials. VIS-Location-MyLocationsAndBelow Grants access to see locations in the person’s location and below ACT-Computer-Shared-Credential-Use-MyOrg Grants access to use a shared credential to initiate a Privileged Session to computers in the person’s locations UI-Computer-PAM-Local-Identity-Administration Grants access to the user interfaces and workflows for managing local computer users, group, IIS App Pools, and Windows services UI-Computer-PSM-User-Full-Access Grants access to the user interfaces and workflows for managing computer objects for PSM ACT-Computer-Shared-Credential-Assigner-MyOrganization Grants access to assign and unassign shared credentials to computers in the person's organization UI-IT-Shop-MS-Shared-Credential Grants access to shop for Shared Credentials in the IAM Shop microservice app VIS-Shared-Credential-MyOrg Grants access to see vaulted credentials in the person’s organization VIS-Computer-MyOrg Grants access to see computers in the person’s organization IAM Shop, My Tasks, and My Identity Self-Service Basic UI Access Only - no resource types Grants access for the UI to use the IAM Shop, My Tasks, My Identity microservices but does not grant visibility to objects or the UI- roles for each resource type. ACT-Computer-Shared-Credential-Login-MyOrg Grants access to use a shared credential to initiate a Privileged Session to any computer in person's organization ACT-Shared-Credential-Object-Administration-MyOrg Grants access to create, edit and delete shared credentials in the person’s organization ACT-Computer-Object-Administration-MyOrg Grants access to create, edit, and delete computers in the person’s organization

Roles needed to administer PAM Settings

To use PAM credentials and computers, users need to be a member of the below Management Role:

Management Role Purpose of Management Role PAM Settings Admin Grants access to user interfaces and workflows for managing Privileged Access Settings and Policies.

IN THIS ARTICLE