Onboard Credentials

Managing credentials is a crucial yet often challenging task for organizations, as it involves handling sensitive information like usernames, passwords, and certificates. To streamline this process and enhance security, EmpowerID offers a user-friendly Onboard Credentials wizard workflow. This step-by-step guide simplifies the process of vaulting computer and non-computer credentials while ensuring their proper storage and easy accessibility.

In this how-to topic, we will walk you through the process of onboarding credentials using EmpowerID's Onboard Credentials wizard workflow. By following this guide, you will be able to securely vault various types of credentials, including Active Directory (AD) accounts, service accounts, SSH keys, API keys, and more, without navigating complex interfaces or processes.

To initiate any credential vaulting, users need to have the appropriate Management Roles for the type of credential being vaulted. For a complete list of the Management Roles associated with shared credentials, please see Graning Access to PAM with Management Roles.

Onboard a credential

Sign-in to the IAM Shop portal.
Select Credentials from the Resource Type dropdown.
Select the Workflows tab and click Onboard a Credential.

This action opens the Onboard Credential wizard workflow.
Enter the following credential information:
- Name
- Display Name
- Credential Type – Select the appropriate type of credential. Options include the following:
  - Azure Application Certificate – Select this credential type to vault a certificate for an Azure application managed by EmpowerID.
  - Azure Application Secret – Select this credential type to vault a secret for an Azure application managed by EmpowerID.
  - Default Credentials – Select this credential type to vault any set of credentials that has significance in your environment.
  - Domain Admin – Select this credential type to vault credentials for the administrator account in a domain managed in EmpowerID. Approved users are granted domain administrator permissions for all computers in the domain that you link to the credential.
  - Domain User – Select this credential type to vault credentials for a non-administrator account in a domain managed in EmpowerID. Approved users are granted user account permissions for each computer in the domain that you link to the credential.
  - Local Admin – Select this credential type to vault credentials for an administrator account on a local computer managed in EmpowerID. Approved users are granted administrator permissions on the local computer.
- Personal Credential – Select this option if the credentials are personal credentials for you.
- User Name – Enter the username portion of the credentials.
- Inventoried User Account – Search for and select the inventoried user account associated with the credentials. This field appears for Domain Admin, Domain User, and Local Admin credential types only.
- Password – Enter the password portion of the credentials. This field is not used when using SSH Keys.
- SSH Key – If onboarding credentials for a Linux system, select this option and then upload the SSH public key file.
- Encrypted Notes – Optionally, enter any notes.
- Description – Optionally, enter a description.
- Location – Click the Select a Location link, then search for and select the desired location for the credentials.
  This field does not appear when onboarding Personal Credentials.
- Enabled – Select this option to enable the usage of the credentials.
Click Next to proceed to the Access Request Settings configuration step.
Under Owners and Policies, configure the following settings:
- Access Request Policy – Select the Access Request policy appropriate for the credential. All of the below default policies are linked to the Owner Approval Approval Flow policy, which means that the owner of the credential must approve access requests.
  - Computer Creds - Allow Multi-Check-Out - No Password Reset – Select this policy when creating credentials that initiate an RDP or SSH session where more than one session (credential checkout) is allowed, and you do not want EmpowerID to reset the password for the account when a user checks in the credentials. This policy is configured with the Owner Approval Approval Flow policy.
  - Computer Creds - No Multi-Check-Out - Password Reset – Select this policy when creating credentials that initiate an RDP or SSH session where more than one session is not allowed, and you do want EmpowerID to reset the password for the account when the user checks in the credentials.
  - MFA - Computer Creds - Allow Multi- Check-Out - No Password Reset – Select this policy when creating credentials that initiate an RDP or SSH session where multi-factor authentication is required, more than one session (credential checkout) is allowed, and you do want EmpowerID to reset the password for the account when the user checks in the credentials.
  - Non-Computer Creds - Multi-Check-Out - No Password Reset – Select this policy when creating credentials for an account where more than one checkout is allowed, and you do not want EmpowerID to reset the password when a user checks in the credentials.
  - Non-Computer Creds - No Approval, No Multi Check-Out with Password Reset – Select this policy when creating credentials for an account where more than one checkout is not allowed, no approval is required, and you want EmpowerID to reset the password when a user checks in the credentials.
  - Non-Computer Creds - No Multi-Check-Out with Password Reset – Select this policy when creating credentials for an account where more than one checkout is not allowed, and you want EmpowerID to reset the password when a user checks in the credentials. Please note that this policy type is only valid for use with user accounts with passwords that have been vaulted in EmpowerID. The user account must belong to a domain or account store that has been inventoried by EmpowerID.
- Responsible Party – Search for and select the person responsible for the credentials.
- Credential Owner – Search for and select the owner of the credentials.
Under Configure Eligibility, add any eligible users for the credential as needed. Users must have a form of eligibility to request access to the credentials in the IAM Shop.
Click Next.
Review the Operation Execution Summary and click Submit.
In the Computer lookup section of the workflow, search for the computer to which you want to link the credential and tick the box on the computer record to select it.
Repeat to select other computers as needed.
Click Next to complete the onboarding process.
Click Submit to close the operation execution summary.