Access Request Policies and Privileged Session Management
- Phillip Hanegan
In EmpowerID, Access Request policies are essential for managing resource access by guiding the approval and fulfillment processes for user access requests. They are particularly important for Privileged Session Management (PSM), where they regulate users' access to computer credentials related to servers or other machines set up for RDP or SSH sessions. Additionally, Access Request policies establish whether such sessions fall under a privileged session policy, which governs aspects such as session recording, live session monitoring, and the maximum number of concurrent sessions allowed on a specific computer.
Approval Policies for Privileged Sessions
Administrators can use Access Request policies to set up Approval Policies, ensuring that privileged session access requests are authorized by an approved user before being granted. By default, EmpowerID Access Request policies for computer credentials are configured with the Owner Approval policy, which requires the owner of a computer credential to approve access requests prior to a user initiating a session. However, organizations can choose other approval flows as desired.
Pre-configured Access Request Policies for Computer Credentials
EmpowerID provides several pre-configured Access Request policies for computer credentials, each featuring its own PSM-specific settings:
1. Computer Creds - Allow Multi-Check-Out - No Password Reset
This policy is applicable for computer credentials initiating an RDP or SSH session where multiple sessions (credential checkouts) are allowed, and password reset upon user check-in isn't required by EmpowerID.
2. Computer Creds - No Multi-Check-Out - Password Reset
This policy is applicable for computer credentials initiating an RDP or SSH session where multiple sessions aren't permitted, and you want EmpowerID to reset the account password when the user checks in the credentials.
3. MFA - Computer Creds - Allow Multi-Check-Out - No Password Reset
This policy is applicable for computer credentials initiating an RDP or SSH session requiring multi-factor authentication, allowing multiple sessions (credential checkouts), and when you want EmpowerID to reset the account password upon user check-in.
Â
Access Request Policy for Computer Credential Settings
By leveraging these pre-built Access Request policies and configuring them according to your organization's security requirements, administrators can effectively manage privileged sessions and ensure secure access to critical resources. Regularly reviewing and updating these policies will help maintain compliance with relevant regulations and internal policies and enhance overall security.
General Settings
Setting | Description |
|---|---|
Name | Name of the policy |
Display Name | Display Name of the policy that appears to users in the UI |
Description | Description of the policy |
Allow Activation (Skip Business Request) | Specifies whether Business Requests are generated for access requests. If selected, the system does not route requests through Approval policies. |
Approval Policy | Specifies the Approval policy linked to the Access Request policy. Approval policies determine who can approve access requests and how many approvals are required before access is granted, etc. The drault Access Request policies for computer credentials are configured with the Owner Approval Approval policy. |
Fulfillment Delay (HRS) | Specifies the number of hours the system should wait to fulfill approved requests |
Is Shipping Data | Internal use |
Enable Just in Time Account Provisioning | Specifies whether EmpowerID should provision a user account on the computer to which the policy is applied when that user connects to the computer using PSM. This only applies when an account store is created for the computer in question. For details on how to create an account store for a Windows server, see the Local Windows Servers Connector topic in this guide. |
Selectable in UI | Specifies whether the Access Request policy can be selected in the EmpowerID Web Interface |
Time Restrictions
Â
Setting | Description |
|---|---|
Time Restrict Access | Specifies whether connections to the computer are restricted to specific durations of time. If enabled, additional settings can be configured to specify the default access duration, the max duration in minutes, and whether users can select durations within those parameters. |
MFA Required for Access Request
Â
Setting | Description |
|---|---|
Min Login LOA If Local | Specifies the minimum Level of Assurance points required for users to log in to the computer if on the local network, if any. |
Min Login LOA If Remote | Specifies the minimum Level of Assurance points required for users to log in to the computer if the user is remote, if any. |
Shared Credential Settings
Setting | Description |
|---|---|
Publish in IAM Shop | Specifies whether credentials are available to eligible users in the IAM Shop |
Allow Multi Check Out | Specifies whether credentials can be checked out by multiple concurrent users |
Reset Password On Check In | Specifies whether EmpowerID should reset the password portion of the credential after a user completes their session and disconnects from the computer |
Update Windows Services On Password Reset | Specifies whether EmpowerID should update Windows services passwords after a user completes their session and disconnects from the computer |
Update IIS App Pools On Password Reset | Specifies whether EmpowerID should update IIS App Pool passwords after a user completes their session and disconnects from the computer |
PSM Computer Settings
Setting | Description |
|---|---|
Privileged Session Policy | Specifies whether privileged session policy applies when users connect to the computer. If selected, additional settings are used to determine the maximum number of concurrent sessions are allowed, whether sessions are to be recorded and whether administrators can view current sessions in real time. |
Password Rotation Settings
These settings are used to specify whether passwords for credentials should be automatically reset by EmpowerID on a scheduled basis. If selected, you can specify the start and end dates and the frequency of the resets.
Assigning Access Request Policies to Computers