You are viewing an earlier version of the admin guide. For the latest version, please visit EmpowerID Admin Guide v7.211.0.0.
Access Request Policies and Privileged Session Management
In EmpowerID, Access Request policies are crucial for managing resource access and guiding the approval and fulfillment processes for user access requests. These policies are pivotal in Privileged Session Management (PSM), regulating access to computer credentials for servers or other devices used in RDP or SSH sessions. They determine whether such sessions are subject to a privileged session policy, which controls session recording, live monitoring, and limits on concurrent sessions for a specific computer. Additionally, Access Request policies include settings to update Windows Services and IIS App Pools when passwords are reset, which is important when credentials linked to these services require password updates after check-outs and check-ins. Furthermore, these policies facilitate the automated rotation of passwords on a scheduled basis, enhancing security and compliance.
Approval Policies for Privileged Sessions
Administrators use Access Request policies to implement Approval Policies, ensuring that an approved user authorizes privileged session access requests before initiation. By default, access to computer credentials is controlled by the Owner Approval policy, requiring the owner's approval before a user initiates a session. However, organizations can choose other approval flows as desired.
Access Request Policies for Computer Credentials
EmpowerID offers several pre-configured Access Request policies tailored for computer credentials, each with specific settings for Privileged Session Management. By leveraging these pre-built Access Request policies and configuring them according to your organization's security requirements, administrators can effectively manage privileged sessions and ensure secure access to critical resources. Regularly reviewing and updating these policies will help maintain compliance with relevant regulations and internal policies and enhance overall security.
You can view these policies by navigating to Low Code/No Code Workflow > Access Request Policies and searching for “Computer.”
Policy Name | Applicability | MFA Requirement | Password Reset Policy |
---|---|---|---|
Computer Creds - Allow Multi-Check-Out - No Password Reset | Suitable for multiple RDP or SSH sessions without a password reset. | No | No |
Computer Creds - No Multi-Check-Out - Password Reset | Ideal for single-session environments where a password reset is required post-session. | No | Yes |
MFA - Computer Creds - Allow Multi-Check-Out - No Password Reset | For environments requiring multi-factor authentication, allowing multiple sessions. | Yes | No |
General Settings for Access Request Policies
The table below outlines the general settings available for Access Request policies in EmpowerID:
Setting | Description |
---|---|
Name/Display Name | Identifies the policy within the system and in the UI. |
Description | Provides a brief overview of the policy's purpose and scope. |
Allow Activation (Skip Business Request) | Specifies whether Business Requests are generated for access requests. If selected, the system does not route requests through Approval policies. |
Approval Policy | Specifies the Approval policy linked to the Access Request policy. Approval policies determine who can approve access requests and how many approvals are required before access is granted, etc. The drault Access Request policies for computer credentials are configured with the Owner Approval Approval policy. |
Fulfillment Delay (HRS) | Specifies the number of hours the system should wait to fulfill approved requests |
Is Shipping Data | For internal EmpowerID use only |
Enable Just in Time Account Provisioning | Enables dynamic account provisioning on the target computer at session start. This only applies when an account store is created for the computer in question. For details on how to create an account store for a Windows server, see the Local Windows Servers Connector topic in this guide. |
Selectable in UI | Allows the policy to be selected from the EmpowerID Web Interface. |
Time and MFA Restrictions
These settings define temporal access boundaries and additional security layers:
Setting | Description |
---|---|
Time Restrict Access | Enables time-based access restrictions with configurable durations. |
MFA Required for Access Request | Imposes a minimum Level of Assurance for login based on user location (local or remote). |
Shared Credential Settings
These settings are used to define if credentials are available to users in the IAM Shop and password reset options:
Setting | Description |
---|---|
Publish in IAM Shop | Determines if credentials are visible for user selection in the IAM Shop. |
Allow Multi Check Out | Permits multiple users to concurrently check out the credentials. |
Reset Password On Check In | Enforces a password reset when a user completes their session and disconnects from the computer |
Update Windows Services On Password Reset | Updates the password for Windows services when a user completes their session and disconnects from the computer. |
Update IIS App Pools On Password Reset | Specifies whether EmpowerID should update IIS App Pool passwords after a user completes their session and disconnects from the computer |
PSM Computer Settings
Setting | Description |
---|---|
Privileged Session Policy | Specifies whether privileged session policy applies when users connect to the computer. If selected, additional settings are used to determine the maximum number of concurrent sessions are allowed, whether sessions are to be recorded and whether administrators can view current sessions in real time. |
Password Rotation Settings
These settings enable administrators to configure automatic password resets for credentials within EmpowerID, enhancing security through regular updates. The settings allow for precise control over when and how often these resets occur.
Setting | Description |
---|---|
Schedule Password Reset Enabled | Toggle this setting to enable or disable scheduled password resets. |
Password Reset Schedule – Start Date | Defines the date when the password resets will start. |
Password Reset Schedule – End Date | Defines the date when the password resets will end, if applicable. |
Interval | Determines the frequency of the password resets. Options include 'Once', 'Hourly', 'Minute', 'Daily', 'Weekly', 'Monthly', or 'Run Indefinitely'. |
Assign PSM-Enabled Computers to Access Request Policies