Granting Access to PAM with Management Roles
Phillip Hanegan
EmpowerID restricts access to PAM and PSM through the use of Management Roles. To work with PAM and PSM, users must be assigned to the appropriate roles. Management Roles are prefixed by their function in EmpowerID and include the following:
UI – Management Roles prefixed with UI grant users access to specific UI elements in the EmpowerID Web interface. An example of this type of role for PAM is UI-Computer-PAM-User-Full-Access. This role grants access to the user interfaces and workflows for requesting PSM access to computers.
VIS – Management Roles prefixed with VIS grant users the ability to see specific objects in EmpowerID. An example of this type of role for PAM is VIS-Computer-MyLocations. This role grants access to see computers that belong to the same location as the person with the role.
ACT – Management Roles prefixed with ACT grant users the ability to manage specific objects in EmpowerID. An example of this type of role for PAM is ACT-Computer-Shared-Credential-Assigner-MyLocations. This role grants users with the role the ability to assign and unassign shared credentials to computers in the person's locations.
Roles needed to use credentials and access computers
To use vaulted credentials and access computers, users need to be a member of one of the below Management Roles (based on the needed scope):
Management Role | Access Granted |
|---|
Management Role | Access Granted |
|---|---|
PAM User for All Creds and Computers (Role Bundle) | This Management is a role bundle that grants people with the role membership in the below Management Roles:
|
PAM User for Creds and Computers in My Locations (Role Bundle) | This Management is a role bundle that grants people with the role membership in the below Management Roles:
|
PAM User for Creds and Computers in My Org (Role Bundle) | This Management is a role bundle that grants people with the role membership in the below Management Roles:
|
PAM User for Creds and Computers I Own | This Management is a role bundle that grants people with the role membership in the below Management Roles:
|
Roles needed to manage credentials and computers
To manage credentials and computers, users need to be a member of one of the below Management Roles (based on the needed scope):
Management Role | Access Granted |
|---|
Management Role | Access Granted |
|---|---|
PAM Administrator for All Credentials and Computers | This Management is a role bundle that grants people with the role membership in the below Management Roles:
|
PAM Administrator for Credentials and Computers in Person’s Locations | This Management is a role bundle that grants people with the role membership in the below Management Roles:
|
PAM Administrator for Credentials and Computers in Person’s Organization | This Management is a role bundle that grants people with the role membership in the below Management Roles:
|
Roles needed to administer PAM Settings
To use PAM credentials and computers, users need to be a member of the below Management Role:
Management Role | Purpose of Management Role |
|---|
Management Role | Purpose of Management Role |
|---|---|
PAM Settings Admin | Grants access to user interfaces and workflows for managing Privileged Access Settings and Policies. |
Â