Keycyte PAM 3.2 · Administrator Guide

Access Requests

With approval-based access, users do not have standing access to sensitive servers or accounts. Instead, a user requests access for a time window, and an owner of the server or account approves the request. The user can connect only during the approved window.

How the Approval Flow Works

1. An administrator selects Approve in a server role, a password role, or both. See Server Roles and Password Roles.
2. A user of the role tries to connect in the Client Panel and is asked to request access. The user enters a start date, an end date and a reason, and submits the request.
3. Keycyte PAM creates a request for each object that needs approval: one for the server if a server role requires approval, and one for the account if a password role requires approval.
4. Keycyte PAM sends an e-mail to the owners of the server (for a server request) and the owners of the account (for an account request). The e-mail contains a link to the Resource Rules page. The request also appears in the notification bell of these owners.
5. An owner approves or rejects the request. When a request is approved, the requester receives an e-mail.
6. Between the approved start and end date, the user can connect. Outside this window, the user must request access again.

If both the server and the account require approval, both requests must be approved before the user can connect.

E-mail delivery must be configured in Settings > Notification. See Notification Settings.

Approving or Rejecting a Request

Before you begin, make sure that:

• You are an owner of the server or account, or a MASTER.
• You have the Edit permission for Resource Rules.

To approve or reject a request:

1. Click the bell in the top bar. A red badge shows the number of pending requests.

2. In the Notifications panel, under Access Permission Requests, check the request:

   Item	Description
   Server or Account tag	Whether the request is for a server or an account.
   User name	The user who requested access.
   ID	ID of the requested server or account.
   Start Date, End Date	The requested access window.
   Requested	When the request was submitted.
   Reason	The reason that the user entered.

3. Click Approve or Reject.

The message Request approved or Request rejected confirms the decision, and the request leaves the list.

You can also decide on requests on the Access Control > Resource Rules page by editing the request and changing its Action. See Resource Rules.