Keycyte PAM 3.2 · Administrator Guide

Configuring Discovery Templates

A discovery template stores where and how Keycyte PAM looks for systems and accounts. You create a template once and then run it by hand from the Discovery page, on a schedule, or both.

To open the page, select Discovery. The page has two areas: Discovery Templates (the list of templates) and Discover User And Computer (running a discovery and registering the results).

Before You Begin

• For Active Directory templates, add an LDAP configuration for the domain in Settings > Authentication. The template uses the bind account and the base settings of that configuration. For details, see Configuring Authentication Sources.
• For VMware templates, prepare the vCenter SDK URL and a vCenter account that can read the inventory.
• To receive e-mail about scheduled runs, configure SMTP in Settings > Notification. For details, see Configuring Notifications.

Creating a Discovery Template

To create a template:

1. In the Discovery Templates area, click Add. The Create Discovery Template panel opens.

2. In Type, select ACTIVE_DIRECTORY or VMWARE.

3. Enter a Name and, optionally, a Description.

4. Specify the source settings:

   For ACTIVE_DIRECTORY:

   Field	Description
   DNS Suffix	LDAP configuration (domain) to search. The list shows the DNS suffixes of the LDAP configurations in Settings > Authentication.
   DN	Search box for organizational units. Type part of an OU name and select the OU from the suggestions. Each OU you select is added to Members.
   Members	Organizational units the discovery searches. To remove an OU, click the delete button in its row.

   For VMWARE:

   Field	Description
   VMware URL	vCenter SDK address, for example https://vcenter.example.com/sdk.
   Username	vCenter account, for example administrator@vsphere.local.
   Password	Password of the vCenter account. When you edit a saved template, leave the field empty to keep the current password.

   For a VMware template, click Test Connection to check the URL and credentials.

5. In the Schedule section, configure automatic runs if required:

   Field	Description
   Run automatically	Turns the schedule on.
   Period	Hourly, Daily or Weekly.
   Start time	Time of day (HH:mm, in the server’s local time zone) from which the period is counted. If it is empty, the next run is one period after the template is saved or last ran.

6. In the Conflict handling section, select the Policy when an existing server matches:

   Option	What happens to a discovered server that already exists
   Update existing (fill empty fields, refresh last seen)	The existing server is updated and its last-seen time is refreshed. This is the default.
   Skip discovered item	The discovered item is ignored.
   Mark only (don’t modify)	Only the last-seen time of the existing server is refreshed.

   Existing servers are matched first by their Active Directory or VMware unique ID, then by address. Address and port values that an administrator changed by hand are never overwritten.

7. In the E-mail notification section, configure notifications if required:

   • Turn on Notify on changes.
   • In Recipients, type an e-mail address and press Enter. Repeat for each recipient.

8. Click Save.

The template appears in the Discovery Templates list. To change a template, click its edit button; to delete it, click its delete button.

How Scheduled Runs Work

Keycyte PAM checks the templates once a minute and runs every template whose next run time has passed. Templates run one after another, not in parallel.

A scheduled run does the following:

• Active Directory templates search for computer objects; VMware templates read the virtual machines.
• Each discovered host is added as a server, or applied to the matching existing server, according to the conflict policy. Windows hosts are added with the RDP protocol on port 3389; Linux hosts discovered in VMware are added with SSH on port 22.
• Servers that were found by the template earlier but are missing from this run are reported, not deleted.
• User accounts are not added automatically. Vault accounts are added only when you register them by hand (see below).

If Notify on changes is on, Keycyte PAM sends an e-mail to the recipients when a run added, changed or missed servers, or reported errors. Runs without any change do not send e-mail.

Running a Discovery and Registering Results

To run a discovery by hand:

1. In the Discover User And Computer area, select the template in Select Template.
2. For an Active Directory template, select what to search for in Search Type: User, Computer or UserAndComputer.
3. Click Start Discovery.

The results appear in the table. For Active Directory, the table shows the name and the location (distinguished name) of each object. For VMware, it shows the host name, IP address, registration status, suggested protocol, power state and guest operating system.

For VMware results, you can narrow the table by power state, protocol and registration status. The registration Status is one of the following:

Virtual machines without an IP address cannot be selected.

To register the results:

1. Select the rows to register.
2. Do one of the following:
   • To add computers or virtual machines as servers, click Add Servers.
   • To add Active Directory users as password vault accounts, click Add Password Vault.
3. To register every matching result at once, without selecting rows, click the All (n) button next to the action buttons.

When you register many results at once, Keycyte PAM reports how many items were added, skipped and failed. Active Directory users are added as Windows Domain accounts.