Keycyte PAM 3.2 · Administrator Guide
Administrator Types
Keycyte PAM has two kinds of administrator accounts: MASTER and ADMIN. A user account becomes an administrator account when it has the MASTER or the ADMIN role. Roles are assigned on the Users page; for details, see User Types and Roles.
MASTER and ADMIN
| MASTER | ADMIN | |
|---|---|---|
| Which pages are visible | Every page of the Admin Panel. | Only the pages for which one of the account’s permission profiles grants the View permission. |
| Which actions are allowed | All actions. | Only the actions (Add, Edit, Delete) that the account’s permission profiles grant for each module. |
| Which objects are visible | All objects. | Only the objects that the ADMIN owns: servers, password vault accounts, users, roles, password policies and access requests for which the ADMIN is listed as an owner. |
| MASTER-only areas | Available. | Not available. |
| Managing administrator accounts | Can create and change MASTER and ADMIN accounts and assign permission profiles. | Cannot create, change or delete MASTER or ADMIN accounts, and can assign only the USER and SERVICE roles. |
Note
Ownership limits what an ADMIN sees, and permission profiles limit what an ADMIN can do with it. For example, an ADMIN with the Delete permission for Servers can delete only the servers that the ADMIN owns. When an ADMIN creates an object such as a server, a user or a password policy, the ADMIN is added as its owner. Owners are changed with the Change Owners dialog on each page; for servers, see Managing Servers.
If an account has both an administrator role and the USER role, the user chooses between Admin Panel and Client Panel after signing in.
MASTER-Only Areas
The following areas are available only to MASTER accounts. Permission profiles cannot grant access to them.
- Discovery
- Access Control > Command Filters
- Everything under Settings, including Permission Profiles, Recycle Bin, Tags and License
Permission Profiles
A permission profile is a named set of permissions. For each module of the Admin Panel, a profile holds four flags: View, Add, Edit and Delete. MASTER accounts are never restricted by profiles.
Every ADMIN account must have at least one permission profile. When an ADMIN has several profiles, their permissions are combined: an action is allowed if any of the profiles allows it.
A module’s Add, Edit or Delete permission also implies its View permission.
The following modules can be granted. Modules marked as view-only have only the View flag.
| Group | Modules |
|---|---|
| Overview | Dashboard (view-only) |
| Resources | Servers, Password Vault, Users |
| Roles | Server Roles, Password Roles, User Roles |
| Sessions | Active Sessions, Session History, Command History, File History |
| Security | Resource Rules, Password Policy, Password Generator (view-only) |
| Reports | Reports |
| Logs | Client, System, Password Manager, Access, Access Control |
For the settings page itself, see Permission Profiles.
Keycyte PAM creates a system profile named Full Admin that grants every permission in every module. It is assigned to existing ADMIN accounts when profiles are first introduced. System profiles cannot be edited or deleted.
Creating a Permission Profile
To create a permission profile:
-
Select Settings > Permission Profiles.
-
Click Add.
-
Enter a Name and, optionally, a Description.
-
Set the permissions in the module matrix. Select or clear the check box of each action for each module. You can also use the preset buttons:
Button Result Read-only Grants only View in every module. Full access Grants every available action in every module. Clear Removes every permission. -
Click Save.
The profile appears in the list. The Modules column summarizes how many modules grant each action, and Assigned Users shows how many users hold the profile.
To assign the profile to an ADMIN account, open the user on the Users page and select the profile in Permission Profiles. For details, see Adding Users.
Deleting a Permission Profile
A profile that is assigned to users cannot be deleted. Remove the profile from those users first, then delete it on the Settings > Permission Profiles page.