Keycyte PAM 3.2 · Administrator Guide
Account Types
Every password vault entry has a type. The type decides which fields the entry has and whether Keycyte PAM can change its password on a target system.
The types fall into two groups:
- Account types describe a login on a target system. Most of them can be linked to servers, assigned a password policy and rotated.
- Secret types are store-only. They have no target system to which a new value could be pushed, so they cannot be linked to servers, cannot have a password policy and are never rotated.
Account Types
| Type | Use | Password change on the target |
|---|---|---|
| Windows Domain | Active Directory account. The entry has a Domain field. | Yes. |
| Windows | Local account of a Windows host. | Yes. |
| Linux | Account of a Linux or Unix host or network device. Can hold a private key and passphrase, and can switch to a root account after login (Su/Sudo). | Yes. |
| MySQL | MySQL or MariaDB account. | Yes. |
| PostgreSQL | PostgreSQL account. | Yes. |
| MSSQL | Microsoft SQL Server account. | Stored and used for connections. |
| Windows Service | Logon account of a Windows service on one server. Linked to a main account. | Indirectly: when the password of the main account changes, Keycyte PAM updates the logon password of the service on its server. The entry itself cannot be changed directly. |
| Other | Any other account. | Stored and used for connections. |
Password changes on target systems are carried out by the Keycyte PAM password manager service (keycyte-password-manager). Only the Windows Domain, Windows, Linux, MySQL and PostgreSQL types are changed by the automatic password rotation of a password policy. For details, see Configuring Password Policies.
Secret Types
| Type | Primary secret | Additional fields |
|---|---|---|
| Certificate | Certificate file (.pem, .crt, .cer) and private key file (.pem, .key). Both are required. | Issuer, Valid From, Valid Until, Thumbprint, Key Algorithm, SAN. Filled in automatically when the certificate is uploaded. |
| PFX Bundle | PFX/PKCS#12 file (.pfx, .p12) and its Passphrase. Both are required. | Bundle Format (PKCS#12 (.pfx/.p12) or JKS), Valid Until, Thumbprint. Filled in automatically when the file and passphrase are entered. |
| API Key / Token | The token, in Password. | Token Type (Bearer, Basic, PAT, Custom), Endpoint URL, Key ID, Scopes, Expiry. |
| TOTP Secret | The TOTP seed, in Private Key. | Issuer, Account Label, Digits (6–10), Period (seconds) (15–300), Algorithm (SHA-1, SHA-256, SHA-512). |
| License Key | The license key, in Password. | Product, License Expiry. |
| Connection String | The connection string or DSN, in Password. | None. |
| Secure Note | The note text, in Note Body. | Format (Plain text or Markdown). |
| SSH Key (Standalone) | Private key, in Private Key, with an optional Passphrase. | Key Label. |
Uploaded files can be up to 8 MB.
Note
Secret types are useful for credentials that applications retrieve through the Secrets API. For details, see Secrets API.