Keycyte PAM 3.2 · Administrator Guide
Roles
Roles grant access. Keycyte PAM has three kinds of roles, each on its own page under Roles:
| Role | What it contains | What it controls |
|---|---|---|
| Server Roles | Servers, and the users and groups that are authorized. | Which servers a user can connect to, and how the session behaves: recording, file transfer, clipboard, approval, MFA, session sharing, notifications. |
| Password Roles | Password vault accounts, and the users and groups that are authorized. | Which accounts a user can connect with, and what the user may do with them: copy the password, see the user name, use the account exclusively. |
| User Roles | Users. | When and from which IP addresses the members can sign in and connect. A user role can also be authorized in server and password roles as a group. |
How Access Is Decided
A user can connect to a server with an account when all of the following are true:
- A server role that contains the server authorizes the user, directly or through a group.
- A password role that contains the account authorizes the user, directly or through a group.
- The account is linked to the server in the password vault.
- The schedules of the roles allow access at this time, and the user’s user roles allow the time and the client IP address.
- If a role requires approval, an approved access request covers the current time. See Access Requests.
- If a role requires MFA, the user enters a valid code.
When several roles apply to the same server or account, their features add up: a feature is on if any applicable role turns it on. For example, a session is recorded if any server role that covers the server for this user has Session Record selected, and copying is blocked if any of them has Disable Copy selected.
A role whose schedule does not include the current time does not apply.
Note
Steps 1 and 2 apply to accounts with the USER role. A MASTER who connects from the Client Panel is not limited by server and password roles, and an ADMIN can also connect to servers and accounts that the ADMIN owns.
Role Owners
Each role has owners, the administrator accounts that manage it. An ADMIN sees and manages only the roles that the ADMIN owns. Owners are set with Owners in the role’s action menu.
Tags
Roles can have tags, like servers and accounts. Tags are labels for grouping and filtering; they do not grant access.