Keycyte PAM 3.2 · Administrator Guide
Server Roles
A server role gives a set of users access to a set of servers and defines how their sessions behave. To open the page, select Roles > Server Roles.
Before you begin:
- You need the Add permission for Server Roles to create roles and the Edit permission to change them.
- Add the servers. See Adding Servers.
- To authorize directory users or groups, configure the directory in Settings > Authentication.
Creating a Server Role
To create a server role:
- Select Roles > Server Roles.
- Click Add. The Server Role panel opens.
- Optionally select Tags, and enter a Name.
- Select the features of the role. See Server Role Features.
- Optionally set the TACACS+ Privilege Level. See TACACS+ Privilege Level.
- Move the servers of the role from Non-Member to Member. Use the search box above each list to find servers.
- Click Save.
- Authorize users and groups. See Authorizing Users and Groups.
After the role is saved, the Linked Command Filters section of the panel lets a MASTER attach command filters to the role. See Command Filters.
Server Role Features
All features are cleared by default.
| Feature | Description |
|---|---|
| Session Record | Records the sessions of the role’s users on the role’s servers. Recordings are played in Sessions > Session History. |
| Text Record | Text recording of the session. |
| File Transfer | Lets users transfer files to and from the server during a session. For RDP, a virtual drive is attached to the session. |
| Approve | Users must request access and have the request approved before they can connect. See Access Requests. |
| MFA | Users must enter an MFA code before each connection. |
| Private Vault | Users can connect with credentials from their own private vault in the Client Panel. |
| Owner | Marks the authorized users and groups of the role as its owners. |
| Auto Login | Connects with the credentials that the user signed in to Keycyte PAM with, instead of a vault account. |
| Disable Copy | Blocks copying from the remote session to the user’s computer. |
| Disable Paste | Blocks pasting from the user’s computer into the remote session. |
| Share | Lets users share an active session with other users. |
| Sign Out | For RDP: after the user disconnects, Keycyte PAM signs the account out of its Windows session on the host, so the session does not stay open in a disconnected state. |
| Notify On Connect | Sends an e-mail to the owners of the server every time a user connects to it. |
| Notify On Disconnect | Sends an e-mail to the owners of the server every time a session on it ends. |
Notify On Connect and Notify On Disconnect apply to every connection to the server through any role that has them selected. E-mail delivery must be configured in Settings > Notification; see Notification Settings.
TACACS+ Privilege Level
For network devices that authenticate operators through the Keycyte TACACS+ server, TACACS+ Privilege Level sets the Cisco privilege level (0–15) that is returned when a shell is authorized: 1 is User EXEC and 15 is Privileged EXEC. When several roles apply, the highest level wins. Leave the field empty (Device default) to return no level, so that the device applies its own default.
Authorizing Users and Groups
A role applies to the users that are authorized in it.
To authorize users and groups:
- In the row of the role, click More actions (…) and select Authorization.
- Under Authorized Users, type at least two characters of a user name in Enter Domain User and select the user. The search covers local and RADIUS users, directory users and Entra ID users.
- Under Groups, type at least two characters in Enter Domain Group and select the group. The search covers LDAP groups, Entra ID groups and user roles.
- To remove an entry, click the delete button in its row.
- Click Save.
A directory user who is authorized directly, or through a group, can sign in for the first time even if no Keycyte PAM account exists yet; the account is created automatically. See Syncing Domain Users.
The Authorized users & groups column of the role list shows the authorized entries. To list only the roles in which a given user or group is authorized, select it in Filter by user or group above the list.
Changing the Servers of a Role
To change the servers of a role, either edit the role, or click … in its row, select Servers, move servers between Non-Member and Member, and click Save.
The Members column shows how many servers the role has; click it to expand the row and see them. To remove one server, click the delete button in its row in the expanded list.
Setting a Schedule
A schedule limits the times when the role applies. Outside the schedule, the role grants no access. Sessions that are open when the schedule ends are warned 10, 5 and 1 minutes in advance and then closed.
To set a schedule:
-
Click … in the row of the role and select Schedule.
-
Select the schedule type:
Type Fields The role applies None — At any time. Default. Daily Start Time, End Time Every day between the two times. If End Time is earlier than Start Time, the window runs overnight and ends the next day. Weekly Start Time, End Time, Days On the selected days (Mon to Sun) between the two times. Custom Start Date, End Date Between two dates and times. You must set at least one of them. -
Click Save.
Times are the local time of the Keycyte PAM server.
Note
A custom schedule without dates does not restrict access. The role list marks such roles with Custom, no dates — not restricted.
Bulk Actions
To change several roles at once, select them in the list and click Bulk actions:
| Action | Description |
|---|---|
| Set features | For each feature, select No change, On or Off. Only the features that you set to On or Off change. |
| Set schedule | Replaces the schedule of each selected role. None removes the time restriction. |
| Add authorized | Adds users and groups to every selected role that does not have them yet. |
| Remove authorized | Removes the selected users and groups from every selected role that has them. |
| Add owners, Remove owners | Adds or removes owners on every selected role. |
| Add tags, Remove tags | Adds or removes tags on every selected role. |
A message reports how many roles were updated, already matched, were skipped because you do not own them, or no longer exist.
Deleting a Server Role
To delete a role, click … in its row, select Delete and confirm. Users lose the access that the role granted. You need the Delete permission for Server Roles.