Keycyte PAM 3.2 · Administrator Guide

Configuring Connection Settings

The Connection page holds the building blocks that some server types need in order to connect: jump servers that host applications, a third-party vault to import accounts from, third-party application definitions, and login scripts for web applications.

To open the page, select Settings > Connection. The page has four cards: Jump Server, 3rd Party Vault, 3rd Party Application and Webapp Dialect.

Jump Server

A jump server is an intermediate host through which Keycyte PAM opens web application and third-party application sessions. You select the jump server in the settings of a server whose protocol is a web application or a third-party application.

• A Windows jump server is reached over RDP; the application (or the web browser for web applications) runs on it as a RemoteApp program.
• A Linux jump server runs browser sessions for web applications; Keycyte PAM shows the browser to the user over VNC.

To add a jump server:

1. On the Jump Server card, click Add.

2. Specify the following settings:

   Field	Description
   Type	Windows or Linux.
   Alias	Name of the jump server shown in lists.
   Address	Host name or IP address of the jump server.
   Port	Windows only. RDP port of the jump server.
   Program Path	Windows only. Path of the launcher program that runs as the RemoteApp program on the jump server.
   Program Path (Linux)	Linux only. Access token that Keycyte PAM uses to start browser sessions on the jump server.
   Login Type	Windows only. How Keycyte PAM signs in to the jump server (see below).

3. Click Save.

Login Type has the following options:

3rd Party Vault

Keycyte PAM can import accounts from a CyberArk vault into its own password vault. Imported accounts are marked as coming from CyberArk; when you synchronize again, the passwords of accounts that were already imported are updated.

To add a CyberArk vault:

1. On the 3rd Party Vault card, click Add.

2. Specify the following settings:

   Field	Description
   Vault Name	Name of the vault in Keycyte PAM.
   URL	Base address of the CyberArk REST API. Keycyte PAM appends /auth/Cyberark/Logon and /Accounts to it.
   Parameters	Optional query string appended to the account list request, for example a search or safe filter.
   Local Vault	Keycyte PAM user.
   Username, Password	CyberArk account used for the API calls.

3. Click Save.

To synchronize, click the run button in the row of the vault. Keycyte PAM signs in to CyberArk, reads the account list, retrieves the password of each account, and creates or updates the matching vault accounts.

3rd Party Application

A third-party application definition describes a desktop program that users start on a Windows jump server, with the credentials of a vault account filled in automatically.

To add an application:

1. On the 3rd Party Application card, click Add.

2. Specify the following settings:

   Field	Description
   Alias	Name of the application shown in lists.
   App	Program to start.
   Arguments	Command-line arguments of the program.
   Script	Automation script that the launcher runs after the program starts.

3. Click Save.

In Arguments and Script, you can use the following placeholders. Keycyte PAM replaces them when the session starts:

Webapp Dialect

A webapp dialect is a named list of script steps that sign a user in to a web application automatically. You select a dialect in the settings of a web application server.

To add a dialect:

1. On the Webapp Dialect card, click Add.
2. Enter a Name.
3. Type a step in Script and click Add. Repeat for each step. Steps run in the order they are listed; to remove a step, click its delete button.
4. Click Save.

In the steps, the quoted words "username", "password" and "domain" are replaced with the values of the vault account when the session starts.