Keycyte PAM 3.2 · Administrator Guide
Permission Profiles
Permission profiles define what an ADMIN user can see and do in each module of the Admin Panel. A profile is a matrix of modules and four permissions: View, Add, Edit and Delete. Profiles are assigned to ADMIN users on the Users page.
Key rules:
- Every ADMIN user needs at least one permission profile.
- When an ADMIN has several profiles, the permissions are combined: a permission granted by any profile is granted.
- MASTER users are never restricted by profiles.
- The View permission of a module decides whether its menu item and page are visible. An ADMIN whose profiles grant no module at all sees a page that says the account has no permissions.
- Profiles cannot open MASTER-only pages: Discovery, Access Control > Command Filters and the whole Settings menu.
- Profiles limit what an ADMIN can do; they do not widen the ADMIN’s ownership scope. An ADMIN still sees only the servers, accounts and users that the ADMIN administers.
To open the page, select Settings > Permission Profiles.
Modules
The matrix contains the following modules, grouped as in the menu:
| Module | Notes |
|---|---|
| Dashboard | View only. |
| Servers, Password Vault, Users | |
| Server Roles, Password Roles, User Roles | |
| Active Sessions | Edit allows sending messages; Delete allows terminating sessions. |
| Session History | Edit allows changing session descriptions. |
| Command History, File History | |
| Resource Rules | The Access Control > Resource Rules page. |
| Password Policy | |
| Password Generator | View only. |
| Reports | Covers both Reports > Account and Reports > Session. |
| Client, System, Password Manager, Access, Access Control (logs) | One module per log page. |
A dash in the matrix means that the permission does not apply to the module.
System Profile
Keycyte PAM creates a system profile named Full Admin that grants every permission of every module. System profiles are marked System in the list and cannot be changed or deleted. On the first start, every ADMIN user without a profile receives Full Admin, so that no administrator loses access.
Creating a Permission Profile
To create a profile:
- Click Add.
- Enter a Name and, optionally, a Description.
- Set the permissions in the matrix. To start from a preset, click Read-only (only View on every module), Full access (every permission) or Clear (nothing). Use the All column to set every permission of a module at once.
- Click Save.
The list shows, for each profile, how many modules grant each permission and how many users the profile is Assigned Users to.
Editing and Deleting Profiles
- To change a profile, click its edit button. Changes apply to every ADMIN who has the profile.
- To delete a profile, click its delete button and confirm. A profile that is assigned to users cannot be deleted; remove it from those users first.
Assigning Profiles to Users
Profiles are assigned in the user’s settings on the Users page, in the Permission Profiles field. The field is required for ADMIN users.