Keycyte PAM 3.2 · Administrator Guide

Adding Users

Add a user account for each person who should sign in to Keycyte PAM. Domain and Entra ID users can also be created automatically at their first sign-in; see Syncing Domain Users.

Before you begin:

• You need the Add permission for Users.
• For domain, RADIUS and Entra ID users, the directory, RADIUS server or Entra ID connection must be configured in Settings > Authentication. See Authentication Settings.
• To create an ADMIN account, sign in as a MASTER and create the permission profiles first. See Administrator Types.

Adding a User

To add a user:

1. Select Users in the menu.

2. Click Add in the toolbar (tooltip New User). The Portal User panel opens.

3. Fill in the fields:

   Field	Description
   Type	Local, Domain, Radius or Entra ID. Default: Local. See User Types and Roles.
   Domain	For Domain users: the domain of the account, for example example.com. Filled in automatically when you select a user from the directory search.
   Username	User name. For Domain and Entra ID users, type at least two characters to search the directory and select the user from the list.
   Password	For Local users: the initial password. Required for new local users.
   Email	E-mail address. Used for e-mail MFA codes, MFA setup e-mails, password reset e-mails and notifications.
   Phone	Phone number. Used for SMS MFA codes.
   Tags	Descriptive labels for grouping and filtering.
   Description	Free-text note.
   Roles	One or more of MASTER, ADMIN, USER and SERVICE. An ADMIN can assign only USER and SERVICE. If you select no role, USER is assigned.
   Permission Profiles	Shown to a MASTER when ADMIN is selected. At least one profile is required. Permissions of several profiles are combined.
   Enabled	Clear to disable the account. A disabled user cannot sign in. Selected by default.
   MFA	Turns on multi-factor authentication. See Multi-Factor Authentication.
   Password never expires	For Local users: excludes the user from password expiry. Use it only for break-glass or service accounts.
   MFA Type	Shown when MFA is selected: AUTHENTICATOR, EMAIL, SMS or NONE.
   Session Timeout (minutes)	Sign-in session lifetime for this user, from 0 to 1440. Leave empty or enter 0 to use the global default.

4. Click Save.

The user appears in the list. If you are an ADMIN, you are added as an owner of the user.

User List

An ADMIN cannot select or change rows of MASTER and ADMIN accounts.

Resetting Local User Passwords

To reset the password of local users:

1. Select the users in the list.
2. Click Reset Password (key icon) in the toolbar. The button appears when users are selected.
3. Select Send new password via email to users to e-mail the new password to each user, or clear it to only show the passwords.
4. Click Reset.

Keycyte PAM generates a random password for each local user. Users must change it at their next sign-in. The Reset Password Results dialog shows each new password with a copy button; share the passwords securely. Domain, RADIUS and Entra ID users are skipped, because their passwords are managed in their identity provider.

Unlocking Users

A local user is locked after too many failed sign-in attempts, according to the local user password policy in Settings > General. The Username column shows a lock badge for locked users.

To unlock users:

1. Select the users in the list. The unlock button appears when the selection contains locked users.
2. Click Unlock n locked user(s) (unlock icon).
3. Confirm.

Changing User Owners

Owners are the administrator accounts that manage a user. An ADMIN sees only the users that the ADMIN owns.

To change the owners of a user, click Change Owners in its row, select the administrator accounts and click Save. To change the owners of several users, select them and click Change Owners of Selected in the toolbar.

Viewing Shared Resources

Shared Resources shows what a user can reach: the servers and the password vault accounts that the user’s roles grant, with the roles that grant each one. Use it to check a user’s access.

To view the shared resources of a user, click Shared Resources in the row of the user.

Exporting the Access Matrix

To download the access of all users as an Excel file, click User Matrix Export (export icon) in the toolbar. The file user_access_matrix.xlsx lists what each user can reach. An ADMIN gets the matrix for the users that the ADMIN owns.

To export the user list itself, click Export to Excel. The file contains the ID, Username, Email, Type, Domain, Enabled, MFA, Roles and Description of each user.

Deleting a User

To delete a user, click Delete in its row and confirm. You need the Delete permission for Users.