Keycyte PAM 3.2 · Administrator Guide
User Types and Roles
A Keycyte PAM user account has one type and one or more roles.
User Types
The type decides where the user’s password is checked.
| Type | Authentication | How the account is created |
|---|---|---|
| Local | The password is stored in Keycyte PAM. The local user password policy in Settings > General applies: complexity, expiry, lockout after failed attempts and password history. | An administrator creates it on the Users page. |
| Domain | The password is checked against an LDAP or Active Directory directory that is configured in Settings > Authentication. | An administrator creates it, or Keycyte PAM creates it automatically at the first sign-in when the user, or a group the user belongs to, is authorized in a server role or password role. |
| Radius | The password is checked against an external RADIUS server that is configured in Settings > Authentication. If the RADIUS server sends a challenge, the user enters the code on the sign-in page. | An administrator creates it. |
| Entra ID | The user signs in with Sign in with Microsoft. | An administrator creates it, or Keycyte PAM creates it automatically at the first sign-in when the user, or an Entra ID group the user belongs to, is authorized in a server role or password role. |
For the directory, RADIUS and Entra ID settings, see Authentication Settings.
User Roles
The roles decide which panel the user can sign in to. A user can have several roles.
| Role | Description |
|---|---|
| MASTER | Full administrator. Signs in to the Admin Panel without restrictions. Only a MASTER can assign this role. |
| ADMIN | Administrator restricted by permission profiles and object ownership. Signs in to the Admin Panel. Only a MASTER can assign this role, and the account needs at least one permission profile. |
| USER | Signs in to the Client Panel to connect to servers. When you save a user without any role, the USER role is assigned. |
| SERVICE | Machine identity for applications. An account with only this role cannot sign in anywhere (Admin Panel, Client Panel, SSH or RDP); it authenticates to the API with an API key. |
For the difference between MASTER and ADMIN, see Administrator Types. For SERVICE accounts, see Service Identities.
Note
A user who has an administrator role and the USER role chooses between Admin Panel and Client Panel after signing in. Add USER or ADMIN next to SERVICE if a person also needs to sign in with a service account.
These account roles are different from the server, password and user roles on the Roles menu, which grant access to servers and accounts. See Roles.