Keycyte PAM 3.2 · Release Notes

What's New in Keycyte PAM 3.2

Keycyte PAM 3.2 introduces the following new features and improvements.

Administration and Permissions

Permission profiles. A new page, Settings > Permission Profiles, defines what ADMIN accounts may do in each Admin Panel module (view, add, edit, delete). Every ADMIN account is assigned a profile. The menu, pages and buttons of the Admin Panel follow the profile. MASTER accounts are never restricted by profiles.
Tags. Servers and Password Vault entries can be tagged. Tags are managed on Settings > Tags and can be used to filter lists. Only MASTER administrators can create, delete and merge tags.
Password Vault recycle bin. A deleted vault entry is moved to the recycle bin (Settings > Recycle Bin) and can be restored until its retention period ends. The retention period is configurable.
Runtime log level. The log level of the PAM server can be changed on Settings > General without a restart.
Light and dark theme. Both panels have a theme switch in the top bar, and the choice is saved per user.
Sortable tables. Clicking a column header sorts the whole list in tables that are paged in the browser, in both panels. Sorting is language-aware and keeps the row selection.

Bulk actions for roles. On Server Roles and Password Roles, a Bulk actions menu changes several roles at once: features, schedule, authorized users and groups, owners and tags. Each bulk change runs as one transaction, reports updated, unchanged, forbidden and not found roles, and is written to the audit log.
Clearer role tables. The role tables show the authorized users and groups, the member count and the enabled features. Roles can be filtered by an authorized user or group, for example to remove a person from every role at once.
Role schedules. Weekly schedules, overnight time windows (for example 22:00–06:00) and custom date ranges are enforced for server, password and user roles. The role list shows each role’s schedule.
Server picker in the Password Vault. The Servers field of a vault entry offers server roles and shortcuts such as “All RDP servers” and “All SSH servers” in addition to individual servers.

Self-first password change. For Windows and Active Directory accounts, the password policy has a new Change Method: the account changes its own password first and falls back to a privileged reset (default), reset only, or self change only. Every change is verified by signing in with the new password, and every step is written to the Password Manager log.
Self-change skip. If an account cannot change its own password for a lasting reason, it is reset with the privileged account for 30 days. The Password Vault shows this, and Retry self change in the action menu ends the skip for one account.

TACACS+ server. Keycyte PAM provides a TACACS+ server for authentication, authorization and accounting of network device administrators. It is configured on Settings > TACACS+ Server. A server can be registered as a TACACS+ device with its own shared secret, and server roles carry a TACACS+ privilege level.

Secrets API. Applications can read secrets from the Password Vault through the Secrets API with service identities and API keys. API keys have an expiry, can be revoked, and are flagged when they are not used for a long time. The API reference is available from the Admin Panel.
Several Syslog targets. Audit records are forwarded to every enabled server on Settings > Syslog Settings. Each target has its own queue, so an unreachable target no longer delays the others. Targets are validated when they are saved.
Faster user and group search. User and group autocomplete shows exact matches first, then names that start with the search term, then names that contain it. Directories are searched in parallel with time limits, and an unreachable directory no longer blocks the search; a note under the field tells you when a directory could not be reached.

Detailed analysis of session reports. Session Reports have a new Detailed analysis tab: filter sessions by users, servers, accounts, time, duration, close reason, recording and client, group them on a chosen axis, view totals and a trend chart, compare with the previous period, export to CSV or Excel and open the matching sessions in Session History. Filter sets can be saved and shared.
Client IP on File History. File History has an optional Client IP column.
Close reasons for SSH sessions. The reason why a web terminal or native SSH session ended is written to the client log.
Session keepalive. The Client Panel keeps the connection of an open session alive and shows a prompt when the sign-in session expires, instead of closing the session without notice.
Kubernetes protocol. Kubernetes is available as a server protocol.

Black terminal theme. A new Black terminal theme shows terminal sessions on a pure black background. The area around the terminal takes the color of the selected theme.

Web TLS certificate management. On Settings > Web TLS Certificate, the certificate, key and chain can be loaded from PEM files. A full chain pasted into the certificate field is split automatically, chains of internal CAs without the root are accepted with a warning, and the chain is served in issuer order. Keys that browsers cannot use (Ed25519, ECDSA P-521) and password-protected keys are refused with a clear message.
Write-only shared secrets. The RADIUS and TACACS+ shared secrets are no longer shown after they are saved.
Protected Admin Panel files. The files of the Admin Panel are served only to signed-in administrators.