6.1.7 Sample Use Cases

The following use case illustrates the work flow of Credential Vault user journey:

Configuring Oracle Database Vault Type Using Credential Vault

This use case helps you to configure the Oracle database vault type using the following procedure:

  1. Click Credential Vault > Resources > +Add New and select the resource.

  2. In the General tab, specify the name of the database in Name. This name is used along with the credential to authenticate.

    NOTE:If you provide an invalid domain name, the user authentication fails.

    Complete the details:

    • Connection Details: This tab is available in Database resources.

      • Connect String: You can specify the string that will reset the password in the database and check in the password.

      • Connect As: Select SYSDBA. If you want Privileged Access Manager to perform the password check in process then, to check the connection to the database server, click Test Connection or select Default.

      • Password Change on Check in:

        Based on the following selection the password of the application will be changed automatically every time a credential is checked in.

        • Never

          You can use this option if you do not want to change the password after every credential check-in.

        • Delegate to Identity Manager

          If you want to delegate the password check-in process to Identity Manager, select Delegate to Identity manager. Once a resource is created in Identity Manager, it gets synced to Privileged Access Manager. Resource permission is created in Privileged Access Manager but during check in and checkout password is rotated and handled by Identity Manager Driver Implementation guide on the PAM documentation page.

          NOTE:Although the latest IDM driver version is 4.8.x, ensure that you use 4.5.x version of the IDM driver package, as 4.5.x version is currently supported with Privileged Access Manager.

          NOTE:Before you delegate password check-in to Identity Manager ensure that both the Privileged Access Manager IDM driver and database driver are operational.

        • Internal

          Use this option, if you want Privileged Access Manager to manage password change.

          Select the appropriate Password Policy that must be used when Privileged Access Manager generates a new password. By default Default Password Policy is selected. You can either modify the default password policy or create a new password policy.

          • Password Policy

            NOTE:Ensure not to use '%' percentage character in the special characters list of the password policy.

          • User Name

          • Password

  3. Click Next.

  4. In the Proxy Connector tab, complete the details.

    • Database Address: Specify the IP address or the Host Name of the Database.

    • Database Port: Specify the Database port number.

    • Connection Protocol: Select TCP or TCPS.

    • Database SSL Version: In case you have selected TCPS, specify if it is Any Database SSL version, or the specific one from the dropdown list.

    • DBAudit Servers: You can either select All or Selected server. Specify the proxy port.

  5. Click Next.

  6. In the Custom Attributes tab, click Add.

    • In the Name field, specify the name of the custom attribute. For example, Expiration date.

  7. In the Value field, specify the value for the attribute. For example, the date you want the entity to expire.

  8. Repeat the steps through 4-6 for any other custom attributes you want to add.

  9. Click Next.

  10. In the Extended Attributes tab, click +Define and select the relevant attributes from the list.

  11. Click Finish.

  12. Enter Privileged Access Manager user credentials and log into the user interface.

  13. On the Privileged Access Manager console, click My Access > Checkouts icon against the Oracle resource.

  14. A Credential Checkout pop-up page is displayed. Enter Access Duration, Email ID, and Reason for accessing the resource and click Check Out.

    NOTE:From Privileged Access Manager 4.2 onwards, an option is provided for you to select the user or the role whose password can be checked out. To see this option, you must have added privilege type. Additionally, it is required to enable Allow selection by user option from Access Control > Assignments > Permissions > Checkout Options page. For more information see, Section 6.1.8, Defining Privileged Type for a Credential.

  15. Note the credentials provided and open Oracle server and enter the same credentials in the Credential Checkout page and click sign in. Now the you are successfully logged into the AWS Database and can proceed with completing the tasks.

  16. You can check-in the credentials after the use of the credentials using the following procedure.

    1. Enter Privileged Access Manager user credentials and log into the user interface.

    2. Click My Access > Check-in icon against the Oracle resource. The message, Credentials Checked in successfully is displayed. Now you can verify and note that you can no longer access the Oracle database using the earlier credentials.

      The administrator can monitor this activity by navigating to Reports > Built-in Reports > Credential Checkouts to access the report using the Privileged Access Manager console.

Selecting Resource and Credentials Using Filter

This resource filter feature simplifies search-ability in scenarios where there are 1000s of locations with more than 400 odd location-based networks.

Consider Mike, a network administrator. The operational equipment such as sensors, actors, and controller is located in the production network. Privileged Access Manager is located in both the office network and in the standard client. But there is no connection between office network and internal network. Mike requires access to a resource from the production network. He uses his network device to access Privileged Access Manager. He selects the credentials based on the three components of location, network, and resource. Consider Mike has 1000s of Resources based out of same location with the same application type. It gets challenging to select the specific resource. You can type the Resource type in the Find Types search field for easy filtering. You can also select a combination of Key Type, Location, and Department for further granular filtering.

Allowing Delegated Resource and Credential Creation

Consider Susan, a network administrator in a chemical plant. A resource is added in the production environment and Susan has to add that resource along with the credentials in Privileged Access Manager. She can define a privileged type for a single resource. She can categorize the credentials in the resource based on the attributes such as finance, HR, or engineering.