You can map credentials to permissions. For more information about permissions, see Assignments and Permissions.
This section is only for Application and Database checkout feature. When you click the Application or Database type resource from Credential Vault > Resources, a fly-out is displayed if you are creating a resource and credential for the first time. The Credentials tab requires you to add the privileged type for the respective credential. If you have already created a credential, click on the resource name and the resource details open in a fly-out and when you click on the Credential Count, a Credential fly-out is displayed.
To create a permission:
In Access Control (enable the Access Control Policy engine from Settings > Policy Engine > Server Settings), follow the below procedure.
Create a Resource Pool for Application/Database type. You can add resources to the Resource Pool. For more information see, Configuring a Resource Pool
Add a User Role. For more information see, Configuring a User Role
Create an Assignment and assign permissions for Application/Database credential type. For more information see, Configuring Permissions.
In the Access Control > Assignments > Permissions > Checkout Options page, select the options as required.
Allow Password Change During Check-in: Move the radio button to the right to enable this option. By default this option is set to disabled and does not allow user to change the password while checking in. Enabling this option allows you to change the password while check in and provides the following options.
NOTE:For users upgrading from Privileged Access Manager 4.1 to 4.2 version, and want to continue using the same Check in and Check out behavior for credentials, do not enable the Allow Password Change During Check in option.
Whereas enabling the Allow Password Change During Check in is a new behavior of functionality from Privileged Access Manager 4.2 version onwards.
Credential Checkout Mode: Selected by System option allows system to select the user for checkout.
Allow Selection by User option allows you to select the user for which you want to perform password check-in and check-out function.
Credentials Allowed for Checkout This option allows you to either allow All credentials to perform Check in and Check Out function.
The Restrict Credentials to a Privilege Type option is only applicable if you have already defined privilege type and want to select for which user you want to change the password while check out. For more information about privilege type, see Section 6.1.8, Defining Privileged Type for a Credential.