7.3.2 Managing Emergency Access Requests

You can analyze a user’s requests to access applications and then either grant access for a specific duration or deny the request.

If you detect any malicious activity on a resource after you grant access, you can revoke a user’s access to the resource. If you revoke a request while a user is accessing a resource, the user can continue to use the resource until the session is disconnected. However, the user will not be able to start a new session to the resource.

Settings such as the email ID to which requests are sent to, the duration after which a request must be deleted, and so on are configured by default. To change the default settings, see Configuring Emergency Access Settings.

NOTE:You cannot approve a request if a user is in the Blocked Users user group. For more information about removing a user from the Blocked Users user group, see Blocked Users.

To approve a request:

  1. Select a pending request from > Requests. All or PENDING.

  2. Click Approve.

  3. Perform the following based on the type of privileged access:

    For more information on the completing the prerequisites in Credential Vault, see Section 6.1, Credential Vault.

    Request Type

    Actions

    Windows

    Connection Type:

    Select SSO when you need privileged single sign on access to Windows agent. When you select this option you get single sign on access through Privileged Access Manager proxy as well as Privileged Access Manager credential provider.

    Select Direct Access when you want to access the Windows directly using the server credentials.

    Windows Web Access

    Connection Type: Select the application or computer you want to access such as, Windows RDP and Windows Web RDP.

    Select Web Access when you want to access the Windows agent directly using the server credentials.

    Select > Active Sessions to view the active sessions.

    SSH/Telnet

    Connection Type: Select SSH or Telnet based on the connection method the target system supports.

    Enable X11: Select this option to get X11 application access through SSH.

    SSH Web Access

    Connection Type: Select SSH or Telnet based on the connection method the target system supports.

    Select > Active Sessions to view the active session.

    Privileged Shell

    1. In Credential Vault:

      1. Register the target machine for which the request is sent, as an agent.

      2. Set up the user’s account on the target machine.

    2. Specify the required Run User. Specify the name of the user as whom a requesting user can start the session. For example, if the requesting user wants to run the session as root, specify Run User as root.

    Database

    Database: Select the database you want to access.

    Password Checkout: Select this option to check out credentials to access the database.

    Database Access: Select this option when you know the credentials to access the database but you need access to the database through Privileged Access Manager proxy.

    Applications

    1. In Credential Vault, configure the Resources for the required application.

    2. To share the application’s host details with the user as a part of the approval comment, select the Send Run Host ID to the User check box.

    Application SSO

    In Credential Vault, add the application credential for application SSO using RemoteApp mode or direct access mode.

    Based on the type of application SSO modes, do one of the following:

    • RemoteApp Mode

      1. Select RemoteApp and select the required credential.

      2. Select the domain user created for SSO. For more information about creating users, see Creating an Active Directory User.

      3. Select the application credential for SSO.

      4. (Conditional) Select Video Offload to convert session images to video in a video off-load server.

    • Direct Access Mode

      1. Clear the RemoteApp check box.

      2. Select the application credential for SSO.

      3. Select Video Offload to convert session images to videos in a video off-load server.

      4. Create direct RDP and run as privileged user rules. For more information on creating these rules, see Adding a Direct RDP Rule and Adding a Rule to Run Application as a Privileged User.

    Application SSO Web Access

    Connection Type: Select the application or computer you want to access.

    Select Web Access when you want to access the Windows directly using the server credentials.

    Select > Active Sessions to access the active session.

    Application Credential

    Application: Select the application for which you want to get the credentials.

  4. Click Approve.