Delegated administrator is a role granted to a user to administer a specific path and associated resources to satisfy the business requirements. Delegated administrator can also create and manage sub-path within the assigned path. Both, LDAP and local users can be granted with Delegated administrator privilege.
Privileged Access Manager provides the capability to store and access resources with their secrets. Resources are organized in a tree-based structure called Path and the policies are defined on top of this path. The ownership for each Path is defined to manage the associated resources.
Delegated administrator allows to achieve the following
Helps to defend against internal security breaches that escalate privileges and exploit them by eliminating endpoint-specific built-in administrative access and rights.
Aids in enforcing the "least privilege" concept to grant users the required access and privileges that they require to perform their tasks in an efficient manner.
In an organization, if you want a specific set of people to manage resources but can access credentials, such as, API users to access the credentials for resources, it is easier to delegate such granular permissions.
In addition to Access Control, in the secrets vault, you can provide delegated access for users who need JIT access, etc. Vault Management itself can be segregated based on certain users and their policies.
It is possible to define specific policies to distinguish Vault administrators from Delegated administrators. Vault administrators are no longer the sole owners managing path and resource. Delegated administrators can manage the designated path, associate resource, and respective sub-paths.
Consider, Adam, Path owner, clicks Credential Vault > Resources search path using / which is the root path and add additional paths in the root path by clicking Access > Create > Path owner (who is a super administrator for a particular path). Path administration, unlike the super administrator will have restrictive permissions. To provide delegated administrator permissions to Alice, Adam must perform the following:
Click Path > Add to create a path. Navigate to the path and click on View Policy to add a new policy where the groups and privilege types are listed.
Edit the created path.
Add users to the created path from Users and Groups.
Create a group (add permissions from the user and group management, view add, modify resources and credentials in Credential Vault). Credential Vault permission and users and group permission are mandatory.
Edit Access path and either enable recursive or disable recursive.
NOTE:Enabling Recursive allows the path owner to manage the delegated path and the inherited child paths.
Log out from Privileged Access Manager as administrator.
When Alice logs in she gets Credential Vault permission (but no path management permission) which means Alice as a delegated administrator has been granted only permission to create a policy and not manage a path and at that particular level, she can manage as a delegated administrator. Additionally, Alice can log in and manage the resources and credentials for the particular path when is given path administrator rights for a path.