6.1.5 Configuring Permissions

Under an assignment, one or more permissions define the access criteria such as Privilege Level, Allowed Access time, Monitoring options, File or Folder access control, Customization etc. Below is the list of permissions based on the Resource Types.

While configuring permissions, only the applicable options are available for configuration. The wizards on the console are helpful in navigating to a particular section of options for a permission and selecting, enabling or disabling the required options.

Windows Agents

Below is the list of permissions under Windows Agents Resource Pools.

Credential Provider
- Users must use the Credential Provider provided by Privileged Account Manager Agent installation.
- Users must use the Credential Provider provided by Privileged Account Manager Agent installation.
Direct RDP
- Users can directly login into the Windows system using own accounts.
- Privilege Elevation is not applicable.
Web Agent RDP
- Users need to login into Privileged Account Manager's User Console.
- Users' are authenticated by authentication sources configured in Privileged Account Manager.
Privileged Applications
- Users can directly login into the Windows system using own accounts. Users need to request a specific application to run with privileges supplied by Privileged Account Manager, using the Run as privileged user option, that appears when you right click on any application.

The table highlights the differences of each permissions with respective options and user experience:

Permissions	Authentication	Privilege Elevation	Mode of Access	Mode of session	Session Capture	Video Capture	Enhanced Access Control	Application Command Lists
Credential Provider	Privileged Account Manager	Yes	Thick Client	RDP Session	Yes	Yes	Yes	NA
Direct RDP	Windows Authentication	NA	Thick Client	RDP Session	Yes	Yes	Yes	NA
Web Agent RDP	Privileged Account Manager	Yes	Web Browser	RDP Session	Yes	Yes	Yes	NA
Privileged Applications	NA	Yes	Thick Client	Requested Application	Yes	Yes	NA	Yes

UNIX Agents

The List of permissions under Linux or UNIX Agents Resource Pools are:

Privileged Shell
- Users can directly login into the Linux or UNIX systems using own accounts.
- Users need to request for privileged shell using the command - usrun pcksh.
Login Shell
- Users can directly login into the UNIX or Linux systems using own accounts.
- Users' default shell should be set to /usr/bin/cpcksh.
Privileged Commands
- Users can directly login into the UNIX or Linux systems using own accounts.
- Users must request for privileged commands using the command - usrun.

The table highlights the differences of each permissions with respective options and user experience:

Permissions	Authentication	Privilege Elevation	Mode of Access	Mode of session	Session Capture	Enhanced Access Control	Application Command Lists
Privileged Shell	Local Accounts on Agent	Yes - On Demand	Terminal	PCKSH Shell	Yes	Yes	NA
Login Shell	Windows Authentication	Yes - On Login	Terminal	CPCKSH Shell	Yes	Yes	NA
Privileged Commands	Privileged Account Manager	Yes - On Execution	Terminal	Requested Command	Yes	NA	Yes

SSH Servers

The List of permissions under SSH Resource Pools are:

Terminal SSH
- Users can list or access SSH Sessions from any terminal, by connecting to the port of SSH Relay - ssh -t -p 2222 username@pamhost
- Users' are authenticated by authentication sources configured in Privileged Account Manager.

Web SSH

Users must login into Privileged Account Manager's User Console.
Users' are authenticated by authentication sources configured in Privileged Account Manager.

The table highlights the differences of each permissions with respective options and user experience:

Permissions	Authentication	Privilege Elevation	Mode of Access	Mode of session	Session Capture	X11	Video Capture	Application Command Lists
Terminal SSH	Privileged Account Manager	Yes	Thick Client	SSH Session	Yes	Yes	Yes	Yes
Web SSH	Privileged Account Manager	Yes	Web Browser	SSH Session	Yes	NA	NA	NA

Telnet Servers

The List of permissions under Telnet Resource Pools are:

Terminal Telnet
- Users can list or access SSH Sessions from any terminal, by connecting to the port of SSH Relay - ssh -t -p 2222 username@pamhost
- Users' are authenticated by authentication sources configured in Privileged Account Manager.

Web Telnet

Users must login into Privileged Account Manager's User Console.
Users are authenticated by authentication sources configured in Privileged Account Manager.

The table highlights the differences of each permissions with respective options and user experience:

Permissions	Authentication	Privilege Elevation	Mode of Access	Mode of session	Session Capture	Application Command Lists
Terminal Telnet	Privileged Account Manager	Yes	Thick Client	Telnet Session	Yes	Yes
Web Telnet	Privileged Account Manager	Yes	Web Browser	Telnet Session	Yes	NA

Windows Servers

The List of permissions under Windows (Agent-less) Resource Pools are:

Web RDP

Users need to login into Privileged Account Manager's User Console.
Users' are authenticated by authentication sources configured in Privileged Account Manager.

The table highlights the differences of each permissions with respective options and user experience:

Permissions	Authentication	Privilege Elevation	Mode of Access	Mode of session	Video Capture
Web RDP	Privileged Account Manager	Yes	Web Browser	RDP Session	Yes

Adding a Permission

On the home page of the console, click Access Control.
In the access control pane, click Assignments.
In the details pane, click Create Assignment or modify an existing Assignment.
Click on Add and select a Permission. Configure the permission options using the wizard. For more information, see Section 6.1.5, Configuring Permissions.
Click Save.

Modifying a Permission

On the home page of the console, click Access Control.
In the access control pane, click Permissions View.
In the details pane, select the permission you want to modify and then click the Edit icon on that row or click on the assignment you want to modify and Edit Permission page is displayed on the right pane.
Configure the permission options using the wizard. For more information, see Section 6.1.5, Configuring Permissions.
Click Save.

Deleting a Permission

On the home page of the console, click Access Control.
In the Access Console pane, click Permissions View.
Select the Permission you want to delete.
In the details pane, click Delete.
Click Delete to delete the selected permission.