Skip to main content
Version: Axidian Privilege 3.4

Automation via ConsoleApp

The ConsoleApp utility allows you to automatically manage Axidian Privilege objects and configure access permissions. For example, you can use the utility to create multiple resources or accounts at once, as well as revoke all unused permissions.

info

All operations performed by the utility are logged in the Events journal.

Authentication​

Before using the utility, configure authentication to access Axidian Privilege. ConsoleApp supports the following OAuth 2.0 authentication modes:

  • Resource Owner Password Flow (ROPC) — the utility obtains an access token on behalf of a PAM user and sends their credentials to the Axidian Privilege IDP component. All actions performed through the utility are executed on behalf of the PAM user, and the available operations are limited by the privileges of the specified user.
  • Client Credentials Flow — the utility authenticates in PAM on its own behalf in Machine-to-Machine (M2M) mode. All actions performed through the utility are executed on behalf of the Console Application service client, and the available operations are limited by the privileges of this client.
info

For ROPC authentication, do not fill in the clientSecret parameter — leave the value empty.

To configure authentication:

  1. Navigate to the utility folder and open the appsettings.json configuration file.
  2. For the coreUrl parameter, specify the Core component address.
  3. For the idpUrl parameter, specify the IdP component address.
  4. For the authUsername parameter, specify the PAM user login.
    If the parameter is not specified, the login will be requested when the utility starts.
  5. For the authPassword parameter, specify the PAM user password.
    If the parameter is not specified, the password will be requested when the utility starts.

When the utility starts, authentication is performed on behalf of the specified PAM user. If two-factor authentication is configured for the user, the utility will request an OTP code.

Configuration file example
{
  "coreUrl": "https://pam.example.local/core",
  "idpUrl": "https://pam.example.local/idp",
  "clientSecret": "",
  "authUsername": "ConsoleAppUser",
  "authPassword": "#123QwerTy!",
  "skipErrorsInBulkProcessing": true,
  "NLog": {
    "variables": {
      "minLevel": "Trace",
      "dbMinLevel": "Info",
      "maxArchiveFilesPerCategory": 23
    },
    "rules": {
      "1": {
        "logger": "*",
        "minLevel": "Trace",
        "writeTo": "processFile"
      }
    }
  }
}

Account operations​

Create an account​

To create an account in Axidian Privilege:

  1. Navigate to the utility folder.

  2. Run the utility with the parameters from the table:

    .\Pam.ConsoleApp.exe create-account <parameter> <value>
    Parameters
    ParameterRequirement
    Description
    --usernameRequiredAccount name
    --resource or --domainRequiredAccount location:
    • --resource — resource name
    • --domain — domain name

    Specify one of the parameters.
    --passwordOptionalAccount password
    --descriptionOptionalDescription
    --policyOptionalPolicy to apply to the account
    --key-fileOptionalPath to the SSH key file, for example: .\id_rsa
    --key-passphraseOptionalSSH key file passphrase
    Command examples
    Create an account
    .\Pam.ConsoleApp.exe create-account `
    --username Administrator `
    --resource app01.local `
    --password "Pass123$" `
    --description "Local admin" `
    --policy Default
    Create a domain account
     .\Pam.ConsoleApp.exe create-account --username Administrator --domain dev.local
    Create an account with an SSH key
     .\Pam.ConsoleApp.exe create-account `
     --username root `
     --resource linux01.local `
     --password "Pass123$" `
     --key-file .\id_rsa `
     --key-passphrase "Passphrase"

Delete an account​

To delete an account from Axidian Privilege:

  1. Navigate to the utility folder.

  2. Run the command, specifying the account name or its identifier:

    .\Pam.ConsoleApp.exe delete-account --name <account name>
    .\Pam.ConsoleApp.exe delete-account --id <account identifier>

    The identifier is displayed in the URL in the account profile.

    Command examples
    Delete an account by name
    .\Pam.ConsoleApp.exe delete-account --name app01.local\User
    Delete an account by identifier
    .\Pam.ConsoleApp.exe delete-account --id a988f1b0-b871-43fa-a40c-6f4ac75f904c

Resource operations​

Create a resource​

To create a resource in Axidian Privilege:

  1. Navigate to the utility folder.

  2. Run the utility with the parameters from the table:

    .\Pam.ConsoleApp.exe create-resource <parameter> <value>
    Parameters
    ParameterRequirement
    Description
    --nameRequiredResource name
    --descriptionOptionalDescription
    --dns-name or --ip-addressRequiredResource address:
    • --dns-name — DNS name
    • --ip-address — IP address

    Specify one of the parameters.
    --user-connection-typeRequiredUser connection type. For more details, see User connection.
    --user-connection-addressOptionalIP address or DNS name of the user connection
    --user-connection-portOptionalUser connection port
    --user-connection-matching-urlOptionalLogin page URL for a web resource
    --user-connection-matching-url-is-regexOptionalIndicates whether the login page URL is a regular expression:
    • true — yes
    • false — no

    Specify if the UC matching url parameter is set.
    --service-accountOptionalService account name
    --service-connection-typeOptionalService connection type. For more details, see Service connection.
    --service-connection-portOptionalService connection port
    --service-ssh-templateOptionalSSH connector template name. Specify if the service connection type is SSH.
    --cisco-privilege-mode-passwordOptionalCisco privileged mode password. Specify if the service connection type is Cisco IOS.
    --policyOptionalPolicy to apply to the resource
    Command examples
    Create a resource
     .\Pam.ConsoleApp.exe create-resource `
     --name APP01 `
     --description "Application server" `
     --dns-name app01.local `
     --user-connection-type RDP `
     --user-connection-port 3389 `
     --service-account DOMAIN\svc_app `
     --service-connection-type Windows

Delete a resource​

To delete a resource from Axidian Privilege:

  1. Navigate to the utility folder.

  2. Run the command, specifying the resource name or its identifier:

    .\Pam.ConsoleApp.exe delete-resource --name <resource name>
    .\Pam.ConsoleApp.exe delete-resource --id <resource identifier>

    The identifier is displayed in the URL in the resource profile.

    Command examples
    Delete a resource by name
    .\Pam.ConsoleApp.exe delete-resource --name app01.local
    Delete a resource by identifier
    .\Pam.ConsoleApp.exe delete-resource --id a988f1b0-b871-43fa-a40c-6f4ac75f904c

Permission operations​

Create a permission​

To create a permission in Axidian Privilege:

  1. Navigate to the utility folder.

  2. Run the utility with the parameters from the table:

    .\Pam.ConsoleApp.exe create-permission <parameter> <value>
    Parameters
    ParameterRequirement
    Description
    --userRequiredPAM user name in UPN format
    --accountOptionalPAM account name for connecting to the resource. If not specified, the user will be prompted to enter the account credentials when starting a session.
    --resources or --resources-groupRequiredResource or resource group name. Specify in the format:
    • <resource name>:<connection type> — for one or more resources
    • <group name> — for a resource group
    --active-fromOptionalDate and time when the permission becomes active. Specify in the format DD.MM.YYYY HH:MM or DD.MM.YYYY.
    --active-toOptionalDate and time when the permission is suspended. Specify in the format DD.MM.YYYY HH:MM or DD.MM.YYYY.
    --schedule-time-fromOptionalTime when the permission can be used. Specify in the format HH:MM.
    --schedule-time-endOptionalTime when the permission cannot be used. Specify in the format HH:MM.
    --schedule-time-utcOptionalConvert the specified access time from the current time zone to UTC:
    • true — use the current time zone
    • false — convert to UTC
    --allow-to-view-credsOptionalAllow the user to view the credentials of accounts added to the permission:
    • true — allow
    • false — deny
    --allow-to-change-credsOptionalAllow the user to change the credentials of accounts added to the permission:
    • true — allow
    • false — deny
    Command examples
    Create a permission for multiple resources
    .\Pam.ConsoleApp.exe create-permission `
      --user ivanov@domain.local `
      --account DOMAIN\Administrator `
      --resources srv01.local:RDP,srv02.local:SSH
    Create a permission for a resource group
    .\Pam.ConsoleApp.exe create-permission `
      --user ivanov@domain.local `
      --account DOMAIN\Administrator `
      --resources-group PROD-SERVERS
    Create a permission with time restrictions
    .\Pam.ConsoleApp.exe create-permission `
      --user ivanov@domain.local `
      --resources srv01.local:SSH `
      --active-from "01.08.2026 09:00" `
      --active-to "31.08.2026 18:00" `
      --schedule-time-from 08:00 `
      --schedule-time-end 21:59 `
      --schedule-time-utc true `
      --allow-to-view-creds true `
      --allow-to-change-creds true

Revoke a permission​

caution

Revoked permissions cannot be restored. If you need to temporarily restrict the use of a permission, suspend it instead.

To revoke a permission:

  1. Navigate to the utility folder.

  2. Run the following command:

    Revoke a permission by number
    .\Pam.ConsoleApp.exe revoke-permissions --permissions <permission numbers>
    Revoke a user permission
    .\Pam.ConsoleApp.exe revoke-permissions-by-user <parameter> <value>
    Parameters
    ParameterRequirement
    Description
    --userRequiredPAM user name in UPN format
    --accountOptionalAccount name
    --resources or --resources-group RequiredResource or resource group name. Specify one of the parameters.
    Command examples
    Revoke user permissions by resources
    .\Pam.ConsoleApp.exe revoke-permissions-by-user `
      --user ivanov@domain.local `
      --account DOMAIN\Administrator `
      --resources srv01.local:RDP,srv02.local:SSH
    Revoke user permissions by resource group
    .\Pam.ConsoleApp.exe revoke-permissions-by-user `
      --user ivanov@domain.local `
      --account DOMAIN\Administrator `
      --resources-group PROD-SERVERS

After the command is executed, the specified permissions are set to the Revoked state.

Suspend a permission​

An unused permission is a permission that has not been used within the period specified in the Monitoring settings. It is recommended to revoke or suspend such permissions.

To suspend unused permissions:

  1. Navigate to the utility folder.

  2. Run the following command:

    .\Pam.ConsoleApp.exe suspend-unused-permissions

After the command is executed, all unused permissions are set to the Suspended state.
The permission can be resumed at any time.