Applications

An Application is third-party software for automation and task execution. When launched, an application requests authentication using account credentials. Typically, this data is stored unencrypted in scripts or configuration files, increasing the risk of interception by third parties.

To enhance security, use the method of automatic credential retrieval — Application to Application Password Management (AAPM). In this case, passwords and SSH keys of accounts are stored in Axidian Privilege and requested by the application only at the moment of task execution. This allows controlling access to credentials, avoiding their storage in an open format, and automatically updating them.

To configure AAPM operation:

1. Add the application to Axidian Privilege and configure authentication.
2. Grant permission and select those accounts whose passwords or SSH keys are required for AAPM operation.
3. Verify the application's operation and retrieve credentials in a convenient way.

info

An AAPM license is required to work with applications.

Application profile

For each application, the following are displayed:

• Administrators — a list of users who can view the application's credentials.
• Permissions — a list of granted permissions to use account credential data.
• Events — records of operations related to the application.

Add application

Restrict access

To improve security, it is recommended to create an application for a specific task and control the permissions granted.

1. Go to the Applications section in the admin console.
2. Click Add.
3. Fill in the Name and Description fields and click Save.

Authentication

Before starting work in Axidian Privilege, applications and users are authenticated in the IdP.
The following authentication methods are supported for applications:

• Password — mandatory and automatically generated when adding an application to PAM. In the admin console, the password cannot be viewed but can be reset. The application administrator can view the password in the user console.
• IP address — set additionally if verification of the IP address from which the token request originates is required.
• Certificate — set additionally if verification of the client certificate fingerprint is required.

Create permission

Permissions allow the application to use passwords or SSH keys of Axidian Privilege accounts.

To create a permission:

1. Open the application profile and click Create permission.

2. (Optional) Select an organizational unit and click Select.

3. Define the permission composition:

   1. Select an application or keep the preset value.
   2. Select one or several accounts whose credentials are required for the application to work.

4. (Optional) Set the Allow change account credentials option. If the option is enabled, users can change the password of the privileged accounts used in the permission.

5. (Optional) Fill in the Description field.

6. (Optional) Configure time restrictions.

   More about time restrictions

   You can set a schedule according to which users are allowed to open sessions or change credentials. For example, you can grant permission to work only on weekdays from 8:00 to 17:00.

   The following settings are available:

   • Validity period — the time period during which the permission is valid. For example, you can grant permission for one day or month.
     

     • Begin — set the date and time when the permission becomes active.
       If only Begin is set, the permission will become active on the selected date, and its validity period will be unlimited.

     • End — set the date and time when the permission becomes inactive.
       If only End is set, the permission will become active at the moment of creation, but will be suspended on the specified date.

       info

       If the Begin and End parameters are not set, the permission will be valid indefinitely.

   • Access schedule — restrictions by days of the week taking into account the specified schedule.

     • Allow access only on selected days — select the days of the week when the permission will be active.

     • Allow access only during selected hours — select the time when the permission will be active.

       info

       Access by days of week is granted according to the management server time zone.

   After the validity period expires, the permission will transition to the Restricted/Inactive state, and the user session will be terminated.

7. Check the data and click Create permission.

Reset password

When adding an application, Axidian Privilege assigns it a random password. In the admin console, this password cannot be viewed, but it can be reset and a new one set. Follow these steps:

1. Go to the application profile and click Reset password.
2. In the window that appears, specify a reason to reset the application password.
3. Click Reset.

After the old password is reset, Axidian Privilege will generate a new one.

Add or remove an administrator

Administrators can view application passwords in the user console.
To add an administrator:

1. Open the application profile and go to the Administrators tab.
2. Click Add Administrator.
3. Select one or more users and click OK.
4. Confirm the action and click Add.

To remove an administrator:

1. Open the application profile and go to the Administrators tab.
2. Select one or more users and click Remove.
3. Confirm the action and click Remove.

Delete application

caution

After deleting application, it will no longer be able to receive passwords or SSH keys from Axidian Privilege accounts.

To remove the application:

1. Go to the application profile.
2. Click Delete and confirm the action.

To delete multiple applications, select the required applications in the Applications section and click Remove.