Resource Groups

The section is intended for grouping resources in order to quickly and conveniently issue permissions to the entire group at once, as well as view sessions and events in the group as a whole.

Resource Groups Search

Enter the resource group name in the search bar and click .

Click Extended search, set one or more filters and click Search.

Resource group profile

The following is displayed for each resource group:

• Resources — list of resources in the group.
• Permissions — the list of permissions issued to the group.
• Sessions — the list of active, finished, and aborted sessions.
• Events — records of operations related to the resource group.

Add resources

To work with resource groups, you must create a group and add resources to it.

1. Click Add in the Resource groups section
2. Select Organizational unit
3. Enter a Resource group Name, Description and save your changes.
4. Also, you can check Add resources with account option which means the type of Resource group. This option affects the creation of a permission for the resource group:
   1. If you check this option, then when adding each individual resource, you will need to specify a privileged Account to access the Resource.
   2. If you do not check this option, then you will not need to specify an account for each individual resource. Also, when creating a Permission for such a group, only domain Accounts will be available for choosing, or you may use the user account option instead.
5. Open the created resource group, in the Resources tab, click the Add button and add the necessary resources to the group.

Create permission

Permissions allow users to connect to resources.

To create a permission:

1. Open the resource group profile and click Create permission.

2. If the group contains resources without an account, select an account in the window that opens:

   • Select account in PAM — the permission is granted to an account added to Axidian Privilege.
   • Use user account — the permission is granted to an arbitrary account.
     The user needs to enter the login and password of the account on the resource.

3. Click Select.

4. Define the permission composition. If necessary, modify the preset parameters.

   More about permission scope

   1. Select who gets access:

      • Users — the permission is granted to one or several selected users.
      • User group — the permission is granted to one selected user group.

   2. Select what to get access to:

      • Resources — the permission is granted to one or several selected resources.

      • Resource groups — the permission is granted to one selected resource group.

      • Ad hoc connections — the permission is granted to Ad hoc resources with the selected connection type, including resources not registered in PAM. One shared account is used for all connection types.

        License required

        A special license is required to work with Ad hoc resources.

        A special license is required to create a permission for PostgreSQL or MSSQL. Before creating the permission, add an account from the DBMS to PAM. You need to specify it in the permission.

   3. Click Next.

   4. Select the account under which the user will open a session on the resource:

      • Select account in PAM — the permission is granted to an account added to Axidian Privilege.
      • Use user account — the permission is granted to an arbitrary account.
        The user needs to enter the login and password of the account on the resource. In RDP and SSH sessions, it is possible to log in using the current Axidian Privilege user credentials.

5. (Optional) Configure access to credentials.

   More about access settings

   You can grant access to credentials only at the permission creation step.

   The following settings are available:

   • Credentials — the option defines actions with credentials:
     • Allow view account credentials — users can view passwords of the accounts from this permission.
     • Allow change account credentials — users can change passwords of the accounts from this permission.
   • Allow running pamsu in SSH sessions — the setting defines access to PamSU when connecting via SSH Proxy:
     • Managed by policies — access to PamSU is determined by the policy of the resource for which the permission is granted.
     • Allowed — the user can use PamSU regardless of policy settings.
     • Denied — the user is not allowed to use PamSU regardless of policy settings.

6. (Optional) Fill in the Description field.

7. (Optional) Configure time restrictions.

   More about time restrictions

   You can set a schedule according to which users are allowed to open sessions or change credentials. For example, you can grant permission to work only on weekdays from 8:00 to 17:00.

   The following settings are available:

   • Validity period — the time period during which the permission is valid. For example, you can grant permission for one day or month.
     

     • Begin — set the date and time when the permission becomes active.
       If only Begin is set, the permission will become active on the selected date, and its validity period will be unlimited.

     • End — set the date and time when the permission becomes inactive.
       If only End is set, the permission will become active at the moment of creation, but will be suspended on the specified date.

       info

       If the Begin and End parameters are not set, the permission will be valid indefinitely.

   • Access schedule — restrictions by days of the week taking into account the specified schedule.

     • Allow access only on selected days — select the days of the week when the permission will be active.

     • Allow access only during selected hours — select the time when the permission will be active.

       info

       Access by days of week is granted according to the management server time zone.

   After the validity period expires, the permission will transition to the Restricted/Inactive state, and the user session will be terminated.

8. In the Connection source setting, select the network address from which sessions to the resource are allowed to be opened. If no network locations are added to PAM, the value is set to No restrictions — the permission can be used from any device on the network.

9. Check the data and click Create permission.

Since the permission is created for the entire group, all resources of the group become available to the user at once. Changing the content of the resource group for the user within the permission will also change the composition of the resources available for connection.

Remove resource group

1. Open the resource group profile.
2. Click Remove.
3. Confirm the action by clicking Remove.

To remove multiple groups, in the Resource groups section, select the required groups and click Remove.