Users

This section is intended for working with the following types of Axidian Privilege users:

• Users from directory service.
  For such users, the Source field indicates Catalog.
• Internal users.
  For such users, the Source field indicates PAM.

By default, 15 users are displayed. When this number is exceeded, a switcher will appear at the bottom of the page. Only 1000 users are available for viewing. The number of users displayed by default on the page can be changed in the configuration file:

• Windows: C:\inetpub\wwwroot\mc\assets\config\config.prod.json
• Linux: /etc/axidian/axidian-privilege/mc/config.prod.json

User search

Enter a first name, last name, phone number, or email address in the search string and click .

Click Extended search, set one or more filters and click Search.

info

Login search is not supported.

To find removed users:

1. Open the Users section and click Extended search.
2. Select the Deleted value for the State parameter.
3. Click Search.

Create an internal user

Warning

Do not close the window until you have passed the password to the user.

Connection via RDS is not available for internal users.

1. Open the Users section.
2. Click Create.
3. Set the user's login. The login is used to access the user and administrator consoles.
4. Select the option:
   • Set password manually — the password is set manually.
   • Generate — the password will be generated by PAM.
5. Copy the password and pass it to the user.
6. Set the Require password change on first login option.
7. Set the user's Email.
8. Click Optional fields and fill in the fields: First Name, Last Name, Phone, Description.
9. Complete adding the user:
   • Click Create to stay in the Users section.
   • Click Create and open to navigate to the new user's profile.

User profile

For each user, the following is displayed:

• Permissions — list of granted permissions for the user to connect to the resource.
• User groups — list of groups the user belongs to.
• Sessions — list of active, ended, and aborted sessions.
• Authenticators — information about the user's configured authenticators.
• Events — records of operations related to the user.

Edit data in the profile

1. Open the user's profile.
2. Click    next to the parameter to set or edit it.

Select a policy

1. Open the user's profile.
2. Click    next to the Policy parameter.
3. Select a policy from the list and click Select.

Configure authenticator

The Authenticators tab displays information about the password, second factor, and SSH keys that allow connecting to SSH Proxy without a password.

For an internal PAM user, the date and time of the last password change, as well as the password expiration period, are displayed.

For all users, the authenticator status is displayed. The value Not enrolled indicates an unregistered authenticator. When the user first logs into the administrator console or user console, a page with instructions for registering the authenticator will open. After registration, the value Enrolled is displayed.

Add SSH key

SSH keys allow connecting to SSH Proxy without a password. A maximum of 10 SSH keys can be added to one user. Keys must be unique within a single user, but can be repeated across different users.

Supported key encryption algorithms:

• rsa-sha2-256
• rsa-sha2-512
• ecdsa-sha2-nistp256
• ecdsa-sha2-nistp384
• ecdsa-sha2-nistp521
• ssh-ed25519

Enabling or disabling the use of keys can be done in the Configuration section.

Warning

To add a key to a user, the administrator must have the User.ManageSshAuthorizedKeys privilege.

To add an SSH key:

• paste the copied string containing the encryption algorithm and key
• attach an X.509 certificate file

Key in text format

1. Open the user's profile.
2. Go to the Authenticators tab.
3. Click Add.
4. Paste the key in OpenSSH format into the Public key field. The key string must contain the encryption algorithm and the key. Optionally, the string may contain a comment, such as a username and a host. Example: ssh-ed25519 AAAAC3... user@host
5. Optionally enter a Description.
6. Click Add.

X.509 Certificate

1. Open the user's profile.

2. Go to the Authenticators tab.

3. Click Add.

4. Click Upload certificate.

5. Check the validity of the certificate dates. To do this, run one of the commands, depending on the OS used:

   Command for Windows

   certutil -verify -urlfetch "yourfilename.crt"
   Command for Linux

   openssl x509 -in "yourfilename.crt" -text -noout

   Make sure that the period in which the key connection is planned falls within the date interval between NotBefore and NotAfter.

6. Upload the file in the X.509 Certificate field.

   caution

   Loading the certificate that contains the certificate chain is not supported.

   Please note that there is no automatic validation of the certificate dates. If the certificate has expired or is not yet valid, the key will be loaded and the session with such a key will open.

7. Optionally edit the Description.

8. Click Add.

Warning

The key cannot be recovered after deletion.

To delete an SSH key:

1. Open the user's profile.
2. Go to the Authenticators tab.
3. Select one or more keys.
4. Click Remove.

When an SSH key is deleted, a session opened using this key is not terminated.

Note

If the same key is added to multiple users, deleting the key for one user will not result in the deletion of the same key for other users.

Two-factor authentication

1. Open the user's profile and go to the Authenticators tab.
2. Click    next to the Require 2FA parameter and select one of the options:
   • Default — by default, the user is required to enter a second factor for authentication in the system.
   • Enabled — the user is required to enter a second factor for authentication in the system.
   • Disabled — the user is not required to enter a second factor for authentication in the system.
3. Click Change.

To reset the authenticator, click    next to the desired authenticator.

X.509 certificate

info

To add a Subject value for a user, the administrator must have the Manage X.509 certificate Subject for users claim.

Specify the Subject value for all users with X.509 certificate authentication enabled. If Subject is not set or entered incorrectly, the user will not be able to log into the console.

To add a certificate Subject:

1. In the admin console, go to the Users section.

2. Open the user profile and go to the Authenticators tab.

3. Next to the Subject field, click    and select one of the options:

   • Paste manually — enter the certificate Subject value.

     Example

     Single line, comma-separated

     CN=John Smith,OU=Development Department,O=Company

     Multiline

     CN=John Smith
     OU=Development Department
     O=Company

   • Upload certificate — select and upload a certificate in .cer, .crt, .pem, or .der format.
     If the certificate is correct, the recognized Subject value will be displayed.

4. Click Save.

OIDC Identity Provider

Make sure that for users who need access to PAM via OIDC:

• OIDC authentication is allowed
• an email address (email) or identifier (sub) is set

OIDC authentication

To allow or deny a user to sign in via OIDC:

1. In the administrator console, go to the Users section and open the user profile.
2. Go to the Authenticators tab and, next to the OIDC authentication field, click .
3. In the dialog that opens, select an option:
   • Allow — the user can sign in via an external Identity Provider (default).
   • Deny — the user cannot sign in via OIDC regardless of the configuration, the defined identifier (sub), and the email address (email).
4. Click Save.

Subject Identifier (sub)

caution

In strict mode, the identifier (sub) in Axidian Privilege must match the sub value in the Identity Provider. If the identifier (sub) is not set or is outdated in PAM, sign-in via OIDC is unavailable.

To set the identifier (sub):

1. In the administrator console, go to the Users section and open the user profile.
2. Go to the Authenticators tab and, next to the Subject Identifier (sub) field, click .
3. In the dialog that opens, specify the identifier and click Save.

To delete the identifier (sub), next to the Subject Identifier (sub) field, click . If matching by email address is enabled in the configuration, a new identifier (sub) value is saved after the user signs in to the PAM console.

Email address (email)

To add or update the email address (email):

1. In the administrator console, go to the Users section and open the user profile.

2. Next to the Email field, click and specify the email address.

   info

   If the user is from a directory service, change the email address in the directory — the data in Axidian Privilege is updated automatically.

3. Click Save.

Create permission

Permissions allow users to connect to resources.

To create a permission:

1. Open the user's profile and click Create permission.

2. (Optional) Select an organizational unit and click Select.

3. Define the permission composition. If necessary, modify the preset parameters.

   More about permission scope

   1. Select who gets access:

      • Users — the permission is granted to one or several selected users.
      • User group — the permission is granted to one selected user group.

   2. Select what to get access to:

      • Resources — the permission is granted to one or several selected resources.

      • Resource groups — the permission is granted to one selected resource group.

      • Ad hoc connections — the permission is granted to Ad hoc resources with the selected connection type, including resources not registered in PAM. One shared account is used for all connection types.

        License required

        A special license is required to work with Ad hoc resources.

        A special license is required to create a permission for PostgreSQL or MSSQL. Before creating the permission, add an account from the DBMS to PAM. You need to specify it in the permission.

   3. Click Next.

   4. Select the account under which the user will open a session on the resource:

      • Select account in PAM — the permission is granted to an account added to Axidian Privilege.
      • Use user account — the permission is granted to an arbitrary account.
        The user needs to enter the login and password of the account on the resource. In RDP and SSH sessions, it is possible to log in using the current Axidian Privilege user credentials.

4. (Optional) Configure access to credentials.

   More about access settings

   You can grant access to credentials only at the permission creation step.

   The following settings are available:

   • Credentials — the option defines actions with credentials:
     • Allow view account credentials — users can view passwords of the accounts from this permission.
     • Allow change account credentials — users can change passwords of the accounts from this permission.
   • Allow running pamsu in SSH sessions — the setting defines access to PamSU when connecting via SSH Proxy:
     • Managed by policies — access to PamSU is determined by the policy of the resource for which the permission is granted.
     • Allowed — the user can use PamSU regardless of policy settings.
     • Denied — the user is not allowed to use PamSU regardless of policy settings.

5. (Optional) Fill in the Description field.

6. (Optional) Configure time restrictions.

   More about time restrictions

   You can set a schedule according to which users are allowed to open sessions or change credentials. For example, you can grant permission to work only on weekdays from 8:00 to 17:00.

   The following settings are available:

   • Validity period — the time period during which the permission is valid. For example, you can grant permission for one day or month.
     

     • Begin — set the date and time when the permission becomes active.
       If only Begin is set, the permission will become active on the selected date, and its validity period will be unlimited.

     • End — set the date and time when the permission becomes inactive.
       If only End is set, the permission will become active at the moment of creation, but will be suspended on the specified date.

       info

       If the Begin and End parameters are not set, the permission will be valid indefinitely.

   • Access schedule — restrictions by days of the week taking into account the specified schedule.

     • Allow access only on selected days — select the days of the week when the permission will be active.

     • Allow access only during selected hours — select the time when the permission will be active.

       info

       Access by days of week is granted according to the management server time zone.

   After the validity period expires, the permission will transition to the Restricted/Inactive state, and the user session will be terminated.

7. In the Connection source setting, select the network address from which sessions to the resource are allowed to be opened. If no network locations are added to PAM, the value is set to No restrictions — the permission can be used from any device on the network.

8. Check the data and click Create permission.

Add and remove from group

To add a user to a group:

1. Open the user's profile and go to the User Groups tab.
2. Click Add user group.
3. Select one or more groups and click OK.

To remove a user from a group:

1. Open the user's profile and go to the User Groups tab.
2. Select one or more groups.
3. Click Remove.
4. In the pop-up window, click Remove.

To add multiple users to a group, in the Users section select the required users and click Add to group. Select one or more groups and click OK.

Set, reset, or request password

Warning

Available only for internal users.

1. Open the internal user's profile.
2. Click Reset password.
3. Select one of the checkboxes:
   • Generate — password is created automatically.
   • Set password manually — password is set in manual mode.
   • Request password change — password is requested by PAM upon system login.
4. Provide the password to the user. After closing the form, it will be impossible to retrieve the password.
5. Set the checkbox Require password change on first login.
6. Set the checkbox Terminate all active sessions and log out.
7. Click Save.

To reset the password for multiple users, in the Users section select the required users and click Request password change. You can terminate all active sessions of the selected users.

Block and unblock

Block a user if you need to restrict access to PAM. When blocked, access to the system is completely terminated: authentication in user and administrator consoles is unavailable, and all active sessions are terminated. A user can be unblocked at any time.

To block a user:

1. Go to the Users section.
2. Open the user's profile.
3. Click Block.
4. In the pop-up window, click Block.

To block multiple users, in the Users section select the required users and click Block.

To unblock a user:

1. Go to the Users section.
2. Open the blocked user's profile.
3. Click Unblock.
4. In the pop-up window, click Unblock.

To unlock multiple users, in the Users section, select the locked users and click Unlock.

Delete a user

Warning

This operation is only applicable to internal users.

A deleted user cannot be restored. It is not possible to delete yourself or the first role administrator.

To delete a user:

1. Open the internal user's profile.
2. Click Remove.
3. Read the information in the pop-up window and click Remove.

To remove multiple PAM users, in the Users section, select the required users and click Remove.

Upon user deletion:

• The user will lose access to PAM and will no longer be able to authenticate.
• All active sessions will be terminated.
• All granted permissions will be revoked.
• The user will be removed from all user groups.
• The user will be removed from the scope of all policies.

Deleted users no longer appear in the Users section, but they can be viewed using extended search.