PAM & Credential Vault operations

Prerequisites and permission model

PAM uses a two-layer access model: RBAC permissions control who can manage vaults, while vault access grants control who can see and use individual credentials.

• Role with pam_vaults.view for listing vaults and identities
• Role with pam_vaults.manage for creating/updating/deleting vaults and credentials, and rotating passwords
• Explicit vault access grant at "View Credentials" level to reveal credential values
• Explicit vault access grant at "Checkout" level to checkout credentials
• Account owners bypass all vault access checks
• Organizations must have an organization secret configured for encryption

Creating vaults

Vaults (called "Identity Groups" in the API) are organization-scoped containers for credentials.

1. Navigate to Identities page from the sidebar (under Policy section)
2. Click Create Vault
3. Enter a vault name and optional description
4. Select the target organization
5. Click Save

Adding credentials

1. On the Identities page, select the target vault from the vault list
2. Click Add Identity
3. Enter: name, username, credential (password or key), and credential type
4. Set the rotation interval in days (how often the password should rotate)
5. Toggle Rotate after use if the password should auto-rotate after every checkin
6. Optionally select hosts this credential applies to
7. Click Create

Credential fields

Granting vault access

1. Navigate to the Vault Access tab on the Identities page
2. Search for a user or group
3. Select the access level
4. Optionally set an expiration date
5. Click Grant Access

Access levels

Access grants can be made to individual IDP users or IDP groups. Group grants provide inherited access to all group members.

Checking out credentials

1. On the Identities page, find the credential
2. Click Checkout
3. Enter a reason (required, 1-500 characters)
4. Set the duration (5-1440 minutes / 24 hours max)
5. Optionally select a target host
6. Click Confirm
7. The decrypted credential is displayed. Copy it for use.
8. When done, click Checkin or let the session expire automatically

Concurrent checkout rules

• If concurrent checkout is disabled: only one user can have the credential checked out at a time.
• If concurrent checkout is enabled: multiple users can checkout, up to the configured maximum concurrent sessions.

Revealing credentials (view only)

Revealing a credential lets you view the decrypted value without formally checking it out. This is for situations where you need to see the password but are not actively using it on a system.

1. Click the Reveal button next to a credential
2. The decrypted value displays for 30 seconds, then auto-clears
3. This action is audit logged

Requires pam_vaults.view plus a vault access grant at "View Credentials" level or higher.

Password rotation

Manual rotation

1. Select a credential (it must not be currently checked out)
2. Click Rotate Password
3. The system generates a new random password
4. The old password is hashed (SHA-256) and stored in password history (max 10 entries)
5. The new password is encrypted with AES-256-GCM
6. Password reset jobs are dispatched to all associated hosts
7. Monitor rotation status: pending → confirmed (or failed)

Automatic rotation

Credentials with a rotation interval configured have a next rotation date calculated automatically. A background scheduler checks every 30 minutes and rotates any credentials whose rotation date has passed. After auto-rotation, the next rotation date advances by the configured interval.

Rotate after use

If "Rotate After Use" is enabled on a credential, the system automatically triggers rotation when the credential is checked in. This ensures the password changes after every use, providing maximum security for highly sensitive accounts.

One-click PAM enrollment

Quickly enroll existing host accounts into PAM directly from the host detail page.

1. On a host detail page, click PAM Enroll
2. Enter the username and select the target vault
3. The system generates a random password
4. A password reset job is dispatched to the host
5. An identity record is created and linked to the host

Requires hosts.manage_users permission and the host must be online.

Support access workflow

Support access provides a controlled mechanism for granting temporary elevated access, typically for vendor or support staff.

1. Navigate to Support Access
2. Click the toggle to enable support access
3. Enter a reason (required)
4. Set an optional expiration (1-365 days)
5. Click Enable

Emergency disable

Use Emergency Disable to immediately revoke all support access across the account. This is a one-click action that takes effect instantly.

Audit trail

All support access toggles, updates, and emergency disables are logged in the support access audit trail, accessible via Support Access > Audit Log.

Credential lifecycle flow

Break-glass emergency access

When normal approval workflows are too slow for a critical incident, break-glass provides emergency credential checkout that bypasses the standard approval process. Every break-glass checkout creates a comprehensive audit trail for SOX 404 compliance.

1. Navigate to the credential you need and click Break-Glass Checkout.
2. Enter a justification reason explaining why emergency access is needed.
3. The credential is immediately checked out without approval. A critical-severity notification is sent to all account administrators.
4. The session has a configurable maximum duration (set per organization). When the session expires, the credential is automatically checked in.
5. After checkin (manual or automatic), the credential password is auto-rotated to ensure the emergency credential is no longer valid.

Audit trail

Break-glass sessions are recorded with additional metadata:

• Break-glass flag on the privileged session
• Justification reason text
• Automatic expiry timestamp
• Full audit log entry with user, IP address, and timestamp
• Critical notification to all account admins for immediate visibility

Permissions reference

Troubleshooting