UseCase4_UserAccessPolicies - sandersdHES/PAMEmergingTech GitHub Wiki

This use case demonstrates how to:

• Create and configure users in PAM360
• Share only the necessary resources securely
• Define role-based privileges
• Enforce Access Control Policies to protect sensitive credentials

In a secure environment, it's essential to give users only the access they need—nothing more. PAM360 helps organizations achieve this with fine-grained user roles, resource sharing, and approval workflows for accessing privileged data.

We will walk through the process of:

1. Creating a basic user
2. Assigning roles and permissions
3. Sharing resources
4. Enforcing approval-based password access via Access Control Policies

1. Navigate to Admin > Users > Add User

2. Fill in the required fields:

   • First Name, Last Name, and Username
   • Email Address (used for notifications)

3. Select a Role — for this example, use Password User

   This role allows:

   • Viewing shared passwords

   • No management or administrative rights

     

   You can also define custom roles if default ones don’t fit your use case. Learn more

   1. Scope: Select Passwords Owned and Shared

      Choosing All Passwords makes the user a Super Administrator

   2. Under Password Setup, select Generate Password

      • This sends login credentials to the user's email

   3. Leave remaining fields as default and click Add User

The new user receives an email with:

• Role description
• Login credentials

By default, the user has no access to resources.

1. Go to Resources
2. Select the target machines (e.g., Windows and Linux)
3. Choose Share > Share Resource
4. Grant View Passwords permission only

1. Log in as the new user
2. The system prompts a password change for security

After login, the user will:

• Be directed to the Resources tab
• See only the machines that were shared

When the user opens a resource:

• Only “View” and “Verify Password” actions are available
• Options like “Change Password” are disabled (greyed out)

To go further and restrict access based on time, approval, or session, enable Access Control Policies.

1. Log in as Administrator

2. Go to the resource and click Resource Actions > Configure Access Control

3. Define Approvers (e.g., Admin account)

   • They will review and approve access requests

     

4. Define Exempt Users (e.g., Admins with auto-access)

   

5. Configure advanced options as shown in the printscreen

   

6. (Optional) Skip manual approval for specific time windows

   

Click Save & Activate

1. Log back in as the Password User
2. Navigate to a shared resource
3. Click Request to request password access

• Now go back and connect with the password user we’ve created previously. If you navigate to the resources and then click on it, notice the password is not visible and replace by a “Request” button

• Fill in a reason and select “Now” for access time

• Admin logs in and sees the request on the dashboard

• Go to Admin > Access Review > Password Access Requests

You will have the list of request password with the field “Process request”

• Click Process Request > Approve and add a reason

• The user will be notified by mail that the password is now accessible, along with approval details

• Go back to previously created user and click on “Check out”. It will prompt you a message telling you that you have 30 minutes and then the password will be revoked back. Click on “Check out” again.

You can now access the machine and see the password.

• Once this is done, click on check-in. If you try to login again, it will fail since you need a new approval to connect to the machine after checking in !

If the admin rejects the request, the user receives a denial email. The password remains inaccessible, but the user can still submit a new request later.

This use case demonstrates how PAM360 allows secure, policy-driven user access by:

• Creating role-limited users
• Sharing only required resources
• Applying approval-based access policies
• Auditing password check-outs and enforcing check-ins

With PAM360, organizations ensure that users access only what they are authorized to, and admins maintain complete control and visibility over privileged operations.