--- version: "6.0" variant: "On-Premises" language: "en" --- # Privileged Access Management * ## [Release Notes](https://docs.sectona.com/pam-technical-documentation/6.0/release-notes.md) * [Version 6.0.0](https://docs.sectona.com/pam-technical-documentation/6.0/version-6-0-0.md) * ### [Installation \& Setup](https://docs.sectona.com/pam-technical-documentation/6.0/installation-setup.md) * [Planning to Deploy](https://docs.sectona.com/pam-technical-documentation/6.0/planning-to-deploy.md) * [Installing Sectona Components](https://docs.sectona.com/pam-technical-documentation/6.0/installing-sectona-components.md) * [Building a High Availability Setup](https://docs.sectona.com/pam-technical-documentation/6.0/building-a-high-availability-setup.md) * [Configuring Disaster Recovery Setup](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-disaster-recovery-setup.md) * [Migrating from evaluation to production](https://docs.sectona.com/pam-technical-documentation/6.0/migrating-from-evaluation-to-production.md) * [2 more pages](https://docs.sectona.com/pam-technical-documentation/6.0/installation-setup.md) * ### [Configure \& Implement](https://docs.sectona.com/pam-technical-documentation/6.0/configure-implement.md) * [General Configurations](https://docs.sectona.com/pam-technical-documentation/6.0/general-configurations.md) * [Configuring user authentication](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-user-authentication.md) * [Configuring the setup for Password Rotation in Windows and Unix Privilege Account](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-the-setup-for-password-rotation-in-win.md) * [Configure Azure Entra ID Account Password Reset](https://docs.sectona.com/pam-technical-documentation/6.0/configure-azure-entra-id-account-password-reset.md) * [Securing \& Monitoring Sessions](https://docs.sectona.com/pam-technical-documentation/6.0/securing-monitoring-sessions.md) * [7 more pages](https://docs.sectona.com/pam-technical-documentation/6.0/configure-implement.md) * ### [Administer](https://docs.sectona.com/pam-technical-documentation/6.0/administer.md) * [Managing assets \& access types](https://docs.sectona.com/pam-technical-documentation/6.0/managing-assets-access-types.md) * [Configuring a Kubernetes Cluster](https://docs.sectona.com/pam-technical-documentation/6.0/5-configuring-a-kubernetes-cluster.md) * [Managing accounts \& keys](https://docs.sectona.com/pam-technical-documentation/6.0/managing-accounts-keys.md) * [Managing user \& authentication](https://docs.sectona.com/pam-technical-documentation/6.0/managing-user-authentication.md) * [Setting up password management](https://docs.sectona.com/pam-technical-documentation/6.0/setting-up-password-management.md) * [14 more pages](https://docs.sectona.com/pam-technical-documentation/6.0/administer.md) * ### [Develop](https://docs.sectona.com/pam-technical-documentation/6.0/develop.md) * [Vault API Registration](https://docs.sectona.com/pam-technical-documentation/6.0/vault-api-registration.md) * [HTTP POST Headers](https://docs.sectona.com/pam-technical-documentation/6.0/http-post-headers.md) * [Management APIs](https://docs.sectona.com/pam-technical-documentation/6.0/management-apis.md) * [Password Vault APIs](https://docs.sectona.com/pam-technical-documentation/6.0/password-vault-apis.md) * [Response Error Codes](https://docs.sectona.com/pam-technical-documentation/6.0/response-error-codes.md) * ### [Use](https://docs.sectona.com/pam-technical-documentation/6.0/use.md) * [Launching the product](https://docs.sectona.com/pam-technical-documentation/6.0/launching-the-product.md) * [Accessing a Target Asset](https://docs.sectona.com/pam-technical-documentation/6.0/accessing-a-target-asset.md) * [Using workflow](https://docs.sectona.com/pam-technical-documentation/6.0/using-workflow.md) * [Executing tasks](https://docs.sectona.com/pam-technical-documentation/6.0/executing-tasks.md) * [Accessing secrets during break glass](https://docs.sectona.com/pam-technical-documentation/6.0/accessing-secrets-during-break-glass.md) --- version: "6.0" variant: "On-Premises" language: "en" --- # Configuring a Kubernetes Cluster The end user can access a cluster through the PAM Jump server. Depending on the RBAC policy defined on the cluster, the user can then access the resources with respective namespaces. Once taking access from SSH Direct proxy server and entering the credentials; the user can then select the configured K8 cluster by entering the name in the provided format. You can configure a Kubernetes cluster as follows: ## Adding a Kubernetes Cluster Asset in PAM: 1. Manage→ Asset Management → Add New Assets 2. Choose Asset category**:** Application, Asset type**:** Kubernetes, Asset version**:** (the preferred version). 3. Fill in the details for Host Name, Primary IP, Secondary IP, Description, Criticality Level, Owner, and Tags. 4. Select the appropriate policies. 5. Enter the configuration values for the four Config Value Fields. Here the following details would be required: 1. Config Value 1: **certificate-authority-data** 2. Config Value 2:**Cluster-Name** 3. Config Value 3:**Master Server URL** 6. Tick the Active checkbox. 7. Click on Save. The system supports a certificate or a token based authentication type for accessing the K8 cluster environment. ## Configuring a Kubernetes Cluster Linked Account in PAM: After creating a Kubernetes Cluster asset, you can now link accounts and specify access with the following steps: 1. Login as PAM admin user. 2. Navigate to the **Manage** → Select **Asset Management**to open assets inventory page. 3. Click on the **Action** arrow of an Kubernetes Cluster asset on which you desire to add the account and select the **Manage Linked Account**option. 4. You will be redirected on the accounts page of the selected asset host-name. 5. Click on **+ Add New Account** button and fill in the credentials. 6. Click on the **Save** button and select the **Save** option → The account is now on-boarded in the system. There are two new additional authentication types called Certificate and Secrets that have been added for accounts linked to a Kubernetes Cluster asset. * The certificate-based authentication would include fields titled **Certificate Data** and **Key Data** which can be found under the **Certificate** authentication type. * A token-based authentication would require **token** can be user specified in**Secret 1** field of the **Secret** authentication type. For defining context and namespace, either of which having the option of being one or more that one. The following format can be entered in the Config Value 2 field of the account configuration form. * The**Format** to define context and namespace can be seen below: * Consider a single context name and a single namespace then such a configuration would be defined as contextname1{namespace1}. *Example* : If user_1 has the access of "dev-context" and namespace "dev" then the format will be **dev-context{dev}** * Consider a single context name and two namespaces then such a configuration would be defined as contextname2{namespace2, namespace3}. *Example* : If user_2 has the access of "dev-context" (only 1 namespace "dev"), and "preprod" context (multiple namespaces as "preprodN1, preprodN2") then the format will be **dev-context{dev}, preprod{preprodN1\~ preprodN2}** * If user_3 has the full access i.e., all context and all namespaces then the format will be **username@clusername{}** * **Note**: Multiple contexts can be separated by comma "," and multiple namespaces can be separated using tilde "\~" operator. In order to enable access to a cluster, a new shell script file is generated and saved in the root directory of the management account. With every new session created the system would also generate a new shell script file in root directory of management account specified in Jump shell proxy configuration. A new dynamic account (with Enforced Password Change) is created and the shell script file from users root directory is deleted. --- version: "6.0" variant: "On-Premises" language: "en" --- # Accessing a Target Asset With Sectona PAM, it is easy to access an asset. You can access a target asset using any of the following methods: * [Taking session via Sectona Web Console](https://docs.sectona.com/pam-technical-documentation/6.0/accessing-a-target-asset.md#tsswc) * [Taking session via Sectona Client](https://docs.sectona.com/pam-technical-documentation/6.0/accessing-a-target-asset.md#tssc) ## Taking session via Sectona Web Console After logging in to the Sectona web console with your username and password, you must choose the **instance** you wish to access target assets. For example, an XYZ parent organization may have subsidiaries such as ABC \& DEF. You may either belong to XYZ, ABC, or DEF or be authorized to work on only target assets from XYZ, ABC, DEF, or all three. The **Instance** option will help you select and work only on target assets of any particular instance as required. You may be assigned a default instance based on the default configuration as defined by your organization's Sectona PAM administrator. However, if you wish to access target assets from another instance, you must select the respective instance from the drop-down list. ![image-20250627-104540.png](https://docs.sectona.com/__attachments/a_daa8c4bc3f19bca7b755de63077e4c3de06ccedc9b12a3712fa0ad2edc6b82f1/image-20250627-104540.png?cb=fb00276a0e4e84540cdd886c9e56d1ba) You will see a list of Assets and the corresponding Accounts. These are the Accounts that you have been granted access to. You may access your target Assets from this list. * [Assets](https://docs.sectona.com/pam-technical-documentation/6.0/working-with-assets.md) are target systems such as Windows Server, Unix Server, Databases, and Network Devices. * [Accounts](https://docs.sectona.com/pam-technical-documentation/6.0/managing-accounts-keys.md) are privileged IDs corresponding to the target assets. ## Taking session via Sectona Client After you have logged in to the Sectona Security Platform or PAM through the Sectona client with your username and password, you will have to choose the instance you wish to access target assets. For example, an XYZ parent organization may have subsidiaries such as ABC \& DEF. You may either belong to XYZ, ABC, or DEF, or you may be authorized to work on only target assets from either XYZ, ABC, or DEF or all three. The Instance option will help you select and work only on any particular instance's target assets as required. You may be assigned a default instance based on the default configuration as defined by your organization's Sectona PAM administrator. However, if you wish to access target assets from another instance, you must select the respective instance from the drop-down list. In addition, you will be able to view the list of all the assets you can access. Unlike web console access, there is no account view in the Sectona client. The purpose of the Sectona client is to access target assets directly and enable **tabbed browsing**. Over the browser, you will not require a Sectona Client, but other types of access will require a Sectona Client application to access Sectona PAM. --- version: "6.0" variant: "On-Premises" language: "en" --- # Accessing Satellite Vault To login to Satellite Vault, the user will require a Security Key generated from the User Profile. To login successfully, it is essential for the administrator to sync the users' profiles with the accounts. Users must download the Security Key only after the sync is complete . To login, the user simply needs to upload the key on Satellite Vault. Any changes made in the Account Groups after the sync operation will not be reflected in Satellite Vault. In this case, the user will need to generate a new Security key to login after the recent sync is complete. It is important to note that downloading a security key and generating a new key is not the same. A security key is downloaded when logging in for the first time, whereas a new key is generated when the user seeks to update their Satellite Vault profile. Follow the below-recommended steps to login to the Satellite Vault: * Verify if the Satellite Vault service is running. You can start the service by selecting Platform Configuration from the product navigator **Platform Configuration** → **System Status** → **App Services** → **SatelliteVaultService** * Go to **User Profile** → **Settings** → **Download**. * If you want to generate a new key, click on Generate New and an XML file will be downloaded. * Upload this file to the **Satellite Vault** by entering the host URL along with the port number (https://12.34.5.67:4432) and click on upload and sign in. ## Accessing the Account password Satellite Vault is a dedicated server that provides access during an emergency situation. You can checkout passwords for accounts that you have been granted access to. These will be the accounts that are visible to you. To checkout the account password in the Satellite Vault. Follow the below-recommended steps: * Go to your configured **Satellite Vault** by entering the URL with its assigned **port** number→ Upload your **Profile Key**. * The access key file can be found located in **Settings menu option** by clicking on your profile button. By clicking on **Download**you will see an XML file Access Key file downloaded.. → Sign in. * Click on the **Lock button** of the respective account to checkout its password. Once the administrator syncs your new Security Key, you will not be able to sign in with the old key. Make a note that the password checkout window will be visible only for 30 seconds. ## Monitoring password view log To monitor the log of password checkout, follow the below-recommended steps: * Go to **Satellite Vault** → Upload your **Profile key** . The **access key** file can be found located in **Settings** menu option by clicking on your profile button. By clicking on **Download**you will see an XML file Access Key file downloaded. → Sign in. * Each of the Account names will be displayed with the checkout button. * Click on the **Lock**button to checkout the password. * Verify if the Satellite Vault service is running. You can start the service by selecting **Platform Configuration** from the product navigator → **System Status** → **App Services** → **SatelliteVaultService** Here you will be able to check which user has checked out the password for a particular account along with the timestamp. ## Allowing access to all users In case of any emergency, if the administrator wants to give access to Satellite Vault to all the users, for a given time limit then the administrator should follow the below-recommended steps: * Verify if the Satellite Vault service is running. You can start the service by selecting Platform Configuration from the product navigator **Platform Configuration** → **System Status** → **App Services** → **SatelliteVaultService** * Go to **Satellite Vault** → Upload your **Profile key** → **Sign in**. * Go to **System** → click on **Configuration**. * Tick the **Yes** checkbox for **Allow all users to login** field. * Select the date and time limit under **Allow Between** field. * Click on Save. After this configuration is saved, users will be able to access the Satellite Vault. --- version: "6.0" variant: "On-Premises" language: "en" --- # Accessing secrets during break glass During a situation when you are unable to access your Sectona vault instance and you wish to access the assets directly by checking out the password, you can do this by accessing the configured Sectona Satellite Vault instance. When Sectona PAM instance(s) is down (Offline), no User(s) will be able to access the Sectona PAM instance(s). In the event of break glass scenario, User can access 'Satellite Vault' to check out privilege account passwords. User(s) need to bring in their respective Profile key into the Satellite Vault system and browse URL to authenticate using the key to login. And then Check-out password for desired privilege accounts from Satellite Vault. ## Generating Profile key To access Satellite vault, you must generate a 'Profile Key' which acts like a single authentication key to access a vault. This key should be available with you/downloaded by you beforehand. Treat this key like direct access to Satellite vault. You can generate a key and keep it in a safe location which is accessible only to you. The procedure for generating Profile key is provided in the steps below: * In your Sectona instance, click on the User icon on the top right. * Navigate to **Settings.** * Go to the Profile Section and click on **Generate New** to generate a new Profile key. Download it or click on **Download**to download the existing Profile key. When you click on **Generate New** , you need to Sync the Sectona Password vault with the Satellite vault. Use **Download**to download the current Profile key after Syncing with the Satellite vault. ## Accessing Satellite Vault Ensure you are aware of your break glass vault IP Address or DNS name to access the vault. To retrieve secrets which are allowed to be accessed, follow the procedure below: * Browse to the Satellite Vault instance. * Click on **Upload**, select the security key. * Click on **Sign in** to access the Satellite vault * You will be directed to the Satellite vault page. * Under Home , you will find all the credentials. Click on the View Password lock button to view the password of the specified account. You can also copy the password to the clipboard by clicking on the Copy icon in the Checkout Details page. --- version: "6.0" variant: "On-Premises" language: "en" --- # Account group management This section details on how to create, delete and update account group settings. This chapter contains the following chapters: * [Create a static account group](https://docs.sectona.com/pam-technical-documentation/6.0/account-group-management.md#csag) * [Create an attribute-based account group](https://docs.sectona.com/pam-technical-documentation/6.0/account-group-management.md#cabag) * [Deleting an account group](https://docs.sectona.com/pam-technical-documentation/6.0/account-group-management.md#dag) ## Creating a static account group * Login to the system and select **PAM** from the product navigator. * Navigate to **Manage** → Click on **Account Groups** from the **Asset Management** section. * Click **+ Add Account Group**. * **Name**: Enter the desired name. * **Description**: Enter a desired account group description. * **Required Ticket Number** (optional): Only enable this option if you want to validate the ticket from the ticketing tools. Refer to [Integrating Ticketing Systems](https://docs.sectona.com/pam-technical-documentation/6.0/integrating-ticketing-systems.md) for all the supported tools. * **Allow Access Via APIs** : Enable this option to access the accounts in an account group via management APIs. Refer to [API - Get Accounts by Account Groups](https://docs.sectona.com/pam-technical-documentation/6.0/api-get-accounts-by-account-groups.md) for more details. * **Enforce Comment** : Enable this option only if you want to ask for comment for access to every account associated with this account group. If enabled, select **Comment Min Length**. The default is 1 that enforces entering a minimum of one character/letter, and at the time of access, you can increase it as per your requirement. * Select the**Static Group**tab * **Note** : If the "Required Ticket No" option is enabled, the requesting user needs to specify the ticket number for the sessions. The ticket number will be validated using the Service Desk or other related configuration. If the ticket validation is unsuccessful, the user will get an error message on the screen. The user can create a workflow request for access or a password if the ticket is validated successfully. * Click **Save** to save the configuration. The system allows adding accounts manually only to static account groups. ## Creating an attribute-based account group * Login to the system and select **PAM** from the product navigator. * Navigate to **Manage** → Click on **Account Groups** from the **Account Management** section. * Click **+ Add Account Group**. * **Account Group** **Name**: Enter the desired name. * **Group Description**: Enter a desired account group description. * **Required Ticket Number** (optional): Only enable this option if you want to validate the ticket from the ticketing tools. Refer to [Integrating Ticketing Systems](https://docs.sectona.com/pam-technical-documentation/6.0/integrating-ticketing-systems.md) for all the supported tools. * **Allow Access Via APIs** : Enable this option to allow access to the accounts in an account group via management APIs. Refer to [API - Get Accounts by Account Groups](https://docs.sectona.com/pam-technical-documentation/6.0/api-get-account-groups.md) for more details. * **Enforce Comment** : Enable this option only if you want to ask comment for access to every account associated with this account group. If enabled, select **Comment Min Length**. The default is 1 which enforces to enter a minimum of one character/letter and at the time of access you can increase as per your requirement. * **Method** : **Attribute Based Group**. * Select the desired attribute refer to the **Rule-Based group** section from [Working with account groups](https://docs.sectona.com/pam-technical-documentation/6.0/working-with-account-groups.md). * You can also add multiple attributes by clicking on the + button. * Click **Save** to save the configuration. To enable the working of Attribute-based account groups you need to start the service by referring to[Manage dynamic mapping of accounts](https://docs.sectona.com/pam-technical-documentation/6.0/monitoring-system-health-service-status.md). ## Delete an account group * Login to the system and select **PAM** from the product navigator. * Navigate to **Manage** → Click on **Account Groups** from the **Account Management** section. * Select the edit button of account group you want to operate. * Select delete button. Deleting an account group deletes policies implemented at the account group level. All accounts are still available in the account inventory. ### Related How-to Articles * [Create a static Account Group](https://docs.sectona.com/pam-kb/Create-a-static-Account-Group.68681992.html) * [Creating an attribute-based Account Group](https://docs.sectona.com/pam-kb/Creating-an-attribute-based-Account-Group.68681994.html) * [Deactivate an Account Group](https://docs.sectona.com/pam-kb/Deactivate-an-Account-Group.68681993.html) * [Delete an Account Group](https://docs.sectona.com/pam-kb/Delete-an-Account-Group.68681990.html) * [Managing account groups](https://docs.sectona.com/pam-kb/managing-account-groups) --- version: "6.0" variant: "On-Premises" language: "en" --- # Account group operations This section helps you in managing account group operations and will guide you to: * [Adding an account to a static group](https://docs.sectona.com/pam-technical-documentation/6.0/account-group-operations.md#aasg) * [Viewing currently assigned accounts to the group](https://docs.sectona.com/pam-technical-documentation/6.0/account-group-operations.md#vcaag) * [Viewing currently mapped user groups to the account group](https://docs.sectona.com/pam-technical-documentation/6.0/account-group-operations.md#vcmugag) ## Adding an account to a static group * Login to the system and select **PAM** from the product navigator. * Navigate to the **Manage** → **Asset Management** on the sidebar → Click on **Account Groups.** * Select **Action** button of the account group of which you would like to add an account to. * Click on **Add Accounts** and select an **Account Category** and an **Account Type** list of accounts will be populated. * Select the account which you want to add in the account group. * Click on **Save** to add the accounts in the account group. ## Viewing currently assigned accounts to the group * Login to the system and select **PAM** from the product navigator. * Navigate to **Manage** → Click on **Account Groups** from the **Account Management**section. * From the **Static Group** tab, select **Linked Accounts** button to which you would like to view the list of accounts associated with the group. ## Viewing currently mapped user groups to the account group * Login to the system and select **PAM** from the product navigator. * Navigate to **Manage** → Click on **Account Groups** from the **Account Management** section. * Click on the **Action** button to view the list of accounts associated with the group. ### Related How-to Articles * [Populate a static account group](https://docs.sectona.com/pam-kb/Populate-a-static-account-group.68681991.html) --- version: "6.0" variant: "On-Premises" language: "en" --- # Account Lifecycle Management This section provides information about managing lifecycle and operations of privileged accounts, key concepts and workflow. It is necessary to control their access permissions on information assets to maintain security and adhere to compliance terms. Whenever a privileged access request is made to the IT operations, manually checking all attributes and grant access might consume much time. If the IT admin supplies the access credentials personally to a user, it might be prone to internal security risks. Tools with inconsistent processes can lead to the loss of sensitive data and compromise their privileged assets. IAM \& PAM systems not integrated together may not provide desired security benefits. Sectona's Account Lifecycle Management enables managing and monitoring privileged account's lifecycle within PAM system context. Sectona provides account ownership and helps to set custodian of an account at time of provisioning. This section covers: * [Advantages](https://docs.sectona.com/pam-technical-documentation/6.0/account-lifecycle-management.md#Advantages) * [Getting started](https://docs.sectona.com/pam-technical-documentation/6.0/account-lifecycle-management.md#GS) * [Supported Devices](https://docs.sectona.com/pam-technical-documentation/6.0/account-lifecycle-management.md#SD) * [How it works](https://docs.sectona.com/pam-technical-documentation/6.0/account-lifecycle-management.md#HIW) ## Advantages Using inbuilt Account Lifecycle capabilities within Sectona Security Platform allows ease of use for IT Operations team. * Account Ownership - Use Sectona to assign account ownership upon creation without manual intervention \& support future governance tasks. * Ease in managing logs - All the details of account lifecycle, date of creation, their permissions, roles, assets assigned, grouping, membership every minor detail of the account are stored in PAM's account lifecycle logs. * Secured - Often IT teams communicate credentials personally to a privileged user or using cumbersome processes which might get flagged as an internal security risk. Allowing passwords \& secrets directly to a user using same platform ensures risks of credential theft while communication. * Time-saving - Account Lifecycle Management gives a secure framework, saves an ample amount of time, and helps in focusing the organization's productivity. ## Getting started For executing Account Lifecycle operations, make sure "AccountsLifecycleService" should be enabled in PAM. For System App services, refer [Monitoring System Health \& Service Status](https://docs.sectona.com/pam-technical-documentation/6.0/monitoring-system-health-service-status.md) . * Management account should be configured and verified in Account Defaults with valid username and password. For configuring Account Defaults, refer [Configuring management account](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-management-account.md) . * Make sure that you use common ports to establish connection between PAM and target server. * Communication Protocol used by PAM are as follows: | Asset Type | Communication Protocol | |------------------|--------------------------| | Windows | WMI | | Unix | SSH | | Database Assets | ODBC (Standard Database) | | Active Directory | LDAP | ## Supported Devices Following are the list of per-defined role provided by Sectona | **Category** | **Type** | **Method** | |-------------------------|--------------------------|---------------------| | Operating System | Windows Server | WMI | | Operating System | Unix Based | SSH Command | | Database | Microsoft SQL | Microsoft SQL Query | | Database | Oracle | Oracle Query | | Database | MySQL | MySQL Query | | Active Directory Server | Windows Active Directory | WMI | ## How it works Account Lifecycle Manager (ALM) leverages core platform services of User Management, Asset Management, Vaulting, workflow management \& device communication. Platform administrator with account lifecycle privilege role can access ALM to provision accounts \& manage provisioned accounts. Assets managed via platforms are available. When a create user event is triggered a typical flow is * ALM verifies the status of the Asset in the platform * Validates management account availability \& configuration for processing the trigger * Collect role information \& password policy information applied to asset at platform level * Execute the job and collect \& store logs --- version: "6.0" variant: "On-Premises" language: "en" --- # Account Provisioning Account provisioning is a two step process namely role configuration \& provisioning. ALM already has various default roles available in the system with flexibility to customize roles. Users with account lifecycle privileged in PAM Roles would be able to access this feature. This section covers how you can add new roles and provision new accounts. This section covers: * [Defining customer roles in ALM](https://docs.sectona.com/pam-technical-documentation/6.0/account-provisioning.md#ALM) * [Provisioning a new account](https://docs.sectona.com/pam-technical-documentation/6.0/account-provisioning.md#nAcc) ## Defining customer roles in ALM For enabling user provisioning to a new non-default role, you need to add configure role settings. Steps to add custom roles are as follows: * PAM administrator authenticates Sectona. * Go to Manage → Account Lifecycle. It will show Configure option. Click on Configuration → Choose Asset Category as per the requirement. * Choose Asset Type as per the requirement. * Based on the role you will be creating, define name for role. * Choose Method based on asset you have selected and role you will be creating. * Add Role Command as per the organizations' needs and save the configuration. Once this role is configured, the admin can use this role to assign the provision account when required. Consider creation of provision account on Microsoft SQL server using role command: `CALL master..sp_addsrvrolemember @loginame = N'%Username%', @rolename = N'sysadmin'`*.* Sectona enables user to login to the server and add the account into the specified account group, say `sysadmin`. ## Provisioning a new account Accounts can be provisioned to roles defined in the system. Typical flow of provisioning a user is as follows: * PAM administrator authenticates Sectona. * Go to Manage → Account Lifecycle → Click on +Provision Account → Add account details and choose a role for the account. * Give description about the account you will be provisioning. * Select the user of the provision account under User Identity * Add account prefix and account name details. User can create provision account by adding prefix to account name. * Choose Account password as per requirement. Password can be set as static as well as can be generated based on policy assigned to the asset. * Enabling password change will allow Sectona to change password of the provision account and visa versa. * Enter name of the owner. This is optional. * User can set a date for creating a provision account. You can immediately create a provision account or you can specify the date for the same. * User can set date of expiry for deprovision of a provisioned account. * Tags can be given to provision account while creating provision account. * Provide asset details as needed and save the configuration. * Based on the inputs given by the administrator, PAM will create a provision account for the user within no time. Once accounts are provisioned, account can be accessed by policies configured in the system for Password Checkout or Access * Provisioning uses default password policy applied at asset level. For configuring password policies refer [Configuring password policy](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-password-policy.md) . Ensure management accounts with sufficient rights are configured in Management Accounts for respective assets. --- version: "6.0" variant: "On-Premises" language: "en" --- # Active Directory (AD) The Active Directory Scan allows Sectona to collect information from the catalog of assets in Active Directory. This reduces the administrator's effort to keep the asset list in sync with AD. You can discover Windows computers by searching Active Directory instances. Discovered computers have a resource created for them in the Asset Profiler. This method uses the LDAP discovery technique from specified Organization Units (OUs) of the active directory. The following requirements must be met while discovering windows assets from the active directory: | **Requirement** | **Description** | |---------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Connectivity / Ports (Sectona → Active Directory) | 389 | | Credential | * This discovery method also requires Active Directory Domain credentials. Refer to this guide for [configuring credentials](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-credentials.md) for this activity. * Recommended permission for Active Directory Credential with Read Permissions on Specific OUs. | ## Adding an Active directory scan job Login to system and select PAM from the product navigator. To add a discovery job, go to Manage → Discovery → Asset. Select active director from the drop-down menu by clicking on the**Asset Discovery** button and follow the below-recommended guidelines: | **Attributes** | **Description** | |--------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Job Details** | | | Job title | Enter a unique title for your scan job | | Directory Server | Select the directory from the drop-down menu. If not available, go to Platform Configuration → Under Authentication select → AD \& Directory Store → Add Directory Store. | | Group Name | Provides the list of groups on Active Directory when you click on Browse | | Schedule type | Select a schedule type whether you would like to initiate this job once or a recurring job. If you select a recurring job, you can choose the days on which this job must be executed. For example, you want to schedule a job every second day at 5.00 p.m. from 1st January 2018 to scan your network. Include the following details: Recur every: 2 days Task Start: 01 Jan 2018 Schedule Start Time: 4:30 pm to 5:15 pm | | Task Start | Select the date from when the job is required to start. | | Schedule Time | You can either choose "Any" or schedule a proper time to start the task and when to end the task | | **Action** | | | Onboard assets | To start a scan manually with an option to add assets to specify profiles, click the Onboard asset as 'No.' If you wish to include assets automatically to existing groups and attributes, select option 'Yes' | | Description (optional) | Added text will be included in every asset description field | | Location (optional) | Added location field will be included in every asset location. You can configure the system management location [here](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-location-tagging.md) | | Criticality level (optional) | Added critical[](https://sectona.atlassian.net/wiki/pages/createpage.action?spaceKey=KC&title=Setting%20criticality%20level%20tags)field will be included in every asset. This is important while structuring reports and notifications | | Tags (optional) | You can associate an asset with your desired single or multiple tags like Infosec, Banking Core Server, ATM Switches, etc. Refer to section [Tags](https://docs.sectona.com/pam-technical-documentation/6.0/applying-conditions-with-tags.md)for more information about adding context with tags. | | Checkout policy | The option is selected as default, as one can choose its policy by unchecking the default option and selecting the policy from the drop-down list available. | | Rotation policy | The option is selected as default as one can choose its policy by unchecking the default option and selecting the policy from the drop-down list available | | Reconciliation policy | The option is selected as default as one can choose its policy by unchecking the default option and selecting the policy from the drop-down list available. | | Config value 1 | The configuration value can be assigned here. | | Config value 2 | The configuration value can be assigned here. | | Config value 3 | The configuration value can be assigned here. | | Config value 4 | The configuration value can be assigned here. | | Exclude from Account Discovery | When ticked, the accounts of this asset will be excluded from the Discovery job. | | Owner (optional) | If you have listed owner information of all the assets, please include it here. | The status slider is set to Active by default and click the Save button to add the Network Scan discovery job to the system. Click the Save + Run Now button to immediately start the active directory discovery. --- version: "6.0" variant: "On-Premises" language: "en" --- # Adding assets in the system Users with administrative rights in the Sectona platform can add new Assets. Users can be added to the system via web form, bulk import, sync with active directory groups, or asset discovery sync. This chapter covers the following: * [Add an asset](https://docs.sectona.com/pam-technical-documentation/6.0/adding-assets-in-the-system.md#aa) * [Update asset attributes](https://docs.sectona.com/pam-technical-documentation/6.0/adding-assets-in-the-system.md#uaa) * [Add assets in bulk](https://docs.sectona.com/pam-technical-documentation/6.0/adding-assets-in-the-system.md#aab) * [Update Bulk Asset Attributes](https://docs.sectona.com/pam-technical-documentation/6.0/adding-assets-in-the-system.md#ubaa) * [Update Bulk Asset Security Settings](https://docs.sectona.com/pam-technical-documentation/6.0/adding-assets-in-the-system.md#ubass) * [Add assets from discovery jobs](https://docs.sectona.com/pam-technical-documentation/6.0/adding-assets-in-the-system.md#aadj) * [Add additional security to assets](https://docs.sectona.com/pam-technical-documentation/6.0/adding-assets-in-the-system.md#aasa) * [Add a new asset type](https://docs.sectona.com/pam-technical-documentation/6.0/adding-assets-in-the-system.md#anat) ## Add an asset You can integrate new assets and accounts by logging to the system and select **PAM** from the product navigator. Go to the **Manage** section of the application, and select the **Asset** from the **Asset Management** in the sidebar. Click **+Add Asset**. * Category: Define the asset category example as "Operating System". * Type: Select the asset category from the drop-down list which contains asset types defined by you. * Version: Enter the version or release number of the asset type example. If oracle is the asset type, then 11g is the version. * Host Name: Enter the hostname of the asset. * Primary IP: Enter the IP address (v4/v6) to which the connection should be made. * Secondary IP (optional): Enter an alternate IP address (v4/v6) to access the asset when the primary IP is unreachable or to achieve load balancing. * Port no: Enter the port number of the host. * Location (optional): Added location field will be included in every asset location. You can configure system management location tabs here. * Owner (optional): If you have listed owner information for all assets, please include it here. * Level (optional): Added critical field will be included in every asset. This is important for structuring reports and notifications. * Description: Enter a unique descriptive title for your new asset. * Tags (optional): One can choose multiple tags to be more specific about the asset. * Exclude from Account Discovery: If selected, the accounts of this asset will be excluded from the Discovery job. * Enforce Host Name for Connection: If selected, Administrators can manage assets that utilise **RDS (Remote Desktop Services)** and **FQDN (Fully Qualified Domain Name)** addressing. This would also provision Session and Password Management along with Audit Log maintenance. * Checkout Policy: This option is selected by default. You can uncheck this option and select the required policy from the drop-down list. * Rotation policy: This option is selected by default. You can uncheck this option and select the required policy from the drop-down list. * Reconciliation policy: This option is selected by default. You can uncheck this option and select the required policy from the drop-down list. * Asset JIT policy: This option is selected by default. You can uncheck this option and select the required policy from the drop-down list. * Config value 1: The configuration value can be assigned here. * Config value 2: The configuration value can be assigned here. * Config value 3: The configuration value can be assigned here. * Config value 4: The configuration value can be assigned here. * Status: To have the asset's status active, it is active by default, and one can toggle it to disable it. ## Updating asset attributes If you want to update/change asset details, you can click on the hostname of your asset, and a form will appear. Make the necessary changes. Click on the update button, and your form will be updated. ## Adding assets in bulk Asset lists can be imported in bulk. Login to the system and select PAM from the **product navigator**, go to the **Manage** section of the application and select the **Asset Management** tab. Click **Bulk Assets**. From the drop-down menu, click the **Import** option. Step1: Add generic asset details * Asset category: Select one of the following types * Operating System is a system software that manages the hardware and software resources providing services to the user. * A database is a structured set of data collection kept in an organized way that can easily be fetched. * The router is a networking device that helps to transfer packets over wide networks. * A firewall is a network security that helps to protect our device by monitoring the incoming and outgoing traffic of the system and acting as a barrier between trusted and untrusted networks. * The switch is a networking device that helps to transfer packets over wide networks. * SANstorage is a dedicated high-speed network that interconnects and presents a shared pool of storage devices to multiple servers. These help in block-level storage. * San Switch is a fiber channel switch compatible with FC protocols. * A directory server provides a central repository for storing and managing information. It is a server providing directory services. * Tape Library is a storage system containing multiple tape drives, bays, or slots to hold tapes. * Cloud App is a software program where cloud-based and local components work together, which relies on remote servers for processing logic that is accessed through a web browser with an internet connection. * Security Device or a token is provided to authorized users so they can authenticate themselves to access network resources or services. * Workstation is a high-performance computer system dedicated to an individual or a group of users for professional and business purposes. * Asset Type: Select the asset type. * Asset Version: Select the version of the asset. * Location: This will specify your asset's location list, which will be enlisted in your dropdown list. * Criticality Level: This will define the level of criticality of the asset. * Tags (optional): Add relevant tags to this user. Refer to the section [Tags](https://sectona.atlassian.net/wiki/spaces/PDN/pages/902758967/5.0+Applying+conditions+with+tags) for more information about adding context with tags. * Exclude from Account Discovery: When selected, the accounts of this asset will be excluded from the Discovery job. * Password Checkout Policy: This option is selected by default. You can uncheck this option and select the required policy from the drop-down list. * Password Rotation Policy: This option is selected by default. You can uncheck this option and select the required policy from the drop-down list. * Password Reconciliation Policy: This option is selected by default. You can uncheck this option and select the required policy from the drop-down list. * Asset JIT Policy: This option is selected by default. You can uncheck this option and select the required policy from the drop-down list. * Status: To have the asset's status active, it is checked by default, and one can uncheck it to disable it. * Click Next. Step 2: Copy Asset Data to be onboarded * Download the CSV to add asset details. * Copy the text from the editors to the text box. * Move to the next step. Step 3: Summary \& Finalize Validate the data entered and complete the action or review the details. You can exclude the asset from being discovered by checking on the 'exclude from account discovery 'option.' Administrators can use the bulk method to add up to 1000 assets simultaneously. ## Updating Bulk Asset Attributes The asset list can be updated in bulk. Login to the system and select **PAM** from the product navigator., you can go to **Asset Management** from the sidebar and select the **Bulk Assets → Update**option from the drop-down list. To update/change asset details, follow the below steps: * **Asset Details** * Tick the checkbox for the fields you want to update and provide the updated value for those fields. * Click on the Download Format link. * This will download an Excel sheet on your system. * Click on the Next button. * **Copy Text** * Open the Excel sheet and add details of the assets you want to update. * Copy the asset's data from the Excel sheet and paste it into the text box. * Click on the Next button. * **Summary** * Validate the data in the Summary section and click on the Finish button. Here, all the assets mentioned in the Excel sheet get updated in bulk with the current details. ## Updating Asset Security Settings Update the security settings such as Session Timeout, Clipboard, and File sharing of assets any one particular asset. Go to Asset Management click on the Action icon ![image-20251104-111528.png](https://docs.sectona.com/__attachments/a_350ad495eaa271b11d8decfc0df49028240981db4525a0f6fabadaaf6a07d69e/image-20251104-111528.png?cb=0ca093fda922d383179fb7ce62d6e39b) of any asset. Consider the following options that will be used for SSH, SFTP and SCP type of session:- * Preferred Host Key Algorithm (UNIX) - Select the preferred Host Key Algorithm from the menudisplaying the following options:- * RSA * DSS * Certificate * ED25519 * ECDsaNistP256 * ECDsaNistP384 * ECDsaNistP521 * ECDsaSecp256k1 * Use Legacy Group Exchange (UNIX) * Allow Keyboard Interaction (UNIX) Sectona PuTTY SSH sessions are not compatible with the **Allow Keyboard Interaction** setting. ### Update Asset Security Settings in Bulk Update the security settings such as Session Timeout, Clipboard, and File sharing of assets in bulk. You can go to Asset Management, from the **Bulk Assets**, select the **Update Security Setting** from the drop-down list. To update/change security settings details, follow the below steps: * Uncheck the default value checkbox * Tick the checkbox for the security fields you want to update and provide the updated value for those fields.\\ * Click on the Download Format link. * This will download an Excel sheet on your system. * Click on the Next button. * Open the Excel sheet and add details of the assets you want to update. * Copy the asset's data into the Excel sheet and paste it into the text box. * Click on the Next button. * Summary - Validate the data in the Summary section and click on the Finish button. * The security settings for all the assets mentioned in the Excel sheet will be updated with the current details. ## Adding assets from discovery jobs Login to the system and select PAM from the product navigator to be able to add Assets, Login to the system and select **PAM** from the product navigator, you can now set up new assets to be onboarded by going to the **Manage** → **Discovery**in the sidebar → **Asset Discovery**. Select Job Type. While adding the information, select the **Yes**option under the **Action**heading for the **Onboard Assets** field. You can check whether the assets are on-boarded by selecting the **Discovery View** option in the **Manage** section. You will find a column named **Vaulted** on the screen. If the value in the **Vaulted** column is **Yes,** then the asset is onboarded, and if the value is **No,** then the asset is not on-boarded. You can use onboard the asset by clicking on the **Action** icon and selecting the **Onboard** option. In the **Last Discovered On** column, you will get the date and timestamp when the assets were last discovered. ## Adding additional security to assets Asset Security Settings allow you to configure session-level controls and authentication preferences for individual assets. These settings help enforce security policies such as session timeout, clipboard restrictions, file transfer controls, MFA enforcement, and SSH authentication behavior. Follow these steps to configure security settings for an asset: * Select **PAM** from the product navigator. * Navigate to **Manage → Asset Management**. * Click the relevant asset's **Action** icon to open the **Security Settings** tab, then select the required options below: * **Session Lockout:** Use this option to automatically lock active session after the selected timeout period. By default, the **Global** checkbox is selected; clear it to specify an asset-specific timeout. * **Clipboard:** Use this option to control copy and paste operations during the session. By default, the **Default** checkbox is selected; clear it and select **Disable for All** to block clipboard access. * Set the global session timeout at System → System Defaults → User Session Lockout (Minutes). * Configure default clipboard and file sharing permissions at Policies → User Access Policy → Manage Permissions. * **File Sharing:** Use this option to control file transfer between the local system and the target asset. By default, the **Default** checkbox is selected; clear it and select **Disable for All** to block file transfer. * **Direct Access:** Use this option to control whether users can connect directly to the asset. By default, the **Default** checkbox is selected; clear it and select **Restrict** to block direct access. * **Enforce MFA for New Session:** Use this option to require MFA when users start a new session. By default, the **Default** checkbox is selected; clear it and select **Enforce** to require MFA for every new session. * When enabled, the system prompts for MFA each time a user starts a new session with the asset. * When the user selects the Enforce option, the system requires MFA for any access to the asset. * **Proxy Connection:** Use this option to route connections through the configured session or web proxy. Select the **Disable** checkbox to bypass proxy routing. If enabled, the session connects through the proxy server on port 22; if disabled, it connects directly to asset port. * **AD Account Name Format (UNIX):** Use this option to define the Active Directory account name format for UNIX authentication. By default, the **Default** checkbox is selected; clear it to enter a custom format. * **Allow Unvaulted Account:** Use this option to allow sessions using accounts that are not stored in the vault. By default, the **Default** checkbox is selected; clear it and select **Allow** to enable this option. * **Remove Old Authorized SSH Keys (UNIX):** Use this option to remove previously deployed SSH keys before adding new keys. By default, the **Default** checkbox is selected; clear it and select **Remove** to enable this behavior. * **Preferred Host Key Algorithm (UNIX):** Use this option to specify the host key algorithm used for SSH connections. Select the required algorithm from the dropdown list. * **Use Legacy Group Exchange (UNIX):** Use this option to enable legacy Diffie-Hellman group exchange methods for compatibility with older systems. Select **Yes** to enable it. * **Allow Keyboard Interaction (UNIX):** Use this option to enable keyboard-interactive authentication for UNIX-based systems. Select **Yes** to allow keyboard interaction. * **Prefer Interactive Authentication (SSH):** Use this option to configure interactive authentication as the preferred authentication method for SSH connections. Select **Yes** to prioritize interactive authentication during connection establishment. * Click the **Save**button. ## Adding a new asset type * Login to the system and select **Platform Configuration** from the product navigator and under the **Plugins and Connectors** section click on **Asset Type**. * Click on the **"Asset type"**in the sidebar. * Click on the **"+Add Asset Type"**button. A form will appear in front of you to fill in the credentials. * **Asset category**: Select one of the asset types from the drop-down list. * **Asset type**: Define a suitable name for the asset type. * **Default port**: The default port for the asset type should be provided. * Click the **"Save"**button, and your access type will be created. ### Related How-to Articles * [Add a network device asset](https://docs.sectona.com/pkb/add-a-network-device-asset.md) * [Add a Unix-based workstation as an asset](https://docs.sectona.com/pkb/add-a-unix-based-workstation-as-an-asset.md) * [Add a vCenter asset manually](https://docs.sectona.com/pkb/add-a-vcenter-asset-manually.md) * [Adding a database (MSSQL, MYSQL, Oracle) asset](https://docs.sectona.com/pkb/adding-a-database-mssql-mysql-oracle-asset.md) * [Adding a Mac workstation as an asset](https://docs.sectona.com/pkb/adding-a-mac-workstation-as-an-asset.md) * [Adding UNIX/LINUX server as an asset](https://docs.sectona.com/pkb/adding-unix-linux-server-as-an-asset.md) * [Adding Windows Server asset](https://docs.sectona.com/pkb/adding-windows-server-asset.md) * [Adding Windows workstation as an asset](https://docs.sectona.com/pkb/adding-windows-workstation-as-an-asset.md) * [How to add AWS/Azure assets?](https://docs.sectona.com/pkb/how-to-add-aws-azure-assets.md) * [Want to add assets in bulk?](https://docs.sectona.com/pkb/want-to-add-assets-in-bulk.md) * [Edit Asset details](https://docs.sectona.com/pkb/edit-asset-details.md) * [Disable asset](https://docs.sectona.com/pkb/disable-asset.md) * [Enable access types for assets](https://docs.sectona.com/pkb/enable-access-types-for-assets.md) --- version: "6.0" variant: "On-Premises" language: "en" --- # Adding new LDAP/LDAPs directory ## About LDAP and Secure LDAP **LDAP (Lightweight Directory Access Protocol)** is an open, cross-platform protocol used for accessing and managing directory information services over an IP network. It's used to interact with directory services that store information in a hierarchical structure, such as user information, groups, and organizational data. LDAP allows applications and systems to query, modify, and authenticate user credentials or retrieve data stored in a directory service. It organizes data in a tree-like format, with entries (like users and groups) represented as nodes. **LDAPS (LDAP Secure)** is a secure version of LDAP that incorporates SSL/TLS encryption to ensure the data being transmitted is secure. It helps protect sensitive information such as user credentials during communication. LDAP is platform-agnostic, allowing non-Windows systems to interact with Active Directory. Using LDAP or LDAPS, centralization of user management, enhancement of security, and interaction streamlining between different systems and applications is made easily configurable with Sectona PAM. LDAP provides a standardized way for systems and applications to authenticate users and check their permissions. Active Directory acts as the central authority for managing user accounts and credentials. LDAP is used to query and retrieve information from AD, such as users, groups, and organizational units. ## Steps to add a new LDAP/LDAPs directory Follow the below-recommended steps to add a new Directory Store in Sectona Platform: * Login to System and select **Platform Configuration** from the product navigator. * Under the **Authentication** section, you can select the **AD \& Directory Store** button. * Click on **+AD \& Directory Store** displayed on the top right position and input data in the form. * Provide a unique name to identify the directory name in field **Directory Name**. * Select the type of directory you are integrating. The system supports Window Active Directory or Generic SAML. * Select the **Directory Store Type**. System supports communication with LDAP and LDAPS method. * Provide an IP address/hostname of the directory store. * Specify the base domain name of the directory store. (eg `DC=LOCALAD,DC=COM` ) * Specify the domain name of the server. * Provide port no. and change the port no. if you are using any custom ports. ( Default port for LDAP is 389 and LDAPS is 636) * Specify the username for server-side authentication. The username should have sufficient privileges to with 'Read' permission. * The same username can be used as a management account for AD privilege account password change. Additional privileges are required to be enabled such as on User Object set (check) permissions - 'Reset Password', 'Read pwdLastSet', 'Write pwdLastSet', 'Read lockOutTime' and 'Write lockOutTime'. * Specify the password for server-side authentication. * Click on the **Status**slider to activate the configuration. * Click on **Save** and your new directory will be created. --- version: "6.0" variant: "On-Premises" language: "en" --- # Adding users in the system The Sectona platform administrator is responsible for setting up details of all the users who are permitted to assign product users. PAM users are given access according to their user role. Each user can be a member of one or more user groups. Groups define the ownership of accounts that the user is permitted to access. The system can integrate with your corporate LDAP infrastructure like Microsoft Active Directory. LDAP groups can be mapped to Sectona discovery groups and thereby assigned permission on the system. A user is set up in a system as a Person Data object and can subsequently be associated with other objects. All actions in the system are recorded against a unique user identity for audit purposes. It is strongly recommended to consider adding an extra layer of authentication with multi-factor authentication. This chapter covers details about how to onboard users in the system. Sectona provides several enrollment methods to add users to the system. Users can be manually added automatically via directory sync or bulk import. * [Adding a new user manually](https://docs.sectona.com/pam-technical-documentation/6.0/adding-users-in-the-system.md#anum) * [Adding users in bulk](https://docs.sectona.com/pam-technical-documentation/6.0/adding-users-in-the-system.md#aub) * [Sync active directory user groups](https://docs.sectona.com/pam-technical-documentation/6.0/adding-users-in-the-system.md#sadug) * [Updating user attributes](https://docs.sectona.com/pam-technical-documentation/6.0/adding-users-in-the-system.md#uua) * [Update user attributes in bulk](https://docs.sectona.com/pam-technical-documentation/6.0/adding-users-in-the-system.md#uuab) ## Adding a new user manually The Sectona platform administrator can set up new users and assign them to groups. For this purpose, go to **Platform Configuration** → **User Management** → **Users**→ Add new user details: * **Authentication type**: Select one of the following types: * Sectona Authentication for enabling authentication within the application. * Directory Authentication for validating user access via Active Directory. A user authentication system called Sectona Authentication is included. However, if your organization already uses an authentication service that incorporates Microsoft Active Directory, it is best practice to integrate the application with this service. Using one service prevents having to manage two sets of user information. * **Directory store** : If you have selected Directory authentication as an authentication type, choose a system-configured directory. For configuring a new directory store in the system, refer to [Configuring directory service authentication](https://docs.sectona.com/pam-technical-documentation/6.0/adding-new-ldap-ldaps-directory.md) * **Username**: Provide a unique username in the application. If you add a directory user, you can validate the user details or skip to the user role as other details are synced from Active Directory. * **Password** : Provide a valid password for the user. You can set up password control in the section [Authentication Providers](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-multi-factor-authentication.md) by selecting an MFA (Sectona Authenticator will no longer be supported from February 1st, 2025) * **First Name**: Provide the user's first Name (applicable for Sectona Authentication). * **Last Name**: Provide the user's last name (which is applicable for Sectona Authentication). * **Mobile No:** Provide the user's mobile no. (applicable for Sectona Authentication). * **Email ID:** Provide the user's email ID (which is applicable for Sectona Authentication). * **Tags:** Add relevant tags to this user. Refer to [Tags](https://docs.sectona.com/pam-technical-documentation/6.0/applying-conditions-with-tags.md)for more information about adding context with tags. * **User Logon policy:** Under the policies tab, select user logon policy and configure policy parameters like access duration, session recordings, collaboration policy, multi-factor policy, etc. * **User Role:** Under the policies tab, with this option you can select a user role configured in [User Role Management](https://docs.sectona.com/pam-technical-documentation/6.0/managing-user-roles.md). * **Company:** Under the Additional Info tab, provider user's company information (applicable for Sectona Authentication). * **Department:** Under the policies tab, provide the user's department (applicable for Sectona Authentication). * **Manager:** Provide the user's manager details. * **Custom Attributes:** Administrators will be able to define workflow rules based on values configured in **Custom Attribute 1** and **Custom Attribute 2.**These details can be used to specify workflows for requesting and approving access. * **Devoid Security:** If you tick the checkbox, the created user will always be allowed to log in without getting Locked or Dormant. * **Expiry:** You can set an expiry date for the user account. * **Status:** By default, all users are provisioned with Active Status. You can disable the user here anytime. Once you have completed adding a User to the Sectona Platform, you can add this User within the PAM product. Click on **Manage** from the navigation bar, User Management → **+ Add User →**Select the name of the User from the drop down menu. Add the policy and activate the user from the slider. ## Copying a User Profile In order to transfer user mapped groups from one user to another copying a User Profile can help maintain such details and make it easier to manage users. * In **Platform Configuration** , select User Management → User → Add User. Click on the **Assign License** tab. * Check the **Copy User Profile** box and select required option from the menu. * Enter the remaining details as stated [above](https://docs.sectona.com/pam-technical-documentation/6.0/adding-users-in-the-system.md#%255BinlineExtension%255DAdding-a-new-user-manually) and click on **Save**. ## Adding users in bulk To add large numbers of new users to Sectona, it is recommended to use one of Sectona's supported Active Directory-based groups (explained in the next section) or by using the bulk import function. Go to Platform Configuration → User Management → Users → Bulk User → Import and add the following details. **Step 1: Add user details** * Authentication Type: Select one of the following types * Sectona Authentication for enabling authentication within the application * Directory Authentication for validating user access via directories like Active Directory * User Role: Select a user role. If you want to add any custom role for this user, refer to the [Managing user role.](https://docs.sectona.com/pam-technical-documentation/6.0/managing-user-roles.md) * Tags (*optional* ): Add relevant tags to this user. Refer to [tags](https://docs.sectona.com/pam-technical-documentation/6.0/applying-conditions-with-tags.md) or more information about adding context with tags. * User logon policy: Select relevant user logon policy and configure policy parameters like access duration, session recordings, collaboration policy, multi-factor policy, etc. If you have not configured any access policy, add [User Logon Policy](https://docs.sectona.com/pam-technical-documentation/6.0/setting-up-logon-policy.md). * Expiry (*optional):*You can set an expiry date for the user account. * Devoid Security: If you tick this checkbox, the created users will always be allowed to log in without getting Locked or Dormant. **Step 2: Copy User Data to be onboarded** * Download the CSV to add user details in the mentioned format * Copy the text from the CSV of user details to the text box. * Move to the next step. **Step 3: Summary \& finalize** * Validate the data entered and complete the action or review the details. Please note that the username should be unique, and using the bulk method, you can add up to 1000 users simultaneously in the system. ## Sync active directory user groups IT environments with a Microsoft Active Directory domain/LDAP directory can import users with directory synchronization. This enables easy to sync with Active Directory security groups containing user information with a specific user group on the platform. User information for imported users is updated regularly to reflect the latest user status and information. Before executing this step, you must have configured Active Directory with the platform. Read more about configuring in [Adding new LDAP/LDAPs directory](https://docs.sectona.com/pam-technical-documentation/6.0/adding-new-ldap-ldaps-directory.md). To perform this step, go to Manage → User Groups → Add new User groups and follow-below mentioned steps: * Group name: Provide a valid user group name * Group description: Add any additional group information * Method: Active Directory Group * Directory store: Select the directory store name preconfigured in the system * User Groups: Browse and Select User Groups fetched from the directory selected above. * Exclude Users: If you want to exclude any user from the sync process, mention the names, and they will not be onboarded with the platform. * Activate this setting to start your sync process. User synced with active directory groups is added with default 'User Role.' This sync process requires system services to be activated: UserManagementService ## Update and View Logs user attributes You can click on the respective username to edit/change ![image-20251106-101257.png](https://docs.sectona.com/__attachments/a_a495e21883946310e0d0cde86db61636f3940656bda798c3cac939bf059ebdcc/image-20251106-101257.png?cb=064a2b7ab9e0202fcb39c77c8acaa700) details. After selecting the user, a form appears in which you can specify the modifications. Click on the Update button, and the changes made in the form will be updated. In order to view the logs for User Status Activity, click on the Action Button ![image-20251106-102255.png](https://docs.sectona.com/__attachments/a_5c75ae957f8748b2ef27eddcc36255fdc10ba6e926b61ff185fc48e706b2ffd9/image-20251106-102255.png?cb=35f17a58d443e38e55422598e1a5e7a4) → User Status Trail where the following details can be tracked. | **Action** | **Status** | |------------------------------------------|----------------| | User active to inactive | Disabled | | User Multiple Login attempts for locking | Locked | | User Unlocked | Active | | User Expiry | Disable | | User Dormancy | Dormant | | User Configure multi-factor | MFA Configured | | User reset multi-factor | MFA Reset | ## Update user attributes in bulk The user's list can be updated in bulk. You can go to Platform Configuration → User Management → User→ Bulk User → Update. To update/change asset details, follow the below steps: * User Details * Tick the checkbox for the fields you want to update and provide the updated value for those fields. * Click on the Download Format link. * This will download an Excel sheet on your system. * Click on the Next button. * Copy Text * Open the Excel sheet and add details of the users you want to update. * Copy the user's data into the Excel sheet and paste it into the text box. * Click on the Next button. * Summary * Validate the data in the Summary section and click on the Finish button. All the users mentioned in the Excel sheet get updated in bulk with the current details. --- version: "6.0" variant: "On-Premises" language: "en" --- # Adjusting Session Risk Scoring & Threat Analytics Parameters Sectona Security Platform uses a combination of a user's access events (user behavior) and activity events (threat levels) to determine a session risk score. Platform leverages composite risk scoring to determine the overall session risk score used for scoring threat levels for every session. Risk score are determined basis risk libraries activated \& configured and calculated once user session is completed. By default all rules are set with a default risk levels and all events are analyzed using default risk levels. This section covers: * [Understanding Risk Scoring Mechanism](https://docs.sectona.com/pam-technical-documentation/6.0/adjusting-session-risk-scoring-threat-analytics-pa.md#RScore) * [Configuring Risk Level](https://docs.sectona.com/pam-technical-documentation/6.0/adjusting-session-risk-scoring-threat-analytics-pa.md#RLevel) ## Understanding Risk Scoring Mechanism Risk score is calculated by determining the registered events that passes validity criteria set out in risk libraries. To determine a final risk score for a session, system analyzes total events generated during the session and correlates with number of behavioral events (Total Events). Further, system categories events as per then defined criticality level scoring defined in the system \& aggregates events \&to arrive Criticality level scoring (Total Events \* Criticality Level Weight). Finally, system further determines final risk score by Total Score of Criticality Levels / number of events. | Criticality Level | Risk Score | Weight | Color Assigned | |-------------------|------------|--------|----------------| | Low | 0 to 25 | 25 | | | Medium | 26 to 50 | 50 | | | High | 51 to 75 | 75 | | | Critical | 76 to 100 | 100 | | ## Configuring Risk Level To define a risk level in Sectona PAM, follow below recommended steps: * Login to Sectona and select **PAM** from the product navigator. * As the PAM product user, navigate to the **Policies** → **General → Risk Scoring →**select the action button next to Activity you want to configure. * From the **Risk Scoring** tab you change the risk level by clicking selecting the desired risk level within the **Configured Risk Level** drop-down menu and click on **Update**. --- version: "6.0" variant: "On-Premises" language: "en" --- # Administer ## Getting Started This section is an operational guide for administering and managing Sectona Platform's operations. This guide will help you work with users, assets, and accounts and lets you manage policies associated with these entities. * [Managing assets \& access types](https://docs.sectona.com/pam-technical-documentation/6.0/managing-assets-access-types.md) * [Configuring a Kubernetes Cluster](https://docs.sectona.com/pam-technical-documentation/6.0/5-configuring-a-kubernetes-cluster.md) * [Managing accounts \& keys](https://docs.sectona.com/pam-technical-documentation/6.0/managing-accounts-keys.md) * [Managing user \& authentication](https://docs.sectona.com/pam-technical-documentation/6.0/managing-user-authentication.md) * [Setting up password management](https://docs.sectona.com/pam-technical-documentation/6.0/setting-up-password-management.md) * [Enabling Just-in-time Access](https://docs.sectona.com/pam-technical-documentation/6.0/enabling-just-in-time-access.md) * [Workflow-based access](https://docs.sectona.com/pam-technical-documentation/6.0/workflow-based-access.md) * [Managing \& reviewing session Logs](https://docs.sectona.com/pam-technical-documentation/6.0/managing-reviewing-session-logs.md) * [Managing server privileges](https://docs.sectona.com/pam-technical-documentation/6.0/managing-server-privileges.md) * [Reporting \& analytics](https://docs.sectona.com/pam-technical-documentation/6.0/reporting-analytics.md) * [Automating Privileged Tasks](https://docs.sectona.com/pam-technical-documentation/6.0/automating-privileged-tasks.md) * [Account Lifecycle Management](https://docs.sectona.com/pam-technical-documentation/6.0/account-lifecycle-management.md) * [Windows Monitoring Agent](https://docs.sectona.com/pam-technical-documentation/6.0/windows-monitoring-agent.md) * [Unix Monitoring Agent](https://docs.sectona.com/pam-technical-documentation/6.0/unix-monitoring-agent.md) * [Managing the system](https://docs.sectona.com/pam-technical-documentation/6.0/managing-the-system.md) * [Running discovery](https://docs.sectona.com/pam-technical-documentation/6.0/running-discovery.md) * [Maintenance Mode](https://docs.sectona.com/pam-technical-documentation/6.0/maintenance-mode.md) * [Security Module](https://docs.sectona.com/pam-technical-documentation/6.0/security-module.md) * [Delegation of Administrative Rights](https://docs.sectona.com/pam-technical-documentation/6.0/delegation-of-administrative-rights.md) --- version: "6.0" variant: "On-Premises" language: "en" --- # Amazon Web Services (AWS) resources In the AWS context, an *instance* is a copy of an Amazon Machine Image running as a virtual server in the AWS cloud. By initiating the dynamic discovery of AWS instances, you can scan and report these instances continually. You can discover cloud assets using service provider APIs to extract data. AWS API 6.5 is integrated with the solution. The resource scan collects data from AWS using valid credentials for authenticating to AWS API. If your Sectona installation is located outside the AWS network, the AWS API must be able to recognize it as a trusted entity before allowing it to connect and discover AWS instances. To make this possible, you must create an IAM user in AWS with permissions that support discovery. When you create an IAM user, you will also create an access key that Sectona will use to log onto the API. Learn about [IAM Users](http://docs.aws.amazon.com/IAM/latest/UserGuide/id.html) and how to [create them](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html). If your Sectona instance can directly authenticate to AWS, port 443 must be allowed from the Sectona web access server to AWS. Alternatively, if your Sectona web access server cannot directly authenticate to AWS, please add [proxy settings](https://docs.sectona.com/pam-technical-documentation/6.0/setting-up-a-network-proxy.md) while configuring AWS Resource Discovery Scan. Ensure your proxy server can communicate with AWS using a 443 port. | **Requirement** | **Description** | |--------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Connectivity/Ports (Sectona → AWS Console) | 443 | | Credential | When you create an IAM user, select the option to create an access key ID and secret access key. You will need these credentials when setting up the discovery connection. You will have the option to download these credentials. Be careful to store them in a safe and secure location. Refer to [Configuring Credentials](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-credentials.md) for more details on adding keys for authenticating to AWS APIs. | ## Adding an Amazon Web Service resource scan job To add a discovery job, go to Manage → Discovery → AWS. Select AWS and follow the below-recommended guidelines: | **Attributes** | **Description** | |--------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Job details** | | | Job Title | Enter a unique title for your scan job | | Account Name | Provide a username with unique permissions to discover other resources. This user must be valid in the vault. The access key and Secret key are taken from the vault | | Schedule Type | Select a schedule type whether you would like to initiate this job once or a recurring job. If you select a recurring job, you can choose the days on which this job must be executed. For example, you want to schedule a job every second day at 5.00 p.m. from 1st January 2018 to scan your network. Include the following details: Recur every: 2 days Task Start: 01 Jan 2018 Schedule Start Time: 4:30 pm to 5:15 pm | | Task Start | Select the date when the task begins | | Schedule Time | You can either choose the "Any" or schedule a proper time from when to start the task and when to end the task | | Network Proxy | If Sectona server cannot communicate with AWS directly, please provide valid proxy details to allow communication between Sectona server and AWS | | **Action** | | | Onboard assets | To start a scan manually with an option to add assets to specify profiles, click the Onboard asset as 'No.' If you wish to include assets automatically to existing groups and attributes, select option 'Yes.' | | Asset description (optional) | Added text will be included in every asset description field | | Location (optional) | Added location field will be included in every asset location. You can configure the system management location [here](https://docs.sectona.com/endpoint-privilege-management/5.4/configure-location-tagging.md) | | Criticality level (optional) | Added critical field will be included in every asset. This is important while structuring reports and notifications | | Tags (optional) | You can associate an asset with your desired single or multiple tags like Infosec, Banking Core Server, ATM Switches, etc. Refer to section [Tags](https://docs.sectona.com/pam-technical-documentation/6.0/applying-conditions-with-tags.md)for more information about adding context with tags. | | Checkout policy | The option is selected as default, as one can choose its policy by unchecking the default option and selecting the policy from the drop-down list available. | | Rotation policy | The option is selected as default as one can choose its policy by unchecking the default option and selecting the policy from the drop-down list available | | Reconciliation policy | The option is selected as default as one can choose its policy by unchecking the default option and selecting the policy from the drop-down list available. | | Config value 1 | The configuration value can be assigned here. | | Config value 2 | The configuration value can be assigned here. | | Config value 3 | The configuration value can be assigned here. | | Config value 4 | The configuration value can be assigned here. | | Exclude from Account Discovery | When ticked, the accounts of this asset will be excluded from the Discovery job. | | Owner (optional) | If you have listed owner information of all the assets, please include it here. | Tick the Active checkbox and click the Save button to add the AWS discovery job to the system. Click the Save + Run Now button to start the AWS discovery immediately. ### Related How-to Articles * [Discovering assets using AWS resource discovery](https://docs.sectona.com/pkb/discovering-assets-using-aws-resource-discovery.md) --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Authentication using OAuth Access Token **Purpose** To generate a token in order to interact with Sectona Management APIs Endpoint: /API/APP/APP007/OAuthToken **HTTP METHOD** POST **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |----------------|-----------------------------------------------------------------------------------------------|--------------|-----------------------------------------------------------------------------------------------| | Accept | application/json | YES | application/json | | Content-Type | application/json | No | application/json | | cache-control | no-cache | No | no-cache | | grant_type | password client_credentials refresh_token | Yes | password client_credentials refresh_token | | client_id | username if grant_type is other than password | No | username if grant_type is other than password | | client_secret | access token if grant_type is client_credentials refresh token if grant_type is refresh_token | No | access token if grant_type is client_credentials refresh token if grant_type is refresh_token | | username | username if grant_type is password | No | username if grant_type is password | | password | user password if grant_type is password | No | user password if grant_type is password | **Sample Response (JSON)** { "Version":"6.0.0.0", "IsSuccess":true, "LogCode":"0", "Result":" { "access_token": "access_token", "token_type": "token_type", "issued_at": "issued_at", "expiry": "expiry", "error": "error", "error_description": "error_description" }", "StatusCode":"Accepted", "Timestamp":"03 Jun 2019 11:58:50 GMT 05:30:00" } **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|-------------------------------------------------------| | 011649 | Current user lacks permission to take this action | | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | | 012235 | Evaluation license expired | --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Get Account Groups **Purpose** A post API to get a list of account groups. **Accessing the API** XML Endpoint: /API/APP/APP007/GetAccountGroups **HTTP METHOD** XML POST **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |----------------|---------------|--------------|---------------------| | Filter | String | YES | All/Active/Disabled | | Instance | String | YES | Instance name | **Sample Request (JSON)** XML { "Filter":"All/Active/Disabled", "Instance":"Instance name", } **Sample Response (JSON)** XML { "Version":"6.0.0.0", "IsSuccess":true, "LogCode":"0", "Result": { [ "GroupName":"String", "Description":"String", "RequiredTicketNo":"String", "AllowAccessViaAPI":"String", "EnforceComment":"String", "CommentMinLength":"String", "Method":"String", "Attributes": [ "Attribute":"String", "Operator":"String "Input":"String", ] ] }, "CreatedBy":"String", "CreatedOn":"String", "Instance":"String", "Status":"String", }, "StatusCode":"Accepted", "Timestamp":"03 Jun 2019 12:20:10 GMT 05:30:00" } | **Error Code** | **Error Description** | |----------------|-------------------------------------------------------| | 011649 | Current user do not have permission to take an action | | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Get Accounts by Account Groups **Purpose** A post API to get a list of accounts using the group name parameter. **Accessing the API** Endpoint: /API/APP/APP007/GetAccountsByGroup **HTTP METHOD** POST **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |----------------|---------------|--------------|---------------------| | Filter | String | YES | All/Active/Disabled | | Group Name | String | YES | Account group name | | Instance | String | YES | Instance name | **Sample Request (JSON)** { "Filter":"All/Active/Disabled", "GroupName":"Group name", "Instance":"Instance name", } **Sample Response (JSON)** { "Version":"6.0.0.0", "IsSuccess":true, "LogCode":"0", "Result":" { "GroupName":"", "Accounts": { [ "AssetType":"String", "AssetHost":"String", "DBInstace":"String", "AccountName":"String", "DirectoryServer":"String", "AccountAuthenticationType":"String", "AccountType":"String", "Owner":"String", "Tags":["T1", "T2"], "Category":"String", "ConsoleAccess":"String", "EnforcePasswordChange":"String", "IsExcludeFromADSync":"String", "Config1":"String", "Config2":"String", "Config3":"String", "Config4":"String", "InheritCheckoutPolicyFromAsset":true/false, "CheckoutPolicy":"String", "InheritRotationPolicyFromAsset":true/false, "RotationPolicy":"String", "InheritReconciliationPolicyFromAsset":true/false, "ReconciliationPolicy":"String", "CreatedBy":"String", "CreatedOn":"String", "Status":true/false, "Instance":"String", "LinkedGroups":["G1", "G2"] ] }, }, "StatusCode":"Accepted", "Timestamp":"03 Jun 2019 11:58:50 GMT 05:30:00" } **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|-------------------------------------------------------| | 011649 | Current user do not have permission to take an action | | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | | 032411 | Unable to get accounts by group | | 011804 | Unable to get account group | | 011811 | Unable to get accounts by group | --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Get Accounts by Asset **Purpose** A post API to get a list of accounts. **Accessing the API** XML Endpoint: /API/APP/APP007/GetAccountsByAsset **HTTP METHOD** XML POST **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |----------------|---------------|--------------|-------------------------------------------------------------------------| | Filter | String | Yes | All /Active/ Disabled | | AssetType | String | Yes | Asset type | | AssetHost | String | Yes | IP address or host name | | DBInstance | String | No | Database instance (required if requested asset is of database category) | | Instance | String | Yes | Instance name | **Sample Request (JSON)** XML { "Filter":"All/Active/Inactive", "AssetType":"Windows Server", "AssetHost":"XX.XX.XX.XX", "DBInstance":"", "Instance":"XXXX" } **Sample Response (JSON)** XML { "Version":"6.0.0.0", "IsSuccess":true, "LogCode":"0", "Result":" { "Asset":" { "AssetCategory":"String", "AssetType":"String", "HostName":"String", "DBInstance":"String", "IPAddress":"String", "PortNo":"String", "Status":"String", "Instance":"String }, "Accounts": { [ "AssetType":"String", "AssetHost":"String", "DBInstace":"String", "AccountName":"String", "DirectoryServer":"String", "AccountAuthenticationType":"String", "AccountType":"String", "Owner":"String", "Tags":["T1", "T2"], "Category":"String", "ConsoleAccess":"String", "EnforcePasswordChange":"String", "IsExcludeFromADSync":"String", "Config1":"String", "Config2":"String", "Config3":"String", "Config4":"String", "InheritCheckoutPolicyFromAsset":true/false, "CheckoutPolicy":"String", "InheritRotationPolicyFromAsset":true/false, "RotationPolicy":"String", "InheritReconciliationPolicyFromAsset":true/false, "ReconciliationPolicy":"String", "CreatedBy":"String", "CreatedOn":"String", "Status":true/false, "Instance":"String", "LinkedGroups":["G1", "G2"] ] }, }, "StatusCode":"Accepted", "Timestamp":"03 Jun 2019 11:58:50 GMT 05:30:00" } **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|-------------------------------------------------------| | 011649 | Current user do not have permission to take an action | | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | | 032410 | Unable to get accounts on asset | | 011685 | Unable to get asset information | | 011810 | Unable to get account | | 011853 | Requested asset is not valid | --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Get Assets **Purpose** A post API to get a list of assets. **Accessing the API** XML Endpoint: /API/APP/APP007/GetAssets **HTTP METHOD** XML POST **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |----------------|---------------|--------------|-------------------------------------------------| | Filter | String | YES | All/Active/Inactive | | AssetType | String | YES | Asset type to select assets with provided value | | Instance | String | YES | Instance name | **Sample Request (JSON)** XML { "Filter":"all", "AssetType":"", "Instance":"Default" } **Sample Response (JSON)** XML { "Version":"6.0.0.0", "IsSuccess":true, "LogCode":"0", "Result":"[ { "AssetCategory": "Operating System", "AssetType": "Unix Based", "AssetHost": "Host", "IPAddress": "IPAddress", "DBInstance": "DBInstance", "CreatedBy": "CreatedBy", "CreatedOn": "16 Dec 2017 13:43:20 GMT 05:30:00", "Status": "Active" }, { "AssetCategory": "Directory Server", "AssetType": "WindowsActiveDirectory", "AssetHost": "HostName", "IPAddress": "IPAddress", "DBInstance": "DBInstance", "CreatedBy": "CreatedBy", "CreatedOn": "15 Jul 2017 00:00:00 GMT 05:30:00", "Status": "Active" } ]", "StatusCode":"Accepted", "Timestamp":"03 Jun 2019 11:51:26 GMT 05:30:00" } **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|-------------------------------------------------------| | 011649 | Current user do not have permission to take an action | | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | | 032409 | Unable to get asset | | 011809 | Unable to get asset | --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Get Discovered Accounts **Purpose** To get a list of discovered accounts using Sectona API interface. **Accessing the API** |-------------------------------------------------| | Endpoint: /API/APP/APP007/GetDiscoveredAccounts | **HTTP METHOD** |------| | POST | **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |----------------------|---------------|--------------|---------------------------------------------------------------------| | Instance | String | Yes | Instance name | | DiscoveryJobTitle | String | No | Account Discovery Job Title (optional) | | DiscoveredBeforeDays | String | No | Discovered Before Days (Considering 100 days if value not provided) | **Sample Request (JSON)** |------------------------------------------------------------------------------------------| | { "DiscoveryJobTitle":"String", "DiscoveredInLastDays ":"String", "Instance":"String", } | **Sample Response (JSON)** |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | { "Version":"6.0.0.0", "IsSuccess":true, "LogCode":"0", "Result":" { "Accounts": [ "AssetType":"String", "HostName":"String", "IPAddress":"String", "AccountName":"String", "Vaulted":"String", "AccountStatus":"String", "PrivilegeLevel":"String", "LastPasswordChangedOn":"Datetime ", "LastDiscoveredOn":" Datetime ", ] }", "StatusCode":"Accepted", "Timestamp":"03 Jun 2019 11:58:50 GMT 05:30:00" } | **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|------------------------------------------------------------------| | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | | 032419 | Unable to get discovered accounts information | | 011851 | The system was unable to load the Discovered account information | | 011651 | The authorization header is either empty or not basic | --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Get Discovered Assets **Purpose** To get a list of discovered assets using Sectona API interface. **Accessing the API** |-----------------------------------------------| | Endpoint: /API/APP/APP007/GetDiscoveredAssets | **HTTP METHOD** |------| | POST | **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |----------------------|---------------|--------------|---------------------------------------------------------------------| | Instance | String | Yes | Instance name | | DiscoveryJobTitle | String | No | Asset Discovery Job Title (optional) | | DiscoveredBeforeDays | String | No | Discovered Before Days (Considering 100 days if value not provided) | **Sample Request (JSON)** |-----------------------------------------------------------------------------------------------------------------------------------| | { "Instance":"Instance name", "DiscoveryJobTitle":"Asset Discovery Job Title", "DiscoveredBeforeDays":"Discovered Before Days", } | **Sample Response (JSON)** |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | { "Version":"6.0.0.0", "IsSuccess":true, "LogCode":"0", "Result":" { "Assets": [ { "Asset Type":"String", "Host Name":"String", "IP Address":"String", "Vaulted":"String", "Last Discovered On":"String", } ] }", "StatusCode":"Accepted", "Timestamp":"03 Jun 2019 11:58:50 GMT 05:30:00" } | **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|----------------------------------------------------------------| | 011649 | Current user do not have permission to take an action | | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | | 032418 | Unable to get discovered assets information | | 011850 | The system was unable to load the Discovered Asset information | --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Get Entitlement ## **Purpose** To get the entitlement by user, asset and account using Sectona API interface. **Accessing the API** |------------------------------------------| | Endpoint: /API/APP/APP007/GetEntitlement | **HTTP METHOD** |------| | POST | **Parameters** | **Parameters** | **Data type** | **Required** | **Description** | |-----------------|---------------|--------------|---------------------------------------| | EntitlementType | String | Yes | All/User | | Username | String | No | Required if entitlement type is User. | | AssetHost | String | No | Asset Host | | AccountName | String | No | Account | | Instance | String | YES | Instance name | **Sample Request (JSON)** |-----------------------------------------------------------------------------------------------------------------------------------------------| | { "EntitlementType":"All/User", "Username":"user name", "AssetHost":"asset host", "AccountName":"Account name", "Instance":"Instance name", } | **Sample Response (JSON)** |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | { "Version":"6.0.0.0", "IsSuccess": true, "LogCode":"0", "Result": [{ "Username":"String", "PolicyName":"String", "AssetCategory":"String", "AssetType":"String", "DBInstance":"String", "HostName":"String", "IPAddress":"String", "AccountName":"String", "AccountType":"String", "Domain":"String", "AccountGroup":"String", ]} "StatusCode":"Accepted", "Timestamp":"03 Jun 2019 12:25:16 GMT 05:30:00" } | **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|-------------------------------------------------------| | 011649 | Current user doesn't have permission to take action | | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | | 032417 | Unable to get entitlement information | | 011656 | Invalid directory store | | 011671 | Invalid account name | | 011685 | Unable to get asset information | | 011690 | Account does not belong to asset | | 011805 | Unable to get user group | | 011853 | Requested asset is not valid | --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Get Instance Information **Purpose** A post API to get a list of instances in Sectona PAM. **Accessing the API** XML Endpoint: /API/APP/APP007/GetInstances **HTTP METHOD** XML POST **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |----------------|---------------|--------------|---------------------| | Filter | String | YES | All/Active/Disabled | **Sample Request (JSON)** XML { "Filter":"All/Active/Disabled" } **Sample Response (JSON)** XML { "Version":"6.0.0.0", "IsSuccess": true, "LogCode":"0", "Result":"[ { "Instance":"Instance1", "ShortCode":"IN1", "Description":"String", "TimeZone":"String", "CreatedBy":"String", "CreatedOn":"String", "Status":true/false, },{ "Instance":"String", "ShortCode":"String", "Description":"String", "TimeZone":"String", "CreatedBy":"String", "CreatedOn":"String", "Status":true/false, } ], "StatusCode":"Accepted", "Timestamp":"03 Jun 2019 10:32:12 GMT 05:30:00" } **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|---------------------------------------------------------| | 011649 | Current user does not have permission to take an action | | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | | 032403 | The system was unable to create account | | 011806 | Unable to get instance | --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Get User Groups Information **Purpose** A post API to get a list of user groups in Sectona PAM. **Accessing the API** XML Endpoint: /API/APP/APP007/GetUserGroups **HTTP METHOD** XML POST **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |----------------|---------------|--------------|---------------------| | Filter | String | YES | All/Active/Disabled | | Instance | String | YES | Instance name | **Sample Request (JSON)** XML { "Filter":"String", "Instance":"String", } **Sample Response (JSON)** XML { "Version":"6.0.0.0", "IsSuccess": true, "LogCode":"0", "Result" : { [ "GroupName":"String", "Description":"String", "Method":"String", "Attributes": { [ "Attribute":"String", "Operator":"String ", "Input":"String" ] }, "ActiveDirectory": { [ "DirectoryStore":"String", "UserGroups":"String ", "ExcludeUsers":"String", "ProvisionNewUser":"String", "MapLinkedDirectoryStoreForNewUser":"String" ] }, "CreatedBy":"String", "CreatedOn":true/false, "Status":"String", "Instance":"String", ] }, "StatusCode":"Accepted", "Timestamp":"03 Jun 2019 10:42:30 GMT 05:30:00" } **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|-------------------------------------------------------| | 011649 | Current users do not have permission to take action | | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | | 032404 | Unable to get user groups | | 011808 | Unable to get user groups | --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Get Users by Group **Purpose** A post API to get a list of users linked in a specified group. **Accessing the API** XML Endpoint: /API/APP/APP007/GetUsersByGroup **HTTP METHOD** XML POST **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |----------------|---------------|--------------|------------------------------------| | Filter | String | YES | All/Active/Disabled/Locked/Dormant | | Group Name | String | YES | Group name | | Instance | String | YES | Instance name | **Sample Request (JSON)** XML { "Filter":"String", "GroupName":"Group name", "Instance":"Instance name" } **Sample Response (JSON)** XML { "Version":"6.0.0.0", "IsSuccess": true, "LogCode":"0", "Result":"{ "GroupName":"String", "Users":" { [ "AuthenticationType":"String", "DirectoryStore":"String", "Username":"String", "FirstName":"String", "LastName":"String", "MobileNo":"String", "EmailID":"String", "Tags":"String", "UserAccessPolicy":"String", "UserRole":"String", "UserType":"String", "Company":"String", "Department":"String", "Manager":"String", "CustomAttribute1":"String", "CustomAttribute2":"String", "DevoidSecurity":"true/false", "Expiry":"true/false", "ExpiryDate":"DateTime", "CreatedBy":"String", "CreatedOn":"String", "Status":"true/false", "UserStatus":"String", "UserStatus":"String", "LinkedStaticGroups":"String", "LinkedNonStaticGroups":"String", "Instance":"String", ] }, "StatusCode":"Accepted", "Timestamp":"03 Jun 2019 10:55:42 GMT 05:30:00" } **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|-------------------------------------------------------| | 011649 | Current users do not have permission to take action | | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | | 032406 | Unable to get users by groups | | 011694 | Unable to get user group | | 011807 | Unable to get user | --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Get Users Information **Purpose** A post API to get a list of users from Sectona PAM. **Accessing the API** XML Endpoint: /API/APP/APP007/GetUsers **HTTP METHOD** XML POST **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |----------------|---------------|--------------|---------------------| | Filter | String | YES | All/Active/Disabled | | Instance | String | YES | Instance name | **Sample Request (JSON)** XML { "Filter":"String", "Instance":"String", } **Sample Response (JSON)** XML { "Version":"6.0.0.0", "IsSuccess":true, "LogCode":"0", "Result":[ "AuthenticationType":"String", "DirectoryStore":"String", "Username":"String", "FirstName":"String", "LastName":"String", "MobileNo":"String", "EmailID":"String", "Tags":"String", "UserAccessPolicy":"String", "UserRole":"String", "UserType":"String", "Company":"String", "Department":"String", "Manager":"String", "CustomAttribute1":"String", "CustomAttribute2":"String", "DevoidSecurity":true/false, "Expiry":true/false, "ExpiryDate":"DateTime", "CreatedBy":"String", "CreatedOn":"String", "Status":true/false, "UserStatus":"String", "LinkedStaticGroups":"String", "LinkedNonStaticGroups":"String", "Instance":"String", ], "StatusCode":"Accepted", "Timestamp":"03 Jun 2019 10:47:50 GMT 05:30:00" } **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|-------------------------------------------------------| | 011649 | Current user do not have permission to take an action | | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | | 032405 | Unable to get user | | 011694 | Unable to get user group | | 011807 | Unable to get user | --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Manage Account **Purpose** A post API to create and modify an account as well as update password of an account in Sectona. **Accessing the API** XML Endpoint: /API/APP/APP007/ManageAccount **HTTP METHOD** XML POST **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |----------------------------------------|---------------|--------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------| | APIActionType | String | Yes | Create OR Modify OR UpdatePassword | | AssetType | String | Yes | Asset type | | AssetHost | String | Yes | Asset host | | AccountName | String | Yes | Account Name | | DBInstance | String | No | Database instance name | | AccountType | String | No | Local, AD Account (Default is Local if not provided) | | AuthenticationType | String | No | Account authentication type (Default is Password if not provided) | | DirectoryServerDomain | String | No | Required if AD Account | | DirectoryServerType | String | No | Required if AD Account | | DirectoryServerIP | String | No | Required if AD Account | | ExcludeFromADSync | Boolean | No | Exclude from AD sync | | Password | String | No | Account password (Required if APIActionType is Create or UpdatePassword) | | PassPhrase | String | No | secret key if key base + secret key Pashphrase if key based and blank if type is password | | Owner | String | No | Owner of an account | | AccountCategory | String | No | Interactive Account, Service Account (Default is Interactive Account if not provided) | | EnforcePasswordChange | Boolean | No | Apply password change policy (Default is Yes if not provided) | | Tags | String | No | Tags to be assigned to account (multiple tags can be provided by comma separated) | | ConsoleAccount | String | No | Console account | | Config1 | String | No | Value of config1 | | Config2 | String | No | Value of config2 | | Config3 | String | No | Value of config3 | | Config4 | String | No | Value of config4 | | IsInheritCheckoutPolicyFromAsset | Boolean | No | Inherit checkout policy from asset (Default is true if not provided) | | CheckoutPolicy | String | No | Checkout policy name | | IsInheritRotationPolicyFromAsset | Boolean | No | Inherit rotation policy from asset (Default is true if not provided) | | RotationPolicy | String | No | Rotation policy name | | IsInheritReconciliationPolicyFromAsset | Boolean | No | Inherit reconciliation policy from asset (Default is true if not provided) | | ReconciliationPolicy | String | No | Reconciliation policy name | | NewAccountName | String | No | New account name if wanted to update | | Instance | String | Yes | Instance name | | IsActive | Boolean | No | Status of account (Default status is true when APIActionType is Create. Considered for modification when APIActionType is Modify and parameter is provided) | **Sample Request (JSON)** XML { "APIActionType": " Create/Modify/UpdatePassword ", "AssetType":"Unix Based", "AssetHost":"XXXXX", "DBInstance":"", "AccountName":" XXXXX _", "NewAccountName":" XXXXX _", "AuthenticationType":"Password", "AccountType":"Local", "Password":" XXXXX ", "PassPhrase":"", "Owner":" XXXXX ", "AccountCategory":"Interactive Account", "OnlyConsoleAccess":false, "EnforcePasswordChange":false, "Tags":"", "Instance":"Default", "IsActive":true } **Sample Response (JSON)** XML { "Version":"6.0.0.0", "IsSuccess":true, "LogCode":"0", "Message":"Account 0.0.0.0@XX Created/updated successfully", "StatusCode":"OK", "Timestamp":"22 Apr 2019 18:34:53 GMT 05:30:00" } **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|--------------------------------------------------------| | 011649 | Current users do not have permission to take an action | | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | | 032403 | The system was unable to create account | | 032420 | Requested asset is not valid | | 011681 | Unable to get account properties | | 011682 | Unable to perform action | | 011853 | Requested asset is not valid | | 011661 | Invalid tags | --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Manage Asset **Purpose** A post API to create and modify an asset in Sectona. **Accessing the API** XML Endpoint: /API/APP/APP007/ManageAsset **HTTP METHOD** XML POST **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |------------------------------|---------------|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------| | APIActionType | String | Yes | Create OR Modify | | AssetCategory | String | No | Asset category name (Considered OperatingSystem if APIActionType is Create and parameter is not provided) | | AssetType | String | Yes | Asset type | | HostName | String | Yes | Asset host name | | DBInstance | String | No | Database instance (Required if AssetCategory is Database) | | IPAddress | String | Yes | IP address | | SecondaryIP | String | No | Secondary IP address. (Considered for modification when APIActionType is Modify and parameter is provided) | | AssetVersion | String | No | Asset version. (Considered for modification when APIActionType is Modify and parameter is provided) | | Description | String | No | Asset description | | PortNo | Number | No | Port number. (Considered for modification when APIActionType is Modify and parameter is provided) | | Config1 | String | No | Value of config 1. (Considered for modification when APIActionType is Modify and parameter is provided) | | Config2 | String | No | Value of config 2. (Considered for modification when APIActionType is Modify and parameter is provided) | | Config3 | String | No | Value of config 3. (Considered for modification when APIActionType is Modify and parameter is provided) | | Config4 | String | No | Value of config 4. (Considered for modification when APIActionType is Modify and parameter is provided) | | Location | String | No | Location name. (Considered for modification when APIActionType is Modify and parameter is provided) | | CriticalityLevel | String | No | Criticality level. (Considered for modification when APIActionType is Modify and parameter is provided) | | Owner | String | No | Owner name. (Considered for modification when APIActionType is Modify and parameter is provided) | | Tags | String | No | Tags to be assigned to asset (multiple tags can be provided by comma separated) | | CheckoutPolicy | String | No | Default policy will be assigned if policy name not provided. (Considered for modification when APIActionType is Modify and parameter is provided) | | RotationPolicy | String | No | Default policy will be assigned if policy name not provided. (Considered for modification when APIActionType is Modify and parameter is provided) | | ReconciliationPolicy | String | No | Default policy will be assigned if policy name not provided. (Considered for modification when APIActionType is Modify and parameter is provided) | | AssetJITPolicy | String | No | Default policy will be assigned if policy name not provided. (Considered for modification when APIActionType is Modify and parameter is provided) | | ExcludeFromAccountDiscovery | Boolean | No | Exclude this asset from account discovery. (Considered for modification when APIActionType is Modify and parameter is provided) | | EnforceHostNameForConnection | Boolean | No | Enforce host name for connection. (Considered for modification when APIActionType is Modify and parameter is provided) | | NewAssetType | String | No | Asset type (required when APIActionType is Modify and asset type to be modify) | | NewHostName | String | No | Asset host name (required when APIActionType is Modify and host name to be modify) | | NewDBInstance | String | No | Database instance (Required if APIActionType is Modify and AssetCategory is Database and Database to be modify) | | NewIPAddress | String | No | New IP address (required when APIActionType is Modify and IP address to be modify) | | Instance | String | Yes | Instance name | | IsActive | Boolean | No | Status of asset (Default status is true when APIActionType is Create. Considered for modification when APIActionType is Modify and parameter is provided) | **Sample Request (JSON)** XML { "APIActionType":"Create/Modify", "AssetCategory ":"Asset category", "AssetType ":"Asset type", "HostName ":"Host name", "DBInstance":"Database instance", "IPAddress ":"IP address", "SecondaryIP":"Secondary IP", "AssetVersion ":"Asset version", "Description ":"Description", "PortNo ":"Port No", "Config1":"Config1 data", "Config2":"Config2 data", "Config3":"Config3 data", "Config4":"Config4 data", "Location":"Location", "CriticalityLevel ":"Criticality level", "Owner ":"Owner", "Tags ":"Tag name 1,Tag name 2,...,Tag name n", "CheckoutPolicy ":"Checkout policy name", "RotationPolicy ":"Rotation policy name", "ReconciliationPolicy ":"Reconciliation policy name", "AssetJITPolicy":"Asset JIT policy name", "ExcludeFromAccountDiscovery ":true/false, "EnforceHostNameForConnection":true/false, "NewAssetType ":"New asset type", "NewHostName":"New host name", "NewDBInstance":"New database instance", "NewIPAddress":"New IP address", "Instance":"Instance name", "IsActive":true/false, } **Sample Response (JSON)** XML { "Version":"6.0.0.0", "IsSuccess": true, "LogCode":"0", "Message":"Asset XXXX / 0.0.0.0 created/Updated successfully", "StatusCode":"OK", "Timestamp":"22 Apr 2019 18:33:25 GMT 05:30:00" } **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|-------------------------------------------------------| | 011649 | Current user do not have permission to take an action | | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | | 032402 | The system was unable to create asset | | 011658 | Invalid asset type | | 011659 | Invalid asset version | | 011660 | Invalid Location | | 011661 | Invalid Tags | | 011662 | Invalid password checkout policy | | 011663 | Invalid password rotation policy | | 011664 | Invalid password reconciliation policy | | 011679 | Unable to get asset properties | | 011684 | Invalid criticality Level | | 011680 | Unable to perform action | | 011842 | Unable to create asset | | 011848 | Invalid password Asset JIT policy | --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Manage User **Purpose** To create and modify a user and update a user's password using the Sectona API interface. **Accessing the API** XML Endpoint: /API/APP/APP007/ManageUser **HTTP METHOD** XML POST **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |--------------------|---------------|--------------|--------------------------------------------------------------------------------------------------------------------------------------------| | APIActionType | String | Yes | Create OR Modify OR UpdatePassword | | AuthenticationType | String | No | Authentication type | | DirectoryStore | String | No | Directory store name of user (Required if authentication type is other than SectonaAuthentication) | | Username | String | Yes | Username of user | | Password | String | No | Password of user (Required if authentication type is SectonaAuthentication) | | FirstName | String | No | First name of user (Required if authentication type is SectonaAuthentication) | | LastName | String | No | Last name of user (Required if authentication type is SectonaAuthentication) | | Mobile | String | No | Mobile number of user | | Company | String | No | Company name of user | | EmailID | String | No | Email ID of user (Required if authentication type is "GenericSAML") | | Manager | String | No | Manager name of user | | Department | String | No | Department name of user | | CustomAttribute1 | String | No | Value of custom attribute 1 | | CustomAttribute2 | String | No | Value of custom attribute 2 | | DevoidSecurity | Boolean | No | Specify to allow devoid security for user. Default it is false | | UserRole | String | No | User role to be assign | | UserType | String | No | Interactive OR APIOAuth OR InteractiveAPIOAuth | | UserLogonPolicy | String | No | Default policy will be assigned if logon policy name not provided | | Expiry | Date | No | It specifies the expiry of user. If not provided, considered as user will never expire. | | NewDirectoryStore | String | No | Directory store name of user (Required if authentication type is other than SectonaAuthentication) Applicable when APIActionType is Modify | | UnlockUser | Boolean | No | Unlock the user. Applicable when APIActionType is**Modify** | | Instance | String | No | Instance name required if system running with MSP license | | Tags | String | No | Tags to be assigned to user (multiple tags can be provided by comma separated) | | IsActive | Boolean | No | User status in system. Default it is enabled | **Sample Request (JSON)** XML { "APIActionType":"Create/Modify/UpdatePassword", "AuthenticationType":"Authentication type", "DirectoryStore":"Directory store name", "Username":"Username", "Password":"Password", "FirstName":"First name", "LastName":"Last name", "Mobile":"Mobile No.", "Company":"Company", "EmailID":"Email ID", "Manager":"Manager", "Department":"Department", "CustomAttribute1":"Custom attribute 1", "CustomAttribute2":"Custom attribute 2", "DevoidSecurity":true/false, "UserRole":"User role", "UserType":"Interactive/APIOAuth/InteractiveAPIOAuth", "UserLogonPolicy":"User logon policy name", "Expiry":"Expiry date", "NewDirectoryStore":"New Directory store name", "UnlockUser":true/false, "Instance":"Instance name", "Tags":"Tag name 1,Tag name 2,...,Tag name n", "IsActive":true/false, } **Sample Response (JSON)** XML { "IsSuccess": true, "LogCode": 0, "Result": "User *username* created/ modified successfully ", "StatusCode": 200, "Timestamp": "28 Apr 2026 16:13:08 GMT 05:30:00", "Version": "6.0.0.0" } **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|--------------------------------------------------------| | 011649 | Current users do not have permission to take an action | | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | | 032401 | The system was unable to create user | | 011669 | Unable to create user | | 011676 | Unable to get user properties | | 011677 | Unable to perform action | | 011805 | Unable to get user group | | 011849 | The system was unable to load tags information | | 011852 | Error in processing | | 011661 | Invalid tags | The authentication type, username, and directory store cannot be changed using the modify API action. --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Map Un-map Account with Account Group **Purpose** A post API to map or un-map account with account group. **Accessing the API** Endpoint: /API/APP/APP007/AccountGroupAction **HTTP METHOD** POST **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |----------------|---------------|--------------|--------------------------------------------------------------| | Action | String | Yes | (map/unmap) | | GroupName | String | Yes | GroupName | | AccountName | String | Yes | AccountName | | AssetType | String | Yes | AssetType | | AssetHost | String | Yes | IP address or host name | | DBInstance | String | No | Database Instance (required when asset category is database) | | AccountType | String | No | Local, AD Account (Default is Local if not provided) | | Instance | String | Yes | Instance name | **Sample Request (JSON)** { "GroupName":"", "AssetType":"Windows Server", "AssetHost":"host or IP address", "DBInstance":"", "AccountName":"Account Name", "AccountType":"Local/ADAccount", "Action":"map/unmap", "Instance":"Instance name" } **Sample Response (JSON)** { "Version":"6.0.0.0", "IsSuccess":true, "LogCode":"0", "Result":"account XXXX unmapped from group (XXXX)", "StatusCode":"Accepted", "Timestamp":"03 Jun 2019 12:20:10 GMT 05:30:00" } **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|-------------------------------------------------------| | 011649 | Current user lacks permission to perform this action | | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | | 032412 | Unable to map account with account group | | 011671 | Invalid account name | | 011685 | Unable to get asset information | | 011690 | Account does not belong to asset | | 011804 | Unable to get account group | | 011814 | Unable to map account with account group | | 011853 | Requested asset is not valid | --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Map, Un-map User with User Group **Purpose** A post API to map or un-map to the user from or to a group. **Accessing the API** XML Endpoint: /API/APP/APP007/UserGroupAction **HTTP METHOD** XML POST **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |----------------|---------------|--------------|-----------------| | GroupName | String | YES | User Group Name | | UserName | String | YES | User Name | | Action | String | YES | (map/unmap) | | Instance | String | YES | Instance Name | **Sample Request (JSON)** XML { "GroupName":"GroupName", "UserName":"UserName", "Action":"map", "Instance":"Instance" } **Sample Response (JSON)** XML { "Version":"6.0.0.0", "IsSuccess":true, "LogCode":"0", "Result":"user XXXXXXX mapped to group (XXXXXXX)", "StatusCode":"Accepted", "Timestamp":"03 Jun 2019 11:34:45 GMT 05:30:00" } **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|-------------------------------------------------------| | 011649 | Current user lacks permission to perform this action | | 011651 | The authorization header is either empty or not basic | | 011673 | Invalid credentials | | 011674 | Invalid credentials | | 011675 | Unable to validate request | | 011683 | Invalid instance name | | 011803 | Unable to insert API log details | | 032407 | Unable to map user with group | | 011694 | Unable to get user group | | 011805 | Unable to get user group | | 011813 | Unable to map user with group | --- version: "6.0" variant: "On-Premises" language: "en" --- # API - Password Vault The following table describes headers that can be used by various types of Sectona APIs. The authorization username must be accesskey (fixed text, no case sensitive) and password must be provided by the user while API registration in Sectona. | **Header Name** | **Header Value** | **Required** | **Description** | |-------------------|---------------------------------------------------|--------------|-------------------------------------------------------------------------------------------------| | **AUTHORIZATION** | username : Accesskey password : {Access key data} | YES | Basic authentication and provide username and password for authorization | | **ACCEPT** | application/json OR text/xml | OPTIONAL | Default request accepts is text/JSON | | **CONTENT-TYPE** | application/json OR text/xml | OPTIONAL | Default content type is text/JSON | | **CACHE-CONTROL** | no-cache | OPTIONAL | Forces caches to submit the request to the server for validation before releasing a cached copy | **Purpose** To add a user using Sectona's API interface. **Accessing the API** XML Endpoint: /API/APP/APP008/RequestPassword **HTTP METHOD** XML POST **Authorization**: This API uses access key data for authorization purposes **Parameters** | **Parameters** | **Data Type** | **Required** | **Description** | |----------------|---------------|--------------|-------------------------------------------| | AssetType | String | YES | Asset type | | AssetHost | String | YES | Host name or IP address | | DBInstance | String | OPTIONAL | DB instance id asset category is database | | AccountName | String | YES | Account Name | | Instance | String | YES | Instance Name | **Sample Request (JSON)** XML { "AssetType":"Unix Based", "AssetHost":"CENTOS7", "DBInstance":"", "AccountName":"admin152", "Instance":"Default" } **Sample Response (JSON)** XML { "Version":"6.0.0.0", "IsSuccess":true, "LogCode":"0", "Result": "{ "AssetType": "Unix Based", "AssetHost": "XXXXXX", "AccountName": "XXXXXX", "AccountAuthenticationType": "KeyBased_SecretKey", "AccountType": "Local", "Password": "XXXXXX", "PassPhrase": "XXXXXX", "CreatedBy": "", "CreatedOn": "03 Jun 2019 15:22:11 GMT 05:30:00", "Status": "Active" }", "StatusCode":"Accepted", "Timestamp":"03 Jun 2019 15:38:18 GMT 05:30:00" } **Standard Error Response Codes** | **Error Code** | **Error Description** | |----------------|---------------------------------------------------| | 011652 | Invalid instance | | 011670 | Invalid account details | | 011672 | Requested details are not valid or not accessible | | 011688 | Invalid access key | | 011689 | Invalid request parameters | | 011691 | Unable to validate request | | 011692 | Unable to get account password | | 011693 | Unable to update API log | | 011803 | Unable to insert API log details | | 011853 | Requested asset is not valid | | 023601 | The authorization header name is not valid | | 023604 | Requested asset is not valid | --- version: "6.0" variant: "On-Premises" language: "en" --- # Application Control for Windows Not all the users in an organization require the same level of access to the Programs in Windows. It is advisable to grant minimum access to the Users to prevent any accidental or intentional misuse. Sectona PAM gives you the liberty to define such permissions through its Server Access Policy, wherein you can restrict or allow access to certain Programs for specific User Groups. You can choose these Programs from the existing library or add a new Program to the Program Repository. This chapter will consists of the following: * [Build server access policy](https://docs.sectona.com/pam-technical-documentation/6.0/application-control-for-windows.md#bsap) * [Define application control](https://docs.sectona.com/pam-technical-documentation/6.0/application-control-for-windows.md#dac) * [Edit a policy](https://docs.sectona.com/pam-technical-documentation/6.0/application-control-for-windows.md#ep) * [Edit a Program in the library](https://docs.sectona.com/pam-technical-documentation/6.0/application-control-for-windows.md#epl) * [Delete a policy](https://docs.sectona.com/pam-technical-documentation/6.0/application-control-for-windows.md#dp) * [Delete a Program from the library](https://docs.sectona.com/pam-technical-documentation/6.0/application-control-for-windows.md#dpl) ## Before you begin * You have installed the Server Control component on the target device. * The Sectona Windows Monitoring Service is in running state. * The User Group you wish to allow/deny access already exists. Supported Access Types for Windows to enable ## Building server access policy * Login to Sectona and select PAM from the product navigator. * Navigate to **Policies**in the navigation bar. * Select the **Server Access Policy** from the sidebar. * Click on the Windows tab. * Click on the **+Add Policy** button. * Fill in the essentials(Policy details, User Groups and Parameters) in the form that appears. * Policy Details: You need to enter the details of the policy you wish to create. * Policy Name: Provide the name of the policy you want to create. * Description: Enter a short description about the policy. * Policy Type: Select whether you want to allow or deny permissions. * Expiry: Set the expiry date of the policy. * User Groups: In the Enforced to User Group(s), specify the User groups you want to apply the server policies on. In the Exception User(s), mention the Users who will be exempted from the server access policy. Click on Next * Parameters: In this tab, select the Programs for which you want to allow or deny access. Confirm option means that authorized users will be asked to confirm their choice when they try to access the program(s)(set as a Parameter in the policy). The Elevate option will allow the user to elevate the access level. Click on Next. The Allow permission allows only the selected application and restricts the rest of the application. The Deny permission denies all the selected application and allows the rest of the application.The Confirm and Elevate options will appear only if the Policy Type is set as 'Allow' in the Policy details. You can select either from Confirm and Elevate options, both of them or none of them. * Summary: It displays a summary of your policy based on the input provided in the last three sections. * Click on the "Finish" button. ## Defining application control By default, there exists a list of stored Programs for the ease of the user. To add a new Program to the Program Repository: * Login to Sectona and select **PAM**from the product navigator. * Navigate to the "**Policies**" option in the navigation bar. * Select the "**Server Access Policy**" from the sidebar. * Click on the **Windows** tab. * Click on the "**Program Repository**" button. * Click on the "**+ Add Program**" button . * Fill in the essentials for your new command to be created: * Risk category: This describes the various types of risk that might occur during running the server access policy commands. * Unusual user activity: If the user behavior in the system performing activities is unusual. * User activity: If certain user activity is bringing about a risk. * Unusual account activity: If the account activities in the system are unusual. * Data theft and exfiltration: Accessing unauthorized data and retrieving it from a system or server. * Privilege account abuse: When the privileged user ignores the policies or may be some malicious activity is taking place by access to unauthorized user. * Accountability risk: Someone is responsible for stealing the data from the system or server. * Identity theft: Someone pretends to be some else in order to get the access. * General: Some misbehavior of the activities due to user performing it wrongly. * Leapfrogging: Adapting to the user and system activities directly in order to have secure access of the data. * Name: Specify the name you want to provide. * Path: Specify the path of the application in the system. * Exe Name: Provide with specific extension name. * Process Name: Provide the name of the process for the app. * Primary Title: Provide a title you want to. * Secondary Title: Providing second title is optional. * Version: Provide the version name (optional). * Publisher: Provide the name of the publisher. * Process description: Specify the description of what the process will do. * Hash : Provide app hash which is (optional). * Type: The command type may vary from the choice you made. * Administrative * Backup * Configuration * Remote access * Status: Toggle the slider to activate the policy * Click on the "Save" button. ## Editing a policy * Login to Sectona and select **PAM**from the product navigator. * Navigate to the "**Policies**" option in the navigation bar. * Select the "**Server Access Policy**" from the sidebar. * Click on the **Windows**tab. * As the new page open you will find the list of existing **server access policies**. * Click on to the **edit**button next to the policy name and make necessary changes in the form the window that appears. * Click on the **Update**button and your policy will be updated. ## Editing a Program in the library * Login to Sectona and select **PAM**from the product navigator. * Navigate to the "**Policies**" option in the navigation bar. * Select the "**Server Access Policy**" from the sidebar. * Click on the **Windows**tab. * Click on the "**Program Repository**" button. A list of existing **Programs**appears. * Click on the **edit**button of the Program you want to modify and make the necessary changes. * Click on to the **update**button and your Program will be updated. ## Deleting a policy * Login to Sectona and select **PAM**from the product navigator. * Navigate to "**Policies**" in the navigation bar. * Select the "**Server Access Policy**" from the sidebar. * Click on the **Windows**tab. * A list of existing server access policies for Windows appears. * Click on to the **delete**icon in the last column. The policy will be deleted. ## Deleting a Program from the library * Login to Sectona and select **PAM**from the product navigator. * Navigate to the "**Policies**" option in the navigation bar. * Select the "**Server Access Policy**" from the sidebar. * Click on the **Windows** tab. * Click on the "**Program Repository**" button and a list of existing Programs appears. * Click on the **edit**button of the Program you want to delete. * Click on to the **delete**button to remove that particular program from the list. Changes made in a policy during a session will be implemented only after restarting the session. ### Related How-to Articles * [Create a Server Access Policy for Windows servers](https://docs.sectona.com/pkb/create-a-server-access-policy-for-windows-servers.md) * [How to add Programs to Program Repository](https://docs.sectona.com/pkb/how-to-add-programs-to-program-repository.md) --- version: "6.0" variant: "On-Premises" language: "en" --- # Applying conditions with tags When working with assets, users, or privileged accounts in your hybrid environment, you may want to identify or group entities according to how they operate in your business environment. For example, you have an SAP HANA environment hosted on multiple servers. You recently added more components to your SAP HANA environment increasing the application servers and data layers. You want to assign the access of these servers to the staff managing these assets. You want to also ensure that the team can access these servers and any new team added on can get access without complicated processes. Creating groups based only on naming conventions still requires the Sectona administrator to assign access to multiple servers manually. Assets are identified by IP Address/Hostname, Users by username, and Accounts by unique names. Tags help in defining business relevance to grant access to users and group assignments. With tags, you can assign attributes to assets, users, and accounts to allow attribute-based linking. You can tag users with SAP Administrators and assets with SAP tags to create dynamic account groups or user groups that will ensure dynamic attribute-based grouping of these entities as soon as you add them. This section covers: * [Steps for creating a new tag](https://docs.sectona.com/pam-technical-documentation/6.0/applying-conditions-with-tags.md#scnt) * [Disabling an active tag](https://docs.sectona.com/pam-technical-documentation/6.0/applying-conditions-with-tags.md#dat) ## Steps for creating a new tag To define a new tag in the PAM solution, follow the given steps: * Login to the System and select **Platform Configuration** from the product navigator. * Under the **Common** **Masters** section click on **Tags**. * Click on the **+Add Tag** button. * A form will appear on the side screen which will ask you to provide a unique tag name and a description of the tag. * Click the **Save** button and your tag will be created. The name of the tag and description can be an alphanumeric string with minimum 2 and maximum 255 characters. Tags can be used in Asset Management, Account Management, and User Management. For more information, refer to [Adding New Assets](https://docs.sectona.com/pam-technical-documentation/6.0/adding-assets-in-the-system.md), [Adding New Accounts](https://docs.sectona.com/pam-technical-documentation/6.0/onboarding-accounts-in-vault.md), and [Adding New User](https://docs.sectona.com/pam-technical-documentation/6.0/adding-users-in-the-system.md) sections. Multiple tags can be used for an Asset, Account, or User. --- version: "6.0" variant: "On-Premises" language: "en" --- # Architecture, flow, & advantages of PTM The basic idea of Privileged Task Management is based on how the system works with respect to its functional behavior. This functional behavior is shown under the architecture of Privileged Task Management below. It describes functional and backend process of how the can task is created, assigned, executed and deleted. Apart from the backend process, there are flowcharts given below which shows the frontend process of how task can be created, assigned, executed and deleted. This section covers: * [The architecture of PTM](https://docs.sectona.com/pam-technical-documentation/6.0/architecture-flow-advantages-of-ptm.md#ap) * [Flow of PTM operations](https://docs.sectona.com/pam-technical-documentation/6.0/architecture-flow-advantages-of-ptm.md#fpo) * [Advantages of PTM](https://docs.sectona.com/pam-technical-documentation/6.0/architecture-flow-advantages-of-ptm.md#aop) ## The architecture of PTM The task is a sequence of commands that can be executed only with help of privileged access. Executing a task on Sectona PAM requires the user to login to PAM. Consider a task is built under PAM for the logged-in user. Once the user initiates the task execution by clicking on the run icon, PAM retrieves the password of the privileged account, selects the communication protocol accordingly, logs in into the target server, and executes the task. Once this task is executed, the output of the task is stored/logged into PAM and the output is then shown to the user. ![PTM_Architecture.png](https://docs.sectona.com/__attachments/a_c5a87cdd5be32e5b51805b8edfc40271e8dc6963058ff43912695d6e48f75906/PTM_Architecture.png?cb=138985a27c4fcb979b7fb2abd09e2720) ## Flow of PTM operations **The flow of importing a new task library** PAM User authenticates Sectona. Login to Sectona and select PAM from the product navigator. To add a new task, go to Manage → Task Management → Task Library. Here you'll find all the list of predefined tasks as well. Click on +Add Task Library. Add Name, select its base access type according to the command you wish to execute. Enter the command. Enter the input field name if necessary. Choose the pattern of the log display and save it. After adding a new task library in PAM, the user can execute this library as and when needed by configuring a task with appropriate asset and account: ![PTM_Flowchart1.png](https://docs.sectona.com/__attachments/a_43c38140eb77eac84513326d94550741d51029436382e37f7bdf19b206553718/PTM_Flowchart1.png?cb=6e820be2cd0c9d848abf164fcf561dee) **The flow of user executing a privileged task** PAM User authenticates Sectona. Users can execute the privileged task without knowing the password of the privileged account. Login to Sectona and select PAM from the product navigator. Go to MyAccess → All Tasks. Private/Delegated tasks will be shown here. Select and run one of the tasks say, *ifconfig* command by clicking on the **Run** icon, and wait for its execution to get completed. Once the execution is completed and its current status is shown as Not Executing, check its history to view the action status and output of the task: ![PTM_Flowchart2.png](https://docs.sectona.com/__attachments/a_99378204ec1d408deb48af1452be563bb26cb12291273b3d4b41aace4a7b3870/PTM_Flowchart2.png?cb=bb588380d3e77abcb9f4ae70004b1dc8) **The flow of user delegating a privileged task** PAM User authenticates Sectona. Users can execute the privileged task without knowing the password of the privileged account. Login to Sectona and select PAM from the product navigator. Go to MyAccess → All Tasks. Private/Delegated tasks will be shown here. Click on +Add Task to configure a task. According to the base access type (SSH, Telnet, or PowerShell) of the task, select the privileged account. Now select the user you wish to delegate this task to and save the configuration. Once the configuration is saved and the delegated user when logs into the system, the task delegated to the user is shown under the Task Management on MyAccess page: ![PTM_Flowchart3.png](https://docs.sectona.com/__attachments/a_acbc3a1adb36b17da23139a05831b2ffde09ee6e9aa28087dce9070b847b628a/PTM_Flowchart3.png?cb=f0f8ce774c718df85bf3b11a9faee6be) **The flow of user creating a task bucket** PAM User authenticates Sectona. User can create a task bucket where he/she can add one or more than one task and privatize/ delegate task to one or more than user by following few steps. Login to Sectona and select PAM from the product navigator. Go to MyAccess → All Tasks → Task Bucket. Configure task bucket by clicking on + Add Task Bucket. If delegating, select one or more than one user according to the need. You need not select any user if privatizing. Once users are select, enter the task bucket name. Now choose a preconfigured task by selecting one or more than one configured task according to the need and save the configuration. Once the configuration is saved you can execute the task bucket by clicking on its run button. Users can also run one or more than one task bucket by selecting the task buckets and clicking on Execute Selected: ![PTM_Flowchrt4.png](https://docs.sectona.com/__attachments/a_6f6d28171eab7322fa93a716132c7a78c3feb7a723b5dbf4b4ac93a8f7582e95/PTM_Flowchrt4.png?cb=04d83d04878211f29810c0d132bd8958) ## Advantages of PTM * Privileged Task Management helps in executing the tasks that address issues that are commonly encountered on systems, applications, or devices that have well-known resolutions. * Frequent support calls can also reduce common issues encountered on the system and can be solved easily without intimating any higher authority. * This functionality enables users to control the actions of privileged users by placing limitations on what a user is allowed to do with an organization's most critical asset. * Design Your Own Task (DYOT) i.e. it enables the operator to create their task based on their specific requirement. * Delegating the task to another person can lower the burden of the organization. * Reduces system administrator's backlogs and helps in automating IT processes. * Complete access to the most critical asset is eliminated and restricted policy is maintained. * Device-specific-knowledge will no more be required to the operator for executing any task. * Dependency among people will be removed. * Once a Task is created, it can be executed repetitively with just one click. * Human error is eliminated as the process of executing a task is automated. * The same task can be performed on different critical assets easily. * Automating task activities can achieve notable resource-saving. * Will help IT team to create task rather than executing it whenever needed. * Organizations will grow faster concerning their IT unit. | **Icon** | **Title** | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------| | ![image2023-9-8_14-26-28.png](https://docs.sectona.com/__attachments/a_a6ddc63b594601a9f910ef6f743ba06b3761ce71b1260c6120d3a426b050b09b/image2023-9-8_14-26-28.png?cb=23704202b9a201c21b6d9efc395f44e9) | Run | --- version: "6.0" variant: "On-Premises" language: "en" --- # Architecture & flow of Notification Service Events are triggered when certain actions are performed or any changes are done. Notification Engine is an event which performs evaluation of incoming events to find the set of users interested in a specific event and henceforth, invokes an application to generate the relevant content for the event and delivers messages to users with its generated content. The engine is triggered whenever there is a change in the underlying feed. This section covers: * [The architecture of Notification Service](https://docs.sectona.com/pam-technical-documentation/6.0/architecture-flow-of-notification-service.md#tans) * [Flow of Notification Service operations](https://docs.sectona.com/pam-technical-documentation/6.0/architecture-flow-of-notification-service.md#fnso) ## The architecture of Notification Service Once an action has been performed under Sectona PAM or an alert has triggered; the log of the data which is stored in Vault, is retrieved from the vault storage and a template is created as per the configuration set. This template is then sent to the email gateway through the communication protocol set as per the organization's requirement and this email is then sent to the desired recipient: ![Notification_Architecture.png](https://docs.sectona.com/__attachments/a_70636d61b570f13bc9591452c6beb789fa9538434b6c61cdecf844e80a35036d/Notification_Architecture.png?cb=cca5c19a363e5343bf1c0e9e1eaf48e0) ## Flow of Notification Service operations **Flow Chart of*****Adding Notification*****via*****Notification Rule*** PAM user authenticates Sectona. Users can configure any notification via notification rule using a few simple steps. Go to Setup→ Notification rules, click on +Add Notification Rule, fill in appropriate details as per requirement including, Notification type, Email recipient, and save the configuration. Once an event occurred based on the notification rule created, a mail will be sent to the same email recipient mentioned in the notification configuration: ![MicrosoftTeams-image (5).png](https://docs.sectona.com/__attachments/a_f85eb2a11e495e10b72900cbaf929ed40eec87e18f00496c6572d64f797fcd7d/MicrosoftTeams-image%20(5).png?cb=73f23e6e300c58e9f1775a1b751ddebe) **Flow Chart of*****Adding Notification*****via*****Notification Group*** PAM user authenticates Sectona. Users can configure any notification via notification group using a few simple steps. Go to Setup→ Notification rules, click on +Add Notification group, fill appropriate details as per requirement including, Notification type, Email recipient, and save the configuration. Now all the notification alerts would be created based on the group you have selected in one go. Once an event occurred based on the notification group created, an email will be received on the same email recipient which is mentioned in the notification configuration: ![MicrosoftTeams-image (5).png](https://docs.sectona.com/__attachments/a_f85eb2a11e495e10b72900cbaf929ed40eec87e18f00496c6572d64f797fcd7d/MicrosoftTeams-image%20(5).png?cb=73f23e6e300c58e9f1775a1b751ddebe) **Flow Chart of*****Updating Notification Role/Group*** PAM user authenticates Sectona. Users can update any notification rule using a few simple steps. Go to Setup→ Notification rules, click on the rule name of the notification you wish to update/modify, fill in necessary details as per requirement, and save the configuration. Based on your updated configuration set on notification, an email will be received to the respective email recipient: ![MicrosoftTeams-image (4).png](https://docs.sectona.com/__attachments/a_abc9d9370f5e506e81cf63f18bc124327983011781e48aa2f6cd3fb98ca053ba/MicrosoftTeams-image%20(4).png?cb=50072090158a4a556fa1277e7e73b5e2) **Flow Chart of*****Updating Notification Template*** PAM user authenticates Sectona. Users can update any notification template using a few simple steps. Go to Setup→ Notification Templates, click on the rule name of the notification template you wish to update/modify, fill in necessary details as per requirement, and save the configuration. You can update the subject line and email content of the notification as per the requirement. There is a button "Content Tag" which has tags related to the notification. With the help of these tags, the user can add new values to the notification template. Based on your updated configuration set on the notification template, an email will be received to the respective email recipient. ![MicrosoftTeams-image (3).png](https://docs.sectona.com/__attachments/a_e7c4c48e7b592b514e8bfde933504e66c11a30a6a2bc3e6dc3690e931e8d7428/MicrosoftTeams-image%20(3).png?cb=8cdd8e77bdd7951aa52b7ebf36aff5ff) --- version: "6.0" variant: "On-Premises" language: "en" --- # Assigning policy-based access to users Active Mapping based policy helps eliminate the misuse of privileged accounts by enforcing precise policies and controls. You can define and enforce rules based on who can access which accounts and under what conditions. You can define access policies by user groups and accounts group to increase security without compromising excessive privilege assignments. Only administrators with administrator privileges can manage and edit the active mapping privilege configuration. Active Mapping is like an authorization engine for your PAM system. The typical enterprise has a set of named privileged accounts for users and a set of shared and default privileged accounts and service accounts associated with multiple assets. Defining policies for handling such accounts can be painful and time consuming. This section provides guidelines for managing different types of privileged accounts. This chapter contains the following: * [Manage access to shared privileged accounts](https://docs.sectona.com/pam-technical-documentation/6.0/assigning-policy-based-access-to-users.md#maspa) * [Manage access to named privileged accounts](https://docs.sectona.com/pam-technical-documentation/6.0/assigning-policy-based-access-to-users.md#manpa) * [Manage exclusive access to privileged accounts](https://docs.sectona.com/pam-technical-documentation/6.0/assigning-policy-based-access-to-users.md#meapa) ## Managing access to shared privileged accounts Failing to manage shared passwords adequately can expose organisations to serious vulnerabilities, particularly in the case of shared or default privileged accounts like root and administrators. Keeping track of privileged users and shared access accounts is important for accountability. This section describes how you can manage access to shared privileged accounts with accountability and control. * Select the user group(s) you would like to link with the account group(s). Doing so will allow users to access the accounts available in the respective account group. Use the option of 'View Entitlements' to view the list of entitlements available to users as part of this mapping structure at a given point of time. ## Managing access to named privileged accounts It is recommended to use named privileged accounts for users. Sectona can handle auto assignment of accounts linking these accounts with the naming convention you use for privileged accounts in your normal operations. For example, John who is a windows administrator uses *John.Doe* as an active directory account to authenticate to a personal computer and other resources in the environment. However John uses john.doe_admin account to perform privileged activities. Supposing all windows privileged accounts are part of the same group and you want to tag only respective user account with privileged accounts, use following techniques for defining such rules: * Login to System and select **PAM**from the product navigator. * Clicking on **Policies** in the navigation bar. * Select **Active Mapping** section under **Mapping**found in the sidebar. * Click on **+ Add Active Mapping**, define a rule name and description for this rule. * Select the user group(s) you would like to link with the account group(s). Doing so will allow users to access the account available in their respective account group(s). * Additionally, define the methodology for linking user accounts with their respective named privileged accounts. For example, %Username%_admin. * All Active mapping is enabled by default active when created. Use the option of 'View entitlements' to view the list of entitlements available to users as part of this mapping structure at a given point of time. ## Managing Exclusive Access to privileged accounts It is quite often with a given administrative environment in any organizations that administrators are part of multiple groups and may require access to specific target servers/ devices with specific privilege accounts. Sectona handles this scenario seamlessly with its easy to configure 'Exclusive Only' option when configuring Active Mapping. For example, John is part of the Windows Administrator group which has access to 10 Windows Servers as per Account Group. Being a part of L1 support team John needs to be given read-only access on 5 servers and complete administrative access on the remaining 5 servers. Such exclusivity to provide specific privilege account access to specific users can be provided with the 'Exclusive Only' option. * Login to the system and select PAM from the product navigator. * By clicking on 'Policies' in the navigation bar * Select Mapping from the sidebar → 'Active Mapping'. * Click on '+ Add Active Mapping', define a rule name and description for this rule. * Select the user group(s) you would like to link with the account group(s). * If you select the 'Exclusive Only' option as doing so you will have to add Named Accounts in the format prefix%Username%suffix * Check the Mapped User and Privileged Account checkbox to add those Users to the current account you are currently using. * Click on Save. * Now select 'Exclusive Access' section from the sidebar. * Select the specific User group and Account group and click search. It will populate user(s) from the selected User group and click on Show. * Select the specific user to whom you need to give specific account access on the target server. ### Related How-to Articles * [Active Mapping for Exclusive Access](https://docs.sectona.com/pkb/active-mapping-for-exclusive-access.md) * [Attribute-based Exclusive Mapping](https://docs.sectona.com/pkb/attribute-based-exclusive-mapping.md) * [Configure Active Mapping using 'All Account' option](https://docs.sectona.com/pkb/configure-active-mapping-using-all-account-option.md) --- version: "6.0" variant: "On-Premises" language: "en" --- # Auditing system changes Users with sufficient or administrator privileges can modify the system configuration in ways that could affect the system environment. The system Trails feature enables you to track changes to the system configuration. All user-initiated events that modify the system's state or behavior are logged. This section will guide you to use the System Trail feature. * [Understanding audit events](https://docs.sectona.com/pam-technical-documentation/6.0/auditing-system-changes.md#uae) * [Viewing system trail](https://docs.sectona.com/pam-technical-documentation/6.0/auditing-system-changes.md#vst) * [System events \& groups](https://docs.sectona.com/pam-technical-documentation/6.0/auditing-system-changes.md#seg) ## Understanding audit events Every action for configuration change in the system log is defined with standard parameters and event-specific additional details. Standard parameters include * Timestamp * Action Type * Performed (Name of the type) Additional event-specific parameters include change logs of respective event groups. ## Viewing system trail To reach the system trail, follow the steps below: * Login to Sectona and select **Platform Configuration** from the product navigator. * Navigate to the "**System Trail** " option under the **System.** * Choose the Date \& Time to define the period for which you wish to view the trails. * If you select **Platform Configuration** tab then you can select a module that are made available under said sections. * On the other hand if you select the **Product wise**tab then you can select the "Instance" for which you wish to view the trails. * Based on the above selections you will be able to see the details covering Timestamp, Action, Performed by, Instance, and the selected parameter. * Based on the action executed, a complete list of the changes made regarding the 'Action' will be generated and viewable. ## System events \& groups System trail events are available in the following groups. | **Trail Record** | **Description** | |----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Access types | The type of access could either be user-defined or system-defined. | | Account dependencies | Account dependencies deal with password setting changes for dependent accounts. | | Account group policy | Account group policy deals with enforcing comment, comment minimum length, allowing access via API, and requiring ticket numbers. | | Account groups | Account groups are created to define which accounts belong to which asset type so that similar assets and accounts are mapped to a group for a particular access. | | Account group attributes | The properties of the account group are used to configure and define an account group. | | Account group mapping | The linking of account groups to various accounts having common access or purpose of work. | | Accounts | Accounts are used to provide particular access to users. | | Account defaults | Default parameters of accounts such as asset category, asset type, account type, and account role. | | Account discovery | Accounts that were discovered across target assets and automatically onboarded to ease the load of creating several accounts every time of account discovery are used. | | Active mapping | Active mapping process is used to link user groups to account groups. | | Active mapping account group | The list of account groups available to be mapped to the user groups. | | Active mapping attributes | The properties of active mapping are used to map user and account groups. | | Active mapping user group | The list of user groups available to be mapped to the account groups. | | Appearance | It helps to customize the system's user interface, such as logo, title, message, etc. | | Appserver TPA | It helps to fetch data of all the access types available. | | Asset configuration directory server | Deals with changes in asset configuration pertaining to the directory server. | | Asset types | Type of target assets based on asset category. | | Asset type access types | The access types which are mapped to the asset type. | | Asset type password change method | The method to change the password of the asset type. | | Assets | List of target assets mapped within the PAM system. | | Checkout policy | Policies to request a checkout of passwords to target assets and accounts. | | Command types | Type commands that can be executed. | | Criticality levels | The level of critical task that we are dealing with defines the criticality level. | | Directory stores | Types of directory such as Windows AD. | | Duo | An authentication provider requires an integration key and secret key to have access to the system. | | Email gateway | A gateway that allows communication of alerts and OTP's to users with SMTP protocols to pass through the server connection. | | Email templates | Notification templates that tell you whatever activity has taken place in the system. | | Generic radius | An authentication provider which requires a username and shared key to have access to the system. | | Google authenticator | An authentication provider which requires the URL link to access the system. | | Instances | These are created to attach an object to itself for defining its functionalities. | | IO devices | The devices which are required to perform input and output operations on the system. | | IP segments | The IP range which is required to have set boundaries for certain data access in the system. | | Landing \& app servers | Used when the ports needed for taking sessions are blocked on PAM or when the processing of sessions needs to be handled by a different server. | | Locations | It helps to locate the IP segments of the particular location. | | Log forwarding | It enables Sectona Session Logs to be forward to an external service such as a SIEM. | | Network discovery AD | It helps to discover assets across the active directory. | | Network discovery AWS | It helps to discover assets across AWS. | | Network discovery Azure | It helps to discover assets across Azure. | | Network discovery Hyper V | It helps to discover assets across Hyper-V. | | Network discovery VMWare | It helps to discover assets across VMware. | | Network proxy | Provides a proxy server to the network. | | Network scan | It helps to discover assets using a network scan. | | Notification rules | It determines the rules that need to be followed while sending a notification based on the attributes. | | Notification templates | It helps to configure/customize notification templates used by the system for various notifications. | | Okta | An authentication provider, which requires a sub-domain and API key to have access to the system. | | One login | An authentication provider which requires a sub-domain, client ID, and client secret to have access to the system. | | OTP configuration | The configuration to generate OTP having maximum retries and OTP length. | | Password change method process | Process for a corresponding password change method. | | Password change methods | The type of password change techniques. | | Password manager | The manager keeps a record of the password change and history of that particular job involved. | | Password manager accounts | Managing the history of accounts whose passwords have been changed. | | Password policy | The properties of passwords that needs to be defined by the user based on the organization's requirement. | | Risk score matrix | The matrix which defines risk activity with the default and configured risk level. | | Rotation policy | The properties of a password defined by the user to tell how frequently the password must be changed automatically in this policy. | | RSA secure ID | An authentication provider which requires a username and shared key to access the system. | | Schedulers | Deals with automatic scheduling of parameters such as password rotation, report generation, etc. | | Sectona authentication lockout policy | The policy which defines the Sectona authentication, i.e. how the password must be locked or unlocked. | | Sectona authentication password policy | The policy which defines the Sectona authentication i.e., how the password must be generated. | | Server access policy | It helps to restrict/allow access to certain programs/commands for specific users in the User Groups. | | Service desk | It helps to configure parameters for service desk/ticketing system integration. | | SMS gateway | The gateway URL is required with a username and password to receive an SMS OTP for authentication. | | System backup | The backup of our PAM system, which might be enabled locally or remotely by the user. | | System default | This helps to see the default as well as configured values when the system is modified. | | Tags | It is a tag as a parameter set to account, user and asset. | | Task library | It displays the task that is already created. | | Task library process | It defines the various tasks that the user can perform on a day-to-day basis. | | User access policy | It defines the method for a user to access the system. | | User settings | The settings are configured for a user. | | Users | Users are the end-users who access the PAM system. | | User groups | These groups are created to add a User to the User Group, which have similar functions and roles. | | User groups active directory | It helps to add a user to a an Active Directory based User Group. | | User group attributes | It helps to add a user to an Attribute-based User Group. | | User group mapping | It helps to map a user to a defined user group. | | User instances | It helps to map a user to the required Instance. | | User roles | It defines the roles which are permitted to a specific user. | | User tasks | These are privileged tasks that the user needs to execute on the target asset. | | Vasco token | An authentication provider which requires an username and shared key to have access to the system. | | Video recording | The sessions are been recorded according to the properties modified by the user. | | Workflow master request types | It helps to put forth workflow requests for access or password change. | | Workflow masters | It helps to create a connection according to the asset category and asset type involved. | | Workflow master approvers | It helps to approve workflow requests for access or password change. | | Workflow master attributes | Properties of workflow master. | ### Related How-to Articles * [Check System History](https://docs.sectona.com/pkb/check-system-history.md) --- version: "6.0" variant: "On-Premises" language: "en" --- # Automating Privileged Tasks A user can perform any activity or task with privileged access to a system. A task is a sequence of commands that can be executed only with the help of privileged access. Generally, to execute a privileged task, an Administrator or helpdesk is required as they have privileged access to the organization's assets. Executing these tasks requires knowledge of various commands as well have to look after the account management system. In process of isolating the use of privileged accounts to reduce the risk of credentials being stolen or used incorrectly, it is equally possible that it can lead to human error that will require fixes.Privileged Task Management (PTM) comes into the picture where an organization's privileged credentials are isolated and henceforth the risk of stealing credentials is reduced. At the same time, it helps in executing the tasks that address issues that are commonly encountered on systems, applications, or devices that have well-known resolutions. PTM also allows delegating a task to another person that can lower the burden of the organization. This will reduce the system administrator's backlogs and will help in automating IT processes as well. Moreover, the user will not require device-specific knowledge from the operator for executing any task, and dependency among people will be removed. PTM has following security benefits: * PTM not only gives you ease for executing privileged tasks but at the same time it provides a secure framework to the organization. * PTM maintains the security by showing the delegated task only to the delegated user as the user is the concerned person who is going to execute the * PTM makes sure that task is only seen by the respective user be it a Sectona authenticated user or a Windows authenticated user so that no other user is allowed to execute any privileged task and henceforth maintains the security of the organization. * Task once delegated to a user in a particular instance the user can only see the delegated task in a particular instance even if the user is part of some other instances as well. This section guides you through following sections: * [PTM key concepts \& capabilities](https://docs.sectona.com/pam-technical-documentation/6.0/ptm-key-concepts-capabilities.md) * [Architecture, flow, \& advantages of PTM](https://docs.sectona.com/pam-technical-documentation/6.0/architecture-flow-advantages-of-ptm.md) * [PTM Libraries](https://docs.sectona.com/pam-technical-documentation/6.0/ptm-libraries.md) * [Configuring Tasks](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-tasks.md) --- version: "6.0" variant: "On-Premises" language: "en" --- # Backing up, Restoring, and Archival A disaster such as a server breakdown or downtime can occur at any point in time. This can result in the loss of data and configurations. It is important to define your backup strategy by understanding your system environment and planning the usage of the solution. You can now maintain copies of your centralized configuration data and restore any copy to revert to old customized settings at any time. Master data and configuration including password and credentials are part of the vault. Vaults can be installed on either embedded database or Microsoft SQL Server. Video log files are stored on a flat file in a secured format. This section describes the following: * [Backup and restoring embedded vault](https://docs.sectona.com/pam-technical-documentation/6.0/backing-up-restoring-and-archival.md#a) * [Backup and restoring vault installed on Microsoft SQL Server](https://docs.sectona.com/pam-technical-documentation/6.0/backing-up-restoring-and-archival.md#b) * [Backup and restoring application file and encryption keys](https://docs.sectona.com/pam-technical-documentation/6.0/backing-up-restoring-and-archival.md#c) * [Backup and restoring system configuration](https://docs.sectona.com/pam-technical-documentation/6.0/backing-up-restoring-and-archival.md#d) * [Backup and restoring video log files](https://docs.sectona.com/pam-technical-documentation/6.0/backing-up-restoring-and-archival.md#e) * [Archiving video logs](https://docs.sectona.com/pam-technical-documentation/6.0/backing-up-restoring-and-archival.md#f) All of the above-mentioned backups are recommended to be configured with an external backup solution or at least taken out of Sectona system and stored on another highly available storage system on a daily basis. Hence, in the case of Sectona system disaster, the respective backups can be retrieved and restored to rebuild the Sectona system again to the point of last known backup. ## Backup and restoring embedded vault Sectona Vault backup is the complete backup with all settings, configurations, and passwords within the vault. This backup is recommended to be taken scheduled on a daily basis at least once a day. ### Procedure to backup embedded vault * Login to System and select **Platform Configuration** from the product navigator. * Under the System section select **System Status.** * Go to **Backup** in the sidebar. Click on **Enable Backup**. * In the **Backup File Name** section, fill in the **Backup File Name Prefix** as to what should be the prefix of the backup file to be created. The **Backup File Name** will be the file name of the backup created. The **Local Backup Directory** will be the location of the backup to be stored. * In the **Backup Schedule** section, The **Recur Days** will be the number of days you want to repeat your backup process after. The **Backup at** will specify the time at which the backup process will start running. You can add/remove multiple backup times by clicking on **+** icon to create multiple backup schedules. * You can take manual adhoc backup of the vault by clicking on the **Backup Now** button and in a few minutes the backup file will be created at the defined directory. * In the App Services, make sure the **SystemBackupService** is running to enable the system to execute backup in a scheduled manner as per the configuration defined. ### Restoring embedded vault Backup * Backups can be resorted to using **Sectona.Vault.StorageHost.Restore** utility. * Browse through the folder where the vault is installed (For example, E:\\Sectona\\Sectona Vault Storage Host) and run Sectona.Vault.StorageHost.Restore.exe. * In **Backup file** section set the path of the vault backup file you want to restore(For example, E:\\Sectona\\Backup folder\\SectonaVault_20200423215008.zip). It is recommended to choose the file to restore the vault to its most recent last known state. * In **Access Key** section enter the vault access key value (you can find the vault access key in the **VaultStorage.cnfg** file present in SectonaVaultStorage folder, for example, E:\\Sectona\\Sectona Vault Storage Host\\SectonaVaultStorage\\VaultStorage.cnfg). Open the file in notepad.exe and check for Access Key value. * Click on the **Restore** option and wait for a while until you receive the **Restored successfully** message. ## Backup and restoring vault installed on Microsoft SQL Server Please refer to Microsoft recommended guidelines for taking adhoc or scheduled backups of Microsoft SQL Server. Refer documentation of backup of MS SQL Server [here](https://docs.microsoft.com/en-us/sql/relational-databases/backup-restore/create-a-full-database-backup-sql-server?view=sql-server-ver15). ## Backup and restoring application file and encryption keys Follow the below-recommended procedure to configure and restore backup: * To take 'Web Access' files backup, go to Sectona Application drive. * In 'Sectona' folder, zip 'PAM' Folder. * After zipping of the folder is completed, move 'SpectraPAM.zip' file to the Backup folder. * To restore 'Web Access' files, go to Sectona PAM Application drive. * Open Backup Folder and select the last known zip file backup * Unzip the folder and copy the 'PAM' folder. * Go to the Spectra PAM Application folder and replace the existing PAM folder with the copied folder. Ensure you overwrite all the files and folder with it. ## Backup and restoring system configuration Follow the below-recommended steps to configure and restore the backup: * Login to System and select **Platform Configuration** from the product navigator. * Under the System section select **System Status.** * Click on the **Backup** button. * In case you want to take the backup, select the **Backup** option and check the fields for which you need a backup. * Then click on the **Backup** button and a backup file will get downloaded. * In case you want to restore the data, select the **Restore** option. * To upload the backup file click on the **Choose File** button and then on the **Upload File** button. * Click on the **Restore** button and your backup will be restored. ## Backup and restoring video log files Follow the below-recommended steps to configure and restore the backup: * For video log file backup, it is recommended to configure the video log folder in an external backup solution for timely and incremental backup at least once daily. * For restoring the video log files, it is simple to restore the same. Retrieve the desired folder which is maintained in Year/Month/Day format from the external backup solution and copy it to the default location of the Sectona session log drive. Now login to PAM with an admin login to view and play the recording of the restored log under **Session View** tab. ## Archiving video logs * Login to System and select **Platform Configuration** from the product navigator. * Under the System section select **System Status.** * Click on **Backup**. * Click on **Enable Backup.** In the **Backup File Name** section, fill in the **Backup File Name Prefix** as to what should be the prefix of the backup file to be created. The **Backup File Name** will be the file name of the backup created. The **Local Backup Directory** will be the location of the backup to be stored. * Click on **Auto Archival**to enable the configurations for archival. * In the **Archival** section, the **Archive Older Than**signifies that the number of days before the mentioned number should be considered for the backup archiving process. Example: If you mention 1 day in this field, the system will archive all the backups exactly one day before in the allocated archival drive. * In the **Archival** section, the **Permanently Delete** action will permanently delete the backup files which are older than the number of days mentioned in the **Archive Older Than**field. * In the **Archival** section, the **Move To Another Location** action will move the backup files from the path mentioned in the **Storage Path** to the path mentioned in the **Move To Another Location**field. * Click on **Save**. --- version: "6.0" variant: "On-Premises" language: "en" --- # Biometric The system integrates with Biometric Devices for multi-factor authentication. Currently, the system supports two types of biometric authentication devices available to securely login as a user. These are the Mantra MSF100 and the Morpho 1300 E3. It requires two scans to be enrolled after the user attempts their first login configured with this type of MFA. With every other login attempt the fingerprint is scanned and validated for successfully accessing the system. ## Before you begin * Make sure the user has hardware device drivers installed. * The service for that particular driver is running. ## Configuring Biometric Authentication with Sectona To configure Biometric Authentication on Sectona, follow the below steps: * Login to PAM as an administrator. * Go to **Platform** **Configuration** under the Authentication column and click on **Multifactor Authentication** → **Biometric Devices**. * Click on **Active**to activate the configuration. * Click on the + symbol and select the type of biometric device. * Click on **Save** and Biometric Devices MFA will be enabled * Configure a [logon policy](https://docs.sectona.com/pam-technical-documentation/6.0/setting-up-logon-policy.md) that requires biometric authentication. * Select the user that would require this logon policy to login to the system. * On the first login the user would require to setup their fingerprint by clicking on each scan button and scanning their fingerprints on the selected device. * Followed by clicking on **Enroll**. * With every following login attempt, there would only be one fingerprint scan required to validate the system login. --- version: "6.0" variant: "On-Premises" language: "en" --- # Building a High Availability Setup The Sectona Platform provides a Highly Available Privilege Access Management system setup. Building PAM as a system that is highly available (HA) utilizes a clear understanding of your current business and IT needs. A system is said to be Highly Available when it is open to users at all times is considered to be highly reliable i.e. similar to a landline connection or a web app like Email. Implementing a PAM setup that is highly available requires specific sub-systems in place. For optimal performance, certain factors need to be considered, like network downtime, managing traffic without interruptions, and maintaining availability of services. The best way to prevent downtime and eliminate these losses is to adopt a series of best practices that help you to achieve high availability for your services. If any component, system, or a process within that system fails, it compromises the system as a whole and affects its operations, and can cause it to fail. In this guide, High Availability (HA) refers to a failure response mechanism that eliminates this type of system failure which is called Single Point of Failure (SPoF). This prevents the system from going down when one component or server fails. Systems nowadays expect HA to recover normal operations in a few minutes while ensuring minimal or no data loss. The Sectona Platform offers multiple High Availability scenarios and options to design your HA strategy for solutions implemented in your environment. This section guides you to achieve quick results and design an HA strategy according to our recommended best practices. Implementing a configuration of a secondary server, disaster recovery, application proxy, and fail-over are components that make the Sectona Platform a highly available PAM system. This guide is intended for teams installing or using the Platform in order to configure it as an HA system; this can be detailed in the following sections:- * [Key Concepts and Components of a High-Availability System](https://docs.sectona.com/pam-technical-documentation/6.0/key-concepts-and-components-of-a-high-availability.md) * [Availability Consideration for Platform Components](https://docs.sectona.com/pam-technical-documentation/6.0/choosing-an-architecture-for-ha-dr-requirements.md) * [Configuring Sectona Web Access for High Availability](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-sectona-web-access-for-high-availabili.md) * [Configuring Vault for High Availability](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-vault-for-high-availability.md) --- version: "6.0" variant: "On-Premises" language: "en" --- # Availability Consideration for Platform Components This section covers the following topics: * [Understanding your Business Continuity Requirements](https://docs.sectona.com/pam-technical-documentation/6.0/choosing-an-architecture-for-ha-dr-requirements.md#ubcr) * [Understanding Scalability requirements](https://docs.sectona.com/pam-technical-documentation/6.0/choosing-an-architecture-for-ha-dr-requirements.md#usr) * [Component wise high availability \& scalability options](https://docs.sectona.com/pam-technical-documentation/6.0/choosing-an-architecture-for-ha-dr-requirements.md#cwhaso) ## Understanding your Business Continuity Requirements Business continuity includes High Availability (HA) and Disaster Recovery (DR). HA focuses on eliminating Single Point of Failure (SPoF) by providing a fully automated failover to a backup system. DR preserves the continuity of service after a disruptive event such as a fire or earthquake. The purpose of DR is to restore access to technological assets like data and applications. It aims to restore as much as possible in the minimum amount of time. ## Understanding Scalability requirements Scalability refers to the ability of an application or a system to handle a massive volume of workload or expand in response to an increased demand for database access, processing, networking, or other system resources. A scalable system can handle increasing requests without adversely affecting response time and throughput. The web application is said to be scalable if, by adding more hardware resources, the application can linearly take more requests than before. There are two ways of achieving this:- ### *Vertical Scaling:-* The growth of computational power within one operating environment is called vertical scaling. Vertical scaling refers to adding more computing resources (CPU/RAM/DISK) to your server as on-demand. One of the most common examples of Virtual Scaling is buying expensive hardware and using it as a Virtual Machine hypervisor (VMWare ESX). However, even after using virtualization, whenever an improved performance is targeted, the risk for downtimes with it is much higher than horizontal scaling. #### *Horizontal Scaling:-* Scaling horizontally refers to adding more physical machines to your server or database. It is about adding more nodes in the cluster, reducing the responsibilities of each member node, and providing additional endpoints for client connections. Organizations prefer to scale horizontally to increase I/O concurrency and reduce the load on existing nodes. ## Component wise high availability \& scalability options The below table provides high-level scalability techniques for each component. Consider talking to a professional services team to discuss scalability requirements for your deployment. | **Components** | **Failover / Load Balancing** | **Vertical Scalability** | **Horizontal Scalability** | |----------------------------|----------------------------------------------------------------------------------------|--------------------------|----------------------------------------------------------------------------------------| | Sectona Web Access | * Windows Clustering * External Load Balancer * Internal Load Balancing | Supported | * 1+1 for internal failover * 1+n for external load-balanced | | Vault | * Internal Replication \& Failover * MS SQL Cluster * MS SQL Always-On | Supported | Not Applicable | | Session Proxy \& Web Proxy | Supported via multiple proxy configuration | Supported | 1+1 for failover | | Jump Host | Supported via multiple Jump Host configurations (supported up to 32 Jump Host servers) | Supported | Supported via multiple Jump Host configurations (supported up to 32 Jump Host servers) | | RDP Direct Proxy | Supported via multiple proxy configuration | Supported | 1+1 for failover | | SSH Direct Proxy | Supported via multiple proxy configuration | Supported | 1+1 for failover | --- version: "6.0" variant: "On-Premises" language: "en" --- # Collaborating session You need to share an ongoing session with an additional entity to monitor the ongoing session or to share the ongoing session. ## Before You Begin * Make sure the user has **Session Collaboration** enabled in the user access policy assigned. ## Procedure to Collaborate a session * Login to the system and select PAM from the Product Navigator * Start a session you wish to collaborate with. * On the top right section, click on **Collaborate**. * A Session Collaboration Invite window will pop up. Fill in the Username, Email ID of the recipient, and Comment to the recipient. * Toggle the allow control option, to enable the collaborator to control the screen. * When the recipient clicks on the link received on mentioned email, the entity will be able to collaborate with the ongoing session. --- version: "6.0" variant: "On-Premises" language: "en" --- # Command Restriction for SSH It is important to note that some commands in Unix are extremely powerful in terms of their magnitude of effect. Misuse of such commands may hamper development, maintenance, production or else create a security threat for confidential information. On the other hand, it is difficult to check illicit use of such commands in an IT environment where hundreds of commands are used everyday. Sectona PAM provides a solution to this problem with its Server Access Policy wherein you can restrict or allow the usage of certain commands for specific User Groups. You can choose these commands from the existing library or add to the Command Repository. This chapter will consists of the following: * [Before you begin](https://docs.sectona.com/pam-technical-documentation/6.0/command-restriction-for-ssh.md#a) * [Supported Access Types for Unix to enable](https://docs.sectona.com/pam-technical-documentation/6.0/command-restriction-for-ssh.md#b) * [Creating a server access policy](https://docs.sectona.com/pam-technical-documentation/6.0/command-restriction-for-ssh.md#c) * [Defining privileged commands](https://docs.sectona.com/pam-technical-documentation/6.0/command-restriction-for-ssh.md#d) * [Editing a policy](https://docs.sectona.com/pam-technical-documentation/6.0/command-restriction-for-ssh.md#e) * [Editing a command from library](https://docs.sectona.com/pam-technical-documentation/6.0/command-restriction-for-ssh.md#f) * [Deleting a policy](https://docs.sectona.com/pam-technical-documentation/6.0/command-restriction-for-ssh.md#g) * [Deleting a command from library](https://docs.sectona.com/pam-technical-documentation/6.0/command-restriction-for-ssh.md#h) ## Before you begin * The User Group you wish to allow/deny access already exists. ## Supported Access Types for Unix to enable * SSH * Telnet ## Creating a server access policy * Login to the system and select PAM from the product navigator. * Navigate to Policies on the top navigation bar. * Select Server Access Policy from the sidebar. * Click on the Unix tab. * Click on Add Policy. * Fill in the essentials(Policy details, User Groups and Parameters) in the form that appears. * Policy Details: You need to enter the details of the policy that you require. Click on Next * Policy Name: Provide the name of the policy you want to create. * Description: Enter a short description about the policy. * Type: Selecting *Allow* will let you choose commands that will allowed in a particular static server and the *Deny*option will block the user from using those commands. * Expiry: Set the expiry date of the policy. * User Groups: In the Enforced to User Group(s), specify the User groups you want to apply the server policies on. In the Exception User(s), mention the Users who will be exempted from the server access policy. Click on Next * Parameters: Here, you can select the commands which you want to allow or restrict in your policy. Confirm option will allow you to ask the user who has hit the command saying whether he/she wants to execute the command. The Elevate option will allow the user to elevate the access to the privileged level. Click on Next The Allow permission allows only the selected commands and restricts the rest of the commands. The Deny permission denies all the selected commands and allows the rest of the commands. The Confirm and Elevate options will appear only if the Policy Type is set as 'Allow' in the Policy details. You are free to select both the Confirm and Elevate options, one of them or none of them for a command. This policy works on SSH as well as SSHD sessions. * Summary: This the summary of the configuration made. Click on Finish ## Defining privileged commands Command repository is an inbuilt store that holds all commands, restricted or otherwise. By default, there exists a list of general commands in the Command Repository. To add a new command into the repository follow the steps below: * Login to the system and select PAM from the product navigator. * Navigate to Policies in the navigation bar. * Select the Server Access Policy from the sidebar. * Click on the Unix tab. * Click on Command Repository. * Click on +Add Command Unix. * A page will appear. Fill in the essentials for your new command to be created. * Risk category: According to the nature of the command, choose an appropriate risk category from the ones explained below * Unusual user activity: If the user is performing some unusual activity in the system. * User activity: If a certain user activity is bringing about a risk. * Unusual account activity: If the activities of an account in the system are unusual. * Data theft and ex-filtration: Accessing unauthorized data and retrieving it from a system or server. * Privilege account abuse: When a privileged user ignores the policies or some malicious activity occurs due to unauthorized access. * Accountability risk: Someone is responsible for stealing the data from the system or server. * Identity theft: Someone pretends to be someone else in order to get the access. * General: Some misbehavior of the activities due to user performing it wrongly. * Leapfrogging: Using system vulnerabilities to leap across barriers for unauthorized access. * Command: Specify the command * Command description: Describe the command description * Asset command type: The command type may vary from the choice you made. * Administrative * Backup * Configuration * Remote access * Click on Save. ## Editing a policy * Login to the system and select PAM from the product navigator. * Navigate to "Policies" in the navigation bar. * Select the "Server Access Policy" from the sidebar. * Click on the Unix tab. * A list of existing Server Access Policies for Unix will be displayed on the screen. * Click on to the edit button next to the policy and make necessary changes in the form that appears. * Click on the "Finish" button and your policy design will be updated. ## Editing a command from library * Login to the system and select PAM from the product navigator. * Navigate to the "Policies" option in the navigation bar. * Select the "Server Access Policy" from the sidebar. * Click on the Unix tab. * Click on the "Command Repository" button and a list of existing commands will be displayed. * Click on the edit button of the command you want to modify. Make necessary changes. * Click on to the update button and your Unix command is been updated. ## Deleting a policy * Login to the system and select PAM from the product navigator. * Navigate to the "Policies" option in the navigation bar. * Select the "Server Access Policy" from the sidebar. * Now you will find three options: Unix, Windows and Database. * As the new page open you will find the list of existing server access policies. * Click on to the delete icon in the last column and the form design will be deleted. ## Deleting a command from library * Login to the system and select PAM from the product navigator. * Navigate to the "Policies" option in the navigation bar. * Select the "Server Access Policy" from the sidebar. * Now you will find three options: Unix, Windows and Database. * Click on the "Command Repository" button and the list of existing commands created will be in front of you. * Click on the edit button of the commands which you want to delete. * Click on the delete button and your Unix command will be removed from the list. If there are any changes made in the policy when a session is started, one needs to restart the session again to implement those changes. ### Related How-to Articles * [Create a Server Access Policy for Unix](https://docs.sectona.com/pkb/create-a-server-access-policy-for-unix.md) * [Set an expiry date for a Server Access Policy](https://docs.sectona.com/pkb/set-an-expiry-date-for-a-server-access-policy.md) * [How to add commands to Command Repository?](https://docs.sectona.com/pkb/how-to-add-commands-to-command-repository.md) --- version: "6.0" variant: "On-Premises" language: "en" --- # Configure Azure Entra ID Account Password Reset This section explains how to configure password reset for Azure Entra ID accounts in Sectona PAM. It provides the required configuration to securely reset and manage user passwords in Azure Entra ID. * [App Registration in Azure](https://docs.sectona.com/pam-technical-documentation/6.0/configure-azure-entra-id-account-password-reset.md#Configure-App-Registration-in-Azure) * [API Permission for Application Registration](https://docs.sectona.com/pam-technical-documentation/6.0/configure-azure-entra-id-account-password-reset.md#Configure-API-Permissions-for-the-Application-registration) * [Configure AD and Directory Store in PAM](https://docs.sectona.com/pam-technical-documentation/6.0/configure-azure-entra-id-account-password-reset.md#Configure-AD-and-Directory-Store-in-PAM-for-Azure-Entra-ID) ## **Configure App Registration in Azure** * Register a new application in App registration. ![image-20260910-064727.png](https://docs.sectona.com/__attachments/a_b223d554f9639e588ce6b08a987a1616a6e28b4bceda7e1a0838daed9888a29b/image-20260910-064727.png?cb=8d68a4d2119cde2b6f13a3df73dd47b8) * Enter an application Name, select Accounts type (Single tenant only), and click Register to create the application. ![image-20260910-064811.png](https://docs.sectona.com/__attachments/a_eeef65bffb06ea6d2229777e962fdf69ff8e24c605503bd9172343de8b0497e5/image-20260910-064811.png?cb=ec80caf019cb29fa75479971ed46c226) **If the application must reset user passwords across multiple tenants, create a separate app registration in each tenant.** * The application is created successfully. ![image-20260910-064851.png](https://docs.sectona.com/__attachments/a_580dbec4b736786860d851e222ed132112d64fd5646d1a0364c7210339859cc6/image-20260910-064851.png?cb=9f973c1f6dd59ac293812b3ed1db0c0b) * Create a client secret for the application registration and securely store its Secret value. ![image-20260910-064927.png](https://docs.sectona.com/__attachments/a_6378cd132668247bf173a26c39b09c048a4acded12dea79f23bab01e8d9a2329/image-20260910-064927.png?cb=d94d225cf6145387ab47f7a10c7ee840) ## Configure API Permissions for the Application registration ### **Method 1: Configure API Permissions for All Entra ID Users** * Go to Password Reset Application → Manage → API permissions. * Click Add a permission → Microsoft Graph → Delegated permissions. * Select User.Read and add the permission. ![image-20260910-065055.png](https://docs.sectona.com/__attachments/a_ae54855ca88fef23a10b45f6cd5b21eb7daa09fa5991d587f4577daca1c7d94e/image-20260910-065055.png?cb=3f0e0901e4dfee9e678f8c11930ace6e) * Click Add a permission → Microsoft Graph → Application permissions. * Select Directory.Read.All and User-PasswordProfile.ReadWrite.All. * Click Add permissions. ![image-20260910-065207.png](https://docs.sectona.com/__attachments/a_d0d55d1d56f760df1d58217510533bec6b2b3b583665c79c10171ada28be499e/image-20260910-065207.png?cb=093956264a0da1258290ea8e56024f03) ![image-20260910-065306.png](https://docs.sectona.com/__attachments/a_aa056029eb35092ea78109e1ac08eb53c7f4ff4b0c13bc9dc43b69fc05dd994a/image-20260910-065306.png?cb=eac44417248979c0261c7a7c53ab8ddf) * Click Grant admin consent for your Default Directory. ![image-20260910-065349.png](https://docs.sectona.com/__attachments/a_e65ca0156a0cd160b76de4ca65cd0ed227675f49bf2452b761e64320d8b6e214/image-20260910-065349.png?cb=29253598d285ccf7a9beee0e3175e076) ![image-20260910-065424.png](https://docs.sectona.com/__attachments/a_9c7ae717c9c25ef1b5fda22dc0503fc9958f8a20feaf91590576de4fa8e08aac/image-20260910-065424.png?cb=0593cf35c0ae1b96dd99e9dcc128fcce) ### **Method 2: Configure API Permissions for Selected Entra ID Users** * **Microsoft Azure license required to access Entra ID configuration. refer the link for details** * **We recommend Method 2 only for configuring password reset in Azure.** ![image-20260816-132230.png](https://docs.sectona.com/__attachments/a_d072b66955420bffd3cb24d263ab41106e13ee30542bdb197310e41545a5315e/image-20260816-132230.png?cb=89f6847fe027133d430b22aaea7fbacc) * Verify that the required API permissions are configured for the application registration. ![image-20260816-133302.png](https://docs.sectona.com/__attachments/a_78115c08ba4cb6c0dc8a8b00805bee5782458258150493f740a438a9033893a1/image-20260816-133302.png?cb=61de30268a2314ecf4f9c0c134a6b321) * Go to Subscriptions and select the required subscription. * Open Access control (IAM) → Add → Add role assignment. * Select the Reader role and click Next. ![image-20260816-133346.png](https://docs.sectona.com/__attachments/a_432173b34a9b0e98dc6f43abe91eeacd0c338b02da144d6048774120f297b077/image-20260816-133346.png?cb=464b372e6ffd37cdb01a3669f6dea6f1) * Select Members, search for and select the required App registration, and click Next. ![image-20260816-133520.png](https://docs.sectona.com/__attachments/a_fae3acb85d78a34028d1be9e53078b42bdad6c6266145821ad75a85218c0ab9e/image-20260816-133520.png?cb=c78b6b030840014411e6b1c747cf804e) * Select the required Assignment duration and click Next. ![image-20260816-134225.png](https://docs.sectona.com/__attachments/a_178193d5e8a14405495ebe4d632585f122653042b5e5eab60d766a6d8a5647ac/image-20260816-134225.png?cb=e2cfe16798f4b816b633f9d6e5de69fe) * Review the role assignment details and click Review + assign. ![image-20260816-134420.png](https://docs.sectona.com/__attachments/a_0e4c31b486a55fd04dfdb0c6925b2e7ba93115bac504ec0b00927556c6a7a873/image-20260816-134420.png?cb=4275e10d3146064ef16f9ddd580cdf55) * Go to Access control (IAM) → Role assignments and verify that the Reader role is assigned to the required App registration. ![image-20260816-134453.png](https://docs.sectona.com/__attachments/a_8c6a2c6d1ad01e5cf6a75cf62eb444a14de76d11b347b9927c3edf769449ffb5/image-20260816-134453.png?cb=c0cad6d54659674f177c99915d153127) * Create a new Administrative Unit in Microsoft Entra ID. Enter the Name and Description for the Administrative Unit, then click Next. ![image-20260816-134527.png](https://docs.sectona.com/__attachments/a_1d3b4564e54c17a6840e867023042e314d469176c53fb4b67b67b12d55356eea/image-20260816-134527.png?cb=aee6c138bec8785c9b693b0501f3bd88) * Review the Administrative Unit details and click Next: Review + create. ![image-20260816-134656.png](https://docs.sectona.com/__attachments/a_603433d5eacba8bc4bb34a81c1dc52d57e5afd4ff5decf902688c2361fe244ec/image-20260816-134656.png?cb=2a510cc7c893557e220b2130abda36a2) * Review the Administrative Unit details and click Review + create. ![image-20260816-134842.png](https://docs.sectona.com/__attachments/a_a5e4ea20639102964885d26c1e4f03465a9d92bc1bafa1c1265ad66907dc3a07/image-20260816-134842.png?cb=2689352da7f8952dbbe99c7de051bd92) * Open the Administrative Unit → Users → Add members. ![image-20260816-135327.png](https://docs.sectona.com/__attachments/a_cefc1c573513335d32b3f1fcedaef310295d966e47eef8a26e2f10afcff2ba5a/image-20260816-135327.png?cb=d8fc56981a6bd381a1cb8512db4a53c6) * Go to Roles and administrators and select the role that matches your requirements. * Assign Password Administrator role - Reset passwords for Non-Administrators and Password Administrators. ![image-20260910-070107.png](https://docs.sectona.com/__attachments/a_b4f123de7d60ad234cae4b80d370542de91dce3a36d22d35a1c726f86800c3d7/image-20260910-070107.png?cb=98355413a94fb4efa84db56200f25e29) * Assign the Privileged Authentication Administrator role to reset passwords for Non-Administrator and Administrator accounts. ![image-20260816-135455.png](https://docs.sectona.com/__attachments/a_81ddff360cada67ba1d73abf1963abe4d2640251c1eff16c1cb479584dcaa8ad/image-20260816-135455.png?cb=e62f19ad6ca6e9d8dd89885a98704a6d) * Click Add assignments. ![image-20260816-135619.png](https://docs.sectona.com/__attachments/a_5340975e168ab3b6e1b8fbd8fefba362695c2c90a42a8006b76c3a0eea208107/image-20260816-135619.png?cb=9705b9b69c52b4d453e628c4c4438948) * Search for the application, select it, and click Next. ![image-20260816-140423.png](https://docs.sectona.com/__attachments/a_10a4fcfd839284de714cedace1915029f0bcbb4162f77bf18ec18577ac69a5d3/image-20260816-140423.png?cb=57bca61da2d11f8d2cff29e82ee93f50) * Review the assignment settings, enter the required justification, and click Assign to complete the role assignment. ![image-20260816-140457.png](https://docs.sectona.com/__attachments/a_836888cc9da0575da5651b8ca30077e1db6bfd0041a7f2bed7fd06648db39997/image-20260816-140457.png?cb=6221f9a34c379d8fd3280880745f4f86) ## **Configure AD and Directory Store in PAM for Azure Entra ID** * Open Platform Configuration. * Select Authentication -\> AD \& Directory Store -\> Add Directory Store. * Select Azure as the Authentication Type. * Select Entra ID as the Directory Store Type. * Enter the required details and select Save. ![image-20260816-140839.png](https://docs.sectona.com/__attachments/a_2cfab2f62033442d203fbf86b7a93b82b8ecb32adfa93625d45dcf93f34a3c6b/image-20260816-140839.png?cb=5b24d308932b6a592376511bf0a4a926) * **Configure the Application (Client) ID and Directory (Tenant) ID in the Directory Store Configuration in PAM using the values from the App Registration window.** * **Configure the Client Secret Value in the Directory Store in PAM using the value from Certificates \& secrets.** --- version: "6.0" variant: "On-Premises" language: "en" --- # Configure Email settings Sectona Privileged Access Management system uses email services to send out alerts and notifications using standard SMTP settings. \& POP3 settings for receives emails responses to workflow approval requests. This section describes the standard procedures for integrating system with SMTP server. * [Steps to configure SMTP settings](https://docs.sectona.com/pam-technical-documentation/6.0/configure-email-settings.md#scss) * [Steps to configure POP3 settings](https://docs.sectona.com/pam-technical-documentation/6.0/configure-email-settings.md#scps) ## SMTP (Simple Mail Transfer Protocol) SMTP stands for Simple Mail Transfer Protocol, and it's a communication protocol that allows users to send and receive emails over the internet. SMTP is a standardized method for delivering emails, and it's supported by most email processing servers. If the recipient's server is temporarily unavailable, SMTP queues the email for retrying later. Modern SMTP requires authentication (username and password) to prevent unauthorized email sending and spam. ### Steps to configure SMTP settings * Login to System and select **Platform Configuration** from the product navigator. * Under **General Configuration** section select **Email Gateway** → **Outgoing (SMTP)**tab. * In the **SMTP Server** box, enter the IP address of the SMTP server that will deliver emails generated by the system. * In the **SMTP Port** box, enter the port number that the SMTP server will use. The default port used is port 465. * In the **Timeout** field, enter any value if you like the SMTP service to wait for a response. By default, the system uses 60 secs. * In the **Connection Security** field, if you wish to enable any implicit or explicit security settings, select accordingly, or select none if you are unsure. * If your SMTP requires authentication, perform one of the following actions: * If your SMTP server uses authentication, fill in the username and password boxes. * If your SMTP server is not configured to send authentication credentials, leave the username blank * In the **Signature** box, enter the details you wish to include in all emails sent out. * In the **Network Proxy** box, select the network proxy if your SMTP server is not directly connected with Sectona Web Access. * **Message Style** can be modified as per general HTML style tags and can be further customized. `%EmailMessage%` must be placed to display content. * In **Outgoing Domain Whitelisting**, you can define a list of comma-separated email domains. You will be allowed to send emails only to the aforementioned email domains. * Click **Save**. ## POP3 (Post Office Protocol v3) POP3 is used to retrieve emails from a mail server to an email client. POP3 downloads emails from the server to the client, allowing offline access. it provides access to the mail inbox stored in the email server. Its a type of pull protocol that connects to a server at regular intervals to receive events which in this case would mean emails. ### Steps to configure POP3 settings * Login to System and select **Platform Configuration** from the product navigator. * Under **General Configuration** section select **Email Gateway** → **Incoming (POP3)**tab. * In the **POP3 Server** box, enter the IP address of the POP3 server that will send and recieve emails generated by the system. * In the **POP3 Port** box, enter the port number that the POP3 server will use. The default port used is port 995. * In the **Timeout** field, enter any value if you like the POP3 service to wait for a response. By default, the system uses 60 secs. * In the **Connection Security** field, if you wish to enable any implicit or explicit security settings, select accordingly, or select none if you are unsure. * If your POP3 requires authentication, perform one of the following actions: * If your POP3 server uses authentication, fill in the username and password boxes. * If your POP3 server is not configured to send authentication credentials, leave the username blank * If your POP3 server is configured you would need OAuth20 Configuration. This option will visible only when OAuth20 option is selected in Authentication Method drop down list. Details with provider set to Microsoft and 5 configuration values Config1 ) URL to generate access token Config2 ) ClientID generated on microsoft portal Config3 ) ClientSecret generated on microsoft portal Config4 ) TenantId generated on microsoft portal Config5 ) Scope defined in [Microsoft portal](https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth). * In the **Network Proxy** box, select the network proxy if your SMTP server is not directly connected with Sectona Web Access. * Tick the **Function Points** checkbox to allow Email Workflow Approval. * Specify approval keywords in **For Request Approval** textbox. * Specify rejection keywords in **For Request Rejection** textbox. * Click **Save**. ## IMAP * Login to System and select **Platform Configuration** from the product navigator. * Under **General Configuration** section select **Email Gateway** → **Incoming (POP3)**tab. * Administrators can select either **IMAP** by toggling the optionfor **Use IMAP (Instead of POP3)**protocol when configuring the Incoming Email Gateway. * The remaining details can configured are identical to the POP3 configuration. --- version: "6.0" variant: "On-Premises" language: "en" --- # Configure & Implement ## Getting Started This guide is intended for configuring \& implementing Sectona PAM. It provides detailed instructions for deploying and setting up the product in your environment. It also lists all the product requirements, necessary rights, and permissions for the installation and audit configuration processes. This guide consists of the following chapters: * [General Configurations](https://docs.sectona.com/pam-technical-documentation/6.0/general-configurations.md) * [Configuring user authentication](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-user-authentication.md) * [Configuring the setup for Password Rotation in Windows and Unix Privilege Account](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-the-setup-for-password-rotation-in-win.md) * [Configure Azure Entra ID Account Password Reset](https://docs.sectona.com/pam-technical-documentation/6.0/configure-azure-entra-id-account-password-reset.md) * [Securing \& Monitoring Sessions](https://docs.sectona.com/pam-technical-documentation/6.0/securing-monitoring-sessions.md) * [Integrating Ticketing Systems](https://docs.sectona.com/pam-technical-documentation/6.0/integrating-ticketing-systems.md) * [Configuring Multi-factor authentication](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-multi-factor-authentication.md) * [Working with multi-tenant environment](https://docs.sectona.com/pam-technical-documentation/6.0/working-with-multi-tenant-environment.md) * [Backing up, Restoring, and Archival](https://docs.sectona.com/pam-technical-documentation/6.0/backing-up-restoring-and-archival.md) * [Configuring Notifications](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-notifications.md) * [Configuring Satellite Vault for break glass](https://docs.sectona.com/pam-technical-documentation/6.0/configuring-satellite-vault-for-break-glass.md) * [Forwarding Logs](https://docs.sectona.com/pam-technical-documentation/6.0/forwarding-logs.md) [Next Page](https://docs.sectona.com/llms-full.txt/1)