Configure Privileged Access Management in Cayosoft Administrator

Overview

Cayosoft Administrator provides a web query called My AD Memberships with TTL to allow limited time-to-live membership in AD groups. The web query builds upon dedicated web actions used to join and leave groups. Additionally, the web query supports granting and revoking time-to-live membership for linked users. This article describes a scenario for setting up the feature in your environment.

Scenario overview

A team manager runs the operations team. Within the team, there are two distinct role groups in Active Directory:

• Infrastructure operations

• Help desk

If a user from either group requires elevated permissions, the manager grants them by adding the user to an elevated permission group for limited time-to-live using the Join Groups (TTL) web action. The following requirements must be met:

• The user to receive the elevated permissions is linked to the manager via an attribute in Active Directory to verify their eligibility.

• The permanent role group is linked to the elevated permission group via an attribute in Active Directory. If a user is a member of the role group, they are eligible to join the elevated permission group.

The manager can grant the permissions for a specific period of time. The administrator defines the duration via the Allowed periods setting in the Cayosoft Administrator console. When the period runs out, the affected user is automatically removed from the elevated permission group, withdrawing the permissions.

NOTE    If the user is removed from the role group, they become ineligible to join the elevated permission group. If the user is removed from the role group while their elevated permissions are active, they keep the permissions until the current period ends, unless the team manager uses the Leave Group (TTL) web action.

Prerequisites

• The Privileged Access Management forest feature must be enabled.

Setup

Set up the following items in Cayosoft Administrator console to implement the scenario in your environment:

• Active Directory extension.

• My AD Memberships with TTL web query

• Discover Groups (TTL) object picker

• Join Groups (TTL) web action

• Leave Group (TTL) web action

Additionally, link items in your AD environment to use eligibility checks.

IMPORTANT    This article does not cover the delegation setup. For additional information, refer to the following article: Role-based delegation.

Setting up linked accounts and groups

• To manage TTL membership in linked accounts, you must first link the users to the team manager. Linking is performed using a separate AD attribute; in this scenario, the msExchExtensionCustomAttribute1 attribute is used. In a user account, edit the msExchExtensionCustomAttribute1 attribute to state the domain name and the objectGUID of the team manager. E.g., specify testing.cayosoft.net|030a4326-4d63-4af1-a952-5d9a08ee9343 in the msExchExtensionCustomAttribute1 attribute of a user account to indicate that the manager with the 030a4326-4d63-4af1-a952-5d9a08ee9343 objectGUID is located in the testing.cayosoft.net domain.

• To allow the join action based on the group membership, you must first link the elevated permission group to the role group. Linking is performed using a separate AD attribute; in this scenario, the msExchExtensionCustomAttribute1 attribute is used. In the elevated permission group, edit the msExchExtensionCustomAttribute1 attribute to state the domain name and the objectGUID of the role group. E.g., specify testing.cayosoft.net|e97ff949-af9d-4e2f-9b7c-68254485101c in the msExchExtensionCustomAttribute1 attribute of the elevated permission group to indicate that linked users must be members of the role group with the e97ff949-af9d-4e2f-9b7c-68254485101c objectGUID in the testing.cayosoft.net domain to join.

IMPORTANT    The msExchExtensionCustomAttribute1 attribute is used in both cases for the purposes of this article. You can use any attribute in manager account−linked account and role group−elevated permission group pairs to link them.

Refer to the list of supported formats for attribute values:

• Domain|objectGUID

• Domain|{objectGUID}

• Domain|objectGUID without dashes

• objectGUID

• {objectGUID}

• objectGUID without dashes

Enabling the web query

In Configuration > Connected Systems Extensions > Active Directory, navigate to Privileged Access Management.Select the Support time-to-live memberships checkbox and click Save changes. Reopen the console to set up the web query.

Setting up the web query

Define the following settings in the web query:

• Set up the web query to limit the scope, define properties to display, filter items for your needs.

• In the Linked accounts section, enable the Resolve linked accounts setting. In the Query criteria setting, specify the following expression:

  Copy

  {msExchExtensionCustomAttribute1 -eq $filterValue}

  The expression returns accounts that match the objectGUID value of the manager.

• In the Initialization script section, specify the following expression:

  Copy

  { $global:filterValue = "$(GetDomainDNSName $SelfServiceIdDN)|$ImpersonatedAccountId" }

  The script builds the filter value from the signed-in manager domain and objectGUID in the domainName|objectGUID format.

Setting up the object picker

The Discover Groups (TTL) object picker defines where the user can search for eligible groups.

• In the Role group scope setting, specify an OU that holds the target, elevated permission group. Only one OU can be defined.

• In the Link attribute setting, specify the attribute that holds the objectGUID value of the role group. For the purposes of this scenario, the msExchExtensionCustomAttribute1 attribute is used.

• In the Shadow principal domain setting, specify the managed domain in a forest that holds shadow principal targets in CN=Shadow Principal Configuration,CN=Services. Use this setting when target, elevated permission groups and shadow principals are in different domains. Alternatively, you can select None to target regular groups within the same scope defined in the Role group scope setting.

• In the Initialization script setting, paste the following script:

  Copy

  {
    function global:Convert-StringToGuid($strGuid)
    {
      return [Guid]::new($strGuid)
    }
  }

  The script is required to convert the GUID value in the attribute to actual objectGUID format.

Setting up the join/leave actions

The Join Groups (TTL) and Leave Group (TTL) web actions are similar to their non-TTL counterparts. The Join Groups (TTL) web action lets users choose a membership duration.

• In the Join Groups (TTL) web action, define time-to-live options in the Allowed periods setting to let a user join a group. When you specify multiple options separated by commas, the end user gets a list of options to pick from. For example, specify 1,3,5 to allow users to join a group for a period of 1 hour, 3 hours, or 5 hours. Only whole values are allowed.

Using the web query

1. In your browser, open your Web Portal. Log in as a manager.

2. In the left pane, locate and open the Self-Service > My AD Memberships with TTL web query.

3. To manage linked accounts, expand the drop-down list in the Filter > Account section. The list contains all linked accounts. When you pick an account and click Search, the results show group memberships of the linked account.

4. To add the linked account to the group, pick it from the drop-down list, and click Join Groups (TTL) in the right-pane. In the new window, select Discover groups to find all groups eligible for joining. Click Search objects to display all eligible groups.

5. Select a group and click OK. In the Time to live field, select how long the membership will last.

6. Click Join to finish the enrollment.

7. To end a group membership, highlight a TTL group and click Leave Group (TTL) in the right pane. Confirm the action by clicking Leave.