Announcing the SAVIYNT KNOWLEDGE EXCHANGE unifying the Saviynt forums, documentation, training, and more in a single search tool across platforms. Click HERE to read the Announcement.

PAM_Config

jezzanuena
Regular Contributor
Regular Contributor

Hi Team. We are implementing CPAM, we have successfully configured the AWS PAM connection and got the import jobs working, however, we're lost in PAM_Config and Bootstrapping.

As of now, we are trying to get the CONSOLE part:

{
"Connection": "AWS_PAM",
"encryptionMechanism": "ENCRYPTED",
"maxRequestTime":"10000",
"whiteListedIPs" : "x.x.x.x",
"EVQuery":"ev.customproperty40='AWSPAM'",
"CONSOLE": {
"maxIDRequestableTime": "2592000",
"maxCredSessionRequestTime": "36000",
"maxCredlessSessionRequestTime": "36000",
"shareableAccounts": {
"IDQueryCredentials": "acc.name in ('account1')",
"IDQueryCredentialless": "acc.name in ('account1')"
},
"endpointAttributeMappings": [
{
"column": "accessquery",
"value": "where users.USERNAME is not null",
"feature": "endpointAccesssQuery"
},
{
"column": "allowChangePassword_sqlquery",
"value": "AC.ACCOUNTYPE != 'Platform Service Account'",
"feature": "allowChangepasswordquery"
},
{
"column": "customproperty43",
"value": "PAMDefaultUserAccountAccessControl",
"feature": "accountVisibilityControl"
}
]
}
}

The Bootstrap job result is a success but the PAM setting on the endpoint level did not enable as well as the accounts. Is there anything that we missed?

6 REPLIES 6

Belwyn
Saviynt Employee
Saviynt Employee

Hi @jezzanuena 

Thank you for reaching out to us, 

There are a few checks you can do if you're not viewing any results in the privileged access module post running the bootstrap Job.

1. Did the import of accounts and entitlements into the Saviynt environment run properly from target? 

2. Do you see the mentioned account in the PAM_Config imported into Saviynt? 

In your scenario it's this below highlighted account.

"shareableAccounts": {
"IDQueryCredentials": "acc.name in ('account1')",
"IDQueryCredentialless": "acc.name in ('account1')"
},  

3. If it is not seen in the account in the Saviynt import, then please check if the account is present in the target. 

Let us know if this helps,

Thanks & Regards, 
Belwyn.

jezzanuena
Regular Contributor
Regular Contributor

1. Did the import of accounts and entitlements into the Saviynt environment run properly from target?  YES

2. Do you see the mentioned account in the PAM_Config imported into Saviynt? YES

In your scenario it's this below highlighted account.

"shareableAccounts": {
"IDQueryCredentials": "acc.name in ('account1')",
"IDQueryCredentialless": "acc.name in ('account1')"
},  

Can you please share the output of below query. Replace endpointkey with the key value of endpoint which didn't have PAM Enabled.

select * from endpoints_properties where endpointkey=<endpointkey>


Regards,
Saathvik
If this reply answered your question, please Accept As Solution and give Kudos to help others facing similar issue.

jezzanuena
Regular Contributor
Regular Contributor

Hi @sk

Thank you for checking on this. Here is the result of the query. Please note that the PAM of the endpoint (AWS Console) has been enabled it is just that the accounts declared in the PAM_Config are not being enabled. Below is the properties of the endpoint of the AWS Console.

ENDPOINTS_PROPERTIES_KEYAPPTYPEKEYENDPOINTKEYGOVERNANCEMATURITYPAMCONFIGPAM_ERROR_DESCRIPTIONPAM_RESOURCE_TYPEPAM_STATEPLATFORM_VERSIONPLATFORM_TYPERISKENABLE_SNOW_SHOWFEATURESAOB_CONNECTION_IDENTIFIERS
747{&quot;maxSessionWarnPeriodInSec&quot;:&quot;1802&quot;,&quot;maxReqExpWarnPeriodInSec&quot;:&quot;902&quot;,&quot;maxSessionLimitInSec&quot;:&quot;28802&quot;,&quot;maxConcurrentSession&quot;:&quot;50&quot;,&quot;maxInActiveTimeInSec&quot;:&quot;182&quot;,&quot;maxInActiveWarnPeriodInSec&quot;:&quot;62&quot;,&quot;authenticationType&quot;:&quot;KEY&quot;}No ErrorConsoleENABLEDAWSConsole

Hey couple of things.

  1. In your last comment you mentioned Endpoint level PAM state is enabled but in your query output I see PAM_STATE is blank, If it is successfully enabled PAM_STATE should have value as ENABLED
  2. What is the logic you used in below section which defines which accounts should get PAM ENABLED "shareableAccounts": {
    "IDQueryCredentials": "acc.name in ('account1')",
    "IDQueryCredentialless": "acc.name in ('account1')"
    },
  3. Do you see accountconfig field getting populated for the accounts that you expected to be PAM Enabled, If so can you share the accountconfig details what you are seeing?

Regards,
Saathvik
If this reply answered your question, please Accept As Solution and give Kudos to help others facing similar issue.

NageshK
Saviynt Employee
Saviynt Employee

@jezzanuena 
Was your issue resolved?

You cannot have the same account mentioned in both the Credentialless and Credentials categories. It can only be in one. Additionally, this account should be present in your AWS Account. Do you have an IAM user with the name "account1"?