Password Checkout for Just-In Time (JIT) Account

[suresh_ravuri]

We're planning on configuring JIT for MS-SQL DB instances, but the client wants password checkout instead of session checkout. Is it possible ? if so then how to configure it?

[sk]

@suresh_ravuri :  As far as I know, JIT by default is a credential-less account, it is not possible to have credential JIT account. But in latest version you have option to view the password even for credential-less accounts, as an alternate option see if you can use this.

You can enable this in Global Configuration -> PAM -> Allow View Password

After enabling global configuration, you have to enable View Password option on Account Level Config

I would suggest to disable Enable Quick Access Mode with combination above settings so that user don't have to launch the session by default. 

[suresh_ravuri]

@sk Thank you for your response.

how to enable View Password option for JIT accounts ?

[sk]

@suresh_ravuri : I haven't personally used or tested this but try to use the parameter: IDQueryCredentiallessViewPwd in PAM_Config which is actually for credential-less not sure if it works for JIT process/account, but just give it a try.

For details refer: https://docs.saviyntcloud.com/bundle/CPAM-Admin-Guide-v23x/page/Content/L-Manage-Accounts/Manage-Acc...