Unable to update "PAM Enabled" to ON in Endpoint

[piyushm]

I am getting below error on UI when updating the "PAM Enable" button to ON at endpoint level.

The PAM_CONFIG json is also updated in the connection. The connection type is AD. 

[rushikeshvartak]

Can you share PAM_CONFIG ?

[piyushm]

@rushikeshvartak 

{

      "Connection": "AD",

    "maxRequestTime": "10",

      "EVQuery": "",

      "encryptionMechanism": "Encrypted",

      

      "Console": {

            "shareableAccounts": {

                  "IDQueryCredentials": "acc.name in ('')",

                  "IDQueryCredentialless": "acc.name in ('')",

                  "IDQueryServiceAccounts": "acc.customproperty2 in ('')"

            },

            "saviyntVaultConnection": "#############",

            "maxIDRequestableTime": "36000",

            "maxCredSessionRequestTime": "36000",

            "maxCredlessSessionRequestTime": "36000",

            "maxConcurrentSession": "36000",

            "endpointAttributeMappings": [

              {

                  "column": "accessquery",

                  "value": "",

                  "feature": "endpointAccessQuery"

              },

              {

                  "column": "allowChangePassword_sqlquery",

                  "value": "",

                  "feature": "allowChangepasswordquery"

              },

              {

                  "column": "customproperty43",

                  "value": "PAMDefaultUserAccountAccessControl",

                  "feature": "accountVisibilityControl"

              }

            ],

            "accountVisibilityConfig": {

              "accountCustomProperty": "customproperty55",

              "accountMappingConfig": [

                  {

                    "accountPattern": "*",

                    "mappingData": "",

                    "override": "false"

                  }

              ]

            }

      }

}

[Belwyn]

Hi @piyushm 

Thank you for reaching out to us, 

The JSON you have share is for the connection, for the account if you scroll to the end of page you can find (See the Screenshot)

Click edit button and then scroll to the end of page and update your PAM Account Config JSON to something like below :

{"defaultrequestabletimeforidinsecs":"86400","defaultrequestabletimeinsecs":"14400","maxrequestabletimeinsecs":"14400","diffbetweenrequests":"","authenticationType":"","maxrequestabletimeforidinsecs":"86400","Saviynt-Status":{"pamState":"ENABLED","pamType":"CREDENTIALLESS"},"ffidAlertTime":"0"}

Let us know if this helps,

Thanks & Regards, 

Belwyn.

[sk]

Have the configuration attribute under PAM Attributes section have below value

{"maxSessionWarnPeriodInSec":null,"maxReqExpWarnPeriodInSec":"600","maxSessionLimitInSec":null,"maxConcurrentSession":"10","maxInActiveTimeInSec":"300","maxInActiveWarnPeriodInSec":null}

Then you should be able to update PAM enable from UI