Native access disclosure plugins

The pswcmdrun access disclosure plugin is used with account set access requests. It allows users to run commands or scripts on multiple managed systems using managed account credentials.

When a user checks out an account set, Bravura Privilege displays a command execution window if any of the member systems support the run command operation.

Currently the following target systems support the run command operation:

Additional preparation is required before pswcmdrun can run PowerShell commands on a Windows Server / workstation target. See Windows Server in the Connector Pack documentation for details.

If the plugin is enabled but an account set contains no managed system that supports the run command operation, Bravura Privilege displays the following message upon check-out:

You can modify the following default attributes to control the behavior of pswcmdrun :

Command attribute

The pswxcmd access disclosure plugin provides users with access to managed systems by executing an external program and providing credentials. The default program is PuTTY.exe, which opens an ssh/telnet terminal to a Windows machine. The external program must meet the following requirements:

There are three types of command prompt controls; one is specifically for managed accounts, and the other two are for temporary group membership, where the password can either be passed onto the command line, or specified upon connection to the remote server.

You can modify the following default attributes to control the behavior of pswxcmd :

Arguments attribute

The arguments provide substitution of the password, user name, host, and other custom plugin attributes. The substitutions are as follows:

Using custom attributes provides control over the arguments attribute. You can enable the user to override the custom attribute only, while leaving the arguments locked or hidden.

The following are examples of customizations using the pswxcmd access disclosure plugin.

Allow optional arguments

The default settings for pswxcmd execute PuTTY and connect using the privileged password. This example shows how you can add a custom attribute to allow the user to specify the port:

Insert an escalation sequence

You can allow users to insert an escalation sequence into a program (such as PuTTY.exe) using a hotkey or window name.

When a user presses the escalation hotkey, the escalation sequence is automatically typed into the program. By default, the escalation hotkey is Ctrl + K.

To configure the escalation hotkey:

When the window name is detected, the escalation sequence is automatically typed into the program.

To configure the escalation window name:

Impersonating the checked-out account

You can allow the requester to run a program (such as cmd.exe) with the permissions of the checked-out account. This will essentially simulate the runas command.

Set the impersonate attribute to:

Executing a shell script

This example shows how you can configure pswxcmd to execute a shell script:

Executing SQL*Plus

This example shows how you can configure pswxcmd to execute SQL*Plus:

Changing the message to users on failure

You can change the message displayed to users in the event that the external program fails to launch by modifying the RES CONNECTION TO SERVER FAILED MSG setting in the global or managed system policy Account access request options.

This is a preconfigured pswxcmd access disclosure plugin specifically for managed accounts. By default, this plugin is configured to execute PuTTY and connect using the user’s SSH keys instead of the privileged password.

The following requirements must be met:

The following attributes are available:

See Command prompt: pswxcmd for more information on modifying these attributes.

The pswxcopy access disclosure plugin provides users with access to a password by copying it into the clipboard of the client workstation. By default, it is configured to clear the clipboard if the browser is closed or if the default 30 seconds expiry time for the plugin has passed.

You can modify the following default attributes to control the behavior of pswxcopy :

The pswxtsvc access disclosure plugin provides users with access to Windows server or client managed systems and RemoteApp programs using Remote Desktop Connection (RDC). The plugin provides automatic connection to the managed system without requiring the entry of administrative credentials for the managed account. You can also connect to the remote server when accessing group sets. This access disclosure plugin supports Network Level Authentication (NLA) and session monitoring.

There are two versions of the pswxtsvc access disclosure plugin:

The plugin requires the following:

You can modify the following default attributes to control the behavior of pswxtsvc :

The following disclosure attributes are applicable to the Remote desktop access disclosure plugin only:

The following disclosure attributes are applicable to the Remote APP RDP disclosure plugin only. You can obtain these values by viewing the contents of the RemoteApp’s .rdp file.

Authentication prompting

If the managed system you are connecting to is configured to include a prompt for password upon connection, you may notice that the password field is already filled in. You can proceed by clicking OK ; you do not need to specify any additional information.

The password is passed from the disclosure plugin to the RDP client via Windows UI Automation (MSAA).

If you receive a similar error and the password is not populated at all, it's possible that Windows changed the RDP dialog. If you are using a supported version of Bravura Security Fabric

Bravura Security Fabric , contact support so they can look for a possible patch.

The pswxview access disclosure plugin provides users with access to a password by displaying it within the browser. When the secure method is enabled, Bravura Privilege uses JavaScript to decrypt the privileged password embedded in the page. If the insecure method is enabled, the browser can store passwords in plain text in the page source, and users can view the password in browsers that do not have JavaScript enabled.

You can modify the following default attributes to control the behavior of pswxview :

Changing default font and size of viewable passwords

You modify the default font and size of viewable passwords by opening the following files:

passFontFamily: ‘<font_name>'
passFontSize: <font_size>

If the ie directory exists, the file in it will override the global file outside of it.

Split password view

You can split up a password amongst multiple viewers by specifying the pwd split attribute. This takes the form ”n/m” where m is the number of pieces to split the password into, and n is the number of the piece that this instance of the control should display.

For example, 1/2 will display the first half of the password, while 2/2 will display the second half. You can configure a plugin to determine what part of the password a viewer will see. See Using a plugin to define access disclosure plugin . If you don’t intend to use password splitting, you can safely delete the default pwd split attribute.

Use an alternative disclosure plugin, such as Website access disclosure plugins , as Internet Explorer is no longer a supported browser. For information about pswxdom see documentation for 12.5 or older.