Example: Install Bravura Privilege Pattern and onboard a system vault
This procedure describes how to install a Bravura Privilege Pattern component, a scenario component, create a team, onboard a system vault and add users to that vault.
A System vault represents systems in the environment and allows you to store account information without a connector or technical integration.
Install the components
This example requires the following components:
RefBuild.pam_team_management.
Scenario.pam_system_type_vault.
Configure the Corporate AD target system
Click Manage the system > Resources > Target systems > Manually defined .
Select the Corporate AD target system.
Click Change next to the Address field and enter the domain for your environment.
Click Continue.
Click Update.
Click the Credentials tab.
Enter your target’s credentials.
Click Update.
Click Maintenance > Auto discovery Execute auto discovery.
Click Continue.
Create and set up a team
Create a team administrator:
Click Manage the system > Policies > User classes .
Select the PAM_TEAM_ADMINS.
Click the Explicit users tab.
Click Select .
Search and select a user.
Click Add.
This user can now log in and create, delete and manage teams.
Log into Front-end (PSF) as the team administrator.
Click Manage Resources.
The Pre-defined requests page is displayed.
The team administrator can create, delete and manage teams using these pre-defined requests.
Click Team: Create.
Bravura Security Fabric displays the team creation wizard
Enter the following information:
Team Name: Vault-Management-Team
Team Description: Team to manage system vault
Click Next .
Add seven groups. Use the ”More” icon to add more team name fields to the list.
Team Trustees Users who can make team management requests.
Account Trustees Users who can make account management requests (onboard accounts).
Approvers Users who allow or disallow access requests.
Auto Approved Users who can check-out access to systems and accounts without making an access request.
Requesters Users who can make access requests.
Credential_Managers Users who can override or randomize the stored password on a checked-out account.
System Trustee Users who can make system management requests (onboard systems).
Vault Trustees Users who can make vault management requests.
Click Next and add team descriptions.
Click Next .
Assign privileges to the team groups:
Team Trustees Team trustees
Account Trustees Account trustees
Approvers Approvers
Auto Approved Auto_Approved and requesters
Requesters Requesters
Credential Managers Requesters and Credential_manager
System Trustees System trustees
Vault Trustees Vault trustees
The Credential_Manager privilege allows a user to override or randomize the stored password on a checked-out account.
Click Next .
Set the initial team trustees for the new team. There must be at least one team trustee to create a team.
Click Submit.
Bravura Security Fabric notifies authorizers to review the request if required.
Click the View request link at the top of the page to view the status of the request.
Once the request has been approved, the team will be configured.
Add users to the additional groups in the team.
Log into Front-end (PSF) as a team trustee.
From the home page, click Manage resources.
Click Team: Manage Group Membership.
Select the Vault-Team.
Click Next .
Select the Account Trustees, Approvers, Auto Approved, Requesters, System Trustees, Vault Trustees, Credential Managers and Team Trustees groups.
Click Next .
Add members to each team group.
Click Submit.
Bravura Security Fabric notifies authorizers to review the request if required.
Click the View request link at the top of the page to view the status of the request.
Once submitted and approved, the group’s membership will be updated to include the selected users.
Onboard a system vault
Log into Front-end (PSF) as the system trustee for the vault-management-team.
Click Manage Resources.
The page is displayed.
Click System: Onboard.
Select the Vault System type from the drop-down menu.
Click Next .
Enter the System FQDN. A system vault will be created with this name.
Select the System Team to manage the system vault.
Click Submit.
Bravura Security Fabric notifies authorizers to review the request if required.
Click the View request link at the top of the page to view the status of the request.
Once the request has been approved, trustees can manage accounts on this system.
Create vault users
Log into Front-end (PSF) as the vault trustee for the vault-management-team.
Click Manage Resources.
Click Vault Account: Create.
Select the Vault:system-vault managed system.
Click Next .
Enter the account information:
Account Name
Managed Password
Click Submit.
Bravura Security Fabric notifies authorizers to review the request if required.
Click the View request link at the top of the page to view the status of the request.
Once the request has been approved, users assigned the requester or auto-approved privileges in the Vault-Management-Team can now check out this account and view the password.