Skip to main content

Self-service system management

Users with the "System Trustees" privilege can use self-service requests to onboard, update, and offboard systems managed by Bravura Privilege .

System trustees have access to the following pre-defined requests:

Onboarding a system

Users assigned as system trustees can use the System: Onboard request to onboard a system.

Click below to view a demonstration:

  1. From the home page, click Manage resources.

  2. Click System: Onboard.

  3. Select a System Type from the drop-down menu.

    Valid system types depend on the scenario components installed, and can include:

    • CentOS

    • Windows Server

    • Oracle

    • MSSQL

    • Vault System

    • Red Hat Enterprise Linux

    • SUSE Linux

    • Solaris 10+ Server

    Vault systems are null targets that can be used to simulate a target system that cannot be targeted another way.

    3406.png

    Click Next .

  4. Enter system onboarding details. including the System Team, the team that will be able to access the system. Depending on the system type, other attributes may include:

    • System FQDN The system’s fully qualified domain name

    • System Team the team that will be able to access the system

    • System Instance ID (Oracle)

    • System Port Format: 1-65535

    • Zone The proxy zone or network (Windows, optional)

      See Example: Expose the ZONE attribute for an example of how to configure this attribute.

    • Connect using managed account (Windows, optional)

      See Example: Expose the USE_MANAGED_CREDENTIALS attribute for an example of how to configure this attribute.

    3407.png

    Click Next .

  5. Enter System onboarding credentials as required.

    For Windows systems, if Connect using managed account was selected in the previous step, you must enter the account ID to use for target system credentials.

    3408.png
  6. Click Submit.

    Bravura Security Fabric notifies authorizers to review the request if required.

  7. Click the View request link at the top of the page to view the status of the request.

Once the request has been approved, account trustees can manage accounts on this system. Systems are onboarded in real time; there is no need to wait for auto discovery to load the system into the database.

API automation for system onboard

Once the API has been configured (See ”SOAP API” in Bravura Security Fabric Remote API (api.pdf) and your script has been authenticated to the API (Login or LoginEx API calls), the WF API calls can be used to create an API request.

Use the WFPDRSubmit function to create a workflow request and submit the request for publishing.

When submitting a request, use "ONBOARD_SYSTEM" as the PDR ID. The request uses the following attributes:

attrkey

value

SYSTEM_TYPE

The system type:

  • CENTOS for CentOS

  • WINNT For Windows Server

  • ORACLE for Oracle

  • MSSQL for SQL Server

  • SYSTEM VAULT for Vault System

  • REDHAT for Red Hat Enterprise Linux

  • SUSE for SUSE Linux

  • SOLARIS for Solaris 10+ Server

FQDN

The fully qualified domain name of the system to be onboarded.

INSTANCE

Optional: System Instance ID (Oracle system type only).

PORT

Optional: System port (format: 1-65535)

ZONE

Optional: Proxy zone. Leave it blank if not using proxy server.

MS_TEAM

The team that the system will be assigned to

USE_MANAGED_CREDENTIAL

T to use a managed credential, F to use system credentials.

ADMIN

Administrator ID of the system. Leave it blank if USE_MANAGED_CREDENTIAL is set to T.

ADMIN_PASS

Administrator password of the system.

SYS_UUID

A universally unique identifier that will be used as the target ID of the onboarded system (Optional).

MANAGED_ADMIN

The account GUID of the managed account being used as the admin credential. Leave it blank if USE_MANAGED_CREDENTIAL is set to F.

ONBOARD_SYSTEM batch request sample:

"SYSTEM_TYPE","FQDN","ZONE","MS_TEAM","USE_MANAGED_CREDENTIAL","ADMIN","ADMIN_PASS","SYS_UUID"
"WINNT", "AMS-WIN8-7M9.corp1.domain","none","TEAM-000000","F","Administrator","F00bar123","d39b55f0-7a6a-487a-abe4-bd8c9ec1679c"

Example: Onboard a system

This example shows you how to install an optional scenario component to support Windows system onboarding. Acting as a trustee, we will onboard a system for our team.

Requirements

This example assumes:

  • Bravura Security Fabric and Connector Pack are installed.

  • Bravura Privilege Pattern is installed.

  • Global team groups and privileges are set up.

Click below to view a demonstration:

Install the Windows onboarding and disclosure components

To manage accounts on a Windows workstation, the Windows system type component must be installed. The RDP disclosure component will also be installed as it provides access disclosure to Windows workstations through RDP sessions.

  1. Log in to the Bravura Security Fabric Front-end (PSF) as superuser .

  2. Click Manage Components > Scenario.

  3. Select two components:

    Scenario.pam_system_type_winnt

    Scenario.pam_disclosure_rdp_local_account

  4. Click Install component(s) from the Actions panel on the right.

    The component management program installs the components along with any dependencies. You should see Completed install for component messages for the selected components in the TASK STATUS section of the Actions panel .

Onboard a Windows system
  1. Open another browser tab to Bravura Security Fabric .

  2. Log in to the Front-end (PSF) as cordeh. Since she has the System Trustees privileges for the Windows Account Admins team, she is able to onboard systems to the team.

  3. In the REQUESTS section of the main menu, click Manage Resources.

  4. Select System: Onboard.

  5. In the System Type field, select Windows Server.

  6. Click Next .

  7. Enter the following:

    System FQDN wkstn1.bravura.corp

    System Team Windows Admin Accounts

    lab-onboard-windows

    Click Next .

  8. Add the credentials for the Windows server.

  9. Click Submit.

  10. Click the View request link at the top of the page to view the status of the request.

  11. In the DETAILS panel on the right, click the Request: ID link to review the details of the request.

  12. Next to Display details: check the box for Operations to ensure the onboarding operation is listed as successful.

    lab-onboard-success
    lab-onboard-success2
Verify the managed systems

When a system is successfully onboarded to a team, it will be listed as a managed system in Bravura Security Fabric .

To view the managed systems in Bravura Security Fabric :

  1. Log in to the Bravura Security Fabric Front-end (PSF) as superuser.

  2. Click Manage the system > Privileged access > Managed systems.

  3. Verify that your Windows target system is listed as a managed system.

    lab-onboard-managed

If your onboarded Windows system shows up in the Managed systems list, then you have completed the lab successfully. Systems onboarded through the System: Onboard pre-defined request are automatically added to the ONBOARDED_ACCOUNTS managed system policy. The managed system being part of a managed system policy allows accounts to be managed from that system and onboarded to teams.

Example: Onboard systems using batch request

Onboarding systems can take a significant amount of time when done manually. For this reason, Bravura Security has implemented a bulk request submission component to enable managed system onboarding in bulk using a CSV file containing system details.

This example demonstrates steps of installing the batch request component, building a CSV input file, and then using the CSV file to onboard multiple managed systems.

Install Functional.hid_batch_request_submit
  1. Log in to the Bravura Security Fabric as superuser.

  2. Click Manage components.

  3. Search for Functional.hid_batch_request_submit.

  4. Select the component and click Install.

See Managing components for more on component installation.

Create a CSV file with batch information

Create a CSV file as shown in the API automation for system onboard table.

Run the batch pre-defined request (PDR)
  1. Log in as a profile with permissions to onboard systems to a team.

  2. Click on Manage resources.

  3. Click on the Submit a request batch via CSV request.

  4. Select "System: Onboard" under Pre-defined request to submit.

  5. Enter the batch request reason (Optional).

  6. Select your CSV Request file.

  7. Click Submit.

Confirm the requests have gone through
  1. Log in as a profile with permissions to onboard systems.

  2. Click Requests > All.

  3. Find the most recent batch request and select it.

  4. Click the request link on the top right corner.

  5. On the request details page, select the check box for Operations .

The status should report 0 failed. If this is not the case you will need to troubleshoot the issues logged in idmsuite.log .

Migrating a system to another team

Users who are system trustees of multiple teams can use the System: Update request to migrate a system to another team.

  1. From the home page, click Manage resources.

  2. Select the System: Update request.

  3. Select a managed system.

    3412.png

    Click Next .

  4. Select a team that will take over management of this system.

    3413.png
  5. Click Submit.

    Bravura Security Fabric notifies authorizers to review the request if required.

  6. Click the View request link at the top of the page to view the status of the request.

API automation for system update

Once the API has been configured (See ”SOAP API” in Bravura Security Fabric Remote API (api.pdf) and your script has been authenticated to the API (Login or LoginEx API calls), the WF API calls can be used to create an API request.

Use the WFPDRSubmit function to create a workflow request and submit the request for publishing.

When submitting a request, use ”UPDATE_ONBOARDED_SYSTEM” as the PDR ID. The request uses the following attributes:

attrkey

value

HOSTID

The ID of the system.

DESTINATION_TEAM

The team that the system will be assigned to.

UPDATE_ONBOARDED_SYSTEM batch request sample:

"HOSTID","DESTINATION_TEAM"
"D39B55F07A6A487AABE4BD8C9EC1679C","TEAM-000001"

Offboarding a system

Users assigned as system trustees can use the System: Offboard request to disable, archive or delete a system.

  • Disable involves disabling listing of accounts on the system.

  • Archive involves moving the system and all of its accounts to an archive. All password history for the accounts will be kept. The listing operation for archived systems remains enabled. To disable the listing operation, run the System: offboard request with the "Disable" option.

    Caution

    If systems are decommissioned, and the listing operation is not disabled, it could cause discovery failure.

  • Delete involves removing the system and all of its accounts from the archive. All password history for the accounts will be lost.

    You cannot delete a system that still has managed accounts associated with it.

  1. From the home page, click Manage resources.

  2. Select the System: Offboard request.

  3. Select a managed system and an action to take.

    3417.png

    Click Next .

  4. Confirm that you want to proceed.

    3418.png
  5. Click Submit.

    Bravura Security Fabric notifies authorizers to review the request if required.

  6. Click the View request link at the top of the page to view the status of the request.

Archiving systems via reports

If the team management component has been installed, pre-defined requests to archive or delete onboarded systems can be submitted from the Managed System Summary report. This functionality can be used to perform scheduled offboarding for systems that cannot be offboarded through import rules.

To enable this functionality, the pre-defined request that will offboard managed systems must be available through reports, and the user submitting the request must be a trustee of the team to which the system is attached.

See Reports for more information.

API automation for system offboard

Once the API has been configured (See ”SOAP API” in Bravura Security Fabric Remote API (api.pdf) and your script has been authenticated to the API (Login or LoginEx API calls), the WF API calls can be used to create an API request.

Use the WFPDRSubmit function to create a workflow request and submit the request for publishing.

When submitting a request, use ”ARCHIVE_ONBOARDED_SYSTEM” as the PDR ID. The request uses the following attributes:

attrkey

value

HOSTID

The ID of the system.

OFFBOARD_ACTION

DISABLE to disable listing of the system, DELETE to remove the system.

CONFIRM_ACTION

T to confirm, F to cancel.

REQUEST_TEAM

The team in which its system trustee(s) will be used to authorize the request. See REQUEST_TEAM attribute for more information.

ARCHIVE_ONBOARDED_SYSTEM batch request sample:

HOSTID","OFFBOARD_ACTION","CONFIRM_ACTION"
"D39B55F07A6A487AABE4BD8C9EC1679C","DELETE","T"

The REQUEST_TEAM attribute is the team in which its system trustee(s) will be used to authorize the request. This can be a different value depending on which PDR is used. In some cases, the value is auto filled and in other cases, a value is not required.

PDR ID

API submittable

REQUEST_TEAM required

REQUEST_TEAM auto-filled

BATCH_REQUEST

No

N/A

N/A

CREATE_LARGE_CREDENTIAL

No

N/A

N/A

UPDATE_LARGE_CREDENTIAL

No

N/A

N/A

WEBAPP_DISCLOSURE_CREATE

No

N/A

N/A

WEBAPP_DISCLOSURE_DELETE

Yes

No

N/A

WEBAPP_DISCLOSURE_UPDATE

No

N/A

N/A

TEAM-CREATE

Yes

Yes

Yes

TEAM-DELETE

Yes

Yes

Yes

TEAM-MEMBERS

Yes

Yes

Yes

TEAM-UPDATE

Yes

Yes

Yes

CREATE_VAULT_SYSTEM

Yes

Yes

Not required

ARCHIVE_VAULT_SYSTEM

Yes

Yes

Yes

UPDATE_VAULT_SYSTEM (1 - same team)

Yes

Yes

Yes

UPDATE_VAULT_SYSTEM (2 - transfer)

Yes

Yes

Yes

CREATE_VAULT_ACCOUNT (1 - team vault)

Yes

Yes

Yes

CREATE_VAULT_ACCOUNT (2 - system vault - same team)

Yes

Yes

Yes

CREATE_VAULT_ACCOUNT (3 - system vault - different team)

Yes

Yes

Yes image idm2004

ARCHIVE_VAULT_ACCOUNT

Yes

Yes

Yes

UPDATE_VAULT_ACCOUNT (1 - team vault)

Yes

Yes

Yes

UPDATE_VAULT_ACCOUNT (2 - system vault - same team)

Yes

Yes

Yes

UPDATE_VAULT_ACCOUNT (3 - system vault - transfer)

Yes

Yes

Yes image idm2004

ONBOARD_SYSTEM

Yes

Yes, but not enforced

No

ARCHIVE_ONBOARDED_SYSTEM

Yes

Yes, but not enforced

No

UPDATE_ONBOARDED_SYSTEM

Yes

No

If the destination team is unset or the destination team is the same as the source team

ONBOARD_ACCOUNT

Yes

Yes, but not enforced

No

OFFBOARD_ACCOUNT

Yes

Yes

Yes

UPDATE_ONBOARDED_ACCOUNT

Yes

Yes, but not enforced

No

CREATE_PAMUTIL_API_USER

Yes

No

Not required

image idm2004 improper display of the team in update/archive when the destination team's vault trustee is not in a team owning the vault system. This will be fixed in a future release.