JIT Domain admin rights and login to Active Directory Controller
0 vote
We have implemented JIT to grant domain admin rights to a select group of our administrators for their privileged account . This right is needed to make a RDP session to a domain controller. At the moment you complete the JIT process to get domain admin rights the privileged account in Devolutions don't have the group claim and you need to restart RDM to get this claim.
In my opinion this is not how this should work.
All Comments (27)
Hello,
Once the JIT process is completed, refreshing the RDM cache with CTRL+F5 should work.
Could you try it and let us know how it goes?
Best regards,
Érica Poirier
I think this needs to be done automatically instead of manual. Is there a way to build this into the software?
Hello,
You can set the Auto refresh option in the Advanced tab of the DVLS data source in RDM. However, we do not recommend setting this parameter with a too-short value because if the DVLS contains too much data, RDM will constantly reload it and freeze.
I understand that this is a workaround as well as the manual cache refresh.
Let me check with the developer team if there is another method.
Best regards,
Érica Poirier
This is not a good option. Right after the JIT request the administrator is logging into the domain controller. This is part of the workflow where you request additional rights to do the action after this right.
Why can't RDM do an automatic refresh after the JIT request?
Hello,
Thank you for your feedback.
At the moment, RDM needs to reload the entries to get the latest permissions set on DVLS, from a JIT process or an update initiated by an administrator. As this process is not automated in RDM, we need to do it manually.
I have moved this thread to the Feature Request section to improve this process.
Let us know if you have any more questions.
Best regards,
Érica Poirier
Hello,
Before going further, I would like to know exactly what your case is and how you are configured. After being granted access to a group, do you receive more permissions on other entries? Is this how you are configured? I agree with you, the system should be able to detect a change in security and refresh that security automatically. Before proceeding, I just want to be sure that you are configured in such a way that when you elevate your account with a specific group, it grants you more permissions on different entries, and these are the entries that you want to access immediately after the check-out.
In your first message, you wrote
This right is needed to make a RDP session to a domain controller.
What right are you talking about here ? The admin right needed in the RDP session or the admin right that will give you access to another entry in the vault to be able to open the session ?
Thanks in advance for helping me understand the exact request.
Best regards,
François Dubois