PAM checkout takes a long time and/or returns error

Resolved

PAM checkout takes a long time and/or returns error

avatar

Hello,

we are currently experiencing significant issues with RDM and hope that you can assist us.

When connecting a session with PAM credentials, the checkout dialog with JIT group appears, but shortly thereafter we receive a message that the account is already checked out. Prior to this connection attempt, the user was checked in. And even if it was checked out, the connection could be established directly without the checkout dialog. A few points at a glance:

- Current versions: RDM 2025.3.29.0 / DVLS 2025.3.14.0. The problem has only existed since 2025.3.x, but it is unclear exactly since which version, approx. 8 weeks.

- All users use the same RDM version, some locally, some via RDS.

- The problem occurs with different PAM providers, but not always and not with all users.

- When connecting to a session, the PAM checkout dialog appears immediately, but then it takes a long time to establish the session, up to 17 seconds, even for successful logins without error messages.

- Logins are fast with non-PAM credentials.

- Manual checkout of accounts (in the PAM vault) also takes a long time.

- From time to time, employees lose their user-specific settings, and all stored credentials are then gone, leaving the list empty. This also affects some users more often than others.

Thank you and kind regards,

Simone

All Comments (7)

avatar

Hello,

Thank you for reaching out!

My name is William and I'm here to assist you in any way I can.

Would it be possible to confirm if you have a replication latency configured in your PAM Provider with JiT Elevation?

This might be the cause of the delay when opening a session using a PAM account.

As for the accounts that are showing as already checked out, can you confirm if they are actually marked as checked out in the web interface of your Devolutions Server?

Note that only one person can check out an account at a time.

Best regards,