Feature Request - Support for Custom AD Attributes in PAM Account Scanning
1 vote
Hi Devolutions Team,
We are currently using Devolutions PAM to manage accounts across multiple remote domains and have implemented a solution to map remote accounts to personnel in our local domain (where Devolutions Server/RDM is hosted). This mapping enables us to automatically apply appropriate permissions to each PAM account within our PAM vaults.
Current Workflow:
Our current process relies on custom Active Directory attributes set on remote AD accounts. We:
This workflow is functional but requires manual intervention and external scripting.
Feature Request:
We would like the ability for Devolutions PAM to read and import custom AD attributes during account discovery. Specifically:
Technical Feasibility:
Since PAM already performs LDAPS queries to retrieve standard AD attributes during account discovery, extending this to include configurable custom attributes should be technically achievable.
Business Value:
This enhancement would:
Would this be something you could consider for a future release? We'd be happy to provide additional details about our use case if helpful.
Thank you for your consideration.
Best regards,
Tony
Hi @tonyfredriksson,
Thank you for reaching out. This is indeed in our list of potential features we're planning to work on, but currently I can't provide an ETA.
We'll let you know once we have more information to provide.
Cheers,
Luc Fauvel
Would it be possible to achieve the same result with a custom PAM provider?
I can't seem to find a base template for Domain Users in PAM-Providers/Providers at master · Devolutions/PAM-Providers · GitHub that could be modified to suit the needs. Being able to solve this need would greatly decrease the complexity of our setup.
Hi @tonyfredriksson,
Indeed, our domain user provider actually doesn't use PowerShell as we query via LDAP directly. It should be possible however to create your own custom provider that maps additional AD attributes to your own attribute mappings in your custom provider template.
Cheers,
Luc Fauvel