Skip PAM checkout replication delay on subsequent checkouts while access is still active

Skip PAM checkout replication delay on subsequent checkouts while access is still active

1 vote

avatar

Summary When performing a PAM checkout, RDM allows configuring a delay to ensure replication completes before the credential is used. Currently this delay is applied on every checkout request. I'd like the delay to only be enforced on the first checkout. As long as the JIT (just-in-time) elevation is still in place and the user still has an active checkout, the delay should be skipped on subsequent requests, since replication has already occurred and waiting again is unnecessary.
Current behavior The configured replication delay is applied on each checkout request, regardless of whether the user already has an active/valid checkout and the JIT elevation is still present.
Proposed behavior Apply the replication delay only on the initial checkout. On any subsequent checkout request, if the JIT elevation is still active and the user is still checked out, skip the delay and grant access immediately.
Benefit Avoids redundant waiting time on repeated checkouts when replication has already completed, improving the user experience without compromising the replication guarantee.

All Comments (0)

Ends in 12 days