"The workspace does not support the use of privileged accounts"
I'm doing a Devolution PAM solution and set everything up. Created a PAM Vault with a privileged account entry and a RDP session and configured this last one to ask for a credential available in this very vault. Created a contractor account, gave him the proper permissions and accessed DVLS Web with this contractor account...
When I try to connect to the RDP session using Launcher and choose the privileged account I get this error: "The workspace does not support the use of privileged accounts". I couldn't find any thread in this Forum or in the Documentatiin about this error...
The workspace in a Devolution Server one and I have a PAM license in place. The connection is being made through Devolutions Gateway.
NOTE: The contractor was 'granted' with a RAM license.
Am I doing something wrong? Can you help me?
Att.,
Elaine
All Comments (6)
Hi @elaineberenguer,
Just to scope down the issue, does launching the session from the contractor account inside of DVLS web work? From what you describe, everything should work and I'm thinking it might be a bug that's specific to Devolutions Launcher.
Cheers,
Luc Fauvel
When I try to connect using the browser I'm unable to select the privileged account... Look:
Using launcher it does shows up for selection, but gives me the error I mentioned in this post:
Regards!
Elaine Berenguer
62a56c45-a77a-49d2-aabc-630ca377d760.png
1e794282-76d1-462a-bf79-fe548e0ddf20.png
Hi @elaineberenguer,
I see you're using the privileged account credential entry type. We are currently adding support for the PAM credential entry type in DVLS web so that is why you can't see it right now. Did you give the contractor read access to the underlying privileged account type as well? The PAM credential type is essentially a link to the actual privileged account and it does not supersede de permissions on the actual privileged account itself.
Cheers,
Luc Fauvel
OK! Got it... Just one more question.. It would be possible to use PAM Credentials using Laucher as well?
I don't know if I get your question right, but this account was created directly in PAM Vault using Domain User option and this specific's user group has access to it...
6c3004e1-6548-4213-94a4-91d61f5609ec.png
Hi @elaineberenguer,
The credential type should work in Launcher yes, trying to rule out if its a permission issue being misconstrued by Launcher as an unsupported type before creating a bug ticket for the dev team. In the PAM section, does the user have Checkout permissions?
Cheers,
Luc Fauvel
Hi @elaineberenguer,
The credential type should work in Launcher yes, trying to rule out if its a permission issue being misconstrued by Launcher as an unsupported type before creating a bug ticket for the dev team. In the PAM section, does the user have Checkout permissions?
Cheers,
@Luc Fauvel
I checked and the Checkout permission was missing. I granted this permission to the user's users group and the message is the same... I have an appointment with William tomorrow and I'll ask him to see if everything is setup correctly so we can move forward about this issue. ;)
Thank your time and attention so far. I'll keep you posted.