Assigning JIT-permission sets to PAM credentials from PAM vault context, if you have permissions on the corresponding PAM provider

Assigning JIT-permission sets to PAM credentials from PAM vault context, if you have permissions on the corresponding PAM provider

1 vote

avatar
markusburkhardt

Good morning Devolutions community,

i am currently in the process of integrating the PAM module in our DVLS/RDM structure and i belive the current way of assiging JIT-permissions sets to PAM credentials cound use some improvement - QoL-wise.

Currently you have to switch from the PAM vault to the PAM provider configuration to assign the a PAM privilege set to the account and then switch back to the PAM vault to set the default groups of the PAM privilege set on the specific account. It whould be more comfortable if you can do that directly from PAM credentials, of course only if you of sufficient permissions within the PAM provider to do so.

I am currently running RDM 2026.3.16.0 with DVLS 2026.3.13.0.

Please take a look at this an let me know if you need further information.

Best regards,

Markus

All Comments (2)

avatar
Luc Fauvel

Hi @markusburkhardt,

We have a new system that will allow you to dynamically allow specific roles for JiT based on a multitude of different rules and checks. It will be available in our next major release. Its a bit different than what you're requesting here but you can achieve the same goals with it. We call it the workflow-based rule engine. If after that update you still find the implementation is missing things, we can revive this thread, but I think it should help your case.

Cheers,

Luc Fauvel

avatar
markusburkhardt

Hello @markusburkhardt,

thanks for the reply. I ll take look into the new system once it is available. I ll let you know if the planned approach will improve QoL and leave feedback in this threads.

Cheers,

Markus