Agent Cache Mechanism

The AAPM Agent is designed to securely manage passwords between applications. It enables applications to access secure and dynamically updated passwords instead of hardcoded credentials. This enhances security while centralizing password management.

The agent functions as a layer between the application and the Kron PAM Password Vault. It can be installed on Linux and Windows environments or deployed as a container on Kubernetes & OpenShift platforms.

To report its operational status, the agent communicates with Kron PAM at regular intervals via heartbeat logs. This allows the agent’s status to be monitored directly from Kron PAM.

Instead of sending every request to Kron PAM, the agent utilizes a caching mechanism to serve requests based on stored cache data. The cache duration is determined by the application’s request. When an application requests access to an account, the agent retrieves the password from the Kron PAM Password Vault on the first request. Subsequent requests are then served directly from the agent’s cache.

The validity status of the cached password is checked based on configurable parameters. There are two modes for status validation. The first is Regular mode, which periodically verifies the password's validity at set intervals. The second is the Intensive mode, which increases the frequency of validation checks as the password change time approaches. Both modes can be adjusted based on parameterized time intervals. The transition to Intensive mode is determined by the bufferInSeconds parameter.