Reference Guide
...
Secrets
Password Vault
Split Password Feature
3min
To secure the two-part approval process, account passwords can be split in two and each part retrieved by different users. After placing the users in different user groups, follow these steps:
- Navigate to Policy > Realms.
- Click on to Add Button.
- Create the Device Group Realm between the user groups (Who?) and the device group (What?) containing the target device and Save.
Device Group Realm for User Groups

- Navigate to Secrets> Vault.
- Search for the account.
- Click the Account Options button.
- Select Permissions to open the permissions pop-up window.
- Define the READ_ONLY_FIRST_PART permission type for the user group that will receive the first part of the password.
- Define the READ_ONLY_SECOND_PART permission type for the user group that will receive the second part of the password.
Account Permissions Set Up for User Groups

- Close the permissions pop-up window.
- Navigate to Policy > Portal Functions.
- Create a portal realm with the SAPM Management, and SAPM Account Module Visibility function groups for both user groups.
Portal Functions Realm for the user groups

After completing these steps, the users log in and retrieve their parts of the password from the Vault section, just like with normal password retrieval. They can log in to the target system using the Account username and the password combined in the correct order.
If one or two-level approval applies to the user, the user will receive the password part via email, once the approval process is completed.