---
title: Assigning Kron PAM Credentials to Target System Accounts
slug: kronpam-reference-guide-3-6-0/Jb9x-assigning-kron-pam-credentials-to-target-system-accounts
description: Learn how to efficiently assign credentials to users with Kron PAM's Assigned Credentials feature. This document provides step-by-step instructions on configuring this feature within device group properties and setting up credentials for individual users.
docTags: 
createdAt: 2022-07-27T12:53:20.000Z
---

In some cases, Kron PAM users are connected to target devices with different credentials. In other situations, there are more than one privileged user account in the target system and different user groups use different privileged accounts to log in to them. The Assigned Credential feature matches the Kron PAM users with the target device users.


In the example below, User A wants to connect to the target system with Account X and User B wants to connect to the target device with Account Y. In this case, User A is assigned to Account X, and User B is assigned to Account Y.


![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/QHkha9EHZmDR24N5pl36C_image.png "Assigned Credentials")

The following steps should be followed to configure the Assigned Credentials Feature and enable its use for a device group.

:::hint{type="info"}
This device group should be added to a device group realm with the user group including the users, beforehand.
:::

1. Log in to the Kron PAM Web GUI as an admin user.
2. Navigate to **Devices> Device Groups.**
3. Click the desired Device Group and select **Properties**.
4. Click the **Edit **and then** Next **buttons.
5. Under the **Additional Credentials** toggle on the** Add Assigned Credential to Credential Selection** property.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/hhzJQLPvdMFaE5n-BVU8o_image.png" size="72" width="738" height="980" position="center" caption="Assigned Credential Configuration" showCaption="true"}

To set up the assigned credentials for different users, first save the accounts. After saving these accounts, follow these steps:

1. Log in to the Kron PAM Web GUI as an admin user.
2. Configure the Vault account for the target system.
3. Navigate to **User **> **Assigned Credential**.
4. Click the **Add** button and continue with **User Selection** and **Vault Account Select** the Kron PAM user as **User **and **Vault **account as **Vault Account.**
5. Click the **Save **button.

Once these steps are completed, assigned credentials will be used for the connection whenever the defined users try to open an SSH session.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/b-tprRwp2F_e_jkiYECR3_image.png "Assigned Credential Configuration")

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/uGQqd8D9QwXSG3wZp4Lxw_image.png" size="72" width="837" height="822" position="center" showCaption="false"}

To list only the accounts matching the relevant domain when listing users from the Vault account before the SSH session, the following steps are followed:

1. Navigate to **Secrets** > **Configuration**
2. Choose **Active Directory** > **Miscellaneous **
3. Set **Show accounts in auto login options only if domains match**
4. Navigate to** Connection **and fill **LDAP** base DN according to the domain.
5. Navigate to **Devices > Inventory > Related Device > Custom Properties.**
6. **Add** auth.domain parameter key with LDAP domain name.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/dRjye-CGFc4SMdBCZTbQH_image.png)

With the newly added **Specific Time Interval switch box** option in the **Assigned Credential** screen, it is now possible to connect and perform actions for Vault Accounts defined under **RDP**, **SSH**, and **HTTP Proxy** services within a specific time interval. Once the time has expired, further login attempts to the respective services will not be allowed. The system will show the start date -time and finish date -time fields when the user switches on the Specific Time Interval button. When the Specific Time Interval switch box is turned on, the start date-time and end date-time values on the screen will not be null. The system will not allow defining more than one record for the same user Vault Account and same date interval value. System will be listed on the screen if there is an Assigned Credential defined on the date and time when the user connects to RDP and SSH Proxy.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/P-EfXBYoB0_PhkKjXsbZL_image.png "Assigned Credential Specific Time Interval Definition Screen")