Adding Function Groups

Grants the right to view the Quick Commands screen in the Utility menu. The Quick Commands section is used to run pre/post-check commands.

Grants the right to view the Script Builder screen in the Script Designer menu. The Script Builder is used to design new scripts and manage existing scripts.

Grants the right to view the Script Player screen in the Script Designer menu. Users can run pre-defined scripts from the Script Player.

Grants the right to view the Workflow History screen in the Workflow Designer menu. When a defined workflow is run, its records are available in the Workflow History screen.

Grants the right to view the Workflow Designer screen in the Workflow Designer menu. Workflows are created here. User groups require permission to use a workflow.

Grants the right to view the Device Groups screen in the Inventory menu. Device groups are created in this menu and device realms are created to determine the authorizations of user groups in the device groups.

Grants the right to view device group secrets such as passwords.

Grants the right to access the tabs “New Device Discovery”, “Auto Device Discovery”, “Auto Discovery Log”, and “Auto Discovery Dashboard” under the Inventory section.

Grants access rights to the Inventory, Discovery, Auto Discovery Log and Auto Discovery Dashboard tabs under the Devices section, and grants the right to add devices.

Grants access rights to the Inventory under the Devices section, and the right to delete devices.

Grants the right to schedule maintenance times for devices in the Devices tab under the Inventory section.

Grants the right to manage devices in unassigned device groups under the Inventory section.

Grants the right to view the Element Type screen under the Inventory menu. This menu is used to create, delete, or edit element types (and their properties) manually.

Grants the right to view the Help Manager screen in the Device Administration menu. This is used to create, edit, or delete the help menu content.

Grants the right to view the Activity Logs screen in the Logging menu. System events and all transactions made in the web interface are logged and can be viewed from here, and the user can only view their own logs.

Grants the right to view the Activity Logs screen in the Logging menu. System events and all transactions made in the web interface are logged and can be viewed from here, and the user can view the logs of all users within their own user group.

Grants the right to view and manage the Approval Mailbox Configuration screen. This section is used to configure mailbox settings for approval workflows.

Grants the right to view and manage the Email Configuration screen under System Configuration Manager. This section is used to configure and maintain email integration settings.

Grants the right to view and manage the LDAP User Integration screen. This section is used to configure LDAP-based user synchronization and authentication.

Grants the right to view and manage the LDAP Device Integration screen. This section is used to configure LDAP-based device discovery and synchronization.

Grants the right to view and manage the SAML Configuration screen under System Configuration Manager. This section is used to configure SAML-based authentication settings.

Grants the right to view and manage the SMS Configuration screen. This section is used to configure SMS notification and integration settings.

Grants the right to view and manage the VMware Integration screen. This section is used to configure VMware environment integration settings.

Grants the right to view the System Configuration Manager screen in the Administration menu. From here, authorized users can add, edit, or delete system configuration parameters.

Grants the right to view and manage the PKI Authentication screen. This section is used to configure certificate-based authentication settings.

Grants the right to view and manage the Application Inspection Integration screen. This section is used to configure risk scoring and application inspection settings.

Grants the right to view the Backup Management page under the Administration menu. This page allows users to get backups after setting relevant parameters in the system configuration.

Grants the right to approve new user requests, even if the grantee is not an admin.

Grants the right to approve pre-approved user requests.

Grants the right to manage users.

Grants the right to manage user groups.

Grants the right to view only the permissioned device list on Kron PAM Desktop Client and Kron PAM Web GUI. Note that aioc.device.group.moduleVisibility is used to view/edit the permissioned device list on Kron PAM Web GUI, whereas desktop.device.group.moduleVisibility is a limited version of aioc.device.group.moduleVisibility, which only grants view permission to the permissioned device list.

Grants users limited access to the Assigned Credentials menu and allows them to manage assigned credentials only within their own user groups. Users with this function can perform actions only within their own groups and do not have visibility or permissions across other groups. (can only view, add, or delete Assigned Credentials related to users and devices within their own group and cannot view or modify credentials belonging to other groups.)

Grants the right to access the Audit Logs tab in the Session Log section, under the Logging menu. In this tab, Audit users can sign sessions as “passed audit”, “failed”, or “n/a”. The user can see the log records of all users within their own user group.

Grants permission to view the Command Log screen under Logging > Session Log. The user can see only the command logs of the commands they executed in their own sessions.

Grants permission to view the Command Log screen under Logging > Session Log. The user can see the command logs of all users in their own user group.

Grants the right to view the RADIUS Account Logs screen in the Logging menu. This section displays RADIUS account logs, and the user can view the logs of all users within their own user group.

Grants permission to view the User Authentication Logs screen in the Logging menu. From this screen, the user can access the login and logout log records of all users within their own user group. The Authentication Logs page shows when and where users logged in and which authentication method was used.

Grants the right to view the HTTP Proxy Logs screen in the Logging menu. In this section, the user can view the HTTP Proxy session transactions of all users within their own user group.

Grants the right to view the TACACS Account Logs screen in the Logging menu. All commands executed during the TACACS+ session can be viewed in the TACACS Account Logs menu, and the user can view the logs of all users within their own user group.

Grants the right to view statistics regarding connections, devices, users, and vault.

Grants the right to view the Datasource Manager screen in the Administration menu. This section allows the definition of a datasource for Kron PAM.

Grants the right to view the Bulk Import screen in the Inventory menu. Devices can be added in bulk from this section.

Grants the right to view the Command Template screen in the Utility menu. Defined commands that are used in scripts or pre/post-checks are managed from here.

Grants the right to view the Components screen in the Administration menu.

Grants the right to view the Inventory screen in the Devices menu. This section enables adding, deleting or editing devices.

Grants the right to view the Job Scheduler screen in the Administration menu. This section allows managing automated and/or manually triggered jobs.

Grants the right to view the System Log Viewer screen in the Administration menu. System logs can be monitored from this section.

Grants the right to view the Mail Management screen in the Administration menu. You can send emails through Kron PAM GUI from this section.

Grants the right to view the Memory Manager screen in the Administration menu. You can check the memory status from this section.

Grants the right to view the Portal Functions screen in the Policy menu. The screens available to user groups is determined in this section.

Grants the right to view the SIEM Configuration screen in the System Configuration Manager menu. Kron PAM can send logs to SIEM systems.

Grants the right to view the User Approval in the User Management menu. The User Approval section displays all users who have sent the “New User” request from the main page and is used to confirm their requests.

Grants permission to view the User Authentication Logs screen in the Logging menu. From this screen, the user can access only their own login and logout log records. The Authentication Logs page shows when and where the user logged in and which authentication method was used.

Grants the right to view the User Accounts screen in the User Management menu. You can define users and user groups in this section.

Grants the right to view the AAA Remote Database screen in the RADIUS menu. In this section, you can define and edit databases.

Grants the right to view the Cloud Integration screen in the Administration menu. In this section, the required configurations to add or discover devices from Amazon Web Services, Google Cloud Platform, and Microsoft Azure can be set.

Grants the right to view the DevOps Management screen in the DevOps menu. You can define new DevOps teams or edit existing ones in this section.

This function provides the “duplicate log” option for logs in the Command Log tab in the Session Log section under the Logging menu.

Grants the right to access the logs of device groups which the user shares a realm with. The user can view the logs of these device groups from the Command Log tab in the Session Log section, under the Logging menu.

Grants the right to view all logs of all devices in the Command Log tab in the Session Log section, under the Logging menu. Regardless of the device realm the user is part of, the user with this function can still view logs for all devices.

Grants the right to access the Audit Logs tab in the Session Log section, under the Logging menu. In this tab, Audit users can sign sessions as “passed audit”, “failed”, or “n/a”. Each user can see only their own log records.

Grants the right to the group manager to enter a connection reservation request on behalf of any group members. When granted, the “For User” selection field appears in the Connection Reservation screen for the group manager.

Grants the right to access the Script Realm tab in the Script Builder section under the Script Designer menu. In this tab, you can authenticate user groups to play scripts.

Grants the right to view the Sensitive Data Discovery screen in the Sensitive Data Discovery menu. This section is used to discover sensitive data in databases.

This function is defined for admins to allow them access to the User Key Management tab, on the SSH Key Manager page under the Users menu.

Grants the right to view the TACACS Management screen under the Administration menu. Kron PAM uses its own TACACS+ server to authenticate users. TACACS+ configuration can be done from the TACACS+ Management section.

Grants the rights to view the screens related to Application Token management under Vault.

Grants users the ability to view the Assigned Credentials menu and manage assigned credentials within the Users menu. Users with this function have full access across the system regarding credential management. They can manage Assigned Credentials across all user groups.

Grants the right to establish an SSH/Telnet connection by clicking the “Open Terminal” option for devices. The “Open Terminal” option is presented in the Device Inventory section under the Device Management menu, or on the Dashboard.

Grants the right to view the Statistic screen in the Dashboard menu. The activities and commands ran by users are viewed in this section.

Grants the right to view the Policy Tracking screen in the Policy Control menu. You can search any user’s authentication/authorization details, and Vault account permissions in this section.

Grants the right to view the RADIUS Account Logs screen in the Logging menu. This section displays RADIUS account logs, and the user can only view their own logs.

Grants the right to view the RADIUS Account Logs screen in the Logging menu.

Grants the right to view the HTTP Proxy Logs screen in the Logging menu. In this section, the user can view only their own HTTP Proxy session transactions.

Grants the right to access the Kron PAM Controller Configuration section. You can configure all instances by using this section.

Grants the right to view the Linux Audit Report screen in the Audit Report menu. This section is used to report the current security status of local Linux accounts.

Grants the right to view the MAC Filtering screen in the Administration menu. This section is used to manage the users' MAC addresses. Allowed MAC addresses can be defined, edited or deleted.

Grants the right to view the Policy screen.

Grants the right to establish a Remote Desktop session by clicking the “Open Remote Desktop” option for devices.

The “Open Remote Desktop” option is presented in the Inventory section, under the Device Management menu, or on the Dashboard.

This function is used to disable the key log hiding feature for certain user groups.

Grants the right to view the Remote Desktop App screen in the Administration menu. Kron PAM allows you to limit the applications to be accessed on windows servers from this section. After the application name and path are defined in this section, permissions are set from the Device Management menu.

This function grants the right to play sessions in the Command Logs tab of the Session Log section, under the Logging menu.

Grants the right to view the Reports screen.

Grants the right to view the Reservation Management screen in the Policy Control menu. Users can make connection reservations for devices that require managerial approval for connection from this section. After the approval from a manager, users can connect to the system within the time frame specified during reservation.

This function makes the user a Vault admin. Vault admins have rights to manage all Vault accounts and view all logs.

This function restricts users from viewing passwords without approval. When a user wants to retrieve a Vault password, an approval email is sent to the Vault admin. After approval by the Vault admin, the user can view the password.

Grants the right to list all Vault accounts, without seeing details.

Grant the right to access the Configuration section in the Vault menu. Vault configurations can be edited in this section.

Grants the right to view the old passwords of Vault accounts.

Grants the right to see the “Password Change”, “New Users”, and “Password Check” logs in the Vault page.

Grants the right to view the Vault menu.

Grants the right to manage and view all accounts that are on any device the user shares a realm with.

Grants the right to list all device accounts defined in the user's policy realms, without seeing the details.

Grants the right to give second level approval for all Vault accounts and view all logs.

This function restricts viewing the password without a two-level approval.

Grants the right to give second level approval for all device accounts defined in the user's policy realms.

Grants the right to view the Active Sessions screen in the Policy menu. Administrators can manage active proxy sessions, such as wiring to the session or killing the session.

Grants the right to view the Session Manager screen in the Administration menu. User activities can be viewed in this section.

Grants the right to view the Kron PAM Setup Wizard screen in the Setup Wizard menu.

Grants the right to view the SQL Proxy Policy screen in the Policy Control menu. The dynamic masking policy and masking methods are defined and managed in this section.

Grants the right to view the SSH Keys Manager screen in the User Management menu. SSH keys can be generated and managed in this section and used for logging in to the Kron PAM proxy instead of the user’s password.

Grants the right to view the TACACS Account Logs screen in the Logging menu. All commands executed during the TACACS+ session can be viewed in the TACACS Account Logs menu, and the user can only view their own logs.

Kron PAM’s multitenancy function can provide multiple and independent applications and functions. It enables an architecture in which a single instance serves multiple customers. Each customer is called a tenant. Tenants may be given the ability to customize some parts of the application. This function works if the licensing requirements are met. Tenant admins can only manage devices and users that they are allowed to access and can only see the logs related to the devices and users they have access to.

Grants the right to access Hardware Token Management, and the Hardware Token Bulk Import tabs under the Multi-factor Authentication section.

Grants the right to view the Multi-factor Authentication section in the Administration menu. Kron PAM provides a Multi-factor Authentication by mobile application or SMS verification.

This function provides the right to assign hardware tokens in the Multi-factor Authentication section.

Grants the right to see the MFA token’s QR Code or written code in the User Information section, in the right-hand upper corner of Kron PAM interface.

Grants the right to view the Session Log screen in the Logging section. The user can only view their own session log records.

Grants the right to access the Report Configuration tab in the Windows Audit Report section. In this tab, you can create a report configuration to check the security of Windows accounts.

Grants the right to access the Dashboard tab in the Windows Audit Report section. In this tab, you can view the reports as graphs.

Grants the right to access the Report tab in the Windows Audit Report section. In this tab, you can search for reports and view them with their details.

Grants the right to view the Windows Audit Report screen in the Audit Report section. The Windows Audit Report is used to report the current security status of local Windows accounts.

Grants the right to see the “User Token Management”, and the “User Group Management” tabs in the Multi-factor Authentication section under the Administration menu. You can manage user and user group tokens and OTPs (One-Time Password) for user groups.