---
title: Adding Vault Configurations
slug: kronpam-reference-guide-3-9-0/adding-vault-configurations
description: Learn how to efficiently manage passwords in SAPM by creating customized configurations for each target system with this comprehensive document. Discover the step-by-step process for creating new configurations and modifying properties, including settings
docTags:
createdAt: 2022-07-29T10:06:38.000Z
---
To manage passwords via Password Vault, a Vault configuration is required. Vault configurations consist of the command sets to make the password changes in target systems. There are pre-defined Vault configurations in Kron PAM, but if the target device is of a different kind from those pre-defined in the system or requires some special treatment, a new Vault configuration can be created for ease of use.
In the configuration screen, **Strategy** defines the method to change the password, and **Configuration Properties** defines the details for each configuration.
:::hint{type="info"}
STATIC Strategy is a configuration where an account can be added to Password Vault without the target system.
:::
To create a new Vault Configuration:
1. Navigate to **Secrets > Configuration**s.
2. Open the **Vault Configurations** tab.
3. Click the **Add** Button.
4. Fill in the **Name, Strategy**, and **Description** fields and fill in the desired parameters
5. Click** Save.**
To add and/or edit properties for the Vault configuration:
1. Write the **Advances Search Field** to see saved configurations.
2.
Click the **Green** arrow button of the desired configuration and **Edit Configuration.**
- Type in the **Property Value **and click **Save**.
::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/ZDDHSpNiu894MEtOiRIIr_image.png" size="80" caption="Figure - Vault Configuration Properties Popup" isUploading="false" width="684" height="779" darkWidth="684" darkHeight="779" showCaption="true"}
These are the properties that can be used for Vault configurations:
| **Vault Configuration Property Key** | **Description** | **Pool Value** |
| ------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Account level properties **
| This property uses values that you can set for account-specific configurations, defined at the account level instead of in the default configuration. You define property values in the **Add Account** pop-up, unless you turn on **Set Account Level Properties** to set them once for the whole configuration instead — see "Setting Account Level Properties in a Vault Configuration." | Other properties |
| **Set Account Level Properties** | Adds an **Account Level Properties** step to the **Add Configuration** and **Edit Configuration** wizards, where you configure account-level settings once for every account that uses this configuration, instead of setting them individually in the **Add Account** pop-up. | Switch (On/Off). Default value: *Off* |
| **Allow to be seen by multiple users ** | If set as “On”, the Vault password can be seen by other users in same user group.
By default, the Vault Account password can be seen only by the user who got the password last.
(For Dynamic Accounts Only) | Switch (On/Off) |
| **Always show accounts in auto login**
| Allows access to other servers with Active Directory and LDAP accounts. (Applies to SSH and RDP sessions.) | Switch (On/Off)
Default value: On |
| **AWS IAM users region**
| AWS region to be accessed during the password change | eu-central-1,eu-west-1,us-east-1 |
| **AWS super user**
| authorized username to change a user's console or security credentials | Authorized user username |
| **AWS super user access key**
| authorized user access key information to change a user's console or security credentials | Authorized user access key |
| **AWS super user secret key**
| authorized user secret key information to change a user's console or security credentials (Encrypted) | Authorized user secret key |
| **Use other account**
| The security credentials of the user who will change their console credentials must first be added as another account. Then this account should be defined as AccountName\@GroupFullPath (Example: Account1@/ParentGroup) | Will change their credentials account |
| **Change password after Session Manager login**
| If set as “On”, the Vault Account password will be changed just after SSH Proxy and RDP Proxy session is started by the Kron PAM Session Manager using this Vault account.
By default, the Vault Account password is not changed after being used by the Session Manager. | Switch (On/Off)
|
| **Use command script for change password** | Switches password changes from a command set to an Expect script. When set to *Off* (the default), Kron PAM uses **Command set for change password**, and **Script set for change password** stays disabled — the existing, backward-compatible behavior. When set to *On*, Kron PAM disables **Command set for change password** and activates **Script set for change password**, which becomes required. Kron PAM then determines whether the password change succeeded from the script's own prompt and output matches, instead of the **Change password success pattern** / **Change password failure pattern** regex checks. Variable substitution such as $\{superPassword} and $\{newPassword} works the same way in both modes. | Switch (On/Off). Default value: *Off* |
| **Command set for change password** | The command set used to change the password. This set can differ for each system and consists of the commands that change the password on the target system. Predefined sets exist for most common systems. If your target device isn't predefined, configure this command set. Available when **Use command script for change password** is *Off* (the default). | Specific to the device type.
E.g. for a Cisco device:
en\n$\{superPassword}\nconf t\nline con 0\npassword $\{newPassword}\nline vty 0 4\npassword $\{newPassword}\nline vty 5 15\npassword $\{newPassword}\nenable secret $\{newPassword}\nend\nwr me\nexit |
| **Change password failure pattern** | During each password change, Kron PAM gets an output. It checks if the password was changed successfully. If there is a failure in the password change process, Kron PAM does not add the new password to its database. If the output matches this regex pattern, Kron PAM decides that the password change command has failed.
If the “skip.password.validation.after.change” parameter is set as “false”, the result of the connection validation overrides this decision, and this parameter has no effect. | Specific to the device type.
E.g. for a Cisco device:
% Invalid input detected. \* |
| **Change password only at change periods**
| When set as “On”, no duration information is required from the user, only comments will be requested. The password will not be changed after the checkout, and other users will be able to check out the same password until the next periodic change.Manually resetting from the account option is allowed.
By default, the user is asked for the duration, and the password is changed after the checkout. | Switch (On/Off)
|
| **Perform first password change at change period** | This parameter is defined at the vault config level and determines global behavior:
* **Enabled**: Newly added accounts will not change their password immediately.
→ The first password change will occur when the configured change period is reached.
* **Disabled**: The newly added account will perform the first password change immediately after being added.
| Switch (On/Off)
|
| **Script set for change password**
| The Expect script used to change the password. Available and required when **Use command script for change password** is *On*. | Script written in expected language. E.g. for Cisco IOS Router: send "enable\r" expect "Password:" send "$\{superPassword}\r" expect \{ "Password:" \{ exit 1 "wrong enable password" } "#" \{ } } send "conf t\r" expect "#" send "username $\{username} password $\{newPassword}\r" expect \{ "#" \{ } "%" \{ exit 1 "command failed" } } send "do write\r" exit |
| **Change password success pattern** | During each password change, Kron PAM gets an output. It checks if the password was changed successfully, and if there is a failure during the password change process, Kron PAM does not write the new password in its database. If the output matches this regex pattern, Kron PAM decides that the password change command was successful and stores the new password.
If the “Skip password validation after password change”
parameter is set as “Off”, the result of the connection validation overrides this decision, and this parameter has no effect. | Specific to the device type.
E.g. for Centos device:
.\*successfully.\* |
| **Change password with domain information**
| Usually, for some Active Directory (AD) systems, the domain name does not need to be sent during a password change request. However, some systems require the domain name to be included in the password change, such as Krontech\username
” instead of username”.
By default, this parameter is set as “Off”, and the domain name is not included in the command sent to the AD servers for AD user password change.
When set as “On”, the domain name is included in the command sent. | Switch (On/Off)
|
| **Change password with super user** | If set as “On”, the super user credentials defined by the Super user name and Super user password properties are used to change the Vault account password in the target device.
When creating a new user, if the password information of **Super\_User** will come from the password vault, then Vault\_Account\_Name@/Full\_Group\_Path format is entered in the super\_user field. In this case, the password value of super\_user will be blank and Kron PAM will find the password from the password vault while defining the new user on the device.
By default, the value is “Off”, meaning the Vault account username and password are used to change the password.
This option should be set as “On” when the Vault account’s rights are not enough to change its own password. | Switch (On/Off)
|
| **Password change self permission** | Permission for Active Directory users to change their password.
According to the Active Directory Self Permission, Kron PAM is given one of these permissions. | CHANGE\_PASSWORD
RESET\_PASSWORD |
| **Default change period (Days)** | The default period to change passwords using this configuration (in days).
If the selected Vault configuration has the Default change period (Days) parameter defined, the parameter value applies to the new accounts automatically. | Integer (in days) |
| **Period for next attempt on fail (Minutes)** | The period to attempt to change the password again when the periodic password change has failed. | Integer (in minutes) |
| **Check newly discovered users with super user** | Password Vault can check for new users in the target systems periodically, or on demand (See section 7.1.20Discover Newly Users for details).
If this parameter is set as “On”, the super user credentials defined by the “Super user name ” and “Super user password ” properties are used to check for new users in the target device.(Server Local Users, Database Users and LDAP Users)
The default value is “Off”, meaning the Vault account username and password are used to check for new users. | Switch (On/Off) |
| **Command set for checking password** | The Password Vault can periodically check the validity of the passwords. The command set defined in this parameter is used to check if the stored password is valid or not. | Specific to the device type. |
| **Check password success pattern** | The output pattern in regex format, which shows that the password is valid. | Specific to the device type. |
| **Enable password validation checks** | If set as “On”, the Vault accounts using this configuration can be included in periodic and one-time password validations.
If set as Off ”, the Check Password operation will not be executed for the Vault accounts using this configuration.
This property checks if the password is correct. | Switch (On/Off)
Default value: On |
| **Check password with super user** | If it is set as “On”, the super user credentials defined by the “Super user name ” and “Super user password ” properties are used to check the validity of the Vault account password in the target device.
The default value is “Off”, meaning the Vault account username and password are used to check the password validity. | Switch (On/Off) |
| **Timeout duration (Seconds)** | Timeout duration for connection | Integer (unit: second) |
| **Driver key for database** | Database driver to manage database passwords. | Oracle/Postgresql/MsSQLServer/MySQL/Cassandra/SAPHANADB/Teradata/Sybase driver in the following format:
oracle.jdbc.driver.OracleDriver org.postgresql.Driver com.mysql.jdbc.Driver com.microsoft.sqlserver.jdbc.SQLServerDriver com.sap.db.jdbc.Driver org.apache.cassandra.cql.jdbc.CassandraDriver com.teradata.jdbc.TeraDriver com.sybase.jdbc4.jdbc.SybDriver |
| **Script set for delete discovered user**
| The Expect script used to delete users | Script written in Expect language.
E.g. for Cisco IOS Routers:
send "enable\r"
expect "Password:"
send "$\{superPassword}\r"
expect \{
"Password:" \{
exit 1 "wrong enable password"
}
"#" \{
}
}
send "conf t\r"
expect "#"
send "no username $\{username}\r"
expect \{
"#" \{
}
"%" \{
exit 1 "command failed"
}
}
send "do write\r"
exit
|
| **Command set for delete discovered user** | The command set used to delete users.
After checking for new users in the target devices, this parameter is used to delete users, after reviewing the New Users list. | Specific to the device type. |
| **Delete discovered user with super user**
| If it is set as “On”, the super user can delete accounts in the Discovered Newly Users Log screen. The default value is “Off”. | Switch (On/Off)
|
| **Allow set comment to account during edit account** | Comments appear when accounts are enabled for editing. | Switch (On/Off)
|
| **Execute post password change command with super user** | If set as “On”, the super user credentials defined by the “Super user name ” and “Super user password ” properties are used to run the commands after the password change (E.g., to kill the active sessions started with the previous password).
The default value is “Off”, meaning the Vault account username and password are used to run the commands after the password change.
See section 7.1.16Configuration Properties to Execute Commands After Changing Passwords for more information. | Switch (On/Off) |
| **Command set for check account error**
| “Super user name” and “Super user password” were added to configuration“, "Command set for check account error”
commands can run on the server.
The parameter just affects SSH strategy. | passwd -S $\{username} |
| **Regex parser for check account error**
| It parses the output of the command executed in the
**Command set for check account error**
parameter and prints the desired message to the screen. Regex is used. | \\(.\*\\) |
| **File Path** | Target file path for FILE strategy.
The "Regex to Match” and “Regex to Replace” properties are also required for this strategy.
See section 7.1.24Managing Passwords in a File for more information. | Specific to the device type. |
| **Regex to Match** | The regex pattern matches with the password in the file path.
The “File Path” and “Regex to Replace” properties are also required for FILE strategy.
See section 7.1.24Managing Passwords in a File for more information. | Specific to the device type. |
| **Regex to Replace** | When the “Regex to Replace” matches the password field, it is replaced with this property value “.
“Regex to Match” and “File Path” properties are also required for FILE strategy.
See section 7.1.24Managing Passwords in a File for more information. | Specific to the device type. |
| **Login method URL**
| The URL the login requests will be sent to (used for API strategy) for applications or devices that provide HTTP login API.
| Specific to the device type. |
| **Login method body**
| The HTTP body for login requests (used for API strategy) for applications or devices that provide HTTP login change API.
| Specific to the device type. |
| **Login method**
| The API method for login requests (used for API strategy) for applications or devices that provide HTTP login API. | POST / GET / PUT |
| **Login method headers**
| The HTTP header for login requests (used for API strategy) for applications or devices that provide HTTP login API. | Specific to the device type. |
| **Logout method URL**
| The URL the logout requests will be sent to (used for API strategy) for applications or devices that provide HTTP logout API.
| Specific to the device type. |
| **Logout method body**
| The HTTP body for logout requests (used for API strategy) for applications or devices that provide HTTP login change API.
| Specific to the device type. |
| **Logout method**
| The API method for logout requests (used for API strategy) for applications or devices that provide HTTP logout API. | POST / GET / PUT |
| **Logout method headers**
| The HTTP header for logout requests (used for API strategy) for applications or devices that provide HTTP logout API. | Specific to the device type. |
| **Certificate keystore path**
| It is the parameter defined to import the certificate. It stores the certificate value in the database. | Specific to the certificate |
| **Certificate keystore password**
| This parameter is the password of the certificate stored in the database. It opens the certificate. | Specific to the certificate |
| **Accepted status codes**
| API Response Accepted Status Codes | Specific to the Application |
| **Login authentication data matcher**
| This parameter allows to use the values obtained from the Login Response in other methods. Source can be header or body. | “\[\{"”e”":"XSRF-TOKEN“, "pattern":"XSRF-TOKEN:\\\s(.+”),“, "source":"header"}] |
| **Password change method body** | The HTTP body for password change requests (used for API strategy), for applications or devices that provide HTTP password change API. | Specific to the device type. |
| **Password change method headers** | The HTTP header for password change requests (used for API strategy), for applications or devices that provide HTTP password change API. | Specific to the device type. |
| **Password change method** | The HTTP method for password change requests (used for API strategy), for applications or devices that provide HTTP password change API. | POST / GET / PUT |
| **Password change method URL** | The URL the password change requests will be sent to (used for API strategy), for applications or devices that provide HTTP password change API. | Specific to the device type. |
| **Password check method body** | The HTTP body for password check requests (used for API strategy), for applications or devices that provide HTTP password check API. | Specific to the device type. |
| **Password check method headers** | The HTTP header for password check requests (used for API strategy), for applications or devices that provide HTTP password check API. | Specific to the device type. |
| **Password check method** | The HTTP method for password check requests (used for API strategy), for applications or devices that provide HTTP password check API. | POST / GET / PUT |
| **Password check method URL** | The URL the password check requests will be sent to (used for API strategy), for applications or devices that provide HTTP password check API. | Specific to the device type. |
| **Delete user method body** | The HTTP body for delete user requests (used for API strategy), for applications or devices that provide HTTP user delete API. | Specific to the device type. |
| **Delete user method headers** | The HTTP header for delete user requests (used for API strategy), for applications or devices that provide HTTP user delete API. | Specific to the device type. |
| **Delete user method** | The HTTP method for password check requests (used for API strategy), for applications or devices that provide HTTP user delete API. | POST / GET / PUT |
| **Delete user method success pattern** | The output pattern in regex format, to show the HTTP delete user request has succeeded, for applications or devices that provide HTTP user delete API. | Specific to the device type. |
| **Delete user method URL** | The URL the delete user requests will be sent to (used for API strategy), for applications or devices that provide HTTP user delete API. | Specific to the device type. |
| **User list method body ** | The HTTP body for user listing requests (used for API strategy), for applications or devices that provide HTTP user listing API. | Specific to the device type. |
| **User list method headers** | The HTTP header for user listing requests (used for API strategy), for applications or devices that provide HTTP user listing API. | Specific to the device type. |
| **User list method** | The HTTP method for user listing requests (used for API strategy), for applications or devices that provide HTTP user listing API. | POST / GET / PUT |
| **User list method URL** | The URL the user listing requests will be sent to (used for API strategy), for applications or devices that provide HTTP user listing API. | Specific to the device type. |
| **LDAP base DN** | Base Distinguished Name (DN) for LDAP | Specific to the LDAP structure.
E.g.: OU=TestUser,DC=SingleConnect,DC=local |
| **LDAP domain**
| The domain name that will be included in the command sent to the AD servers for AD user password changes, when the “ Change password with domain information ” property is set as “On” | Domain Name |
| **Ignore certificate errors** | Ignore certificate for LDAP/AD | Switch (On/Off) |
| **LDAP password attribute name** | The attribute name for the password in the LDAP/AD records. | If there is no exception, it “s "userPassword” |
| **LDAP security authentication** | Active Directory verifies Channel Binding Token (CBT) requirements for LDAP/LDAPS connections on the domain controller. If the customer's Active Directory group policy sets **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options** > **Domain controller: LDAP server channel binding token requirements** to *Always*, the domain controller rejects clients that don't send a valid channel binding token during LDAP authentication. Microsoft introduced this security mechanism specifically to prevent attacks such as NTLM relay, man-in-the-middle, credential relay, and LDAP relay attacks. If you don't provide a value for the LDAP bind method parameters on the AD side, the Vault configuration returns LDAP error code 49, AcceptSecurityContextError: 52e. If you set this field to *SIMPLE*, Kron PAM performs a simple bind using the LDAP username and password without errors. Set this field to *KERBEROS* to change Active Directory account passwords over the Kerberos kpasswd protocol instead of an LDAP bind. When you select *KERBEROS*, Kron PAM displays the **Kerberos realm**, **KDC address**, **Kerberos KDC port**, and **Kerberos kpasswd port** fields.
**Prerequisite:** Before setting **LDAP security authentication** to *KERBEROS*, confirm outbound network access from the Kron PAM server to the domain controller on TCP/UDP port 88 (Kerberos ticket requests) and TCP/UDP port 464 (kpasswd password-change requests). The Vault account — or the super user, if **Change password with super user** is enabled — must also hold sufficient Active Directory permissions to reset the target account's password.
| SIMPLE / DIGEST-MD5 / KERBEROS |
| **LDAP username DN template** | The Distinguished Name (DN) template for users managed with this Vault Configuration. | Specific to the LDAP structure.
E.g.: CN=$\{username},DC=example,DC=com |
| **Kerberos realm** | The Kerberos realm name Kron PAM uses for Active Directory authentication. Required when **LDAP security authentication** is set to *KERBEROS*. Enter the realm in uppercase; it must match the Active Directory domain name. | String. For example: *EXAMPLE.COM* |
| **KDC address** | The hostname or IP address of the Key Distribution Center (KDC), that is, the Active Directory domain controller Kron PAM contacts for Kerberos authentication. Required when **LDAP security authentication** is set to *KERBEROS*. | String. For example: *dc1.example.com* |
| **Kerberos KDC port** | The port Kron PAM uses to request Kerberos tickets from the KDC. |
Integer. Default value: *88*
|
| **Kerberos kpasswd port** | The port Kron PAM uses to send Kerberos password-change (kpasswd) requests to the KDC. | Integer. Default value: *464* |
| **Timeout duration (milliseconds)**
| Sets the LDAP and Active Directory response read timeout | Default value:"5000 ms |
| **Password encryption key** | The encryption key to be used when “Password encryption method” is chosen as AES. | String |
| **Password encryption method** | The method to be used for password encryption. | CLEAR / MD5 / AES / UNICODE\_ENCLOSED\_IN\_DOUBLE\_QUOTES |
| **Users excluded from newly discovered check (Comma separated)** | The list of users to be ignored in the new user checks. | |
| **Automatic action for newly discovered users** | The action to be taken when a new user is found. | LOG / NOTHING / DELETE / LOG\_AND\_DELETE |
| **Password change reminder time (Days)**
| The duration (in days) to wait before sending a reminder to the email addresses defined in the sapmMailList property in the device group, before a password change. | Integer (days) |
| **Characters that are counted as symbols** | The pool of characters allowed as symbol characters in password strength.
Double quotation mark (“) and percent mark (%) are not allowed for a Vault Account password which has WinRM configuration. | Character string.
E.g.”
!"#’%&'()\*+,-./:;\**IMPORTANT NOTE:** If the total length of the character types (uppercase letters, lowercase letters, numbers, and special characters) entered in the password configuration parameters is less than the value entered in the **“Password Length”** field, Kron PAM will generate the remaining characters randomly according to the randomness rule. | Integer |
| **Command set for post password change ** | The commands to be executed on the server after a successful password change
(E.g., to kill active sessions started with the previous password).
Multiple commands can be separated with \n characters.
See section 7.1.16Configuration Properties to Execute Commands After Changing Passwords for more information. | Specific to the device type |
| **Command set for post password change failure pattern** | If the pattern set for this property is found in the command results of the “post-command”, the command is tagged “s” FAILED”".
When this happens, the command execution is stopped, and the remaining commands are not executed if the “Stop on fail for post password change”
property is set as “true”. | Specific to the device type |
| **Stop on fail for post password change** | When set as “On”, if any failure occurs during post command execution, the remaining commands are not executed. The default value is “Off”. | Switch (On/Off) |
| **Allow set comment to account during check out password**
| Comments appear when prompted for password check out. | Switch (On/Off)
|
| **Skip password validation after password change** | If set as “On”, no password validation is done after a password change.
The default value is “Off”, meaning the password validation is done after a password change (For SSH and Windows Services Strategy only).
For TACACS+ devices it must be set as” On”. | Switch (On/Off) |
| **Show accounts in auto login options only if domains match**
| It is defined to use Active Directory and LDAP accounts only in domain accounts. Domain parameters should be added on the device. | Switch (On/Off)
Default value: Off |
| **SSH port** | The port number for SSH connections, for SSH strategy. The default value is 22. | Specific to the device type. |
| **Wait duration between SSH commands (Milliseconds)**
| Time to wait between commands | Integer (milliseconds) |
| **Static Secret Type**
| Select the type of static accounts with static configuration. | USER\_CREDENTIAL
SSH\_KEY
SSL\_CERTIFICATE
OTHER (Secret Data) |
| **Super user password** | The password of the super user who has superior rights on the target server.
The value must be set when one of the "\*\*\*\*with.superuser" properties is set as “On”. | String (hidden) |
| **Super user name** | The username of the super user who has superior rights on the target server.
The value must be set when one of the "\*\*\*\*with.superuser" properties is set as “On”.
If ** Super user name**
is written as username\@hostname, it can be used in an account on another Vault-defined device. | String |
| **Target URL Template** | In an Active Directory LDAP configuration, the Root Domain and Hostname Verification serve two distinct but equally critical functions for search scope and security. The Root Domain, configured as the Base DN (Base Distinguished Name) using domain components (e.g., dc=company,dc=local), acts as the starting coordinate for directory searches, dictating that Kron PAM should query for users and groups starting from the very top of the directory hierarchy. Meanwhile, to securely transmit this data over LDAPS, Kron PAM must perform Hostname Verification by using the server's FQDN (Fully Qualified Domain Name, such as ad-server.company.local) in the target URL rather than a simple IP address. | Root Domain or Device specific |
| **Unlock account with super user**
| To unlock the AD user, Super user must be used. | Switch (On/Off)
|
| **Regex parser for delimiter for user groups**
| The delimiter character to separate multiple user groups when checking for new users in a server. | String |
| **Command set for getting newly discovered user lists**
| The command to get the user list. | E g. :
cat /etc/passwd |
| **Script set for getting newly discovered user lists** | The “expect” script used to get the user list. | Expect script |
| **Regex parser for delimiter for user** | The regex pattern to find usernames after the users are listed. | Specific to the device type.
Ex: (.\*?):.\* |
| **Allow set comment to account during update password**
| Comments appear when prompted for password update. | Switch (On/Off)
|
| **WinRM authentication method** | Authentication method for WinRM. | Basic, Digest, NTLM |
| **Ignore certificate errors** | When set to “One”, certificate errors will be ignored during WinRM connections. | Switch (On/Off) |
| **WinRM port** | The port number for WinRM device configurations. | Integer |
| **Use secure WinRM**
| When set to “true”, the connection will be over HTTPS. Otherwise, it will be over HTTP. | true/false |
| **WinRM connection timeout**
| Sets the WinRM response read timeout | Default value :"5000” ms |
| **Find User DN without UPN suffix** | If the domain account to be added to the vault uses the UPN suffix (@domain) for the initial connection, the account's username is defined as user\@domain.
When a password change is required, the User Distinguished name (DN) (user) information is required. In this case, the UPN suffix information is removed when changing the password, and the password is changed for the found DN.
In the Active Directory Vault Configuration, under the Password Change Category, select the Find User DN without UPN suffix switch box (Yes/No). | Default value is No |
| **Use in Session Manager without UPN Suffix** | If the username definition for the domain account added to the vault includes a UPN suffix (@domain), the UPN suffix is removed when connecting to the server in the domain, and the device connects using the DB information.
In the Active Directory Vault Configuration, under the Password Change Category, select the Use in Session Manager without UPN Suffix switch box (Yes/No). | Default value is No |
| **Use Master Server** | The key parameter indicating whether the network will be managed via a central "Master" server in the NMS architecture. | Switch (On/Off)
|
| **Master Server IP Address** | The static IPv4 or IPv6 address of the NMS management server (Master) that is accessible on the network. This is the main IP that devices will communicate with. | String |
| **Master Server User** | The authorized system or service account username used to access the Master NMS server via SSH. | String |
|
**Master Server User Password**
| The password used for the authentication of the Master server user. | String |
| **Child Node Connection User** | The standard connection username the NMS will use when remotely accessing the child devices it manages via protocols like SSH | String |
| **Child Node Connection User Password** | The authentication password for the account establishing the initial connection to the child nodes. | String |
| **Child Node Escalation User** | The account type or command required for Privilege Escalation (e.g., sudo/root in Linux, enable on network devices) to gain configuration privileges after successfully connecting to the child network devices. | String |
| **Child Node Escalation User Password** | The password required for the privilege escalation process | String |
| **Command set for change password of master server flow** | The set of scripts or CLI commands the NMS will execute to safely and automatically change the Master server's own system password (or a child device's NMS access password). | Multiline Text / Script Block |
| **Command set for check password of master server flow** | The verification command sequence | Multiline Text / Script Block |