---
title: Assigned Credentials
slug: kronpam-reference-guide-3-9-0/assigned-credentials
description: Learn how to assign credentials in Kron PAM to establish connections between users and target systems. This guide provides step-by-step instructions on matching Kron PAM users or groups with local or Active Directory users, allowing for proxy connections 
docTags: 
createdAt: 2022-07-25T14:56:21.000Z
---

Assigning credentials correlates different Kron PAM users or user groups with specific local or Active Directory (AD) users in target systems via the Kron PAM [Password Vault](docId\:yUVFx_u4NERDT13ut4Of7).

In Proxy connections, the target device’s credentials are either entered as a** global username/password** or they can be retrieved from the Password Vault. In either situation, the users use just one local user to connect to the target device, and these credentials are defined for the whole device group.

In some cases, different users might need to connect to the same device through different user accounts. In this case, assigning credentials will let different Kron PAM users connect to target devices with different Vault accounts.

Also, as mentioned before, user groups can be retrieved from Active Directory. Credentials in Vault can be assigned to AD user groups, as well as users.

If a specific Device or Device Group is selected in the Assigned Credentials definition, the user can use the Vault account defined in the selected device connection. This process applies to devices for the selected Device or Device Group, or you can use the Apply for All Devices option.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Nh_5iC7tn4mD1vh1kndHD_image.png "Connection with and without Assigned Credentials ")

In the example illustrated above, the users are connecting to target devices with and without assigned credentials. In the first diagram, Kron PAM users A, B, and AD user groups use the same local/AD user accounts to connect to the target devices. In the second diagram, assigned credentials were configured between Kron PAM User A and Local/AD User A, and between Kron PAM User B and Local/AD User B, which allowed Kron PAM User A to log in to target devices as Local/AD user A, and Kron PAM User B to log in as Local/AD user B.


Defining the Assigned Credentials allows the use of the defined accounts in Active Directory, LDAP, WinRM, and SMB strategies to connect to different devices. But first, you must configure the local/AD user as a Dynamic Password Controller account in order to use assigned credentials. See the related sections in this document for configuration details.


To configure assigned credentials:

1.      Navigate to Users > Assigned Credentials, and click Add.

2.      In User Selection, choose a User or a User Group.

3.      In Vault Account, select the account to assign. The pop-up stays open after each selection, so you can select more than one Vault account in the same session. Kron PAM lists everything you've selected so far as removable tags above the field.

4.      (Optional) To apply this assignment to every device instead of specific ones, turn on Apply For All Devices. Otherwise, select a device or a Device Group under Advanced Apply For.

5.      Click Save.

6.      To use this assignment; navigate to **Devices > Inventory.**

7.      Click the edit button of a device group that will connect to the target devices via assigned credentials and select **Edit option. **

8.      Go to section 2(properties)

9.      Click Additional Credentials menu and enable **Add Assigned Credential to Credential Selection**.

:::hint{type="info"}
Sections 5 through 7 can also be applied to users or user groups. When editing a user or user group in the Assigned Credentials menu, accounts for the same purpose can be selected.
:::

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/JzR-q9TQgbBDwTh4XTHkI_image.png "Assigned Credentials Configuration ")

To edit an existing assignment, navigate to **Users** > **Assigned Credentials**, select the assignment, click **Actions**, and select **Edit Assigned Credential**. The same multi-select behavior described above applies when editing.