Configuring JIT Access for Classic Active Directory
Classic Active Directory JIT access creates a temporary directory user, adds it to the configured group, and removes both the membership and the user when the validity period ends. To configure the connector, you can follow the below steps:
1. Open the Classic Active Directory Vault configuration and enable privileged operations with the configured super account.
2. Verify that the super account can create and delete directory users and manage membership in the target group.
3. Open the Just In Time properties.
4. Enable Add to Group.
5. Enter the required group in Target Group.
6. Define or verify the Command set for JIT Creation and Command set for JIT Revocation operations.
The generated sAMAccountName must not exceed 20 characters. Keep the Base account name short enough for the underscore and generated suffix, and do not use characters prohibited by Active Directory.
1. Create or edit a Static account with Account Subtype set to Ephemeral Base and select the Classic Active Directory configuration.
2. Open the Base account action menu and select Generate Ephemeral Account.
3. Select the required Duration, enter a Comment, and generate the account.
4. Verify that a unique directory user is created and added to the configured target group.
5. After the duration expires, verify that the membership is revoked and the generated user is deleted.