Department-Based of Administrative Isolation

Department-Based Administrative Isolation enables administrative users to manage Kron PAM resources within the scope of their own department.

When multiple departments or administrative teams use the same Kron PAM environment, this feature provides administrative isolation by limiting the visibility and management of PAM objects according to object ownership.

Department Administrators can view and manage only the objects available within their department scope. Objects outside the permitted scope are not available to these users.

The kronpam.department.admin Portal Function is used to define Department Administrators.

When this Portal Function is assigned to a User Group, the administrative scope of the users in the group is limited according to department ownership.

The kronpam.department.admin Portal Function does not grant additional administrative permissions. It determines the scope in which the user's existing permissions can be used. The operations that a Department Administrator can perform are still controlled by the Portal Functions and Function Groups assigned to the user.

Department-Based Administrative Isolation works together with the existing Kron PAM authorization mechanism.

Department-Based Administrative Isolation applies to the following object types:

·         Users

·         User Groups

·         Devices

·         Device Groups

·         Policy Keys

·         Policy Groups

·         Policy Realms Department ownership determines which of these objects are available to a Department Administrator.

Department ownership defines the administrative scope of an object.

When a Department Administrator creates a supported object, ownership is automatically assigned to the department User Group or User Groups that the administrator belongs to at the time of creation.

Ownership is assigned to the User Group rather than directly to the user who creates the object.

Therefore, ownership of an object is maintained independently of the individual user who created it. If the creator is later removed from the system, other authorized users in the same owner group can continue to manage the related objects.

This group-based ownership model prevents objects from becoming unavailable when the user who originally created them no longer exists in the system.

Department ownership is used when displaying, searching, creating, updating, deleting, and referencing supported PAM objects.

Department Administrators can create new objects according to their assigned functional permissions.

When a Department Administrator creates a supported object, the department User Group or User Groups that the administrator belongs to are automatically assigned as the Owner Groups of the new object.

The kronpam.department.admin Portal Function does not provide create permissions by itself. The administrator must also have the required Portal Functions for the related operation.

When a Department Administrator accesses a management page, Kron PAM filters the displayed objects according to the applicable authorization and ownership rules.

Objects outside the permitted administrative scope are not available unless they are accessible through an existing authorization mechanism defined for the related object type.

The visibility rules applied to Department Administrators are described in the Object Visibility Rules section.

Department Administrators can update objects owned by their department User Groups according to their assigned functional permissions.

Kron PAM checks both the functional permissions of the administrator and the ownership of the related object.

The kronpam.department.admin Portal Function does not provide update permissions by itself.

Department Administrators can delete objects owned by their department User Groups according to their assigned functional permissions.

The administrator must have the required delete permission for the related object.

Department ownership does not replace the existing authorization controls. Both the required functional permission and the applicable ownership rules are evaluated before an operation is performed.

Ownership assignments can be managed only by:

·         Supervisors

·         Users with the kronpam.ownership.admin Portal Function

Department Administrators cannot change ownership assignments.

This restriction prevents Department Administrators from assigning their own department User Groups as owners of objects outside their existing administrative scope.

Therefore, the kronpam.department.admin Portal Function provides access to department-owned resources, while the kronpam.ownership.admin Portal Function provides authority to manage ownership assignments.

Kron PAM provides the following screens for viewing and managing object ownership:

·         User Ownership under the Users menu

·         Device Ownership under the Devices menu

·         Policy Ownership under the Policy menu

These screens are available only to Supervisors and users with the kronpam.ownership.admin Portal Function.

Each Ownership screen provides an Object Type selector to display the supported object types for the related module.

The Ownership screens also provide a search function. The search is performed against both the object name and the Owner Group name. This allows objects to be searched according to their assigned owner groups.

The following ownership filters are available:

·         All Owner States

·         Has Owner Group

·         No Owner Group

These filters can be used to display objects according to their current ownership status.

The User Ownership screen is available under the Users menu.

It is used to view and manage ownership information for supported user-related objects.

Access to this screen is restricted to Supervisors and users with the kronpam.ownership.admin Portal Function.

The Device Ownership screen is available under the Devices menu.

It is used to view and manage ownership information for supported device-related objects.

Access to this screen is restricted to Supervisors and users with the kronpam.ownership.admin Portal Function.

The Policy Ownership screen is available under the Policy menu.

It is used to view and manage ownership information for policy-related objects.

The Object Type field can be used to select the following object types:

·         Policy Keys

·         Policy Groups

·         Policy Realms

Access to this screen is restricted to Supervisors and users with the kronpam.ownership.admin Portal Function.

The Owner Groups action is available in the User Group edit dialog.

This action provides access to the ownership information associated with the selected User Group.

The Owner Groups action is available only to Supervisors and users with the kronpam.ownership.admin Portal Function.

Department Administrators have create, read, update, and delete access to records owned by their department User Groups, provided that they also have the required functional permissions.

Department Administrators cannot change object ownership assignments. Ownership management is restricted to Supervisors and users with the kronpam.ownership.admin Portal Function.

A Department Administrator is also prevented from deleting the only User Group that grants the user Department Administrator authority.

If the User Group is the only group providing kronpam.department.admin authority to the user, the delete operation is blocked. This prevents the administrator from irreversibly removing their own Department Administrator privileges.