Managerial Approval for OT/ICS Sessions
Kron PAM applies the Managerial Approval for Connections feature to OT/ICS Session Manager sessions. When a connection approval workflow covers the session, users cannot reach the target device until a manager approves an instant approval request or an approved connection reservation covers the current access attempt.
Kron PAM evaluates approval when the application connects to the forwarded local port, not when the SSH tunnel opens. The tunnel therefore opens as usual, and Kron PAM allows or blocks each forwarded connection separately.
OT/ICS Session Manager supports two approval modes:
· Connection reservation: Users request an access window in advance. Kron PAM checks approved reservations automatically without user input.
· Instant approval: When no valid reservation exists, Kron PAM prompts the user to create an approval request. After the user confirms the operation, Kron PAM creates the request and blocks forwarded connections until a manager approves it.
Kron PAM evaluates every forwarded connection in the following order:
Condition | Result |
|---|---|
No connection approval workflow covers the session. | Kron PAM allows the connection immediately. |
An approved connection reservation covers the user, the applicable device or device group, and the current time. | Kron PAM allows the connection immediately and shows no approval prompt. |
No valid reservation exists, and instant approval is enabled. | Kron PAM blocks the connection and prompts the user to create an instant approval request. |
No valid reservation exists, and instant approval is disabled. | Kron PAM blocks the connection, states that a reservation is required, and closes the tunnel session. |
Prerequisite: Define the OT device with the TCP access protocol, and associate its device group, user group, and policy group in a realm. See "OT/ICS Session Manager Configuration". Define a connection approval workflow. See "Approval Workflow" in the Approval Management section.
To require managerial approval for OT/ICS sessions:
1. Navigate to Policy > Approval Workflow.
2. Click +Add, enter the workflow name and description, and then click Next.
3. To make this workflow reservation-only, select Disable Instant Approval.
4. Define the workflow levels, and then click Save.
5. Navigate to Policy > Policy Groups, and open the policy group that the OT device group uses.
6. Select the workflow in Workflow for Connection Approval, and then click Save.
To disable instant approval for all TCP Proxy sessions, navigate to Administration > System Config Man, and set disable.instant.approval.for.tcp to true. The default value is false.
Parameter | Description |
|---|---|
disable.instant.approval.for.tcp | Disables instant approval requests for TCP Proxy sessions when set to true. Users can reach the target device only with an approved connection reservation. The default value is false. |
kill.session.on.reservation.end | Closes the tunnel session when the reservation window ends if set to true. When set to false, Kron PAM terminates only the forwarded TCP channels and keeps the tunnel session open. |
auto.approve.when.requester.is.approver | Approves a request automatically when the requester is also an approver of the group and the setting is enabled. |
aioc.approval.excluderequester.enabled | Prevents requesters from approving their own requests when the setting is enabled. Another approver must approve the request. |
aioc.connection.reservation.max.allowed.hours | Limits the maximum duration that users can request for a connection reservation. |
aioc.connection.reservation.reason.required | Makes the Reason field mandatory on the connection reservation screen when the setting is enabled. |
For the full description of these parameters and other general connection reservation settings, see "APPENDIX 1: System Config Manager Parameters" and the Approval Management section.
Use Disable Instant Approval to make a specific workflow reservation-only. Use disable.instant.approval.for.tcp to disable instant approval for TCP Proxy sessions at the system level.
Kron PAM loads the approval requirement, selected workflow, kill.session.on.reservation.end, and disable.instant.approval.for.tcp values once for each tunnel session and keeps them for the life of that session. Changes to these settings affect new tunnel sessions.