Privileged Task Automation Authorization
Two independent layers control access to PTA. Both layers must allow an operation before a user can perform it:
· Portal functions determine which PTA tabs a user opens, whether the user creates script groups and scripts, whether the user manages script realms, and how much log data Kron PAM returns. Assign portal functions from Policy > Portal Functions.
· Script realms determine the Play, Edit, and Delete permissions that a user group holds on specific script groups. Manage script realms on the Realms tab of Privileged Task Automation.
Portal functions do not grant object-level permissions, and script realms do not make a tab visible. Users who open the Scripts tab see only the script groups covered by a script realm and can perform only the actions granted by that realm.
Table 1: Privileged Task Automation Portal Functions
Function | Description |
|---|---|
kronpam.pta.scripts.moduleVisibility | Grants the right to view the Scripts tab in the Privileged Task Automation menu. Users see only the script groups and scripts that a script realm covering one of their user groups includes. This function does not grant the right to create script groups or scripts. |
kronpam.pta.scripts.add | Grants the right to create script groups and scripts. This function has no effect on its own, so assign it together with kronpam.pta.scripts.moduleVisibility. Users do not need this function to edit a script that a script realm already covers. |
kronpam.pta.realms.moduleVisibility | Grants the right to view the Realms tab in the Privileged Task Automation menu in read-only mode. Users see only the script realms that include one of their user groups, and Kron PAM hides the add, edit, and delete controls. |
kronpam.pta.realms.manage | Grants the right to create, edit, and delete script realms. Assign it together with kronpam.pta.realms.moduleVisibility so that Kron PAM displays the Realms tab. |
kronpam.pta.logs.moduleVisibility | Grants the right to view the Logs tab in the Privileged Task Automation menu. Users see only the script executions that they performed. |
kronpam.pta.groupLogs.moduleVisibility | Grants the right to view the Logs tab in the Privileged Task Automation menu. Users see the script executions that the members of their own user groups performed. |
kronpam.pta.logs.all | Expands the scope of the Logs tab to the script executions of all users. This function has no effect on its own, so assign it together with kronpam.pta.logs.moduleVisibility or kronpam.pta.groupLogs.moduleVisibility. |
kronpam.pta.super.user | Grants the right to view and manage all script groups and script realms, regardless of script realm membership. This function does not display the Logs tab, so assign a log visibility function as well. |
Table 2: Common Privileged Task Automation Function Sets
Task | Portal Functions to Assign |
|---|---|
Run scripts authorized by an administrator | kronpam.pta.scripts.moduleVisibility, with the Play permission in the related script realm |
Create script groups and scripts | kronpam.pta.scripts.moduleVisibility and kronpam.pta.scripts.add |
Review script realms without changing them | kronpam.pta.realms.moduleVisibility |
Manage script realms | kronpam.pta.realms.moduleVisibility and kronpam.pta.realms.manage |
Review your own script executions | kronpam.pta.logs.moduleVisibility |
Review script executions from your own user groups | kronpam.pta.groupLogs.moduleVisibility |
Review script executions from all users | kronpam.pta.logs.moduleVisibility or kronpam.pta.groupLogs.moduleVisibility, with kronpam.pta.logs.all |
Administer all script groups and script realms | kronpam.pta.super.user, with the required tab visibility functions |