Set Manual Password for Dynamic Vault Accounts

The Vault module periodically changes the passwords of dynamic vault accounts. The Password Vault's password generation algorithm creates random passwords and assigns them to accounts.

You can also assign a password of your choosing to an account for a specified duration, instead of waiting for the next automatic change. This applies to dynamic accounts and to static accounts, except accounts that use the STATIC strategy (static accounts without a target device). Once a manually assigned password expires on a dynamic account, Kron PAM automatically generates and assigns a new random password. Static accounts don't change automatically, so a manually set password stays in effect until you change it again.

To set a manual password for the dynamic Vault account, the single.connect.sapm.set.password.manual function is necessary to include in the function realm.

With this definition, users in the relevant group who have the Manage Password permission or higher see the Set Password button enabled on the Vault screen. This button is functional for dynamic vault accounts, and for static vault accounts other than those using the STATIC strategy.

A parameter called Set Password Manually is on the Vault Configuration > Password Change group pop-up.

Suppose the user has the Set Manual Password function from the Portal Definition screen and the Set Password Manually option is set to On in the Vault Configuration screen. In that case, the Set Manually Password option will become available on the Vault Definition screen.

Even if this parameter is defined as True in the Portal Function, Kron PAM can ensure that some Vault Accounts cannot manually set passwords according to Vault Configurations.

If the Set Manual Password function isn’t defined as False on the Portal Function in this case system will not enable the user on the Vault Password Change popup even if Set Password Manually is defined as True on the Vault Configuration screen.

When the user clicks the Set Manual Password button, the Set Manual Password step opens, where the user enters a new password. If no specific password configuration rule is defined for the relevant vault configuration, the screen displays information stating that the default password will use three uppercase letters, three lowercase letters, and two numbers.

If the vault configuration defines Password Creation Criteria for the account (for example, a minimum number of uppercase letters, lowercase letters, or numbers), Kron PAM displays these requirements on the screen. If the user enters a password that doesn't meet them and clicks Set Manual Password, Kron PAM displays a warning message instead of saving it.

To generate a random password that meets these requirements instead of typing one, click the generate icon next to the New Password field. This opens the random password generation screen.

Kron PAM validates the entered password by connecting to the target device, then sets it there.

For dynamic accounts, when the user enters the password value and clicks Next, a pop-up appears where the user can select how long the password will be used and enter a comment.

For static accounts, this duration step doesn't apply. After the user enters a comment and clicks Set Manual Password, Kron PAM changes the password immediately, both on the target device and in the Password Vault database, and doesn't schedule any further automatic or random password change.

A new log type will be added to the Vault Log screen, and if a user performs the Set Manual Password action for any account, this will be logged as such.