4.1 Managing SAPM (Shared Accounts Password Management) Accounts

Adding SAPM Configuration

Authorized users can create SAPM accounts. To add an account:







Duplicating SAPM Configuration

Users can duplicate an SAPM Configuration with all properties. To duplicate an SAPM Configuration:

After saving, a duplicate configuration will be created. Users can edit the properties for the new configuration later.

Configuration to Show Password to Multiple Users

If an SAPM password is to be seen by the same user group at the same time, the "allow.seen.by.multiple.user" property must be set.





Configuration to Execute Commands After Changing Password

After changing passwords, executing some commands may be need. For these commands to be executed, the following properties must be set in SSH and SMB strategy:

Configuration to Reminder for Changing Password

A reminder can be set before the password change date arrives. To set a “password change reminder day” follow the steps below;





Adding Accounts in SAPM

Authorized users can create SAPM accounts. To add an account:





Adding Cluster Accounts in SAPM

Firstly, an SAPM account is defined for an active cluster node. Then, other nodes are defined as below;



To search identical accounts:



SSH Key Rotation by SAPM

SSH Keys can be changed by SAPM module periodically. To add an SSH key:





The SAPM account will be saved and listed in the SAPM Accounts part. From this moment on, the SSH Key will be changed periodically.

Checking out and resetting SSH Key works just like the normal SAPM accounts.



Adding Auto Import Rules

If there are a lot of devices that have the same username and password, the function can be used to add SAPM Account.





Adding Permissions to SAPM Accounts

Different authorization levels can be defined to SAPM accounts. To set permissions to accounts;







Permission Types: READ_ONLY: These users only have the authority to see the SAPM password.

FULL_CONTROL: Users who have full control permission are admins of this SAPM account. These users have full authority such as resetting, changing the password, and giving permission to users.

READ_ONLY_FIRST_PART: These users have only authority to see the first half of the SAPM password.

READ_ONLY_SECOND_PART: These users have only authority to see the second half of the SAPM password.

One user can be a member of multiple user groups with different rights. In this case following order will be used: FULL_CONTROL > READ_ONLY > READ_ONLY_FIRST_PART > READ_ONLY_SECOND_PART

This means that if a user has FULL_CONTROL and READ_ONLY rights, they will have the FULL_CONTROL right which is superior. If they have the READ_ONLY_FIRST_PART and READ_ONLY_SECOND_PART rights, they will get the first part of the password.



Create a One-Time Password





Change Account Password Manually





Reset Account Password



Checking New Users

SAPM can check new users in a server after adding at least one SAPM account in the server. To do this:





SAPM will check the users and a pop-up will inform the user about the process. After that, the new user list can be viewed:



Importing New Users to SAPM

New users can be imported to SAPM using New Users Log screen. To do this:





Deleting New Users

New users can be deleted using New Users Log screen. To do this:



Display Password Check Log



Display Password Change Log





Display Password History Log





SAPM Dashboard

The SAPM Dashboard shows a graphical report of validity and the change status of the password of SAPM Accounts in a Parent device group. Managers can only access reports of device groups which they are authorized to see.





Managing Passwords in a File

The Single Connect SAPM Module can change passwords in a specific file.

sapm.password.change.strategy

sapm.change.password.with.super.user

sapm.super.username

sapm.super.password

sapm.file.path

sapm.file.regex.to.match

sapm.file.regex.to.replace



SAPM Notifications Settings

SAPM Mail List Notifications





4.On the “Device Group Properties Information” screen, select the “sapmMailList” as the “Property Key” and enter the e-mail information





Password Retrieval Approval Notifications

When a user (who retrieves a password with only administrator approval) requests to retrieve the SAPM password, a "SAPM Password Approval Request" e-mail is sent to the below list:

Password Retrieval Second-Level Approval Notifications

The users whose password retrieval requests need two-level approvals should have an “SAPM Second Level Approval Requirement” function group defined in their Portal Functions Realm. To do so, these steps should be followed:

When a user, who retrieves a password with two-level approval, requests to retrieve the SAPM password, "SAPM Password Approval Request" e-mail is sent to the list below:

So, the following steps should be followed:

If a user from these lists approve the initial request, an "SAPM Password Approval Request" e-mail is sent to the second-level approvers, which are provided in the list below:

So, the following steps should be followed:

If a user from these lists approves the second-level request, the requester receives an e-mail and can proceed to password checkout.

If any of the authorizers deny the request, informational e-mails are sent to all participants, and the request gets terminated.

Future Date Reservation

Password retrieval for an SAPM Account can be reserved for a future date. These steps should be followed for future date reservation:









If one or two-level approval is applied for the user, then the approvers should approve reservation before the user gets the password.

If all approvals are completed, the user gets a reminder e-mail at reminder time and gets the password e-mail at reservation time

The past and future reservations can be searched in the “Reservation” tab. In order to delete any of them:

Split Password Feature

In order to secure the two-part approval process, the password of an SAPM account can be split in to two and be retrieved by different users. After placing the users in different user groups, these steps should be followed:

After completing these steps, the users log in and retrieve their parts of the password from the SAPM Management section like normal password retrieval. They can log in to the target system using the SAPM username and the password combined in the correct order.







If one or two-level approval is applied for the user, the user will get the related part in the e-mail when the approval process is completed.