I need guidance on a Senhasegura PAM implementation.
I have two PAM admin accounts:
fnadmin: Requires access to 20 devices.
snadmin: Requires access to only 13 of those 20 devices.
Customer doest want me to onboard 20 credential they want Both users should access their assigned devices using a single shared AD domain account, without creating duplicate credentials on the Domain Controller.
Current Configuration
Created the AD domain seguratest123 under System Parameters → AD/LDAP.
Assigned this domain to all 20 devices, including the Domain Controller.
Created a Domain Admin credential for fnadmin, linked to the Domain Controller device using seguratest123 domain
The “Open another device using this credential” option works correctly and displays all 20 devices even I can able to pen any device using the same credential.
Issue
For snadmin, I created a second AD/LDAP domain, seguratest456, and assigned it to the required 13 devices. Reason ( if I used “seguratest123” it will expose remaing 8 devices which snadmin not atorize to so by using seguratest456 The device list displays correctly under snadmin but when I try to open another device ption using the shared credential, the session fails.
The credential works only when I select the original AD/LDAP domain, seguratest123, which displays all 20 devices.
The customer requires least-privilege access and does not want me to create separate individual credentials for every device in segura pam credential gui.
Any guidance on the recommended architecture or configuration would be appreciated.
First, let me make sure I understand the current setup correctly.
There are 20 devices in total .
fnadmin is a PAM User and should have access to all 20 devices .
snadmin is also a PAM User, but should have access to only 13 of those 20 devices .
The remaining 7 devices should be accessible only by fnadmin.
The 13 devices assigned to snadmin are therefore a subset of the 20 devices, not an additional 13 devices.
The Credential is the AD/domain account that Senhasegura uses to authenticate to the target devices. This is different from the PAM Users (fnadmin and snadmin ).
The AD domain is seguratest123 , and the requirement is to use the same shared AD Credential for accessing the target devices, without creating separate credentials for every device or creating duplicate AD accounts on the Domain Controller.
If the above understanding is correct, then I believe the access restriction for snadmin should be handled through Senhasegura authorization/security policies , rather than by creating a second AD/LDAP domain.
In other words, fnadmin should be allowed to use the shared Credential against all 20 devices, while snadmin should be restricted to only the specific 13 devices.
Therefore, for the PAM User snadmin , we should create or configure a Security Policy that defines which devices this user is allowed to access. I assume that when the PAM Users were created, the default PAM Core policy was applied to both users, and the required device-level filtering/authorization should be implemented through Security Policies.