Privileged Access Management (PAM)

Privileged access management (PAM PAM (Privileged Access Management): Controls privileged access by vaulting credentials, enforcing least-privilege/just-in-time access, rotating secrets, and auditing sessions. Across Keyfactor products, PAM protects diverse sensitive operations and secrets—for example certificate stores and CA credentials—via built-in or third-party providers; external integrations are delivered as custom PAM extensions (several published on Keyfactor’s public GitHub).) functionality in Keyfactor Command allows for configuration of third party or Keyfactor Command local PAM providers to secure certificate stores, credentials for accessing certificate authorities, and similar. Third-party PAM functionality is provided using custom PAM extensions.

System Settings → Privileged Access Management

Keyfactor provides several PAM extensions on the publicly-facing Keyfactor GitHub:

The Keyfactor Command PAM solution is made up of these elements:

• Install an appropriate custom PAM provider extension if using a third-party solution (see Installing Custom PAM Provider Extensions).
• Create a PAM provider record in Keyfactor Command (see PAM Provider Configuration in Keyfactor Command).
• Create secret entries for your required needs in the PAM database. If you’re using a Keyfactor Command local PAM database, this can be done in the Keyfactor Command Management Portal (see Managing Secrets for a Local Keyfactor Command PAM Provider) or by using the POST /PamProviders/Local/{providerId}/Entries Keyfactor API An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. operation (see POST PAM Providers Local ID Entries).
• Apply PAM provider security to individual certificate stores (see Add or Modify a Certificate Store), certificate authority A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. records and other locations as needed in Keyfactor Command.

PAM Extensions support installation either locally (on the Keyfactor Command server) or remotely (on each instance of the Keyfactor Universal Orchestrator The Keyfactor Universal Orchestrator, one of Keyfactor's suite of orchestrators, is used to interact with servers and devices for certificate management, run SSL discovery and management tasks, and manage synchronization of certificate authorities in remote forests. With the addition of custom extensions, it can provide certificate management capabilities on a variety of platforms and devices (for example Amazon Web Services (AWS) resources, Citrix\NetScaler devices, F5 devices, IIS stores, JKS keystores, PEM stores, and PKCS #12 stores) and execute tasks outside the standard list of certificate management functions. It runs on either Windows or Linux servers or Linux containers. that will be accessing PAM secrets). You will need to make a determination as to which installation type best meets your needs:

• Local (Keyfactor Command server): Supports all PAM secret integrations available in Keyfactor Command, including certificate stores, certificate authorities, identity providers, workflow A workflow is a series of steps necessary to complete a process. In Keyfactor Command, it refers to the workflow builder, which allows you to automate event-driven tasks such as when a certificate is requested, revoked or found in a certificate store. steps, task queue connections, and SMTP Short for simple mail transfer protocol, SMTP is a protocol for sending email messages between servers. settings. This option provides the broadest coverage but requires the Keyfactor Command server to communicate directly with the PAM provider.
• Remote (CA Connector Client or Universal Orchestrator): Supports PAM secret integration only for resources managed by the connector or orchestrator Keyfactor orchestrators perform a variety of functions, including managing certificate stores and SSH key stores. where the PAM extension is installed (for example, certificate stores managed by the Universal Orchestrator). This option can simplify network connectivity by allowing the connector or orchestrator, rather than the Keyfactor Command server, to communicate with the PAM provider.