Only users added individually to the Management Tool can create secrets and folders. Users who belong only to an Active Directory group do not have this permission. For more information, see the Management Tool issues and error messages page.
Before you start
- Sign in to the Management Tool.
- Identify the secret type you need (Active Directory, Windows, Unix SSH, Unix Telnet, Web, or MS SQL).
- Obtain the login and password for the account the secret will access.
1. Open the New Secret window
1
Sign in to the Management Tool
Log in with an account that has permission to add secrets.
2
Open Password Management
Click the Password Management tab in the left navigation.
3
Add a secret
On the Secrets tab, click Create in the top right of the page and choose available secret’s type. The New Secret window opens.
The General section of the Details tab.
2. Set the general properties
On the Details tab, in the General section, specify:- Secret Name - a unique name for the secret.
- Description (optional) a short description of the secret.
- Tags - (optional) are colored labels used to filter the secret grid..
Then enter:
- Login — the existing user name of the account the secret will access.
- Password — the existing password for that account.
For the Unix account (SSH) secret type, you can select the “Use SSH key” option instead of “Use password”. In this case, upload a
.PPK file containing the private key and enter the private key passphrase, if applicable. See Remote password rotation for SSH key handling.For the Active Directory account secret type, you can optionally restrict access to specific computers. Select the checkbox, then choose the required computers from the drop-down list to allow connections only to those computers in the specified domain.
For the Windows account and Unix account (SSH) secret types, if you plan to use the File transfer functionality, please refer to the Transferring files using the WinSCP application page.
The General section of the Details tab.
3. Configure automatic password rotation
The Automation tab is available for the Active Directory account, Windows account, Unix account (SSH), and MS SQL account secret types only.
- Enable remote password rotation — select this to allow the account’s password (and the secret’s matching password) to change automatically, and manually at any time.
- Rotate Password Every — set how often the password changes automatically.
After a secret is created, the Rotate Now button becomes available on the Automation tab when editing the secret. This button allows you to manually rotate (change) the account password at any time.
For Active Directory, Windows, and Unix (SSH) account secret types, File transfer functionality requires Remote Password Rotation to be enabled. Additionally, the password must be rotated at least once before file transfers can be performed using the WinSCP application.
The Automation tab, where remote password rotation is configured.
4. Set security and checkout options
On the Security tab, you can enable activity recording during secret use and turn on Password Checkout so only one user can use the secret at a time.- Record user activity while the secret is in use — monitors user activity only while a user is connected to the account through Syteca Connection Manager. If unselected, no recording occurs.
- Requires check out — enables Password Checkout, so only one user can check out the secret’s password (and connect to the account) at any given time.
- Change password on check in — (Active Directory, Windows, Unix SSH, and MS SQL only) rotates the password every time the secret is checked back in.
- Check in automatically after — sets a time period after which the secret is automatically checked back in and the current user is forcibly disconnected.
- Force Check In (button) — appears when editing an existing secret; manually checks the password back in and disconnects the current user.
When Record user activity while the secret is in use is selected and the Endpoint has an endpoint license with User Activity Monitoring enabled in the serial key:
- If the checkbox is selected, all user activity is monitored, regardless of the filtering parameters in the Endpoint settings.
- If the checkbox is not selected, user activity is monitored according to the filtering parameters in the Endpoint settings.
Change password on check in is independent of Enable remote password rotation (on the Automation tab). Both options can be enabled and used simultaneously without affecting each other.
Check in automatically after is independent of Allow access without approval during work hours (on the Just In Time Access tab). Both options can be enabled at the same time. In this case, the user is automatically logged off when the first configured time limit is reached.
The Security tab, where recording and Password Checkout are configured.
5. Grant permissions
On the Permissions tab, add the users and user groups who can use the secret, and set what each can do. Click Add, select the required users or user groups, then assign:- Role Type permissions — select Owner, Editor, or PAM User in the Role Type column. See Permissions for secrets.
- Advanced permissions — select the checkboxes in these columns as needed:
- File Transfer (Active Directory, Windows, Unix SSH only) — allows the user to transfer files with the WinSCP application between the Connection Manager computer and the host computer, if File transfer is configured.
- View Password — allows the user to view the secret’s password in Syteca Connection Manager. See Showing a secret’s password.
- Copy Password — allows the user to copy the secret’s password in Syteca Connection Manager.
Alternatively, the users or user groups who can access the secret, along with their permissions, can be inherited from the parent folder (except for the All secrets folder). To do this, select Inherit users and their roles from current folder to inherit Role Type permissions, and Inherit advanced permissions from current folder to inherit View Password and File Transfer permissions.
The Permissions tab, where users and their roles are assigned.
6. Set access restrictions
On the Just In Time Access tab, configure how users are allowed to access the secret. Select one option:- Access without any restrictions — users can use the secret freely.
- Always require approval on secret usage — users must request approval each time they use the secret.
- Allow access without approval during work hours — specify the date range, work hours, and days of the week during which users can use the secret without approval.
- Users Who Can Approve Access — select the Management Tool users (Approvers) who can approve access requests.
- Owners or Approvers also require approval — select this to require approval (for example, by the default admin) even for Owners and Approvers.
Approvers receive email notifications and can approve access either from the email link or in the Management Tool. See the Access requests section.
The Just In Time Access tab, where access approval rules are configured.
7. Save the secret
Click Save in the bottom right to finish creating the secret.The secret is added to the Secrets list and can be edited at any time.
Client software prerequisites
Depending on the secret type, specific software must be installed on the computer running Syteca Connection Manager for the secret to work:For the Web account secret type, compatibility is limited to Google Chrome only. If the system does not log you in automatically, a Syteca extension for Chrome is available to insert the username and password.
A Web account secret opens in a Chrome Incognito window.
Next steps
Edit a secret
Change a secret’s properties, rotate on demand, or copy its ID for the ACB.
Delete a secret
Remove one or more secrets you no longer need.
Permissions for secrets
Understand Owner, Editor, and PAM User roles and advanced permissions.
Remote password rotation
Configure automatic and on-demand password and SSH key rotation.