KB-34632: Configuring a "su-only" Role with Access Manager

Home >

KB-34632: Configuring a "su-only" Role with Access Manager

Product:

Authentication Service ,

Published:

22 May,20 at 06:08 PM

Rating:

Question:

How can an Active Directory account be configured such that the account does not have login rights to a target machine, but other accounts are allowed to "su" to this account?

Answer:

In this example, the su-only account is a service account named cfy-srv-account.

1) In Access Manager, create the user profile in the desired zone for cfy-srv-account.

2) Create the PAM Access Right. In this example, the right is named "su-only".

Access Manager -> <Go to the Zone> -> Authorization -> Unix Right Definitions -> PAM Access -> Add PAM Access Right

3) Create a Role Definition that has this right. It must also have a login system right and "user is visible" right. In the example, the Role is named "su only"

Access Manager -> <Go to the Zone> -> Authorization -> Role Definitions -> Add Role