Skip to main content

Giving a Person Access to an Endpoint User

An endpoint user (a local account on a managed endpoint, such as root or oracle) is given to a person with an Endpoint Policy. The policy names the person, the endpoints and the accounts. AuthNull is deny-by-default: a session that no policy covers is refused.

All of these screens are in the admin console under Switch product → PAM.

Assigning an endpoint user to a person​

  1. Go to Policies and click New policy.

  2. Who can connect: in Who, select the people by email, or turn on Everyone in the organisation. People are matched by the email on their account.

  3. Where: choose the Gateway, then the Hosts, then the Accounts (the endpoint users) the person may open. You can pick an account found on the selected hosts or type any account name. To give each session its own account instead of a shared one, choose Temporary user (created per session); it is deleted when the session ends.

  4. Sudo (optional): choose None, Full sudo or Specific commands, and set a Time limit for the elevation.

  5. Action: choose what happens when a session opens:

    • Require approval (default): the person approves a push on their phone before the session opens.
    • Deny: the session is refused. Deny always wins over any other matching policy.
    • Allow without approval: no second factor. Only administrators can choose this.

  6. Name: keep the suggested name or type your own, then click Save policy.

To end the access, open the policy's ⋯ menu and choose Suspend (later Resume) or Delete.

Note: Adding an endpoint user to a machine grants nobody access. Only an Endpoint Policy that names the account does.

Before the person connects​

Sessions with Require approval are approved with a push from your organisation's MFA provider (Settings → MFA Provider: AuthNull Authenticator, Duo Security or Okta Verify). For AuthNull Authenticator, enrol the person's phone from Users → row ⋯ → Register device.

Authenticating via an Endpoint User to an Endpoint​

The person can reach the endpoint in the following ways: