Possibility of PAM Integration Outside LAPS

[mkreitzer]

The LAPS integration is great to see here. One day we might use it. For now, however, we use a PAM (Privileged Access Management) solution by Imprivata (formerly Xtontech). We could really use some way to dynamically pull credentials from this system similar to the current LAPS integration.

A generic system to allow custom implementations would be ideal, I think. There are many PAM solutions out there today. A job queue command to call a script to retrieve credentials that BatchPatch then inserts into the grid would be very helpful. I could adapt to almost anything, return a JSON object, XML… heck I’ll return TOML if you ask nicely.

One thing that would really help enable this is if the credential field could store an arbitrary “PAM ID” string that would be available to any script called. Most PAM systems will have an object ID associated with the credential you want to query, and some way to provide that to the script would help avoid having to do any searches or heuristics based on only the host name.

Thanks!

(I hope I’m not being too aggressive with forum spam here. I’m still in the honeymoon phase and I could probably write 30 more of these requesting various capabilities! :D)

[doug]

Thanks. You’re not being too aggressive. We love to receive thoughtful feedback and suggestions!

[Author]

Posts