Privileged credential rotation

Rotation changes privileged account passwords on the target itself, through the appliance, and stores the new version in the vault. It happens on a schedule, when a lease is checked in, after a reveal or a break-glass access, or on request.

Rotation policies

1. Open «PAM» › «Rotation» and choose «Add policy».
2. Fill in «Name», «Rotate every (hours)» (between one hour and one year), «Password length» (12 to 128) and the classes («Lowercase letters», «Uppercase letters», «Digits», «Symbols», «Leave out look-alike characters»). The console shows the approximate strength in bits.
3. Optional: «Rotation windows (UTC, optional)», one per line, for example Mon 02:00-04:00.
4. Choose «Save policy».

How do I attach a policy to an account?

1. In the target's accounts, choose «Rotation» on the account's row. «Rotation of» the account opens: «The policy sets how often the credential changes; the connector sets how.»
2. In «Rotation policy», choose a policy (shown as «Weekly · every 168 h») or «No scheduled rotation».
3. Check the «Connector» and, for ephemeral accounts, the «Privileges of temporary (JIT) accounts»: «Standard user» or «Administrator».
4. Choose «Save rotation». The change needs a recent passkey confirmation: «Rotation of root saved.»

With dual control on, the policy change waits for a second administrator («Change an account's rotation policy» in «Dual control»): «The connector was saved. The rotation policy is waiting for a second administrator in PAM, Dual control.»

HTTP connectors

For systems with their own API, create an «HTTP connector» with its «Definition (JSON)» (up to 16 KiB; templates use only {{username}}, {{newSecret}} and {{currentSecret}}). Under «Hosts HTTP connectors may reach», list up to 64 exact names and choose «Save hosts».

Rotation jobs

The «Rotation jobs» section shows each rotation with its reason («Schedule», «Check-in», «After a reveal», «Break-glass», «Compromise», «Manual», «New secret check») and state: «Queued», «Starting», «Applying», «Verifying», «Done», «Failed», «Needs attention».

• A failure is retried at growing intervals; after six attempts it becomes «Needs attention» and the account is flagged «Rotation failed».
• «Retry» queues the rotation again: «The rotation is queued again.»

Rotate now

On a vaulted account's row, choose «Rotate now»: «Rotation of root queued.» With dual control on, it waits for a second administrator: «Sent for approval: a second administrator must approve this change in PAM, Dual control.» The job then appears under «Rotation jobs» with the reason «Manual».