Accounts | PS On-prem

What is the Accounts tab?

The Accounts tab lists the managed accounts for which you have permissions to request access to retrieve passwords and start sessions.

How is it useful?

From this grid, you can initiate an access request for the listed accounts, streamlining the request process. By populating the grid with managed accounts, users can easily see which accounts are available and take action without needing to navigate to other areas of the console You can populate the list of managed accounts in the grid using any one of the following options:

• Click the Browse by Category buttons to filter the list by category.
• Select filter criteria from the Filter by dropdown to filter by selected account properties.
• Search for accounts using the Quick Filter option.
• Click Load All Accounts to load all associated accounts.

How do I access the Accounts tab?

1. Open a browser and enter the URL for your Password Safe instance: https://<hostname>/WebConsole/index.html.
2. Enter your username and password.
3. From the left menu, click .
   The Password Safe home page displays.
4. Click the Accounts tab.
   The Accounts grid displays.

ℹ️

• For optimum efficiency, the web portal screen resolution should be no less than 1280 × 800 pixels.
• When you first log in to the Password Safe web portal, no accounts are available in the Favorites tab. Click the star next to the account to add it to the Favorites tab. Click Refresh above the grid to update the listed accounts.

The Accounts grid

1. Browse by different categories to filter results in the grid.
2. Select Filter by to further filter results.
3. Accounts grid.

Request a password release

1. From the left menu, click .
   The Password Safe home page displays.
2. Click the Accounts tab.
   The Accounts grid displays.
3. Click to the right of the managed account.
   The Access panel displays.
4. Select the Start Session tab.
5. Enter a Reason for the password release.
6. Select a ticket system and provide a ticket number if required.
7. Check required options under Advanced Request Options.
8. Click Start RDP Session. An RDP connection file downloads with a one-time use token that expires based on the Session Initialization timeout settings.
9. Run the file to establish a connection to the target system.
10. Enter the password that you use to authenticate into Password Safe.
11. Click Access for the managed account for which you wish to request a password.
12. From the Submit Request tab:
    • Set a start date and time for the password to be made available.
    • Set the length of time for the password to be available.
    • Check Password for the type of access you need.
    • Provide a reason for the request. The maximum allowed length is 200 characters.
    • Select a ticket system and provide a ticket number.

ℹ️

Reason, Ticket System, and Ticket Number fields might be optional or required, depending upon options configured in the access policy by your Password Safe administrator. Also, if your Password Safe administrator has set a specific ticket system in the access policy, you cannot select a different ticket system with your request.

13. Click Submit Request. An email is sent to the approver if email notification is configured. You can view the status of your request from the Requests tab.

Retrieve a password

Passwords approved for release can be displayed at any time (and as often as needed) during the release duration. After the password is approved, an email notification is sent to the requestor's email account. The requestor can then retrieve the password.

1. From the left menu, click .
   The Password Safe home page displays.
2. Click the Accounts tab.
   The Accounts grid displays.
3. Click to the right of the managed account.
   The Access panel displays.
4. Select the Start Session tab.
5. Enter a Reason for the password retrieval.
6. Select a ticket system and provide a ticket number if required.
7. Check required options under Advanced Request Options.
8. Click Retrieve Password to display the system account password.
9. The password displays in a separate window. The visibility of the password might be limited, with a timer showing remaining time. Click Close Window to close the windows before the timeout.
10. Click to copy the password to the clipboard.
11. Use the password to log in to the system within the password release time period.

Retrieve a password using Quick Launch

If your access policy is configured for auto-approval for the managed system account you are accessing, Quick Launch is available, allowing you to quickly retrieve the password for the managed account, bypassing the approval process. To use Quick Launch:

1. From the left menu, click .
   The Password Safe home page displays.
2. Click the Accounts tab.
   The Accounts grid displays.
3. Click to the right of the managed account.
   The Access panel displays.
4. From the Quick Launch tab, click Retrieve Password.
5. Click Show to display the password or click to copy it to the clipboard.

Request SSH or RDP Sessions

When configured by your Password Safe administrator, you can request access to a managed system using a remote session. Using the Password Safe request and approval system, you can request remote sessions that use RDP and SSH connection types.

Password Safe acts as a proxy, providing session management to target systems. No passwords are transmitted, allowing inherently secure session management. The sections below detail how to request and start sessions in Password Safe.

Request an RDP session

1. From the left menu, click .
   The Password Safe home page displays.
2. Click the Accounts tab.
   The Accounts grid displays.
3. Click to the right of the managed account.
   The Access panel displays.
4. Select the Start Session tab.
5. Enter a Reason for the RDP session.
6. Select a ticket system and provide a ticket number if required.
7. Check required options under Advanced Request Options.
8. Click Start RDP Session. An RDP connection file downloads with a one-time use token that expires based on the Session Initialization timeout settings. Run the file to establish a connection to the target system.
9. Enter the password that you use to authenticate into Password Safe.
10. Click Access to the right of the managed account to request a session.
11. From the Submit Request tab:
    • Set a session start date and time that corresponds with the access policy and is outside of a scheduled maintenance window.
    • Set the length of time for the session.
    • Check RDP Session for the type of access you need.
    • Provide a reason for the request. The maximum allowed length is 200 characters.
    • Select a ticket system and provide a ticket number.

ℹ️

Reason, Ticket System, and Ticket Number fields may be optional or required, depending upon options configured in the access policy by your Password Safe administrator. Also, if your Password Safe administrator has set a specific ticket system in the access policy, you cannot select a different ticket system with your request.

8. Click Submit Request. An email is sent to the approver if email notification is configured.

Use Direct Connect for RDP session

You can also use the Direct Connect feature to initiate an RDP session. As the requester, you can access the system without ever viewing the managed account's credentials.

To use Direct Connect, you must download the RDP file from the Password Safe web portal. This is a one-time download. Each account and system combination requires that you download the unique RDP file associated with it.

If the requestor is granted approval for RDP sessions, a message displays, stating, Request requires approval. If the request is not approved within 5 minutes, this connection will close. After five minutes, the RDP client disconnects, and you can send another connection request. When the request is approved, you are automatically connected.

To initiate a Direct Connect RDP session:

1. From the left menu, click .
   The Password Safe home page displays.
2. Click the Accounts tab.
   The Accounts grid displays.
3. Click to the right of the managed account.
   The Access panel displays.
4. Select the Start Session tab.
5. Enter a Reason for the direct connect session.
6. Select a ticket system and provide a ticket number if required.
7. Check required options under Advanced Request Options.
8. Click Start RDP Session. An RDP connection file downloads with a one-time use token that expires based on the Session Initialization timeout settings. Run the file to establish a connection to the target system.
9. Run the file to establish a connection to the target system.
10. Enter the password that you use to authenticate into Password Safe.
11. Find the account in the list. Click Access to the right of the managed account to request a session.
12. From the Direct Connect tab, click Download RDP File.
13. Run the file to establish a connection to the target system.
14. Enter your password that you use to authenticate into Password Safe.

ℹ️

• When using direct connect, enter the password, the defined delimiter, and then the 2FA. The password policy does not need to account for the delimiter.
• LDAP users that use the mail account naming attribute cannot use RDP Direct Connect.

Start an RDP session without submitting a request

Users who have permissions to bypass the request and approval process for accessing the managed system and Password Safe administrators are able to start sessions and retrieve passwords immediately from the Start Session tab. The Start Session tab does not display for users who do not have permissions to bypass the request and approval process. To start the session:

1. From the left menu, click .
   The Password Safe home page displays.
2. Click the Accounts tab.
   The Accounts grid displays.
3. Click to the right of the managed account.
   The Access panel displays.
4. Select the Start Session tab.
5. Enter a Reason for the RDP session.
6. Select a ticket system and provide a ticket number if required.
7. Check required options under Advanced Request Options.
8. Click Start RDP Session. An RDP connection file downloads with a one-time use token that expires based on the Session Initialization timeout settings. Run the file to establish a connection to the target system.
9. Run the file to establish a connection to the target system.
10. Enter the password that you use to authenticate into Password Safe.

SSH Direct Connect

Using an SSH client, a user can use the Password Safe Request and Approval system for SSH remote connections. The requester's information, including the Reason and the Request Duration, are auto-populated with default Password Safe settings.

To access a managed account or application using Direct Connect, the requester has to connect to Password Safe's SSH Proxy using a custom SSH connection string with one of the following formats:

• For UPN credentials:

  <Requester>+<Username@Domain>+<System Name>@<Password Safe>

• For down-level logon names\non-domain credentials:

  <Requester>@<Domain\\Username>@<System Name>@<Password Safe>

You can override the default SSH port and enter port 4422. The requester is then prompted to enter the password they use to authenticate with Password Safe.

• For UPN credentials:

  ssh -p 4422 <Requester>+<Username@Domain>+<System Name>@<Password Safe>

• For down-level logon names\non-domain credentials:

  ssh -p 4422 <Requester>@<Domain\\Username>@<System Name>@<Password Safe>

• For an SSH application:

  ssh -p 4422 <Requester>@<Account name>:<Application alias>@<System name>@<Password Safe>

Once the requester is authenticated, they are immediately connected to the desired machine.

Direct Connect in Pathfinder

Direct Connect lets you open an SSH or RDP session from the tools you already use, such as PuTTY, a terminal, or Remote Desktop. You don't need to open the Password Safe web portal first.

Here is what happens when you connect:

1. You connect to the Password Safe session proxy instead of the target system.
2. Password Safe checks who you are.
3. Password Safe checks the access policy and creates a request for you.
4. If the request is approved, Password Safe signs you in to the target system with the managed account.

You never see the managed account's password. Password Safe records and monitors the session based on your access policy.

Direct Connect is part of the BeyondTrust Total Privileged Account and Session Management (Total PASM) solution. Total PASM brings together credential management and session management, so your team controls both the password and the session.

Key concepts

What is Direct Connect?

Direct Connect works the same way in Pathfinder as before. The biggest change is how you prove who you are.

Before you begin

• Your administrator turns on personal access tokens. For more information, see Configure PAT tokens.
• Your administrator gives you access to the managed account through an access policy.
• For SSH, install an SSH client, such as PuTTY or OpenSSH.
• Create a personal access token and save it somewhere safe.

Use Direct Connect for SSH

1. Open your SSH client.
2. Connect to the Password Safe SSH proxy on port 4422. Use the format that matches the account:
   • UPN credentials:
     
     ssh -p 4422 <Requester>+<Username@Domain>+<System Name>@<Password Safe>
   • Down-level logon names or non-domain credentials:
     
     ssh -p 4422 <Requester>@<Domain\\Username>@<System Name>@<Password Safe>
   • SSH application:
     
     ssh -p 4422 <Requester>@<Account name>:<Application alias>@<System name>@<Password Safe>
3. When prompted for a password, paste your PAT.
4. If your request needs approval, a message displays: Request requires approval. Wait for the approver. If no one approves within 5 minutes, the connection closes. You can try again.
5. After approval, Password Safe connects you to the target system.

Use Direct Connect for RDP

1. Go to ☰ > Password Safe > Password Safe Accounts.

2. Click the download arrow next to the managed account to download the RDP Direct Connect file. Each account and system pair has its own file.

3. Run the RDP file.

   ℹ️

   The Direct Connect file is intended to be saved and re-used (that is, you do not have to continually log back in to the Web console to download the RDP file for the same account & system every time you want to use it.

4. When prompted for a password, paste your PAT.

5. If your request needs approval, wait for the approver. After approval, Password Safe connects you to the target system.

Tips for using Direct Connect

• Reuse requests. If you already have an open request for the same account and system, Password Safe reuses it.
• Use short token lifetimes. Create a PAT that lasts only as long as you need it.
• Use one token per purpose. For example, use one PAT for Direct Connect and a different one for scripts. If one leaks, revoke it without breaking the other.
• Revoke tokens you no longer use. A revoked token stops working right away.

Personal access tokens

A personal access token (PAT) is a secret value that proves who you are. You use it instead of your password for Direct Connect and the public API. You create and manage your own tokens. Administrators view token details and revoke tokens when needed.

Create a Personal Access Token

To create and manage personal access tokens is performed from your profile settings.

1. Click Profile and preferences in the upper-right hand corner.

2. Click Account Settings.

3. Navigate to Personal Access Tokens.

4. Select Create Token.

   

5. Configure the token settings, such as expiration (for example, one day).

6. Copy the token value for immediate use.

   

7. Click Close.

View and manage tokens

You can view existing tokens, including expiration details as well revoke tokens at any time.

To view token metadata for an existing token, do the following:

1. Click Profile and preferences in the upper-right hand corner.
2. Click Account Settings.
3. From My Account pane, select Personal Access Token.
   
   The Personal Access Token table displays with metadata (that is, Token Description, Issued Date, Expiry Date, etc.)

Revoke a token

To revoke tokens, do the following:

1. Click Profile and preferences in the upper-right hand corner.

2. Click Account Settings.

3. From My Account pane, select Personal Access Token.
   
   The Personal Access Token table displays.

4. Select an existing token from the table.

5. Click Revoke.

   

6. The following confirmation dialog box displays:

   

7. Click Revoke Token.

Authenticate using a Personal Access Token

Users can authenticate with a personal access token instead of a password. They can use the token for Direct Connect authentication or for Public API authentication.

The platform continues to support password-based authentication, ensuring full backward compatibility across on-premises and cloud environments.

Administrator capabilities

Administrators manage personal access tokens at both the system and user levels.

View and revoke tokens (System level)

Administrators can review system-wide token metadata across all users. They can also review token metadata for suspicious or unused tokens and select tokens and revoke them as needed.

View and revoke tokens (User level)

Administrators can also manage tokens for individual users by viewing the user's profile and associated PATs. They can also revoke tokens directly from the user account.

Configuration

Enable or disable Personal Access Tokens

To configure the global settings for PAT, go to Configuration > Authentication Management > Authentication Options.

To allow token creation and usage, click Enabled. To disable the feature entirely, unselect the Enabled check box.

Set token policies

To define usage limits and security controls, set either of these settings:

• Maximum Token Lifetime (days) (default: 90 days)
• Maximum Active Tokens per user (default: 5 tokens)

ℹ️

These settings help enforce security and limit the number of active tokens.

Require tokens for API authentication

To require personal access tokens for public API authentication, you need to select the Personal access token required checkbox. This applies rules that enforce token-based authentication.

Security tips

• Use tokens instead of passwords for scripts and repeated access.
• Keep token lifetimes short.
• Revoke tokens that are unused or look suspicious.
• Require tokens for API sign in when you can.