Access Group Criteria
In the Criteria tab some attributes are arranged as lists and others as a free text field. Free text fields allow the use of wildcard or masks.
The wildcard character is the asterisk (*) and can be used anywhere in the value. Let's see some examples of wildcard uses in the Device field:
srv*
will filter all devices whose hostname starts with srv;*www*
will filter all devices that have www in their hostname;vmh*-db
will filter all devices whose hostname starts with vmh and ends with -db;
Some fields allow multiple values to be separated by a comma. The Device field is one of these. The values will be considered as an OR condition in the rule. So, will be considered a pattern/value or another pattern/value. Example for the Device field:
srv*,vmh*
Allow hostnames that start with srv or vmh;
Another special value that can be used is the [#USERNAME#] mask, which will be replaced by the username of the logged senhasegura account requesting the operation. And you can use this mask along with wildchar and fixed texts. Example for the Username field:
[#USERNAME#]
Allow only credentials whose username is equal to the requester's username;[#USERNAME#]-adm
Allow only credentials whose username is a composition of the requesting user's username plus the suffix -adm;[#USERNAME#]-*
Allow only credentials whose username is a composition of the requesting user's username plus a suffix that starts with "-" followed by any other value;
Examples
For the examples, we will use the credential list below:
ID | Username | Hostname | Device type | Product | Site | Tag |
---|---|---|---|---|---|---|
1 | root | srvdns | Server | RedHat 7.0 | LAX | |
2 | administrator | msad | Server | Windows Server 2019 | LAX | |
3 | sa | mssqlprd | Database | Windows Server 2019 | NYC | dba |
4 | System | Oraprd | Database | Oracle 19c | NYC | dba |
5 | administrator | WS1092 | Workstation | Windows 10 | SEA | |
6 | administrator | WS1035 | Workstation | Windows 10 | SEA | |
7 | administrator | WS2018 | Workstation | Windows 10 | NYC | |
8 | peter.lee | WS1092 | Workstation | Windows 10 | SEA | |
9 | peter.lee | mssqlprd | Database | Windows Server 2019 | NYC | |
10 | john.ferrer | WS1035 | Workstation | Windows 10 | SEA | |
11 | john.ferrer | WS1092 | Workstation | Windows 10 | SEA | |
12 | root | vmh-www | Server | RedHat 7.0 | AWS | |
13 | root7vmh-cicd | Server | RedHat 7.0 | AWS | ||
14 | root | vmh-fw | Server | RedHat 7.0 | AWS |
Default Filter
Allow the ServiceDesk to have access only to the Administrator user of workstations.
Username:
Administrator
Device type:
Workstation
As a result, only credentials
5
,6
, and7
will be made available.
Using Wildcard
Allow DBAs to have access only to privileged Oracle database credentials:
Device type:
Database
Device model:
Oracle*
Credential Tags:
DBA
As a result, only credential
4
will be made available.
Allow virtualization administrators to access only virtual machines hosted on AWS. By the rule adopted in this fictitious company, these machines receive the prefix vmh in their hostname:
Device name:
vmh*
Website:
AWS
As a result, only credentials
12
,13
, and14
will be made available.
Using Masks
Allow users to have access to credentials that take their username, regardless of the device:
Credential username:
[#USERNAME#]
As a result, only credentials whose username is the same as the user logged in to senhasegura will be made available. If the username of senhasegura is john.ferrer only credentials
10
and11
will be made available.
These are just a few examples that show how filters can be combined in creating some access groups.