Access Group Criteria

In the Criteria tab some attributes are arranged as lists and others as a free text field. Free text fields allow the use of wildcard or masks.

The wildcard character is the asterisk (*) and can be used anywhere in the value. Let's see some examples of wildcard uses in the Device field:

• srv* will filter all devices whose hostname starts with srv;

• *www* will filter all devices that have www in their hostname;

• vmh*-db will filter all devices whose hostname starts with vmh and ends with -db; 

Some fields allow multiple values to be separated by a comma. The Device field is one of these. The values will be considered as an OR condition in the rule. So, will be considered a pattern/value or another pattern/value. Example for the Device field:

• srv*,vmh* Allow hostnames that start with srv or vmh;

Another special value that can be used is the [#USERNAME#] mask, which will be replaced by the username of the logged senhasegura account requesting the operation. And you can use this mask along with wildchar and fixed texts. Example for the Username field:

• [#USERNAME#] Allow only credentials whose username is equal to the requester's username;

• [#USERNAME#]-adm Allow only credentials whose username is a composition of the requesting user's username plus the suffix -adm;

• [#USERNAME#]-* Allow only credentials whose username is a composition of the requesting user's username plus a suffix that starts with "-" followed by any other value;

IMPORTANT

Create an access group only with the mask [#USERNAME#], if you have more than 5,000 credentials. The other criteria must be added in a second access group. This ensures that groups are processed quickly.

Access group form - Criteria tab

Examples

For the examples, we will use the credential list below:

ID	Username	Hostname	Device type	Product	Site	Tag
1	root	srvdns	Server	RedHat 7.0	LAX
2	administrator	msad	Server	Windows Server 2019	LAX
3	sa	mssqlprd	Database	Windows Server 2019	NYC	dba
4	System	Oraprd	Database	Oracle 19c	NYC	dba
5	administrator	WS1092	Workstation	Windows 10	SEA
6	administrator	WS1035	Workstation	Windows 10	SEA
7	administrator	WS2018	Workstation	Windows 10	NYC
8	peter.lee	WS1092	Workstation	Windows 10	SEA
9	peter.lee	mssqlprd	Database	Windows Server 2019	NYC
10	john.ferrer	WS1035	Workstation	Windows 10	SEA
11	john.ferrer	WS1092	Workstation	Windows 10	SEA
12	root	vmh-www	Server	RedHat 7.0	AWS
13	root7vmh-cicd	Server	RedHat 7.0	AWS
14	root	vmh-fw	Server	RedHat 7.0	AWS

Default Filter

• Allow the ServiceDesk to have access only to the Administrator user of workstations.

  • Username: Administrator

  • Device type: Workstation

    As a result, only credentials 5, 6, and 7 will be made available.

Using Wildcard

• Allow DBAs to have access only to privileged Oracle database credentials:

  • Device type: Database

  • Device model: Oracle*

  • Credential Tags: DBA

    As a result, only credential 4 will be made available.

• Allow virtualization administrators to access only virtual machines hosted on AWS. By the rule adopted in this fictitious company, these machines receive the prefix vmh in their hostname:

  • Device name: vmh*

  • Website: AWS

    As a result, only credentials 12, 13, and 14 will be made available.

Using Masks

• Allow users to have access to credentials that take their username, regardless of the device:

  • Credential username: [#USERNAME#]

    As a result, only credentials whose username is the same as the user logged in to senhasegura will be made available. If the username of senhasegura is john.ferrer only credentials 10 and 11 will be made available.

These are just a few examples that show how filters can be combined in creating some access groups.