Configuring after installation

 AccessRetention number type REVOKE|INACTIVE|ACTIVEONTERM

Indicates the uidMask used to select users for a PAM project

This parameter is required for ACF2 projects. For more information, see ACF2 mask.

AllowInactive Enable|Disable

When the product runs on a RACF system, it issues an ALU RESUME command to clear the inactive status of the requested user ID.

The default is Disable.

Setting the AllowInactive parameter to Enable is similar to specifying the INACTIVE keyword with the AccessRetention parameter.

AllowRepeatedRequests All|Unique|None

Make multiple requests against your own linked user ID. The AllowRepeatedRequests parameter is valid for user pool mode (Mode UserPool) projects only and is not valid for self-elevation mode (Mode SelfElevation) projects.

Select one of the following options:

• All—approves all requests and does not validate the request for duplicate environments
• Unique—approves all requests that does not match a previous set of systems. Your request for the same user ID is approved, but if you request the same set of systems, the request is rejected.
• None—rejects repeated requests.

The default is None.

Approver type value

(Optional) TSO user ID or email address of the person who will approve access requests for the project

This parameter is useful for sending notifications to support mailboxes or to a mailing list of approvers. Notification is not sent for automatic approvals.

• type indicates how the approver is notified:
  • EMAIL specifies the email address of the approver.
  • TSO specifies the TSO user ID of the approver.
• value contains the corresponding email or TSO user ID.

(Deprecated from SPE2507 onwards) Determines whether to automatically generate a random password during the password reset process

(Optional) Enables automatic access-request approval for the specified time period

Users must receive manager approval when requesting user ID pool or self-elevation access. Managers may not always be available when access requests come in. To address such issues you can specify periods of time that approvals are given automatically. For example, on weekends or holidays when a project manager might be traveling or on vacation.

• Enter start and end times in hours and minutes using hh:mm hh:mm.
• Use either WEEKDAYS or WEEKENDS (you can only use one) to specify when the time period occurs.

• Define one or more AutoPeriod parameters as needed for the project.

  Warning

  Important

  AutoPeriod uses a 24–hour clock. If a time period spans midnight, the start time must be greater than the end time. For example:
  AutoPeriod 23:30 08:30 WEEKDAYS

If you omit AutoPeriod, the default is that manager approval is required for all access requests.

BMCHelixAuth dataSet

Name of the data set containing the authentication token that is used to authenticate the change ID (or incident ID) validation request sent from PAM to the BMC Helix ITSM instance

For more information, see Validating Security PAM change IDs and incident IDs by using BMC Helix ITSM.

BMCHelixUser userID

Base64-encoded BMC Helix ITSM user ID that is used to authenticate the change ID (or incident ID) validation request sent from PAM to the BMC Helix ITSM instance

Make sure that the user ID that you specify with this parameter has the required permissions to read change IDs and incident IDs in BMC Helix ITSM. For more information, see Validating Security PAM change IDs and incident IDs by using BMC Helix ITSM.

BMCHelixPass password

Base64-encoded password for the BMC Helix ITSM userID

BMCHelixURL url

Endpoint URL for sending the REST API requests from PAM

If your endpoint URL is https://exampleurl.com, then specify it as exampleurl.com.

For more information, see Validating Security PAM change IDs and incident IDs by using BMC Helix ITSM.

Force specific change or incident ID prefixes for the project

You can configure multiple, custom change or incident ID prefixes to use for tracking requests from the project. Users are shown the required prefixes when requesting a user ID. The prefixes are not case sensitive.

(SPE2407)

The prefixes are displayed in the Change or Incident ID list in the UI.

If PAM change or incident ID validation against ServiceNow records is enabled, the Change or Incident ID list in the UI displays CHG and INC only. No other prefix is displayed.

User ID for issuing commands

Ensure that the user ID for the specified value has sufficient privileges to issue the necessary commands.

• Job, issues commands under the user ID for the started task running PAM.
• Group, issues commands under the owning user ID for the group or profile associated with the project. On non-RACF installations, we recommend to use Job .

If you omit CommandUserID, the default Job is used.

CommentField Enable|Disable

Determines whether users must mandatorily enter a comment in the Comment box on the Confirm PAM Access Request modal window

If you omit CommentField, the default Disable is used.

ConnectACF2 priv1 priv2 priv3 ...

ConnectGroup group1 group2 group3 ...

ConnectProfile profile1 profile2 profile3 ...

(For self-elevation projects only) Names of the user-access ESM resources associated with the project

ESM user-access resources provide projects with access to required system resources. These are primarily in the form of RACF groups, TSS profiles, and ACF2 departments. Projects created for self-elevation can connect to multiple resources, providing a wide range of access for the user. You can define multiple resources for a single Connect parameter or you can use multiple Connect parameters instead.

In addition, when operating PAM on a RACF or TSS system, users are connected automatically to the RACF group or TSS profile defined specifically for the project via the RACFGroup or TSSProfile keyword. For more information, see RACF groups and TSS profiles.

ACF2 supports additional processing with this keyword because of the flexibility of ACF2 installations and the various differences in the organization structure. The ConnectACF2 parameter supports any string of the format parameter(value) and two special keywords: ACCOUNT and SECURITY. The parameter options are those defined for your organization's UID string. To find the parameter, issue a LIST userid ACF2 command. The output for the command is as follows: DIV(XXX) ENDVRDEF( ) JTTL() LOC() SECT() STAFFID( )
In this example, the available options are DIV, ENDVRDEF, JTTL, LOC, SECT, and STAFFID. ACF2 administrators can then use any of these options to filter access to the required resources.

You can specify up to 24 ACF2 departments, RACF groups, and TSS profiles with ConnectACF2, ConnectGroup, and ConnectProfile. If you exceed this limit, PAM ignores the rest and issues the following error message: Connect group limit exceeded

CSDATAField fieldName

Name of the CSDATA field in RACF that has the project user ID that you want to link to a manager-level logon user ID

When you define this parameter in a project, a manager must request and gain approval to use a project user ID that is linked to their logon user ID. This same manager can approve project user ID requests raised by other users in projects to which the manager has access.

Make sure that the CSDATA field is protected by RACF to prevent unauthorized changes. For more information, see Self-managed projects.

A sample code to create the CSDATA field follows:

DefaultRetention number type

(SPE2410)

A safeguard to ensure that both MaximumRetention and AccessRetention parameters are updated if either of them is unavailable

ExpiryNotify type value

(Optional) TSO user ID or email address for project expiry warnings

Use this parameter to notify people when access for any of the project's user IDs is about to expire. First choose the method of notification and then fill in the details:

• type, indicates the how the approver is notified.
  • EMAIL, specifies the email address of the approver.
  • TSO, specifies the TSO user ID of the approver.
• value, contains the corresponding contact information
  • For EMAIL, enter the email address of the person you want notified.
  • For TSO, enter the TSO user ID of the person you want to notify or one of the following:
    • USER, sends the notification to the PAM user ID requested from the project.
    • REQUESTER, sends the notification to the person who requested the PAM user ID from the project.

You can add multiple ExpiryNotify parameters to add multiple email recipients.

If the email address is longer than 64 characters, you can enter it in two lines. To enter an email address in two lines, in the first line, specify the parameter with a + sign at its end and enter the first part of the email address. In the second line, specify the parameter again without a + sign and enter the second part of the email address. You can enter 64 characters in each line. So, you can enter an email address of up to 128 characters.

For example:
ExpiryNotify  EMAIL+  userName 
ExpiryNotify  EMAIL   @bmc.com

ExpiryTimer number type

LocalAuthenticate resourceProfileName

(Optional) resource profile containing the list of users permitted to use local authentication

Defining this parameter enables local authentication. As a result, users on the list must enter their password only once and authenticate on the master system to gain access to all systems in the request. You must use this parameter in a multisystem configuration only and need READ or higher access to grant this privilege.

This parameter controls system visibility on the UI and password authentication in the following ways:

• If a user ID has access to the relevant profile in the master (or agent) system and LocalAuthenticate is defined, the project is displayed on the UI.
• If a user ID does not have access to a specific profile in the agent system and LocalAuthenticate is not defined, the project is not displayed on the UI.
• If you omit LocalAuthenticate, users must enter passwords for each system in the request.

Maximum time to retain access to project resources

Enter the maximum amount of time users can retain their user pool ID or self-elevation privileges.

• number is the number of minutes, hours, or days. The maximum value is 90.
• type is the unit of measure: Minutes (the default), Hours, or Days.

If the user enters a value in the Duration box when requesting a user ID that is greater than the MaximumRetention value, MaximumRetention takes precedence.

If you omit type, the default Minutes is used.

(SPE2410)If you omit this parameter, its value is loaded from the DefaultRetention parameter.

Notify activity emailAddress|CSDATA

(Optional) Sends a notification to the specified email address when the specified project activity occurs

Typically, you would enter the project manager's email address to trigger notification to that address from users. To add multiple email recipients, define multiple Notify parameters with the required email addresses.

If the email address is longer than 64 characters, you can enter it in two lines. To enter an email address in two lines, in the first line, specify the parameter with a + sign at its end and enter the first part of the email address. In the second line, specify the parameter again without a + sign and enter the second part of the email address. You can enter 64 characters in each line. So, you can enter an email address of up to 128 characters.

For example:
Notify  userName 
Notify  @bmc.com

Notify  Release+  userName 
Notify  Release   @bmc.com

NotifyURL protocol domain

(Optional) Adds a URL to the notification email that users receive when performing a project activity. The URL redirects users to the BMC AMI Security Logon window. This parameter takes the following values:

• protocol is the network protocol that is prefixed in the URL. Specify one of the following values:
  • HTTP—The browser creates an insecure connection to the product.
  • HTTPS—(Default) The browser creates a secure connection to the product.
• domain is the domain name in the URL. Specify one of the following values:
  • IP—PAM provides the IP address from the IPAddress parameter (defined in the RSS HTTPServer block). If the IPAddress parameter is not defined, PAM uses the local TCP/IP stack IP address.
  • Host—(Default) PAM resolves the IP address to a host name
  • hostName—User-specified host name

RestrictRelease Yes|No

Denies a user the privilege of releasing other user IDs that are in the same project

The default is No.

SNOWInstance instance

(SPE2407)

ServiceNow instance name used as part of PAM REST API requests.

If your ServiceNow URL is https://companyName.service-now.com, replace companyName with the instance name, which you must provide in the PAM parameter file for REST API access.

SystemList systemName1 systemName2 systemName3 ...

(Optional) Names of servers defined for the project

This parameter applies if you use PAM in a multisystem configuration. Specify one or more servers that user pool or self-elevation IDs associated with the project can access. When a user requests an ID from the project, their authorization to access these servers is verified.

You must make sure that all servers defined for this parameter are also defined in the PAMServers configuration block.

The total list of systems for this parameter always includes the local system on which the master instance is installed. You do not need to define it here.

If you omit SystemList, PAM runs as a single-system instance.

UniversalMode Yes|No

Determines whether PAM should allow a manager to request a project user ID

When you enable this parameter in a project, to use a project user ID, a manager must request and gain approval. The same manager can approve project user ID requests raised by other users in projects to which the manager has access.

User IDs for managers must have ALTER access.

User IDs for users only must have READ access.

You can use this parameter with user pool mode and self-elevation mode projects. UniversalMode is mutually exclusive with the CSDATAField parameter—if you define both these parameters, PAM considers the CSDATAField configuration only and ignores UniversalMode. For more information, see  Self-managed projects.