Only check out PAM secrets used

[DionEarnshaw]

Currently when syncing objects from Thycotic server (Delinea) it will check out all secrets in the folder being syncd meaning that nobody else can check them out and they're exclusively in your name.

I'd like this to work where you can view a list of secrets available and only check out the ones that you select, leaving the rest checked in, like you would if you was using the PAM web interface.

Thanks.

[DevOma]

Hi,

thanks for your suggestion - I just checked the API - there are optional parameters when reading the credentials

AutoCheckIn - AutoCheckOut - ForceCheckIn

Didn't know that in detail - would it make sense to try to use these parameters instead? We can try set AutoCheckOut = false - or if that do not work - to set ForceCheckIn = true

What do you think - Selecting credentials to sync can be also implemented, but would take some more time...

[DionEarnshaw]

Hi,

thanks for your suggestion - I just checked the API - there are optional parameters when reading the credentials

AutoCheckIn - AutoCheckOut - ForceCheckIn

Didn't know that in detail - would it make sense to try to use these parameters instead? We can try set AutoCheckOut = false - or if that do not work - to set ForceCheckIn = true

What do you think - Selecting credentials to sync can be also implemented, but would take some more time...

Good Afternoon,

Thank you for your reply. I think setting autocheckout to false could work, how do I test this?

Additionally I do think selecting credentials to sync would be good but if the above can be done then this would be better, I'd like to have a list of all credentials available and be able to click on one of them to check them out and use them.

Thanks.

[DevOma]

You can't test it currently - I see that the API supports that setting - we need to implement - I guess all customers before had this feature deactivated :-)

I will update you as soon I have something to test

[DionEarnshaw]

You can't test it currently - I see that the API supports that setting - we need to implement - I guess all customers before had this feature deactivated :-)

I will update you as soon I have something to test

Okay great - When can this be implemented?

Thanks.

[DevOma]

Will give you access to preview version in the next days...

[DionEarnshaw]

Okay great thank you.

[DevOma]

Send you PM with Download-Link

[DionEarnshaw]

I'm still experiencing issues with syncing these secrets, I have selected the folder that they're in but they're not showing in there.

[DevOma]

What options are set for these secrets? I can ask if we can setup in our environment similar settings - but I need the exact setup of these secrets...

[DionEarnshaw]

They're set to require check out, checkout interval is 2 days, change password on check in set to yes, require comment set to yes.

[DevOma]

I will try to setup the same in the next days - need to wait for our IT security team

[DionEarnshaw]

Okay thank you.

[DevOma]

Just to update you - I can reproduce your issue - now investigating how to solve that issue :-)

[DevOma]

Now I would like to get your ideas on how to implement - if secrets are restricted we can't get the details without checkout / comment.

Would it be ok to set "Checkout" manually? Like a context menu "Checkout Secret" - then a dialog is displayed where to enter your comment - checkout is done - then you should be able to use that cred for connecting to any destination - afterwards you can select "Checkin" in context menu.

[DionEarnshaw]

Now I would like to get your ideas on how to implement - if secrets are restricted we can't get the details without checkout / comment.

Would it be ok to set "Checkout" manually? Like a context menu "Checkout Secret" - then a dialog is displayed where to enter your comment - checkout is done - then you should be able to use that cred for connecting to any destination - afterwards you can select "Checkin" in context menu.

Yes this sounds great - Would it also be possible to only see secrets that are not 'checked out', I think there should be an option in the API to see if a secret is checked out or not.

So either only show secrets that aren't checked out, or include a collumn in rocket remote to show if a secret is checked out or not?

This would be really helpful as currently we have to guess if it is checked out.

Thanks

[DionEarnshaw]

Is there any update on this?

[DevOma]

Yes - the next main release will be published in the next days - and it is implemented

[DionEarnshaw]

Yes - the next main release will be published in the next days - and it is implemented

Okay thank you.

[DionEarnshaw]

Has the main release been published yet? If so can I have a link to this please?