JIT Management of AD groups

[djclark46]

We'd like to use AM to provide JIT access to a group rather than just computers. Ideally we'd like a user to be added into a group for a temporary period of time using the AM portal. I appreciate we could make a dummy computer in AD and request against that and use the underlying JIT group that's created but that's a bit clunky. Possible?

Thanks

Dave

[ryannewington]

Hi Dave,

It's not possible to do today, but it is 100% on our roadmap for access manager as an enterprise edition feature.

Ryan

[sylwester-majcher]

Hi,
How it will work this one? For now JIT adds user to group normally. I ask because I am interresting and maybe I dont understend this specific case at all.
Is this when I will need to add user to the group with fix name instead of dynamic with variable?

[ryannewington]

There will be a new screen that allows you to JIT into a "role" rather than a computer. The role will be attached to a single AD group that you can add to whatever you like.

The role could be anything eg "domain admins", "server admins", "US workstation admins". It's not going to specifically be about computers or admin rights, just jitting into a specific group you nominate.

[sylwester-majcher]

Uuu perfect one!
Based on the PAM we will try using our ITSM to automate it but by having it in AM maybe it will be the main tool to manage temp membership in the group.
Cross fingers to see this solution

[djclark46]

Any news on this? The linux support is nice but this would be very useful so we can provide JIT access to all our systems using AD groups.

[brolifen]

Also waiting on this feature.

[djclark46]

We've managed to fudge it while we wait for the feature to be implemented by creating a dummy computer, its not pretty but it works.

[ryannewington]

Hi all,

Here's an update on this feature and our release roadmap.

Version 2.0 is coming at the end of June. The main focus of this build will be delivering LAPS for Azure AD, Linux, macOS and standalone Windows devices. We lost a bit of time having to convert the project to dotnet 6, as dotnet 3.1 which we currently use is end of life in December.

Once we have that out the door, then we'll be working on JIT for roles. The engine updates have already been made to support this, and the code is tested and working. So real progress has been made. We have a fair bit of work to do integrating this into the web app in a way that makes sense side-by-side with the computer access requests. I don't have an exact time frame on release, but it will be coming in a servicing update once we get 2.0 out the door. We'll do our detailed planning for that feature and map out our release dates then and provide another update.

[bemoore34]

Any updates around the release date for version 2.0? Thanks.

[ryannewington]

Hi all,

We're just finalizing our internal testing the build that will be beta-2, and this will be coming out in the next week or two.

While we are a bit delayed, the good news is that JIT for roles (JIT into any AD group) is now part of this release. 🎉 Customer demand has been significant for this capability, so we brought forward the plans to include in this release.

I'll provide an update once the build is ready and available for download.

From there, we will have a release candidate build, followed by the production release.

[ryannewington]

Final preview of v2 is out, including JIT for AD groups!

https://github.com/lithnet/access-manager/releases/tag/v2.0.8904-preview2

Looking forward to your feedback

[djclark46]

Ryan, can I ask how it works under the hood, how does the user get removed from the group after a period of time? I like the JIT for computers feature as it uses self destructing groups built into Windows Server so doesnt rely on the portal being up and running, just AD.

Dave

[ryannewington]

@djclark46

The JIT mechanism for computers and roles is the same underlying engine.

In 2016 functional level domains, JIT makes use of time-based group membership in AD, where we can add a user to a group, and tell AD to expire the membership at a certain time. This is always the best option to use, if possible.

In downlevel forests, the mechanism changed from v1 to v2. In v1, we used dynamic objects - the "self-destructing groups", as you put it. These work fine, but they have a problem in that every one we create consumes a entry from the RID pool. These are a finite resource, and in domains with heavy JIT usage, this can speed up the exhaustion of the RID pool. So in v2, we moved to using an internal scheduler in the AMS service itself. The AMS service creates an internal timer job to remove the member at the specified time. This applies to both JIT for computers and JIT for roles

There's a bit more detail here

https://docs.lithnet.io/ams/help-and-support/app-pages/jit-access-page#jit-mode

[ryannewington]

v2 Documentation can be found here -> https://docs.lithnet.io/ams/v/2.0/