Approval on connection

This page explains how privileged access is approved and the difference between approving on request and approving on connection. You need it if you manage policies or approve requests.

Approval is one more factor

In Ironchip, approval is not a separate setting: it is an approval policy that you add to an access just like a device or a safe zone. That is why it combines with them. For example, an access can require Device AND Office safe zone or Device AND Approval, so that approval makes up for being away from the office.

An access with no approval in any combination is permanent: the person connects whenever they want. One with approval is on request: the person asks for a window.

The two approval moments

	On request (When access is requested)	On connection (When the person connects)
When it is asked	When the access is requested	When the person opens the connection
What it opens	A time window	Only that connection
Several connections	The person connects as many times as they like within the window	Each connection waits for its own decision
What the approver sees	The request and its reason	Someone at the door, now, from an address
When to use it	Planned work	Machines where every connection matters

On request. One approval opens a window. Inside it, every connection still goes through the broker and the address and factor check. The window closes automatically when it expires.

On connection. The request waits and nobody is asked until the person connects. The broker holds the connection while the approvers decide, so the question they answer is “should this be happening now?”. If nobody decides within 5 minutes, the connection is rejected. A new connection asks again.

Quorum and window

• Approvers required says how many different people have to approve. With 0, the window opens as soon as it is requested.
• The window starts with the last required approval and lasts as long as was requested, up to the policy’s maximum.
• If an access has several approval policies, the strictest one applies.

Rules

• Nobody approves their own request or approves the same one twice.
• The approved window closes automatically.
• Approval does not skip any check: the address and factors are evaluated on every connection.
• Approval also counts as a factor for your single sign-on (SSO) applications.

Approving commands and programs

If you install the agent on the machines, control policies take the decision beyond the connection:

• On Linux, every sudo asks Ironchip: it is allowed, rejected with an explanation of why, or held until someone approves it in PAM > Approvals. The record shows who authorized it and under which rule.
• On Windows, only the allowed programs can be opened while the session lasts, even if they are renamed.

More information

• Approvals: create approval policies and decide requests.
• Accesses: where approval is added.