Just-in-Time sessions

A Just-in-Time (JIT) session is privileged access that exists only for the length of an approved window. This page explains how it works and why, day to day, nobody needs to take a password out of the vault.

Life of a session

1. Request. The person asks for access to a specific resource, with a reason if the policy requires one.
2. Approval. An approver accepts or rejects it, either once on request or on every connection, depending on the policy. See Approval.
3. Open window. A period of time opens during which the person can connect.
4. Connection. The person connects with a single-use ticket, from the console or with their own client. Before admitting them, Ironchip checks the address and the access factors, such as the device and the safe zone.
5. Close. The window closes automatically when it expires. The session is recorded and, if configured, the account password is changed.

What the person sees and what they do not

The person never knows or types the privileged credential. The Ironchip PAM broker reads it from an encrypted store, injects it when opening the connection and hands it to nobody. That is why a vendor who finishes their work, or an employee who changes company, takes no password with them.

If the password is ever needed to use the machine without the broker, it is taken out with a checkout or, in an emergency, with a break-glass, and it is rotated as soon as it is returned.

Differences from a traditional vault

	Traditional vault	Ironchip JIT session
Credential	The person obtains it by check-out	The broker injects it; the person does not see it
Privilege duration	Permanent or until the credential is returned	A window that closes automatically
Network access	VPN or jump server	Outbound tunnel from your network, no inbound ports
Stolen login	Gives access to the vault	Does not open without device, safe zone and factors

Next steps

• Architecture: which pieces take part in a connection.
• Credential vault: where credentials are stored and how they are rotated.
• Request access: the flow for the person asking for the session.
• Access policies: what each policy decides.