# Authentication Methods

## Overview

Keeper Connections can be authenticated using one of the following methods:

* [**Launch Credential**](#launch-credential)\
  The session to the target is authenticated using the "Launch Credentials" configured directly on the PAM Machine,  PAM Database, or PAM Directory record types. The user does not need access to the credentials in order to launch the connection.
* [**Personal/Private Credential**](#personal-private-credentials)\
  When "Allow users to select credentials from the vault" is enabled, users can choose to authenticate the session to the target using a personal/private credential stored securely in their own Keeper Vault.
* [**Ephemeral Accounts**](#ephemeral-account)\
  When the ephemeral account feature is enabled on the PAM Machine or PAM database resources, a system-generated, time-limited privileged account is created specifically for the session. This account is deleted automatically after the session ends, eliminating standing privilege. This method is used for [Just-In-Time access](https://docs.keeper.io/en/keeperpam/privileged-access-manager/getting-started/just-in-time-access-jit) with no persistent account on the target system.

## Launch Credential&#x20;

When configuring the launch credential on a PAM Machine, PAM Database, or PAM Directory record types, the sessions to the target system are authenticated using the configured launch credential.&#x20;

To configure the launch credential:

* Open the PAM Settings on a PAM Machine, PAM Database, or PAM Directory record type
* Navigate to the Connection Tab
* In the Launch Credentials Dropdown, choose the PAM User record to be used as the Launch credentials&#x20;

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FReQy0q1WNeBYfpi9N0ke%2FScreenshot%202025-07-07%20at%204.11.29%E2%80%AFPM.png?alt=media&#x26;token=362ffd5b-3d32-487c-a178-d8f7e6e3418b" alt=""><figcaption><p>Configuring Launch Credentials</p></figcaption></figure>

* After configuring the Launch Credential, close the PAM settings by clicking "Update" and save the record.&#x20;
* Enabling the "Rotate launch credentials upon session termination" checkbox will automatically rotate the launch credential after every session.

After configuring the Launch credential, the PAM Record type will show the launch credential:&#x20;

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2Fz7ErRjgU2j1JjbPCWfa5%2FScreenshot%202025-07-07%20at%204.11.48%E2%80%AFPM.png?alt=media&#x26;token=1c29b8b2-0b70-4e90-848e-2e7ecd702c51" alt=""><figcaption></figcaption></figure>

## Personal/Private Credentials&#x20;

PAM Machine, PAM Database, and PAM Directory record types can be configured to allow users to authenticate sessions using personal/private credentials stored in their own Keeper Vault. When this is configured, users are able to select a credential from their Keeper Vault at session launch.

To enable users to use their own credential:

* Open the PAM Settings on a PAM Machine, PAM Database, or PAM Directory record type
* Navigate to the Connection Tab
* Enable the "Allow users to select credentials from their vault" checkbox:

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2Fe2s3rlsO0VmGP1VblUaj%2Fbyocsettings.png?alt=media&#x26;token=285a815f-6fda-4362-8603-3108698eafb8" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
If launch credentials are configured, users will be able to choose between the launch credential and their own personal/private credential

If "Rotate launch credential upon session termination" is enabled, only the configured launch credentials are rotated. Personal/Private credentials will not be rotated.&#x20;
{% endhint %}

* After enabling step 3, close the PAM settings by clicking "Update" and save the record.&#x20;

When users click on the launch button, they are presented with the ability to select a credential from their Keeper Vault:

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2Fsy0tT31JvIpi0njvbd5F%2Fbyocview.png?alt=media&#x26;token=9aa5515a-9f44-41a4-95eb-aedffc540522" alt=""><figcaption></figcaption></figure>

***

## **Ephemeral Account**

PAM Machine, PAM Database, and PAM Directory record types can be configured to allow users to authenticate sessions using ephemeral accounts.&#x20;

Ephemeral accounts is a system-generated, time-limited privileged account that is created specifically for the session. This account is temporary and deleted automatically after the session ends. This method is used for [Just-In-Time access](https://docs.keeper.io/en/keeperpam/privileged-access-manager/getting-started/just-in-time-access-jit) with no persistent account on the target system.

To enable ephemeral accounts:

* Open the PAM Settings on a PAM Machine, PAM Database, or PAM Directory record type
* Navigate to the "JIT" tab
* Enable "Create ephemeral account for connection"
  * Note: For machines, you will need to specify the type of system to generate the user for. For example, ephemeral account for linux will be a linux user.
  * (Optional) Enable "Elevate account during connection" to elevate the account used to authenticate the session to the specified group or role. The group or role must be valid.&#x20;

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FhUbVRG1a0wNM8aBeZgwN%2FScreenshot%202025-07-07%20at%204.14.41%E2%80%AFPM.png?alt=media&#x26;token=33770d96-d4b6-45f3-9013-09922c62f507" alt=""><figcaption><p>Configuring Ephemeral Accounts</p></figcaption></figure>

* After enabling the above, close the PAM settings by clicking "Update" and save the record. Your record should look the following:

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FRzs6fMlT0ZfqMZ59Tzq4%2FScreenshot%202025-07-07%20at%204.16.24%E2%80%AFPM.png?alt=media&#x26;token=04a52a87-1918-4233-911b-440b5d3de83b" alt=""><figcaption></figcaption></figure>

## Protocol Configuration&#x20;

For additional configuration details on your protocol, visit the following page:

{% content-ref url="session-protocols" %}
[session-protocols](https://docs.keeper.io/en/keeperpam/privileged-access-manager/connections/session-protocols)
{% endcontent-ref %}
