Attaching Post Rotation Scripts to Records

Overview

Post Rotation scripts can be attached to any of the PAM Record Types. Depending on the PAM record the script is attached to, the script will run either on the gateway, or the remote host where rotation occurred.

The following table shows all the available PAM Records and where the attached script will execute:

Record Type	Attached Post Execution Script will execute on
PAM Network Configuration	Gateway
PAM Machine	The Device specified in record
PAM Database	The Device specified in record
PAM Directory	The Device specified in record
PAM User	Gateway

Order of Execution

Scripts will be executed in the following order:

1. Scripts attached to User Record types

2. Scripts attached to PAM Machine, PAM Database, or PAM Directory Record types

3. Scripts attached to PAM Network Configuration Record types

If multiple scripts are attached to a record, scripts will be executed in the order they're in on the PAM Record

Attaching Post Rotation Scripts

1. When creating or editing a PAM record, towards the bottom, there is a Add PAM Script button:

2. Clicking on Add PAM Script will allow you to:

   1. Browse locally and choose your Rotation Script(s). [Required]

   2. Add additional Resource Credential(s). This is to add additional records which contains the necessary credentials required to execute the attached post rotation script(s). [Optional]

   3. Specify a custom command to executed. In the below screenshot, I attached a python script (postRotationTest.py) and specified the command to be used to execute the python script. [Optional]

Multiple Scripts can be attached to a record.

3. After successfully selecting the script(s), the record will be updated to show the attached Post Rotation scripts:

4. Click Save to create or update the record. Attached Post Rotation Scripts can be deleted or edited by clicking on their respective inline icons.