Use Cases for Jump Item Implementation

To offer you the most flexibility and control over your Jump Items, BeyondTrust includes quite a few separate areas where permissions must be configured. To help you understand how you might want to set up your system, we have provided two use cases below.

Basic Use Case

You are a small organization without a lot of Jump Items or users to manage. You want your administrators to manage all of the Jump Item setup steps and your users to only be able to Jump to those items.

1. Create two Jump Item Roles, Administrator and Start Sessions Only.
   1. The Administrator role should have all permissions enabled.
   2. The Start Sessions Only role should have only Start Sessions enabled.

 

2. Create a Shared Jump Group that will contain all shared Jump Items. Personal Jump Items can also be created.

 

3. Deploy a Jumpoint to each remote network segment where Jump Items will be deployed.

 

4. Put users into two group policies, Admins and Users.

 

5. In the Admins group, configure settings and permissions as appropriate. The permissions should include the following:
   1. Define Representative Permissions and enable Allowed to provide remote support.
   2. Under Jump Technology, check all Allowed Jump Methods that your organization will use.
   3. Under Jump Item Roles, set the Default and Personal roles to Administrator.
   4. Set the Teams and System roles to Start Sessions Only.
   5. Under Memberships, define Add Jumpoint Membership.
      1. In the Jumpoint field, search for and select each Jumpoint.
      2. Click Add to grant the members of this group policy access to the Jumpoint.
   6. Under Memberships, define Add Jump Group Memberships.
      1. In the Jump Group field, search for and select Shared.
      2. Set the Jump Item Role to Administrator.
      3. Click Add to assign the members of this group policy to the Jump Group.
   7. Save the group policy.

 

6. In the Users group, configure settings and permissions as appropriate. The permissions should include the following:
   1. Define Representative Permissions and check Allowed to provide remote support.
   2. Under Jump Technology, check all Allowed Jump Methods that your organization will use.
   3. Under Jump Item Roles, set the Default to Start Sessions Only.
   4. Set the Personal Jump Item Role to Administrator.
   5. Set the Teams and System roles to No Access.

   6. Under Memberships, define Add Jumpoint Membership.

      1. In the Jumpoint field, search for and select each Jumpoint these users will need to access.
      2. Click Add to grant the members of this group policy access to the Jumpoint.

   7. Under Memberships, define Add Jump Group Memberships.

      1. In the Jump Group field, search for and select Shared.
      2. Set the Jump Item Role to Start Sessions Only.
      3. Click Add to assign the members of this group policy to the Jump Group.
   8. Save the group policy.

 

7. Deploy Jump Items, assigning them to the Shared Jump Group.

 

8. Now, administrators can deploy and start sessions with Jump Items in the Shared Jump Group. They can also manage their personal lists of Jump Items and start sessions with all other Jump Items.

   Likewise, users can now start sessions with Jump Items in the Shared Jump Group. They can also manage their personal lists of Jump Items.

Advanced Use Case

You are a large organization with a lot of Jump Items to manage and with users to manage in three different departments. You want your administrators to manage all of the Jump Item setup steps and your users to only be able to Jump to those items. Some Jump Items should be accessible at all times, while others should be accessible only on weekdays.

1. Create two Jump Item Roles, Administrator and Start Sessions Only.
   1. The Administrator role should have all permissions enabled.
   2. The Start Sessions Only role should have only Start Sessions enabled.

 

2. Create a Jump Policy, Weekdays.

 

3. In the Jump Policy, enable the Jump Schedule.
   1. Click Add Schedule Entry.
   2. Set the Start day and time to Monday 8:00 and the End day and time to Monday 17:00.
   3. Click Add Schedule Entry and repeat the process for the remaining weekdays.
   4. Save the Jump Policy.

    

 

4. Create three Jump Groups, Web Servers, Directory Servers, and User Systems. Personal Jump Items can also be created.

 

5. Deploy a Jumpoint to each remote network segment where Jump Items will be deployed.

 

6. Put users into two group policies, Admins and Users.

 

7. In the Admins group, configure settings and permissions as appropriate. The permissions should include the following:
   1. Define Representative Permissions and enable Allowed to provide remote support.
   2. Under Jump Technology, check all Allowed Jump Methods that your organization will use.
   3. Under Jump Item Roles, set the Default and Personal roles to Administrator.
   4. Set the Teams and System roles to Start Sessions Only.

   5. Under Memberships, define Add Jumpoint Membership.

      1. In the Jumpoint field, search for and select each Jumpoint.
      2. Click Add to grant the members of this group policy access to the Jumpoint.
   6. Under Memberships, define Add Jump Group Memberships.
   7. In the Jump Group field, search for and select Web Servers.
      1. Set the Jump Item Role to Administrator.
      2. Click Add to assign the members of this group policy to the Jump Group.
   8. In the Jump Group field, search for and select Directory Servers.
      1. Set the Jump Item Role to Administrator.
      2. Click Add to assign the members of this group policy to the Jump Group.
   9. In the Jump Group field, search for and select User Systems.
      1. Set the Jump Item Role to Administrator.
      2. Click Add to assign the members of this group policy to the Jump Group.
   10. Save the group policy.

 

8. In the Users group, configure settings and permissions as appropriate. The permissions should include the following:
   1. Define Representative Permissions and check Allowed to provide remote support.
   2. Under Jump Technology, check all Allowed Jump Methods that your organization will use.
   3. Under Jump Item Roles, set the Default to Start Sessions Only.
   4. Set the Personal Jump Item Role to Administrator.
   5. Set the Teams and System roles to No Access.

   6. Under Memberships, define Add Jumpoint Membership.

      1. In the Jumpoint field, search for and select each Jumpoint these users will need to access.
      2. Click Add to grant the members of this group policy access to the Jumpoint.
   7. Under Memberships, define Add Jump Group Memberships..
   8. In the Jump Group field, search for and select Web Servers.
      1. Set the Jump Item Role to Start Session Only.
      2. Click Add to assign the members of this group policy to the Jump Group.
   9. In the Jump Group field, search for and select Directory Servers.
      1. Set the Jump Item Role to Start Session Only.
      2. Click Add to assign the members of this group policy to the Jump Group.
   10. In the Jump Group field, search for and select User Systems.
       1. Set the Jump Item Role to Start Session Only.
       2. Click Add to assign the members of this group policy to the Jump Group.
   11. Set the Jump Item Role to Start Sessions Only.
   12. Click Add to assign the members of this group policy to the Jump Group.
   13. Save the group policy.

 

9. Deploy Jump Items, assigning them to the three Jump Groups as appropriate. If any particular Jump Item requires a Jump Policy schedule to be enforced, assign that, as well.

 

10. Now, administrators can deploy and start sessions with Jump Items in all three Jump Groups. They can also manage their personal lists of Jump Items and start sessions with all other Jump Items.

    Likewise, local users can now start sessions with Jump Items in all three Jump Groups. They can also manage their personal lists of Jump Items.

    Specified Jump Items can be accessed only on weekdays.