search

pspete / psPAS

PowerShell module for CyberArk Privileged Access Security REST API
https://pspas.pspete.dev
MIT License
295 stars 92 forks source link

Enumerate Object Level Access on a PASAccount [maybe already exists??] #262

Closed AaronG1234 closed 4 years ago

AaronG1234 commented 4 years ago

Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] I have a safe with Object Level Access, I would like to know who has permission to use/retrieve a password granted from the "Permissions" tab in the account (versus the member tab in the safe)

Describe the solution you'd like if the functionality exist, i could use some pointers, if not: if sensible.. add functionality to Get-PASAccountACL [this may not be a good fit for psPAS design.. but it is where "I" jumped to, to logically solve my problem] or create new function Get-PASAccountOLA

Also if this is really a new feature, any advice on how I could find entitlement in a safe that uses Object Level Access in the interim

Describe alternatives you've considered So far the only way i have seen is use PVWA, and you must know which account to look at, I have yet to find a way to find what accounts a user can read via Object Level Access

Additional context Add any other context or screenshots about the feature request here.

pspete commented 4 years ago

There is no published capability of the API to query object level access control permissions.