PAM account discovery

Discovery scans your systems for accounts, such as Active Directory users or PostgreSQL roles, so you can import the ones you want to manage as PAM accounts. You need the Product Admin role to use Discovery. To set up a discovery source, follow the guide for the system you want to scan:

​

How discovery works

1. You create a discovery source, which names the systems to scan, the PAM accounts to sign in with, and the Gateway to connect through
2. Infisical scans the source on demand or on a schedule, and adds the accounts it finds to the source’s staged accounts
3. You select the staged accounts to import, and pick a folder and an account template for them
4. Infisical creates a PAM account for each staged account you imported

Discovery finds each account’s username but not its password. An imported account can’t be used until you enter its credential on the account.

​

Staged accounts

A staged account is an account that a scan found and that you haven’t imported yet. To see a source’s staged accounts, go to Privileged Access Management > Discovery, select the source, and open its Staged Accounts tab. When you scan a source again, Infisical updates its staged accounts instead of adding duplicates, and doesn’t stage an account you already imported. If a scan no longer finds a staged account, Infisical removes it, except on Unix sources.

​

Stale accounts

If a scan no longer finds an account that you imported, Infisical lists the account on the source’s Stale Accounts tab and marks it as stale on the Accounts page. A stale account keeps working, including sessions and rotation. Check whether the account still exists on the target, and delete the PAM account if it doesn’t. For Windows, PostgreSQL, and Microsoft SQL Server sources, Infisical only removes staged accounts and marks accounts as stale on hosts that the scan reached, so an unreachable host doesn’t change its accounts.

​

Unix sources

Unix sources never remove staged accounts or mark imported accounts as stale. If you delete a user from a Unix host, its staged account and its PAM account stay as they were. Check the host itself before you treat an account from a Unix source as current.

​

Scan schedules

Each source has a Scan Schedule: Infisical checks once a day for sources that are due. A scheduled source scans at the first check after its interval has passed since its last scan. The source’s Runs tab shows each scan’s start time, status, and result.