JIT access: approvals and access windows in Remote Access

This page is for the administrator who decides how people get into a remote host: at any time, or only after someone says yes, for a limited time. What the requester and the approver see is in Access request approval and remote sessions.

Who can do this. A Super admin or an Application admin sets the access policy. Approvers are the people and groups you list; they need no administrator role. Only a Super admin can Revoke approved access from the console.

What is needed first. A saved Remote Access resource assigned to an application, and the people who will use it assigned to that application.

The result. A person sees the resource on My Apps with Request access, asks with a reason and a duration, an approver decides from their approvals page, and the person can open the host only inside the approved window. Everything is recorded.

The examples use the fictional company Acme Corp, the employee Maria Lopez, the approver Pat Chen and the server Acme Build Server (SSH).

The two access modes

Mode	What the console says	What happens
Standing	“Standing: everyone who may open it can, any time”	Anyone in the audience opens the resource whenever they like, for up to its maximum session length.
Just in time	“Just in time: a person asks, an approver says yes, for a limited time”	A person requests access with a reason; one approver approves; the person may open the resource until the window ends.

A new resource has no access policy. The Access tab warns: “Access has not been set up for this resource. It is just-in-time with no approver, so nobody can request or open it until you save a policy here.”

Set up just-in-time access

In the Admin Console, choose Secure access > Remote Access and open the resource.
Open the Access tab. The top line shows the saved policy’s “Version N, saved … by …”.
Under How access is granted, choose Just in time: a person asks, an approver says yes, for a limited time.
Under Who may open it, choose Everyone assigned to the application, or Only these groups and people (who are also assigned) and use Add a group and Add a person (and Remove) to build the list.
Under Approval, read the fixed rule: “The requester is never their own approver, whatever is listed. One approval is required in this version, and a reason is always required.” Under Approvers, add at least one group or person with Add a group / Add a person.
Set the time limits:

Field	Range	Meaning
Longest access window (minutes, 15 to 1440)	15 minutes to 24 hours	The most a person may ask for. The requester’s form shows it as “up to”, for example “up to 4 h”.
A request may wait (hours, 1 to 72)	1 to 72 hours	How long a request stays Pending before it expires undecided. Approvers see it as “Expires if undecided at …”.

Select Review changes. The panel Who loses access now lists each person affected by the change: “Could open or request access”, “Pending request revoked” or “Approved access revoked, live session ended”, or says “Nobody loses access.”
Select Save access. The page says “Access saved.”

To let a capability (clipboard or file transfer) be granted per request rather than to everyone, turn it on With approval in the Capabilities section of the same tab; see File transfer and clipboard. The requester then ticks it under Also allow, and the approver may grant all, some or none of what was asked.

How a request moves

State	How it gets there	What the requester sees on My Apps
Pending	The person selects Request access, gives a Reason (10 to 500 characters), a Duration in minutes (15 up to the longest window) and a Start (When approved, or At a time within 7 days). One pending request per person per resource.	“Waiting for approval · requested 5 minutes ago”, with Cancel request
Approved	An approver selects Approve. The window starts at approval (or at the requested start, if later) and lasts the requested duration, capped by the longest access window.	“Approved · from 14:00 to 15:00” and “Opens at 14:00”, then “Access until 15:00 (42 min left)” with Open
Denied	An approver selects Deny and confirms Deny request.	“Denied by Pat Chen · note”, with Request again
Withdrawn	The requester selects Cancel request.	Request access again
Expired	Nobody decided within A request may wait, or the approved window ended. Any live session is ended.	“Expired …”, with Request again
Revoked	A Super admin selects Revoke in the console, or the policy changed so the person is no longer allowed. Any live session is ended.	“Revoked by … · note”, with Request again

A denied, expired or revoked outcome stays on the requester’s card for 24 hours, then the card returns to Request access.

Who may approve

Any person listed under Approvers, directly or through a listed group, except the requester: “You cannot decide your own request.”
The approver must have completed a second sign-in step within the last 10 minutes, of a kind the resource’s application accepts. Otherwise the approvals page says “Needs a second step from the last 10 minutes, of a kind this resource accepts. Sign in again and return here.”
One approval decides the request. There is no second approver and no approval step in the Admin Console: approvals happen on the approver’s own Approvals page on My Apps.
When SSOGEN has mail set up, each eligible approver gets one email per request, subject SSOGEN Remote Access approval waiting on followed by the SSOGEN address, with a Review request button. The email says nothing about who asked or why.

How long a session may last

Inside an approved window, a session is also bound by the resource’s Maximum session (seconds) and Idle timeout (seconds) (set on the resource’s Overview tab; 300 to 86,400 and 60 to 86,400 seconds). The session page shows the sooner of the window end and the maximum session as “… left”; the console shows the moment a session must end at the latest as its Hard limit. When the window ends the person sees “Your access window ended or the session reached its time limit.”

Watch and revoke requests in the console

Choose Secure access > Remote Access and open the Requests tab (every resource) or a resource’s Requests tab.
The table shows Requester, Resource, State, Reason, Asked for, Requested and Decided by. Under the reason: “Also asked for: …” and, once decided, “Approved with: …” or “Approved without extra capabilities”. Filter by State.
To withdraw approved access, open the row menu of an Approved request and choose Revoke. The dialog Revoke Maria Lopez’s access? says: “Maria Lopez’s approved access to Acme Build Server (SSH) is withdrawn, and any session they have open on it is ended.” Select Revoke access.

What is recorded

On the resource’s Timeline and in Monitoring > Audit: Access requested (with “Reason:”, “Access: just in time”, “From:”, “Until:” and “Capabilities:”), Approved or Denied (with the approver, their “Note:” and what was approved), Request withdrawn, Access expired, Access revoked (with who and why), and Access settings changed when the policy is saved. See Remote Access session audit.

Check it worked

As a person in the audience, open My Apps: the resource’s card reads “Requires approval · up to …” with Request access. Send a request.
As an approver, open Access requests waiting for your approval on My Apps: the request is there with the reason. Select Approve.
Back on the requester’s My Apps, the card reads “Access until … (… left)” with Open, and the resource opens.
In the console, the resource’s Requests tab shows the request as Approved with Decided by filled in, and the Timeline shows Access requested followed by Approved.

Troubleshooting

What you see	What it means	What to do
“Choose at least one group or person, or allow everyone assigned to the application.”	The audience is empty.	Add someone, or choose Everyone assigned to the application.
“Choose at least one approver.” / “Just-in-time access needs at least one approver.”	Just in time with no approver.	Add an approver.
“The longest access window is a whole number of minutes from 15 to 1440 (24 hours).” / “A request may wait a whole number of hours from 1 to 72.”	A limit is out of range.	Correct it.
“The access policy changed since you opened it. It has been reloaded; make the change again.”	Another administrator saved meanwhile.	Make the change again.
“The access settings could not be saved.”	The save failed.	Try again.
A person’s card says “Access has not been set up yet”	No policy is saved.	Save one on the Access tab.
A person sees “You already have a request waiting for approval.”	One pending request per person per resource.	Wait for the decision or Cancel request.
A person sees “That duration is outside what this resource allows.”	More than the longest access window, or under 15 minutes.	Ask for less.
An approver sees “You are not an approver for this request.”	They are not in the resource’s current approver list.	Add them under Approvers.
An approver sees “The resource’s access settings changed and no longer allow this request. You can deny it.”	The policy changed (for example to standing, or the requester left the audience) after the request was made.	Deny it; the person requests again if needed.
“Only an approved request can be revoked.” / “That access could not be revoked.”	The request is not approved, or the revoke failed.	Check the State; try again.
Approvers get no email	Mail is not set up, or the approver is the requester.	Set up mail, or tell approvers to check Access requests waiting for your approval.
“Only a Super Admin can change this.” on Revoke	Your role cannot revoke.	Ask a Super admin, or change the policy so the person loses access (the review panel ends their session).