Sign in
Catalog / Hands-on lab

Lab: Just-in-time access with approval and revoke

A real Monopam with a Linux server and a user who can reach it at any time. Remove that standing access, offer the server through a Request Policy, then request, approve, use and revoke time-bound access while the server itself proves each step.

Monopam University Pass 1 hAdvanced DE · EN · ES · TR Administrator Security analyst

Version 4 · updated Nov 9, 2026What changed?

Hands-on lab
Sign in to start

Included with University Pass.

What you will learn

  • Replace standing access with a self-service request catalog
  • Run an approval with a bounded time window
  • Revoke an active grant and confirm on the server that the live session ended

Your lab environment

YOUR LAB SERVERYour browserpamadmin, deniz and mert inturnMonosignSign-in to the MonopamapplicationLab userspamadmin admin, denizrequester, mert approverMonopamPolicies, Requests,Resources, web terminallinux-01Linux SSH server, rootaccount in the vaultlinux-01-standingPolicy that gives denizstanding accessSigns inIdentity
Your lab environment: Monopam signs its users in through Monosign and opens SSH sessions to linux-01 only while a request is approved

Lab tasks

Each task is checked automatically against the real state of your lab environment.

  1. 1. As pamadmin, end the standing access: deniz must no longer get linux-01 from the policy linux-01-standing
  2. 2. Create a Request Policy that offers linux-01 with its root account to deniz for at most 60 minutes, approved by mert
  3. 3. As deniz, raise a 30 minute request for linux-01 from Requests > New Request, with a business reason
  4. 4. Approve the request as mert, then as deniz connect to linux-01 from Resources and run: touch /tmp/jit-proof
  5. 5. As pamadmin, revoke the grant while deniz is connected and confirm the session ends