# Proyecto

## PAM cloud (v.3)

### Actores

Soffid : sroujac ; gbuades

Cliente : Solarig : <dsanchez@solarig.com> ; <cesarlafuente@solarig.com>

Partner : Getronics

### Arquitectura 

MV Madrid

- sync server proxy
- jump server

MV Soria

- jump server

Consola : [https://solarig.prod.soffid.net/](https://solarig.prod.soffid.net/)

### Configuraciones

#### General 

**Carga de usuarios** : Agente AD en read only + eris

Incluye sincronización y rotación de contraseñas.

Principalmente configuraciones de los menus de acceso y del vault.

##### Cuentas compartidas 

Todas las cuentas AD adm\* tienen asociadas el usuario normal como owner para que solo la pueden usar.

##### Otros componentes

- Break glass
- ESSO

#### IDP &amp; SP

[![Captura desde 2026-07-13 12-28-12.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/OjJ9j9qVwEHhGAzJ-captura-desde-2026-07-13-12-28-12.png) ](https://bookstack.soffid.com/uploads/images/gallery/2026-07/OjJ9j9qVwEHhGAzJ-captura-desde-2026-07-13-12-28-12.png)

Soffid IDP config :

- mtd d'autentificació pw + OTP
- perfils : ESSO + openidProfile
- SP SAML

[![Captura desde 2026-07-13 12-33-08.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/5Dxjw7unKvRniZb3-captura-desde-2026-07-13-12-33-08.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/5Dxjw7unKvRniZb3-captura-desde-2026-07-13-12-33-08.png)

SP Azure :

[![Captura desde 2026-07-13 12-35-07.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/byWhIrEyic1XGFWy-captura-desde-2026-07-13-12-35-07.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/byWhIrEyic1XGFWy-captura-desde-2026-07-13-12-35-07.png)

#### Config Autentificació

[![Captura desde 2026-07-13 12-36-58.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/4VAYxesBUV2iwjzv-captura-desde-2026-07-13-12-36-58.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/4VAYxesBUV2iwjzv-captura-desde-2026-07-13-12-36-58.png)

#### Sesiones PAM

Carpetas de departamentos del cliente : Redes, Cyber y Sistemas.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/ISbH4n8mtaJqnlBg-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/ISbH4n8mtaJqnlBg-image.png)

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/Se5RATdxg89oOuNy-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/Se5RATdxg89oOuNy-image.png)

##### Menus de acceso 

OJO config diferente para Azure.

[Customizing browser PAM.pdf](https://drive.google.com/file/d/1epQi1Ntw4RM4S_GTwkz_KTcf_e_zQWjy/view?usp=drive_link)

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/vFvBSM1HjCWvszEu-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/vFvBSM1HjCWvszEu-image.png)

##### Config Pw Vault 

SSO users : rol SOFFID\_PRIV para permitir ver la cuenta pero lanzar workflow de aprobaciones si no es owner de la cuenta.

SSO owners : usuario(s)propietario(s) de la cuenta

#### Workflows 

1. reservationAccount en el vault   
    
    - Initiadores : rol SOFFID\_PRIV
    - Abrobadores : <span id="bkmrk-soffid_super" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;"><span id="bkmrk-soffid_super-1" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;">SOFFID\_SUPER</span></span> de lunes a viernes y <span id="bkmrk-soffid_cc" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;">SOFFID\_CC</span> el finde
2. Elevación de privilegios en equipos 
    - Initiadores : usuarios ESSO que no tienen cuentas AD admin
    - Abrobadores : <span id="bkmrk-soffid_super-2" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;"><span id="bkmrk-soffid_super-3" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;">SOFFID\_SUPER</span></span> de lunes a viernes y <span id="bkmrk-soffid_cc-1" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;">SOFFID\_CC</span> el finde

#### Roles importantes

<table border="1" id="bkmrk-soffid-roles-users%C2%A0-" style="border-collapse: collapse; width: 100%; height: 246.883px;"><colgroup><col style="width: 24.788%;"></col><col style="width: 32.8917%;"></col><col style="width: 42.4256%;"></col></colgroup><tbody><tr style="height: 29.7167px;"><td style="height: 29.7167px;">Soffid roles</td><td style="height: 29.7167px;">Users </td><td style="height: 29.7167px;">Permissions</td></tr><tr style="height: 46.5167px;"><td style="height: 46.5167px;"><span id="bkmrk-soffid_priv" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;">SOFFID\_PRIV</span></td><td style="height: 46.5167px;">Usuarios con acceso a soffid vault </td><td style="height: 46.5167px;">ver el vault, pedir permisiones y acceder a su sistemas y autorizaciones PAM </td></tr><tr style="height: 31.0333px;"><td style="height: 31.0333px;"><span id="bkmrk-soffid_cc-2" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;">SOFFID\_CC</span></td><td style="height: 31.0333px;">Centro de control de solarig</td><td style="height: 31.0333px;">Validadores de workflow durante el finde</td></tr><tr style="height: 31.0333px;"><td style="height: 31.0333px;"><span id="bkmrk-soffid_super-4" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;"><span id="bkmrk-soffid_super-5" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;">SOFFID\_SUPER</span></span></td><td style="height: 31.0333px;">Departamiento IT </td><td style="height: 31.0333px;">Validadores de workflow durante la semana</td></tr><tr style="height: 31.0333px;"><td style="height: 31.0333px;"><span id="bkmrk-soffid_acceso_finde" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;"><span id="bkmrk-soffid_acceso_finde-1" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;">SOFFID\_ACCESO\_FINDE</span></span></td><td style="height: 31.0333px;">usuarios con acceso a toda hora</td><td style="height: 31.0333px;">usuarios con acceso de lunes a domingo</td></tr><tr style="height: 46.5167px;"><td style="height: 46.5167px;"><span id="bkmrk-soffid_week_access" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;">SOFFID\_WEEK\_ACCESS</span>

</td><td style="height: 46.5167px;">usuarios con accesos solamente en horarios laborales</td><td style="height: 46.5167px;">usuarios con acceso de 8h a 18h de lunes a viernes</td></tr><tr style="height: 31.0333px;"><td style="height: 31.0333px;"><span id="bkmrk-soffid_admin" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;"><span id="bkmrk-soffid_admin-1" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;">SOFFID\_ADMIN</span></span>

</td><td style="height: 31.0333px;">dsanchez, mfandino &amp; cesarlafuente</td><td style="height: 31.0333px;">\*</td></tr><tr><td><span id="bkmrk-soffid_user" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;"><span id="bkmrk-soffid_user-1" style="font-size: 11pt; font-family: Sansation,sans-serif; color: #000000; background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;">SOFFID\_USER</span></span>

</td><td>Usuarios con acceso a soffid</td><td>Acceso consola</td></tr></tbody></table>

#### XACML Policies 

[![Imagen pegada.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/2VEbERMJCuI9ABII-imagen-pegada.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/2VEbERMJCuI9ABII-imagen-pegada.png)