Key concepts

PAM is a set of principles and practices to control, monitor, and secure access to critical resources by both human and machine identities. PAM ensures that users have the right-sized permissions to access critical resources, such as infrastructures, applications, or data essential to an organization’s operations, and that could cause significant harm if compromised or unavailable.

PingOne Privilege replaces long-lived, standing privileges with just-in-time (JIT) access: temporary permissions that are granted when needed, expire automatically, and are revoked when they expire. Users request access through the self-service portal, or policies grant it, and every grant is time-bound and auditable.

Modern Windows and Mac laptops include hardware-based security features like the TPM chip or Apple’s Secure Enclave. These provide a secure, tamper-resistant location for storing private keys, offering stronger security than file-based credentials because the keys can’t be directly read or extracted.

The Endpoint Controller, installed during setup, creates, and stores a non-exportable private key in the device’s TPM or Secure Enclave. The Endpoint Controller uses this key to establish a secure mutual TLS (mTLS) connection with PingOne Privilege, which verifies the identity of both the user and the device.

For situations where the Endpoint Controller can’t be installed, the No Endpoint Controller provides secure access to resources like SSH, cloud CLIs, and Kubernetes. When a user authenticates through the No Endpoint Controller, they’re redirected to PingOne SSO for authentication. After successful authentication, the user can access resources based on their permissions.