Configuring Human Privilege
This section provides guidance for administrators on configuring Human Privilege. Which configuration steps you need depends on the resources your organization uses and how users connect to them. Find your scenario in the following topics, then follow the linked pages in the order shown.
| If you’re securing AI agent access instead of human access, refer to Configuring Agent Privilege. |
Access Kubernetes clusters
Choose this path to configure just-in-time access to Kubernetes clusters. You must first onboard the cloud account before configuring access to Kubernetes clusters:
If the cluster is in a private VPC with no inbound internet access, you must also deploy a gateway or relay. Learn more in Gateways.
Access on-premise servers and databases
Choose this path to configure access to resources on a private network, such as on-premise servers, databases, or applications. You must first configure the network infrastructure, since resources are only reachable through a gateway.
The basic flow for this path involves:
-
Configure the necessary network infrastructure based on your organization’s needs:
-
Deploy a gateway on your own infrastructure.
-
If your network doesn’t allow inbound connections, deploy private relays instead.
-
-
After configuring a Private Proxy or Relay, you can:
-
Configure certificate-based SSH for passwordless access on Linux servers.
-
Configure RDP access for Windows servers.
-
Add MFA challenges
Choose this path to challenge onboarded users with MFA when they connect to PingOne Privilege or escalate privileges. Based on your PingOne Privilege deployment model, you can:
-
Require PingID Workforce Authentication when users connect to the Endpoint Controller in Endpoint Controller-based deployments.
-
Require step-up authentication for sudo commands in No Endpoint Controller deployments.