Permissions & RBAC / Credentials
Credentials overview
Learn which credential types ITVA supports, how to add a credential to your inventory, and how ITVA stores it.
ITVA uses credentials to sign in to your devices through a probe. You add each credential to your inventory one time. Then you assign it to one or more devices.
Credential types
Select the type that matches how the device accepts a sign-in.
| Type | Use it for | Fields |
|---|---|---|
| Username / Password | SSH, or HTTPS for firewalls | Username, Password |
| API Key | Devices and services that accept an API key | API Key |
| SNMPv1 | SNMP version 1 | Community |
| SNMPv2c | SNMP version 2c | Community |
| SNMPv3 | SNMP version 3 | Username, Auth Algo, Auth Password, Priv Algo, Priv Password |
For SNMPv3, Auth Algo can be None, MD5, SHA1, SHA224, SHA256, SHA384, or SHA512. Priv Algo can be None, DES, AES-128, AES-192, AES-256, AES-192 (Cisco), or AES-256 (Cisco). If you select None for an algorithm, its password is not required.
Before you begin
- Access to the ITVA portal, with permission to manage credentials.
- The sign-in details for the device. Where the device supports it, use a read-only account.
Add a credential to your inventory
- In the portal, go to Inventory > Credentials.
- Select New Credential. The New Credential panel opens.
- In Name, enter a name for the credential. For example, the account name and the devices it is for.
- In the type list, select the credential type.
- Fill in the fields for that type.
- Optional: In Tags, add one or more tags.
- Select Save.
For a Username / Password credential, you can encrypt the password on your probe before you save it. ITVA then stores the password but can never read it. See Encrypt your credentials.
To use the credential, assign it to a device in the device's Credentials list. You can also create a credential from there. If a device has more than one credential, ITVA tries them in order, from the top of the list to the bottom. See Add your first device.
How ITVA stores credentials
ITVA encrypts every secret field before it writes the credential to its database. This includes passwords, API keys, SNMP communities, and SNMPv3 usernames and passwords.
After you save a credential, the portal never shows a secret in full. It shows a mask with only the first and last character, for example a***z. If the secret has fewer than 5 characters, the mask is *****.
ITVA holds the key for this storage encryption, because it must send the credential to your probe when the probe signs in to a device. If you do not want ITVA to be able to read a password, encrypt the password on your probe. This option is available for Username / Password credentials only.
Check that it worked
Go to Inventory > Credentials. The new credential shows in the list with its Name, Kind, and Tags.
To make sure the credential can sign in, assign it to a device. Then select Test Connection on the device's page.