Skip to main content

Configuration and security

Who a Job runs as, who may change it, and what it connects to.

Here are the essential components you will use to manage identity, permissions, and routing in JAMS:

  • Credential: Secure storage objects for authentication data used primarily to define the execution context for jobs and centralize connections to external systems.
  • Access Control List (ACL): Establishes user permissions for a JAMS object itself.
  • Connection: Specifies how a Job connects with systems outside of JAMS.

Credentials​

A Credential in JAMS is a stored account. It holds a logon username and a password, a key value, or both.

A Credential is used in two different ways:

  1. Sets the account a Job runs as, which is the "Execute As" property. When the Job is submitted, its Entry runs under that account, and everything the Job does on that machine happens with that account's rights.

  2. Credentials also authenticate outward connections, providing the necessary accounts for jobs that communicate with mail servers, FTP/SFTP servers, SQL/Oracle databases, or third-party applications.

Assign a Credential to a single Job, or to a Folder so every Job inside the Folder inherits it. A Job that names its own Credential overrides the one it would inherit. A Job cannot run without one.

Where the secret is kept​

When you create a Credential you choose where its values live: in the JAMS database, or in an external secret provider that JAMS reads at runtime. Azure Key Vault is the supported provider. JAMS only reads from a secret provider. It never writes back to one.

Access Control Lists​

An Access Control List decides which users and groups may do what inside JAMS: create Jobs, change them, run them, look at History, or only watch the Monitor.

An ACL is a list of Access Control Entries. Each entry names one identifier, a user or group from Active Directory, along with the types of access that identifier gets.

Objects inside a Folder inherit that Folder's security the same way they inherit its other settings. Variables are the exception: a Variable is protected only by its own ACL, and if you add nothing to it, only administrators and whoever created it can see it.

An ACL is not a Credential​

A developer allowed to create and modify Jobs while an operator may only run them is an ACL. Neither statement says anything about which account those Jobs execute under, and both of them may well run as the same service account.

Connections​

A Connection is reusable connection information kept in a Connection Store: a name, an optional description, and a type such as SQL, SFTP or SMTP. These Connections can be reused in multiple Jobs, making it easier to maintain the connection information in one place. You can also use Connections with Job Properties, Job Source, or Job Triggers.

A Connection describes where, not who. Nearly every Connection names a Credential for the account it authenticates with, which keeps the address in one object and the secret in another. Rotating a password does not touch the Connection, and moving a server does not touch the Credential.

Define the Connection Information once and reference it from every Job that needs it, rather than embedding the same Connection Properties in twenty Job Sources and maintaining them all when it changes.

A Connection can be attached at the Execution Method, Folder or Job level, and follows the same inheritance rule as any other property.

Working with Credential Definitions

Create the accounts your Jobs run as and authenticate with.

Configuring a Secret Provider

Keep Credential values in Azure Key Vault rather than the JAMS database.

Setting Access Control Lists

Give each group only the access its role needs.

Connections in JAMS

Define a server once in the Connection Store and reuse it everywhere.