Account Commands ​

Account commands provide access to managed privileged accounts in your environment. These commands help you discover available accounts, view their details, and check out credentials for temporary use.

grantflow accounts list ​

Display all managed privileged accounts you're eligible to access. This includes service accounts, database credentials, and other shared administrative credentials managed by GrantFlow.

Usage ​

bash
grantflow accounts list [--output table|json|yaml]

Parameters ​

  • --output - Output format (default: table)

Example ​

bash
$ grantflow accounts list
ID            NAME              SYSTEM    DESCRIPTION           PASSWORD_LAST_ROTATED  ENABLED  POLICY_ID
acct-prod-db  prod_admin        Oracle    Production database   2024-10-20T10:30:00Z   true     policy-123
acct-ad-svc   service_account   AD        Service account       2024-10-15T14:20:00Z   true     policy-456
acct-azure-sp sp-deployment     Azure     Service principal     2024-10-18T09:00:00Z   true     policy-789

Understanding Account Information ​

Each row represents a managed account you can check out. The columns provide important context about the account and its current state.

The system column indicates which platform or application the account belongs to. Common values include Oracle, SQL Server, Active Directory, Azure, AWS, and various on-premises applications.

The password last rotated timestamp shows when GrantFlow last changed the account's credentials. Most accounts rotate automatically on a schedule to maintain security. If you see an old date, it might indicate the account has rotation disabled or uses certificate-based authentication instead of passwords.

The enabled column indicates whether the account is currently available for checkout. Disabled accounts may be undergoing maintenance, locked due to security events, or temporarily removed from the rotation schedule.

While the CLI doesn't currently support built-in filtering for the accounts list command, you can combine it with standard Unix tools:

bash
# Find all Oracle database accounts
grantflow accounts list | grep Oracle

# Use jq to filter JSON output for specific systems
grantflow accounts list --output json | jq '.[] | select(.system == "Azure")'

For more advanced filtering and search capabilities, use the Account Checkout interface in the web portal.

grantflow accounts get ​

Retrieve detailed information about a specific managed account, including its configuration, policy settings, and current status.

Usage ​

bash
grantflow accounts get <account-id> [--output table|json|yaml]

Parameters ​

  • <account-id> (required) - The ID of the account to retrieve
  • --output - Output format (default: table)

Example ​

bash
$ grantflow accounts get acct-prod-db
ID:                  acct-prod-db
NAME:                prod_admin
SYSTEM:              Oracle
DESCRIPTION:         Production database
PASSWORDLASTROTATED: 2024-10-20T10:30:00Z
ENABLED:             true
POLICYID:            policy-123
MAXREQUESTMINUTES:   120
MAXCHECKOUTMINUTES:  60

Request and Checkout Limits ​

The max request minutes value controls how long you can request a checkout for. When you run the checkout command, you can specify any duration up to this limit.

The max checkout minutes value represents the default checkout duration if you don't specify one explicitly. These values help enforce least-privilege principles by limiting how long credentials remain active.

Policy Association ​

The policy ID references the account policy assigned to this account. The policy sets the maximum checkout duration, how the password is generated and rotated, and what happens when it expires. Who may check out the account is decided separately, by the links an administrator creates between users and accounts.

Administrators configure these policies through the web interface. As an end user, you don't need to worry about policy details—GrantFlow enforces them automatically when you request checkout.

grantflow accounts checkout ​

Check out a managed account to receive temporary access to its credentials. This creates a time-limited checkout that grants you the account's username and password (or other authentication material).

Usage ​

bash
grantflow accounts checkout <account-id> --reason <justification> [--duration <minutes>]

Parameters ​

  • <account-id> (required) - The ID of the account to check out
  • --reason (required) - Business justification for the checkout
  • --duration - Requested checkout duration in minutes (default: 60)

Example ​

bash
$ grantflow accounts checkout acct-prod-db \\
    --duration 30 \\
    --reason "Database schema migration for release v2.5 - CHANGE-1234"

✓ Account checked out successfully
  Checkout ID: checkout-abc123def456
  Expires: 2024-10-24T12:30:00Z

Accessing Credentials ​

After successfully checking out an account, you'll need to retrieve the actual credentials. The CLI currently creates the checkout but doesn't display the password directly. Navigate to the Account Checkout page in the web interface to view the credentials securely.

INFO

This design ensures credentials are displayed securely through the web interface with proper session management and audit logging. Future CLI versions may support credential retrieval through secure terminal output.

Checkout Duration ​

Choose the shortest duration that covers your planned work. A checkout cannot be extended; if you need more time, check the account in and start a new checkout. Shorter checkouts reduce risk and align with security best practices.

If you request a duration longer than the account's maximum, the CLI returns an error showing the permitted limit. Check the account's configuration with grantflow accounts get to see the maximum allowed duration.

Justification Requirements ​

Like activation requests, account checkouts require business justification that becomes part of the audit trail. Reference specific work items, change tickets, or operational needs:

  • "Emergency password reset for locked user - TICKET-5678"
  • "Scheduled database backup verification - OPS-TASK-910"
  • "Application deployment following CHANGE-4321"

Clear justification helps auditors understand why credentials were accessed and supports compliance reporting.

No Approval Step ​

Account checkouts need no approval. If the account is linked to you, nobody else holds it, and the duration is within the policy's limit, the checkout starts right away. It stays pending until GrantFlow has enabled the account in the directory. You can follow its status on the Account Checkout page in the web interface.

Credential Security ​

When you check out an account, GrantFlow logs the event, who requested access, when they received credentials, and how long the checkout lasted. The system may also record when the credentials are actually used against target systems, depending on integration capabilities.

Always treat checked-out credentials with the same care as your personal credentials. Never share them, store them in unsecured locations, or use them beyond the approved justification.

DANGER

Misuse of checked-out credentials violates security policy and may result in access revocation. All usage is logged and subject to audit.

Ending a Checkout Early ​

If you finish your work before the checkout expires, you can end the session early through the web interface. This is good security hygiene and demonstrates responsible privilege management.

Account Rotation ​

GrantFlow automatically rotates account passwords on a schedule that administrators define in the account's account policy. It does not rotate a password while the account is checked out. Scheduled rotations skip the account, and manual rotations are refused, so the password you checked out stays valid until you check the account in. The one exception is a password that a target rejected after GrantFlow injected it into a session. GrantFlow rotates such a password once to bring the directory and its stored copy back in line.

Depending on the policy, GrantFlow may rotate the password when you check the account in after it injected the password into a session. Your next checkout always returns the current password, so you don't need to track rotations yourself.

Scheduled rotations run inside the policy's rotation window, in the time zone the policy names (UTC when it names none). GrantFlow rotates a password early when it would otherwise expire before the window next opens.

Expired Passwords at Checkout ​

If the account's policy refuses checkout once the password has expired, grantflow accounts checkout no longer fails for that reason alone. The server rotates the expired password first and then completes the checkout, so the command can take noticeably longer than usual. The same happens for a password GrantFlow has never rotated.

If the rotation is still running when the server stops waiting, the checkout is refused with "The account's password is being rotated. Try again in a moment." Run the command again shortly. If it is refused with "account disabled due to expired password, or unassigned password policy", GrantFlow could not rotate the password, for example because the account's connector is disabled or the directory rejected the new password. Contact your administrator.