> For the complete documentation index, see [llms.txt](https://newdocs.keeper.io/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://newdocs.keeper.io/en/keeperpam/privileged-access-manager/just-in-time-access-jit/keeper-privileged-cloud/configure-and-elevate-access-for-a-pam-database.md).

# Configure and Elevate Access for a PAM Database

<figure><img src="/files/olTInWrpp8IPGdadeWfG" alt=""><figcaption></figcaption></figure>

### Overview

This guide shows how to use a PAM Database record to grant just-in-time elevated access to a database through the configured identity provider.

After the record is shared and the JIT and Workflow settings are configured, users can request access, receive temporary group-based elevation for the approved time window, and connect to the database without permanent standing privilege.

Use this setup when database access must be approved, time-bound, and fully auditable.

### Configure and Share the PAM Database Resource

In the example below, a PAM Database record is configured to grant elevated access through the identity provider. Select **Edit** in **PAM Settings** to configure Workflow and JIT.

<figure><img src="/files/qCngEm83ozODig25HwDh" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/MHs5NYGaEzeMS81HQCgZ" alt=""><figcaption></figcaption></figure>

#### **KeeperDB Settings**

When configuring a database, KeeperDB support can also be configured to enable easier administration of the database. See [KeeperDB](/en/keeperpam/privileged-access-manager/keeperdb.md) for more information.

<figure><img src="/files/Tl71prIt60K6G87m6HGW" alt=""><figcaption></figcaption></figure>

#### **JIT Settings**

JIT settings define how access is granted after approval. In this example, the record uses group-based privilege elevation. If the database authenticates through an identity provider, enable authentication through the identity provider. The group name must match the corresponding group in the identity provider. After approval, the user receives temporary elevation for the configured duration. Role-based elevation is not supported through identity-provider elevation at this time.

<figure><img src="/files/ClKGUAe9ETq000RWpvEI" alt=""><figcaption></figcaption></figure>

#### **Workflow Settings**

Workflow settings define the approval controls for the record. In this example, the record requires approval and limits access to 1 hour. When the access window ends, any active session closes and the temporary elevation is removed. You can also require a reason and ticket number with each request.

See [Workflow](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/workflow.md) for more information.

<figure><img src="/files/Hh7c8FN0WS7OoLjxNdHC" alt=""><figcaption></figcaption></figure>

### Requesting Access

Once the PAM Database record is shared and JIT and Workflow settings are configured, the user can submit an access request from the Keeper Vault or from Commander.

See [Keeper Privileged Cloud](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/keeper-privileged-cloud.md#access-workflow) for a full workflow.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://newdocs.keeper.io/en/keeperpam/privileged-access-manager/just-in-time-access-jit/keeper-privileged-cloud/configure-and-elevate-access-for-a-pam-database.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.