Creating authorizor admin and local admin users
Once you have successfully installed the desktop client application, you must add the objects you need to write access request policies, such as users, accounts, and assets. If your company practices the principles of separation of duties (SoD), the Authorizer Administrator needs to create the following additional administrators.
NOTE: A user can be assigned more than one set of permissions.
To add local administrator users
- Log in to the Windows desktop client application as the Bootstrap Administrator.
- From the Home page, navigate to
Administrative Tools and select Users.
-
Add the following additional local administrator users.
IMPORTANT: After creating, log out as the Bootstrap Administrator and log in as the Authorizer Administrator. It is recommended you disable the Bootstrap Administrator for security purposes.
-
|
AuthorizerAdmin
(Log in as this user to create all other administrators.)
|
Test123 |
All |
The administrator responsible for creating all other administrators |
| ApplianceAdmin |
Test123 |
Appliance |
The administrator responsible for configuring the appliance |
| AssetAdmin |
Test123 |
Asset |
The administrator responsible for adding and managing partitions, assets, and accounts |
| Auditor |
Test123 |
Auditor |
The administrator responsible for reviewing all access request activity |
| PolicyAdmin |
Test123 |
Security Policy |
The administrator responsible for defining the entitlements and policies that control which assets and accounts a user can access |
| UserAdmin |
Test123 |
User |
The administrator responsible for managing users |
Note: When you choose certain permissions, Safeguard for Privileged Passwords also selects additional permissions. Do not clear these additional settings.
Before you log out, verify that Safeguard for Privileged Passwords added these users.
To view the audit log
- From the Home page, navigate to the
Activity Center.
- Leave the default search criteria (I would like to see all activity occurring within the last 24 hours).
- Click Run.
- Explore the results.
As the Authorizer Administrator, you can view User Authentication and Object History for Audit Events pertaining to users.
- Log out.
Configuring external integration settings
First we will log in to the desktop client with an Appliance Administrator account (ApplianceAdmin) to configure the following external integration settings:
- Starling join (used for secondary authentication and Approval Anywhere)
- Email notifications
Setting up a Starling account
We will be using Starling Two-Factor Authentication (2FA) as our service provider for secondary authentication and Approval Anywhere. To get started, you must register a Starling Organization Admin account or a Collaborator account associated with the One Identity Hybrid subscription. Also, you must download the Starling 2FA app on your mobile phone to use the Approval Anywhere feature.
To sign up for a Starling One Identity Hybrid service trial account
- Go to https://www.cloud.oneidentity.com/ and log in or register a new account for the Starling cloud platform.
- From the Starling home page, click Sign in to Starling.
- Enter a valid email address and click Next.
- Enter your password and click Sign In.
-
On the Create your Account page, enter your organization and your mobile phone number.
NOTE: If the email address you entered does not exist, you will be taken directly to the Create your Account page to register your organization and enter your name, password, and mobile phone number.
When registering for the first time, you will be sent a verification email in which you must click the supplied link in order to complete the registration process.
-
Once logged in, click the Trial button under the One Identity Hybrid tile. Follow the prompts on the screen.
The service will be added to the My Services section and be available for use until the trial period has ended. The number of days left in your trail is indicated by a countdown at the top right of the service access button on the home page of Starling. At any point in the trial you can use the More Information button associated with the service to find out how to purchase the product.
Joining Starling
One Identity Starling Two-Factor Authentication (2FA) is a Software-as-a-Service (SaaS) solution that provides two-factor authentication on a product, enabling organizations to quickly and easily verify a user's identity. This service is provided as part of the One Identity Starling cloud platform. In addition Starling offers a hybrid service, One Identity Hybrid, that allows you to take advantage of companion features from multiple Starling services, such as Starling Two-Factor Authentication.
Joining Safeguard for Privileged Passwords to Starling adds Safeguard for Privileged Passwords to the One Identity Hybrid service allowing you to use features from both the Starling Two-Factor Authentication.
Once Safeguard for Privileged Passwords is joined to Starling, the following Safeguard for Privileged Passwords features are enabled and can be implemented using Starling Two-Factor Authentication:
-
Secondary authentication
Safeguard for Privileged Passwords supports two-factor authentication by configuring authentication providers, such as Starling Two-Factor Authentication, which are used to configure Safeguard for Privileged Passwords's authentication process such that it prompts for two sources of authentication when users log in to Safeguard for Privileged Passwords.
A Starling 2FA service provider is automatically added to Safeguard for Privileged Passwords when you join Safeguard for Privileged Passwords to Starling. As an Authorizer or User Administrator, you must configure users to use Starling 2FA as their secondary authentication provider when logging in to Safeguard for Privileged Passwords.
-
Approval Anywhere
The Safeguard for Privileged Passwords Approval Anywhere feature integrates its access request workflow with Starling Two-Factor Authentication (2FA), allowing approvers to receive a notification through an app on their mobile device when an access request is submitted. The approver can then approve (or deny) access requests through their mobile device without needing access to the desktop or web application.
Approval Anywhere is enabled when you join Safeguard for Privileged Passwords to One Identity Starling. As a Security Policy Administrator, you must define the Safeguard for Privileged Passwords users authorized to use Approval Anywhere.
Later in the guide, we will step through the process of configuring a user to require two-factor authentication as well as logging in with two-factor authentication. We will also discuss how to define the users who are authorized to use Approval Anywhere to approve access requests.
To join Safeguard for Privileged Passwords to Starling
- Log in to the Windows desktop client as ApplianceAdmin.
- From the Home page, navigate to Administrative Tools | Settings | External Integration | Starling.
-
Click Join to Starling.
NOTE: The following additional information may be required:
- If you do not have an existing session with Starling, you will be prompted to authenticate.
- If your Starling account belongs to multiple organizations, you will be prompted to select which organization Safeguard for Privileged Passwords will be joined with.
After the join has successfully completed, you will be returned to the Safeguard for Privileged Passwords desktop client and the Starling settings pane will now show Joined to Starling. In addition, the Administrative Tools | Settings | External Integration | Identity and Authentication pane displays Starling 2FA as a secondary authentication provider.
Stay logged in as the ApplianceAdmin for setting up email notifications.
