Authentication tab (add user)
On the Authentication tab, specify the authentication settings for the user. An authentication provider can be the same or different as the user's identity provider.
Use valid combinations of identity and authentication providers. For more information, see Identity and Authentication.
Table 222: User: Authentication tab properties
Indicates how this user is to authenticate to Safeguard for Privileged Passwords. The options are:
If Certificate provider:
Certificate, Certificate Thumbprint (SHA-1)
If adding a Certificate user, enter the unique hash value (40 hexadecimal characters) of the certificate. You can copy and paste the Thumbprint value directly from the certificate, including the spaces.
If external federation provider:
Email Address or Name Claim
If adding an external federation user account, enter the email address or name claim that will be returned from the STS of an authenticated user. A case-insensitive comparison will be performed on the value when the user is logging in.
NOTE: You must configure or ensure that the STS includes either the email address claim or name claim. Safeguard for Privileged Passwords will first look for the email address claim in the claims token. If that claim does not exist, it will use the name claim. You must create the user account in Safeguard for Privileged Passwords according to what claim is returned by your STS, with precedence given to the email address claim.
If local or Radius as Primary provider:
If using Local or Radius as Primary for authentication, this is the user's login name. This defaults to the value entered on the Identity tab, Username field.
If using directory authentication, the login name is auto-populated.
Set Password button
(editing an existing Local provider)
If you are editing an existing user for a Local provider, you may click Set Password to change a user's password. This button is not available when creating a new user or editing a user account from an external identity provider like Microsoft Active Directory.
(adding a Local provider)
If adding a Local user, enter a password for the user. You must comply with the password requirements specified in the dialog. For more information, see Local Password Rule.
Require Certificate Authentication
(Active Directory provider if provider is MS AD)
Select this check box to require that the user logs into Safeguard for Privileged Passwords using their domain issued user certificate or SmartCard. This option is only available when the Authentication Provider is a Microsoft Active Directory.
Password Never Expires
Select this check box to set a password that does not expire.
User must change password at next login
This check box is only available when using Local for authentication. When selected, this check box requires the user to change their password during their next login.
|Require Secondary Authentication
Select this check box to require that this user logs in to Safeguard for Privileged Passwords with two-factor authentication. For more information, see Requiring secondary authentication log in.
Then choose the Secondary Authentication Provider for this user. Use valid combinations of identity and authentication providers. For more information, see Identity and Authentication.
(for secondary authentication; not used for FIDO2)
- When a directory is selected for secondary authentication, Browse to select the account on the secondary authentication provider this user must use when logging into Safeguard for Privileged Passwords with two-factor authentication.
- If Radius as a secondary authentication provider is selected, this value is pre-populated with the log in identifier. For more information, see Radius settings.
A best practice is to have the users log in to validate the correct user is set up.
Permissions tab (add user)
On the Permissions tab, select the user's Administrator permissions, if applicable. For details on the rights for the permissions, see Administrator permissions.
Users permissions across multiple user groups
Users have permissions based on the user groups to which they are assigned. If a user is removed from a user group, the permissions related to that group are removed but the permissions for all other groups the user is assigned to remain in place.
User permissions on import
When a directory user group is imported, newly created Safeguard users are assigned the selected permissions. If the user exists in Safeguard, the selected permissions are added to the existing user permissions.For more information, see Adding a directory user group.
To assign permissions
When assigning permissions to a user, select the appropriate access controls. You can Select all or Select none at the bottom of the dialog.
Requiring secondary authentication log in
You can require a user to log in using two-factor authentication by enabling the Require Secondary Authentication option in the user record.
To require a user to log in using secondary authentication
Setup a secondary authentication provider in Appliance Management > Safeguard Access > Identity and Authentication. For more information, see Adding identity and authentication providers.
- Configure the Safeguard for Privileged Passwords user to Require Secondary Authentication. For more information, see Authentication tab (add user).
- On the Authentication tab of a user's properties, select the Require Secondary Authentication check box.
- Choose the Authentication Provider.
Depending on the type of authentication provider selected, specify the additional information this user must use when logging into Safeguard for Privileged Passwords with two-factor authentication.
Log in with secondary authentication.
When you log in to Safeguard for Privileged Passwords as a user which requires secondary authentication, you log in as usual, using the password that is set for the Safeguard for Privileged Passwords user account. Safeguard for Privileged Passwords then displays one or more additional login screens. Depending on how the system administrator has configured the secondary authentication provider, you must enter additional credentials for your secondary authentication service provider account, such as a secure password, security token code, or both.
NOTE:The type and configuration of the secondary authentication provider (for example, RSA SecureID, FIDO2, and so on) determines what you must provide for secondary authentication. Check with your system administrator for more information about how to log in to Safeguard for Privileged Passwords with secondary authentication.
Adding a user to user groups
It is the responsibility of the Security Policy Administrator to add users to user groups to assign to password policies.
To add a user to a user group
- Navigate to User Management > Users.
- In Users, select a user from the object list and open the User Groups tab.
- Click Add from the details toolbar.
- Select one or more groups from the list in theUser Groups dialog and click OK.
If you do not see the user group you are looking for and are a Security Policy Administrator, you can click Create New in the User Groups dialog and add the user group. For more information about creating user groups, see Adding a user group.