Appendix: SPP and Safeguard for Privileged Sessions appliance link guidance

The Asset Administrator can link a Safeguard for Privileged Sessions (SPS) cluster to a SPP (SPP) cluster of one appliance or more for session recording and auditing. The actual link must be between the SPP primary and the Safeguard for Privileged Sessions cluster master. This means that the Safeguard for Privileged Sessions cluster is aware of each node in an SPP cluster and vice-versa.

Once linked, all sessions are initiated by the SPP appliance via an access request and managed by the Safeguard for Privileged Sessions appliance and sessions are recorded via the Sessions Appliance.

CAUTION: When linking your Safeguard for Privileged Sessions (SPS) deployment to your SPP (SPP) deployment, ensure that the SPS and SPP versions match exactly, and keep the versions synchronized during an upgrade. For example, you can only link SPS version 6.6 to SPP version 6.6, and if you upgrade SPS to version 6.7, you must also upgrade SPP to 6.7.

Make sure that you do not mix Long Term Supported (LTS) and feature releases. For example, do not link an SPS version 6.0.1 to an SPP version 6.1.

NOTE: If you have a single node Safeguard for Privileged Sessions cluster where the Central Management node is also the Search Master, SPP will be unable to launch sessions. There has to be at least one Safeguard for Privileged Sessions appliance in the cluster that is capable of recording sessions. See the One Identity Safeguard for Privileged Sessions Administration Guide, Managing Safeguard for Privileged Sessions (SPS) clusters.

Additional overview information can be found in the One Identity Safeguard for Privileged Sessions Administration Guide, Using SPS with SPP.

NOTE: Configuration options and details related to Safeguard for Privileged Sessions will only be visible to customers that have purchased and joined the product to One Identity Safeguard for Privileged Passwords.

Session recording, playback, and storage after the link
  • Sessions recorded after the link are playable through SPP and are stored on the Safeguard for Privileged Sessions appliance. An archive server can be set up through Safeguard for Privileged Sessions.
Functionality after the link

The following functionality handled in SPP's user interface is available in Safeguard for Privileged Sessions after the link.

  • Session certificate assignment is handled by Safeguard for Privileged Sessions. The certificate is available for audit by the Auditor.
  • The primary provider names must match for a Safeguard for Privileged Sessions initiated RDP connection with SPP. See KB article 311852.

The following functionality is available in SPP after the link.

  • During the link, SPP sets the SPS Connection Policy to safeguard_default for SSH or safeguard_rdp for RDP, as appropriate and may need to be changed. This default is nothing more than SSH or RDP connection policy.
  • Other configuration set via the Access Request Policies dialog, are not affected by the link. These include: General, Scope, Security, and Workflow tabs.
  • The Activity Center shows all old sessions and new sessions per the configuration. You can play back a session from SPP. Starting with session player 1.9.4, sessions can be played in SPP with full indexing (which makes the privileged users' activity searchable). However, if you are using an earlier version of the sessions player then indexing is only available in Safeguard for Privileged Sessions.
  • Entitlement reports have not changed.
  • On the Dashboard, administrators can still view and manage access requests and accounts failing tasks as usual.
  • When integrating with Safeguard for Privileged Sessions, you can effectively enable Single Sign-On (SSO) between the two applications by creating and using the same SAML2 external federation login provider in both. The Login Provider ID value from SPP (for more information, see Identity and Authentication) must then be entered into the Safeguard for Privileged Sessions Script Reference field when creating the matching SAML2 login method.
Step 1: Link Safeguard for Privileged Sessions and SPP

The link is initiated from Safeguard for Privileged Sessions. For details about the link steps and issue resolution, see the One Identity Safeguard for Privileged Sessions Administration Guide.

NOTE: SPP can target a specific Safeguard for Privileged Sessions appliance or network interface by IP address. This is done by configuring the Safeguard for Privileged Sessions connection policy to specify an explicit TO address (for example, CIDR notation /32). When that connection policy is selected as the Safeguard for Privileged Sessions connection policy for the access policy, SPP will construct a connection string that targets that specific IP address.

Pay attention to the roles assigned to the Safeguard for Privileged Sessions nodes. The following caution is offered to avoid losing session playback from SPP.

CAUTION: Do not switch the role of a Safeguard for Privileged Sessions node from the Search Local role to Search Minion role. If you do, playback of the sessions recorded while in the Search Local role may not be played back from the SPP appliance, and may only be played back via the Safeguard for Privileged Sessions web user interface. Recordings made with the node in Search Minion role are pushed to the Search Master node and are available for download to SPP. For details about Safeguard for Privileged Sessions nodes and roles, see the One Identity Safeguard for Privileged Sessions Administration Guide: One Identity Safeguard for Privileged Sessions - Technical Documentation.

Step 2: Perform post link activities in SPP and Safeguard for Privileged Sessions

Steps to perform in SPP

  1. The Appliance Administrator assigns the managed networks for sessions management.

    Navigate to Appliance > Cluster > Managed Networks. For more information, see Managed Networks..

  2. The Appliance Administrator can view, delete, or edit link connections, as needed.

    Go to Appliance > Cluster > Session Appliances. For more information, see Session Appliances with Safeguard for Privileged Sessions link..

    If you soft delete a session connection, then reconnect, the access policies remain available. If you hard delete, the Security Policy Administrator will need to relink and reestablish the Safeguard for Privileged Sessions Connection Policy. For more information, see Connection deletion: soft delete versus hard delete.

  3. The Security Policy Administrator identifies the session settings on the entitlements access request policy.

    Perform the following steps to ensure each policy's session setting is correctly assigned.

    1. Navigate to Security Policy Management > Entitlements, select an entitlement, and open Access Request Policies.
    2. Double-click a policy, or select a policy and click Edit Access Policy.

    3. On the Security tab, go to the SPS Connection Policy. The host name of the cluster master is displayed first followed by the IP address: safeguard_default.

    4. If needed, select the cluster or appliance to which the policy applies.

      For more information, see Session Settings tab on page 1.

  4. While on the Access Request Policies dialog, the Security Policy Administrator checks any other tab, as needed. The link does not affect the settings on the tabs including the General, Scope, Security, and Workflow tabs.

Steps to perform in Safeguard for Privileged Sessions

Complete any set up in Safeguard for Privileged Sessions required (such as setting up an archive server, the SSH banner, the SSH host key, as well as SSH-related or RDP-related command detection and controls). For details, see the One Identity Safeguard for Privileged Sessions Administration Guide: One Identity Safeguard for Privileged Sessions - Technical Documentation.

Standard operating procedure after the initial link

If you add another Safeguard for Privileged Sessions (SPS) cluster after the initial link, follow these standard operating procedures:

  1. Add link connections. For more information, see Session Appliances with Safeguard for Privileged Sessions link..
  2. Identify the session settings on the entitlements access request policy (SPS Connection Policy that is the IP address of the cluster master). For more information, see Creating an access request policy.
  3. Assign the managed networks. For more information, see Managed Networks.