Tchater maintenant avec le support
Tchattez avec un ingénieur du support

One Identity Safeguard for Privileged Passwords 2.11 - Administration Guide

Introduction System requirements Using the virtual appliance and web management console Using the cloud Setting up Safeguard for Privileged Passwords for the first time Search box Using the web client Installing the desktop client Using the desktop client Privileged access requests Toolbox Accounts Account Groups Assets Asset Groups Discovery Entitlements Partitions Settings
Access Request settings Appliance settings Asset Management settings Backup and Retention settings Certificate settings Cluster settings External Integration settings Messaging settings Profile settings Safeguard Access settings Sessions settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP 2.7 or later migration guidance Appendix C: SPP and SPS join guidance Appendix D: Regular Expressions Appendix E: Historical changes by release Glossary

General tab (add asset)

Use the General tab to specify general information about the asset, including the partition and profile to which the asset is assigned. An asset can only be in one partition at a time. When you add an asset to a partition, all accounts associated with that asset are automatically added to that partition. All assets must be governed by a profile and new assets are automatically governed by the default profile unless otherwise specified.

Table 46: Asset: General properties
Property Description
Name

Enter a unique display name for the asset.

Limit: 100 characters

Required

Description

(Optional) Enter information about this managed system.

Limit: 255 characters

Partition

Browse to select a partition for this asset. You can set a specific partition as the default, see Setting a default partition.

Profile

Browse to select a profile to manage this asset's accounts.

You must assign all assets to a profile. Safeguard for Privileged Passwords assigns all new assets to the default profile unless you specify another. You can set a specific profile as the default. For more information, see Setting a default partition profile.

Click Reset to set the profile to the current default.

The Reset button only becomes active when the asset has been explicitly assigned to the profile. If the asset is only implicitly assigned to the profile, Safeguard for Privileged Passwords does not activate the Reset button. If you do not explicitly assign an asset to a profile, it is always assigned to the current default profile.

Management tab (add asset)

Use the Administrative Tools | Assets | Management tab to add the network address, operating system or directory service, and version information for an asset.

When you create a directory asset, accounts created display as discovered accounts in the Discovered Accounts properties grid. For more information, see Discovered Accounts.

The settings for an asset are shown below.

Table 47: Asset: Management tab properties (for example, Windows, Linux, OpenLDAP, or Active Directory)
Property Description
Product

Select an operating system or directory service, for this asset.

A custom platform can be selected. For more information, see Custom platforms.

NOTE: Safeguard for Privileged Passwords allows you to select a generic operating system of Other, Other Managed, or Other Linux. This allows you to add an asset to Safeguard for Privileged Passwords without designating a specific platform.

  • Other: An asset with an Other operating system cannot be managed. You can manually change passwords on accounts associated with an asset with an Other operating system. Safeguard for Privileged Passwords cannot connect to the asset so there is no automatic password check and change, test connection, or other activity requiring a connection.
  • Other Managed: Safeguard for Privileged Passwords stores the password and can automatically check and change it per the profile configuration. There is no active connection or service account. The passwords are rotated internally and event notifications are sent when the rotation is complete. Another component or piece of automation can change the password or make use of the password in configuration files. For example, a listener can pick up the change event via the Safeguard for Privileged Passwords Application to Application (A2A) service and perform actions, as required.
  • Other Linux: Safeguard for Privileged Passwords manages an asset with "Other Linux" on a best effort basis.

Other platform details: Any Other platform type can be changed to different platform type. Conversely, any platform type can be changed to Other, however, any property values specific to the current platform type will be lost. For example, you may want to change an Other Linux operating system to any type of Linux, such as AIX, HP-UX, or Solaris. Then, the specific platform type can be changed back to Other, if needed. For more information, see Modifying an asset.

Version

If applicable, select the operating system version. When adding a Linux or Macintosh OS X system, Safeguard for Privileged Passwords allows you to choose an Other version.

NOTE: Safeguard for Privileged Passwords does not manage passwords for accounts on domain controllers. Manage accounts on domain controllers through the directory asset that hosts the domain controller. For more information, see Adding an account to an asset.

Architecture

If applicable, the product's system architecture.

Network Address

If applicable, enter a network DNS name or the IP address used to connect to the managed system over the network.

For Amazon Web Services assets, enter the Amazon AWS Account ID or Alias.

Domain Name (directory)

The domain for the asset (Name on the General tab). A domain can be identified for more than one directory asset so that multiple directory assets can be governed the same domain.

Manage Forest (directory)

Select if you want to manage the whole forest. Do not select if you want to manage just one domain.

Available for discovery across all partitions

If applicable, select to make this asset read-access available for Asset Discovery jobs beyond partition boundaries. Any partition that exists is able to use this directory asset. Other partition owners do not have read password access. If not selected, partition owners and other partitions will not know the directory asset exists.

In setting up the Asset Discovery job, use the Directory asset discovery Method so that directory assets that are shared can be discovered into any partition. For more information, see General tab (asset discovery).

Enable Session Request

If applicable, this check box is selected by default, indicating that authorized users can request session access for this asset.

Clear this check box if you do not want to allow session requests for this asset. If an asset is disabled for sessions and an account on the asset is enabled for sessions, sessions are not available because the asset does not allow sessions.

Advanced

 

Managed Network

The managed network that is assigned for work load balancing. For more information, see Managed networks.

RDP Session Port

If applicable, specify the access port on the target server to be used for RDP session requests.

Default: Port 3389

SSH Session Port

If applicable, specify the access port on the target server to be used for SSH session requests.

Default: Port 22

Telnet Session Port

If connecting to TN3270 or TN5250, the port for connection. By default, a telnet server typically listens on port 23.

Sync additions every [number] minutes

For directory assets, enter or select how often you want Safeguard for Privileged Passwords to synchronize additions (in minutes). This updates Safeguard for Privileged Passwords with any additions, or modifications that have been made to the objects, including group membership and user account attributes mapped to Safeguard for Privileged Passwords.

Default: 15 minutes

Range: Between 1 and 2147483647

Directory Sync is enabled by default and can be disabled. For more information, see Enable or Disable Services (Access and management services).

Sync deletions every [number] minutes

For directory assets, enter or select how often you want Safeguard for Privileged Passwords to synchronize deletions (in minutes).

This updates Safeguard for Privileged Passwords with any deletions that have been made to the objects, including group membership and user account attributes mapped to Safeguard for Privileged Passwords.

Default: 15 minutes

Range: Between 1 and 2147483647

Directory Sync is enabled by default and can be disabled. For more information, see Enable or Disable Services (Access and management services).

Account Discovery tab (add asset)

The Account Discovery tab is only available after Active Directory Asset has been created. On the Account Discovery tab, the default is Do not perform account discovery.

Table 48: Account Discovery tab properties
Property Description
Description

Select the description of the Account Discovery job desired and the details of the configuration display.

Click Add to add a job or Edit to edit the job. You can click the drop-down and select Do not perform account discovery.

Partition The partition in which to manage the discovered assets or accounts.
Discovery Type The type platform, for example, Windows, Unix, or Directory.

Directory

The directory for account discovery.

Schedule

Click Schedule to control the job schedule.

Select Run Every to run the job along per the run details you enter. (If you clear Run Every, the schedule details are lost.)

  • Configure the following.

    To specify the frequency without start and end times, select from the following controls. If you want to specify start and end times, go to the Use Time Window selection in this section.

    • Minutes: The job runs per the frequency of minutes you specify. For example, Every 30 Minutes runs the job every half hour over a 24-hour period. It is recommended you do not use the frequency of minutes except in unusual situations, such as testing.

    • Hours: The job runs per the minute setting you specify. For example, if it is 9 a.m. and you want to run the job every two hours at 15 minutes past the hour starting at 9:15 a.m., select Runs Every 2 Hours @ 15 minutes after the hour.

    • Days: The job runs on the frequency of days and the time you enter.

      For example, Every 2 Days Starting @ 11:59:00 PM runs the job every other evening just before midnight.

    • Weeks The job runs per the frequency of weeks at the time and on the days you specify.

      For example, Every 2 Weeks Starting @ 5:00:00 AM and Repeat on these days with MON, WED, FRI selected runs the job every other week at 5 a.m. on Monday, Wednesday, and Friday.

    • Months: The job runs on the frequency of months at the time and on the day you specify.

      For example, If you select Every 2 Months Starting @ 1:00:00 AM along with First Saturday of the month, the job will run at 1 a.m. on the first Saturday of every other month.

  • Select Use Time Windows if you want to enter the Start and End time. You can click add or - delete to control multiple time restrictions. Each time window must be at least one minute apart and not overlap.

    For example, for a job to run every ten minutes every day from 10 p.m. to 2 a.m., enter these values:

    Enter Every 10 Minutes and Use Time Windows:

    • Start 10:00:00 PM and End 11:59:00 AM

    • Start 12:00:00 AM and End 2:00:00 AM

      An entry of Start 10:00:00 PM and End 2:00:00 AM will result in an error that the end time must be after the start time.

    If you have selected Days, Weeks, or Months, you will be able to select the number of times for the job to Repeat in the time window you enter.

    For a job to run two times every other day at 10:30 am between the hours of 4 a.m. and 8 p.m., enter these values:

    For days, enter Every 2 Days and set the Use Time Windows as Start 4:00:00 AM and End 20:00:00 PM and Repeat 2.

  • Time Zone: Select the time zone.
Rules

You may click Add, Delete, Edit, or Copy to update the Rules grid.

Details about the selected account discovery setting rules may include the following based on the type of asset.

  • Name: Name of the discovery job
  • Rule Type: What the search is based on. For example, the rule may be Name based or Property Constraint based if the search is based on account properties. For more information, see Adding an Account Discovery rule.
  • Filter Search Location: If a directory is searched, this is the container within the directory that was searched.
  • Auto Manage: A check mark displays if discovered accounts are automatically added to Safeguard for Privileged Passwords.
  • Set default password: A check mark displays if the rule causes default passwords to be set automatically.
  • Assign to Profile: The partition profile assigned
  • Assign to Sync Group: A check mark displays if the rule automatically associated the accounts with a password sync group.
  • Enable Password Request: A check mark displays if the passwords is available for release.
  • Enable Session Request: A check mark displays if session access is enabled.

Connection tab (add asset)

On the Connection tab, choose an Authentication Type (see the table that follows) and specify the service account credentials. The type of asset specified in the Product field on the Management tab determines the authentication types available for the asset. If the asset has a custom platform, the Custom Properties elements are displayed. For more information, see Custom platforms.

Table 49: Connection tab: Asset authentication types
Authentication Type Description
SSH Key To authenticate to the asset using an SSH authentication key.
Directory Account

To authenticate to the asset using a directory account from an external identity store such as Microsoft Active Directory.

NOTE: In order to use this authentication type, you must first add a directory asset and add domain user accounts. For more information, see Accounts.
Local System Account

For SQL Server assets, to authenticate to the asset using a local system account, which is a Windows user account on the server that is hosting the SQL database.

Password (local service account)

To authenticate to the asset using a local service account and password.

Account Password

When the function account credentials are not in the custom script, for example, Amazon Web Services. For more information, see Adding a cloud platform account.

Access Key

For Amazon Web Services assets, to authenticate to the asset using an access key. For more information, see Adding a cloud platform account.

Custom

No authentication information is taken because the custom parameters or parameters in a customer platform script are used. No accounts associated with the asset are stored. For more information, see Custom platforms.

None

No authentication information is taken and check/change functions are disabled. No accounts associated with the asset are stored.

Test Connection

Verify that Safeguard can log in to the asset using the service account credentials that you have provided.

Timeout

Enter the connection timeout period.

Client ID: For SAP assets, enter the client ID.

Custom platform properties

If the Product field on the Management tab identified a custom platform, complete the dialog based on the custom properties of the custom platform script. Safeguard for Privileged Passwords checks to ensure the values match the type of the property that include a string, boolean, integer, or password (which is called secret in the API scripts). Safeguard for Privileged Passwords cannot check the validity or system impact of values entered for custom platforms. For more information, see Creating a custom platform script.

Documents connexes