One Identity Safeguard for Privileged Passwords 8.0 LTS - Administration Guide

Use the General tab to add the required service account information. The following table lists the properties and designates the properties for Active Directory and LDAP.

Attributes tab

On the Attributes tab, synchronize the attributes in Safeguard for Privileged Passwords to the directory schema attributes. The Attributes tab displays the default directory attributes that are mapped to the Safeguard for Privileged Passwords properties, such as the user's first name.

There are multiple valid schema mappings supported and you can modify its configuration, as needed. For example, the LDAP dialog, Attributes tab may display the Username as the cn <Display Name> or the uid <Username> based on your directory configuration.

The following table list the default directory attributes.

One Identity Safeguard for Privileged Passwords supports the SAML 2.0 Web Browser SSO Profile, allowing you to configure federated authentication with many different STS servers and services, such as Microsoft's AD FS. Through the exchange of the federation metadata, you can create a trust relationship between the two systems. Then, you will create a Safeguard for Privileged Passwords user to be associated with the federated user. When an end user logs in, they will be redirected to the external STS to enter their credentials and perform any two-factor authentication that may be required by that STS. After successful authentication, they will be redirected back to Safeguard for Privileged Passwords and logged in.

To use external federation, you must first download a copy of, or have the URL to the federation metadata XML of your STS. For example, in Microsoft AD FS, you can download the federation metadata XML from: https://<adfs server>/FederationMetadata/2007-06/FederationMetadata.xml. Or if the Safeguard for Privileged Passwords appliance can directly access that URL, it can be used as well when creating the provider.

To add external federation:

1. In the External Federation dialog, supply the following information:

   1. Name: The unique name assigned to the external federation service provider. The name is for administrative purposes only and will not be seen by the end users.

   2. Description: Enter any text. The text is seen only here and used for administrative purposes.

   3. Realm: Enter a unique realm value, typically a DNS suffix, like contoso.com, that matches the email addresses of users intended to use this STS for authentication. Values can be separated by a space, comma, or semi-colon. A case-insensitive comparison will be used on the value(s) when performing Home Realm Discovery.

   4. Federation Metadata: Select one of the following options:

      1. From File: When using this option, Safeguard for Privileged Passwords stores a static copy of the metadata. It is the responsibility of the administrators to update the metadata, when necessary, by repeating this process. For example, when the signing certificate used by the STS changes.

         You must first download the federation metadata XML for your STS and save it to a file locally. For example, for Microsoft's AD FS, you can download the federation metadata XML from: https://<adfs server>/FederationMetadata/2007-06/FederationMetadata.xml.

         Click Browse to select the STS federation metadata xml file.

      2. From URL: When using this option, Safeguard for Privileged Passwords will automatically download the STS metadata and refresh it on a periodic basis, so it should always have the current signing certificates and other information used by the STS.

         Specify the complete HTTPS URL to the STS metadata. The SSL/TLS certificate used by the HTTPS URL must be trusted on every node of the Safeguard for Privileged Passwords cluster, and each node of the cluster will need network/internet access to be able to download from the specified HTTPS URL. It is strongly recommended to verify that you can successfully log in on each node of the cluster after initially creating the Identity Provider.

         After the external federation provider is created, you can manually trigger Safeguard for Privileged Passwords to update the metadata from the configured URL by clicking the Update Metadata button. This may be useful to help minimize any downtime when you know that the STS metadata has changed.

         NOTE: A proxy server may be configured. For more information, see Networking.

   5. Application ID Override: If needed, override the Issuer name value that is sent in a SAML2 AuthnRequest to match the ID of the relying party application defined in the IdP.

      For example, when creating an App registration in Microsoft's Azure AD, you would copy the Application ID URI value into this field.

   6. Login Provider ID: A system generated identifier that can be used when integrating with third-party or other custom software or automation scripts. For information on accessing the Safeguard for Privileged Passwords API, see Using the API.

      NOTE: When integrating with SPS, you can effectively enable Single Sign-On (SSO) between the two applications by creating and using the same SAML2 external federation login provider in both. This Login Provider ID value from Safeguard for Privileged Passwords must then be entered into the Safeguard for Privileged Sessions Script Reference field when creating the matching SAML2 login method.

   7. When the Require User to Always Authenticate check box is selected, the user will always be required to enter their credentials on the external provider, regardless of whether they are already logged in. This may be seen as negating one of the features of Single Sign-On, and therefore can be turned off. Or it may be considered a more secure option and turned on.

2. Click Download Safeguard for Privileged Passwords Metadata File: You will need this file to create the corresponding trust relationship on your STS server. The federation metadata XML file typically contains a digital signature and cannot be modified in any way, including white space. If you receive an error regarding a problem with the metadata, ensure the file has not been edited. Also see: How do I create a relying party trust for the STS.

Create and configure a Radius server for use as either a primary authentication provider or secondary authentication provider. To use a Radius server for both primary and secondary authentication, you will need to create two authentication providers. The steps to create Radius as a primary provider or secondary provider follow:

1. In the Radius dialog, supply the following information:

   1. Name: The unique display name. When creating the Radius provider for primary authentication, this name value will be displayed in the drop-down list on the login page.

   2. Description: Enter any text. The text is seen only here and used for administrative purposes.

   3. Type: Choose As Primary Authentication or As Secondary Authentication.

   4. Server Address: Enter a network DNS name or the IP address used to connect to the server over the network.
   5. Secondary Server Address: (Optional) Enter a network DNS name or the IP address for an additional or redundant server.
   6. Shared Secret: Enter the server's secret key. Click to show the server's secret key.
   7. Port: Enter the port number that the Radius server uses to listen for authentication requests. The default is port 1812.
   8. Timeout: Specify how long to wait before a Radius authentication request times out. The default is 20 seconds.

   9. PreAuthenticate for Challenge/Response: If selected, an Access-Request call containing only the User-Name is sent to the Radius server prior to the user's authentication attempt. This is done to inform the Radius server of the user's identity so it can possibly begin the authentication process by starting a challenge/response cycle. This may be required to seed the user's state data. In addition, the Radius server's response may include a login message that is to be displayed, which is specific to that user.

      If the Radius server is not configured to respond with an Access-Challenge, then this will cause the log in to fail and the user will be unable to proceed. This setting is only applicable when using Radius as a secondary authentication provider. The setting has no effect if enabled on a primary authentication provider.

   10. Always Mask User Input: If selected, the text box that the user enters their one-time password, or other challenge required by the Radius server, will always be a password style text box in which the user's input is masked and appears as a series of dots, not as clear text. This may be desired when the challenge is not only a one-time password, but also contains the user's PIN. This will prevent any passer-by from seeing the private information. Note, however, that when this setting is enabled, it will also override the Prompt attribute of the Radius server's Access-Challenge response, such that the user's input will always be masked.

2. Click OK.

Create and configure FIDO2 for use as a secondary authentication provider.

1. In the FIDO2 dialog, provide the following settings:
   1. Name: The unique name assigned to the provider. The name is for administrative purposes only and will not be seen by the end users.

   2. Domain Suffix: This must be a DNS name that identifies the appliance. Typically, this will be the DNS name used to access Safeguard. It cannot be an IP address. The value is a a domain string identifying the WebAuthn Relying Party for which the registration or authentication ceremony is performed.

      A public key credential can only be used for authentication with the same entity (identified by this value) it was registered with. However, this value can be a registerable domain suffix of what appears in the user’s browser when registering. For example, you could enter contoso.com to register against a server at https://www.contoso.com or https://node1.contoso.com. Later, you can use the same authenticator security key to authenticate at either of the locations.

   3. Description: Enter any text. The text is seen only here and used for administrative purposes.
2. Click OK.

Create and configure OneLogin MFA as a secondary authentication provider.

1. In the OneLogin MFA dialog, provide the following settings:

   1. Name: The unique name assigned to the provider. The name is for administrative purposes only and will not be seen by the end users (up to 50 characters).

   2. Description: Enter any text. The text is seen only here and used for administrative purposes (up to 255 characters).

   3. DNS Host Name: Enter the complete OneLogin DNS host name of your subscription; for example, <subdomain>.onelogin.com.

   4. Client ID: Enter the API Client ID created in OneLogin. Safeguard for Privileged Passwords requires that the Manage users permission is used for the API credentials created in OneLogin. For more information, see Working with API Credentials.

   5. Client Secret: Enter the API Client Secret created in OneLogin. Safeguard for Privileged Passwords requires that the Manage users permission is used for the API credentials created in OneLogin. For more information, see Working with API Credentials.

2. Click OK.

Create and configure System for Cross-Domain Identity Management (SCIM) provisioning via Azure Active Directory or OneLogin.

1. In the SCIM dialog, provide the following settings:

   1. Name: The unique name assigned to the provider. The name is for administrative purposes only and will not be seen by the end users.

   2. Description: Enter any text. The text is seen only here and used for administrative purposes.

2. Click OK to save the information.

3. On the Identity and Authentication pane, select the name of the newly created SCIM provider and click .

4. Use the General tab to provide the following information:

   Table 69: SCIM: General tab

   Setting	Description
   Name	The unique name assigned to the provider. The name is for administrative purposes only and will not be seen by the end users.
   Description	Enter any text. The text is seen only here and used for administrative purposes.
   Tenant URL	This is the URL for the tenant that you specified in Azure Active Directory. Use the button to copy the URL.
   Application Token	This is the token required to connect with Azure Active Directory and will needed to be added to you SCIM provisioning configuration in Azure Active Directory. Use the Generate New Token button to populate this field and provide a button to copy the token. The token text for a previously generated token is unavailable for both viewing and copying once you save the configuration.
   Application Token Set	This is the date (month, day, year) that the token was last generated.
   Generate New Token	Click this button to generate a new token. Once generated, the token text will appear in the Application Token field.

5. Use the Authentication tab to provide the following information:

   Table 70: SCIM: Authentication tab

   Setting	Description
   Default Primary Authentication Provider	(Optional) Select a primary authentication provider.
   Default Secondary Authentication Provider	(Optional) Select a secondary authentication provider.

6. On the Permissions tab, select any of the administrative permissions and/or the Personal Password Vault permission to be assigned to each member of the SCIM User Group. For each group member, the selected permissions of the group will be combined with any existing permissions that have already been granted explicitly or by some other Group to which they belong. For more information, see the Permissions tab (add user).

   During synchronization of a SCIM User Group, a user may be identified as no longer being a member. In this case, the selected permissions of the SCIM User Group are removed from the user unless the user is also a member of another Group from which they inherit the permission. Safeguard for Privileged Passwords does not keep track of nor distinguish between an explicitly assigned permission versus one that was assigned via a Group.

7. IMPORTANT: The Personal Password Vault permission, like any other permission, can be set explicitly on a user or inherited from a Group. If a user with the Personal Password Vault permission stores one or more personal passwords and then later has the permission revoked, either explicitly or by having been removed from all Groups from which they inherited it, the user will no longer be able to access Personal Password Vault features. But the user’s data within the vault will still be maintained. If at any point the user is granted the Personal Password Vault permission again, they regain access to all of their existing data.

8. Click OK.