One Identity Safeguard for Privileged Sessions 6.0.2 - Administration Guide

Using UPN usernames in audited SSH connections

When you specify user names in a User Principal Name (UPN) format (e-mail address as username) for an SPS-audited SSH connection, the connection is unsuccessful.

The connection is unsuccessful because SPS uses the '@' character in the username as inband destination selection. If this happens, the username is stripped from the domain part and the UPN suffix is interpreted as inband target. For example, if using test@ema.il as username, the username for the connection will be 'test' and the inband destination is 'ema.il'. SPS interprets the last two '@' characters from the connection string, for example, username@my-inband-target@SPS.

To avoid this, you must use inband destination selection. By specifying the target host explicitly, you can prevent SPS to misinterpret the '@' character from UPN usernames.

• For more information, see the How to use UPN usernames in audited SSH connections Knowledge Base article.
• For more information about inband destination selection, see Using inband destination selection in SSH connections.

Using SPS with SPP

You can join your One Identity Safeguard for Privileged Sessions (SPS) deployment to your One Identity Safeguard for Privileged Passwords (SPP) deployment. That way you can jointly use the features of the two deployments.

Both appliances provide different functionality. You can use them together or independently from each other.

SPP provides:

• Machine and account discovery

• Password rotation and management

• Advanced access request and approval workflows

• A user portal and desktop application to initiate connections

SPS provides:

• Transparent or non-transparent interception of remote admin protocols (SSH, RDP, Telnet, Citrix ICA, and VNC)

• Audit recording and video-like playback of sessions

• Inband authentication of the monitored users independently from the target servers

• Basic access control policy enforcement

• Advanced search and reporting capabilities in the audit records

• Built-in user behavior analytics for the recorded sessions (One Identity Safeguard for Privileged Analytics)

Configuring the Passwords-initiated workflow

Prerequisites

• Minimum versions:

  • SPP version 2.7

  • SPS version 6.0

• You must have built an SPS cluster by promoting an SPS node to the role of the Central Management node, even if it is a single node. For more information, see Building a cluster.

To configure the Passwords-initiated (SPP-initiated) workflow

1. On SPS, join SPP and SPS as described in Joining SPS to SPP.

2. Configure SPP to use the joined SPS as described in Configuring SPP for Passwords-initiated workflow.

3. Optionally, customize monitoring settings as follows:

   • To make use of the more advanced features of SPS, you can change the safeguard_default Connection Policy or create a new Connection Policy and select that in SPP.

   • The critical setting is the AA plugin – make sure you use the same one as what the auto-generated one uses.

Configuring SPP for Passwords-initiated workflow

To configure SPP to use the joined SPS in Passwords-initiated (SPP-initiated) workflows, complete the following steps. For details on the workflow, see Using SPS with SPP.

Prerequisites

• Minimum SPP version 2.7

• You have joined SPP and SPS as described in Joining SPS to SPP.

To configure SPP for Passwords-initiated workflow

1. On SPP, assign the managed networks for sessions management.

   1. Navigate to Administrative Tools > Settings > Cluster > Managed Networks.

   2. Add the network you want to monitor with SPS and choose the SPS appliance for the Sessions Managed By field.

2. Select the SPS for the access request policy.

   1. Navigate to Administrative Tools > Entitlements > Access Request Policies > (create or edit a policy).

   2. On the Session Settings tab of the selected policy, select the SPS Connection Policy. The IP address of the cluster master is displayed first followed by the SPS Connection Policy name (safeguard_default by default).