Local Password Rule
Password rules define the complexity requirements for user authentication to Safeguard for Privileged Passwords. You can create rules governing the type of password a user can create, such as:
- Set the allowable password length in a range from 3 to 225 characters.
- Set first characters type and last character type.
- Allow uppercase letters, lowercase letters, numbers, and/or printable ASCII symbols along with the minimum amounts of each.
- Identify excluded uppercase letters, lowercase letters, numbers, and symbols.
- Identify if consecutive letters, numbers, and/or symbols can be repeated sequentially and, if allowed, set the maximum repetitions allowed.
NOTE: These rules only apply to local users; they do not affect users accessing Safeguard for Privileged Passwords from an external provider such as Microsoft Active Directory. The password rules are listed in the Set password dialog. For more information, see Setting a local user's password.
Modifying user password requirements
It is the responsibility of the Appliance Administrator to configure the user password rules.
To configure user password rules
- Go to password rules:
web client: Navigate to 
Safeguard Access > Local Password Rule.
- Check the current password requirements displayed in the Rule Summary.
-
Set the password rule requirements.
-
Password Length: Set a range for the password allowable length from three to 255 characters. The default is 8 to 64 characters. The maximum length must be equal to or greater than the sum of minimum characters required in the following steps. For example, if the password must have two uppercase letters, two lowercase letters, and two numeric characters, the minimum Password Length must be six. Note that a diacritical letter is one character.
- First Character Type: Choose one of the following:
- All: Alphabetical, numeric, or symbols
- Alphanumeric: Alphabetical or numeric
- Alphabetic: Only alphabetical characters
- Last Character Type: Choose one of the following:
- All: Alphabetical, numeric, or symbols
- Alphanumeric: Alphabetical or numeric
- Alphabetic: Only alphabetical characters
- Repeated Characters: Choose one of the following:
- Allow repeated characters: Any letters, numbers, or symbols can be repeated in any order, including consecutively.
- No consecutive repeated characters: No letter, number, or symbol can be repeated after itself. You can restrict the number of consecutively repeated characters later by uppercase letters, lowercase letters, numbers, symbols, or a combination of those.
- No repeated characters: All letters, numbers, or symbols can only be used once in the password.
-
Allow Uppercase: Select to allow uppercase (capital) letters.
- Require a Minimum of Uppercase Characters: Enter a number to identify the least number of uppercase letters required. To allow but not require uppercase letters, set this value at zero.
- Limit Consecutively Repeated Uppercase Characters: If you allowed repeated characters earlier, select the check box to limit the number of consecutively repeated uppercase letters. You must enter a Maximum Allowed Characters value of one or more.
- Exclude these Uppercase Characters: Enter any uppercase characters you want to exclude from the password. This field is case-sensitive.
- Allow Lowercase: Select to allow lowercase (small) letters.
- Require a Minimum of Lowercase Characters: Enter a number to identify the least number of lowercase letters required. To allow but not require lowercase letters, set this value at zero.
- Limit Consecutively Repeated Lowercase Characters: If you allowed repeated characters earlier, select the check box to limit the number of consecutively repeated lowercase letters. You must enter a Maximum Allowed Characters value of one or more.
- Excluded these Lowercase Characters: Enter any lowercase characters you want to exclude from the password. This field is case sensitive.
-
Limit Consecutively Repeated Alpha Characters: To set the number of repeated lowercase or uppercase letters combined, enter the Maximum Allowed Characters.
For example, if you set the Max Allowed at 2 then you can not have more than two alphabet characters next to each other in the password. Using this example, Ab1Cd2EF is valid but AbC1d2EF is not because it has three alphabet characters in a row.
- Allow Numeric Character (0-9): Select to allow numeric characters in the password.
- Require a Minimum of Numeric Characters: Enter a number to identify the amount of numbers required in a password. To allow but not require numbers, set this value at zero.
- Limit Consecutively Repeated Numeric Characters: Select the check box to limit the number of consecutively repeated numeric characters. You must enter a Maximum Allowed Characters value of one or more.
- Exclude these Numeric Characters: Enter any numeric characters you want to exclude from the password. This field is case sensitive.
-
Allow Symbols (e.g. @ # $ % &): Select this check box to allow characters that are printable ASCII characters. These often include: ~ ` ! @ # $ % ^ & * ( ) _ - + = { } [ ] \ | : ; " ' < > , . ? /
- Require a Minimum of Symbols: Enter a number to identify the least number of symbols required. To allow but not require symbols, set this value at zero.
- Limit Consecutively Repeated Symbols: If you allowed repeated characters earlier, select the check box to limit the number of symbols that can repeat consecutively. You must enter a Maximum Allowed Characters value of one or more.
- Set the following:
- Valid Symbols: Select this option to enter allowable special characters. Enter the allowable symbols in the Symbol List text box.
- Invalid Symbols: Select this option to enter prohibited special characters. Enter the prohibited symbols in the Symbol List text box.
- Click Test Rule to check the rules set.
- When the rules are complete, click Apply.
Identity and Authentication
Safeguard for Privileged Passwords allows you to create various types of identity and authentication providers to integrate with existing directory services. This helps you to effectively manage users and how they will log in to Safeguard. You can create providers for Active Directory, LDAP 2.4, any SAML 2.0 federated service, or Radius.
Go to Identity and Authentication:
- web client: Navigate to Appliance Management > Safeguard Access > Identity and Authentication.
The Identity and Authentication pane displays the following details about the identity and authentication providers defined.
Table 62: Identity and Authentication: Properties
| Name |
The name assigned to the identity or authentication provider. Names are assigned by the administrator that creates the identity or authentication provider. Depending on the provider type, the name may be displayed in a drop-down list on the login page, with exception of Active Directory, External Federation, and any 2FA provider. |
| Type |
Types of identity and authentication providers follow. There are valid primary and secondary authentication combinations. For more information, see Authentication provider combinations.
- Active Directory
- LDAP
- External Federation
- Radius (use as a secondary authentication provider)
- Radius as Primary (use as a primary authentication provider)
- FIDO2
- OneLogin MFA
- SCIM
|
|
Description |
Enter any descriptive information to use for administrative purposes. |
|
Login Provider ID |
A system generated identifier that can be used when integrating with third-party or other custom software or automation scripts. For information on accessing the Safeguard for Privileged Passwords API, see Using the API.
NOTE: When integrating with Safeguard for Privileged Sessions, you can effectively enable Single Sign-On (SSO) between the two applications by creating and using the same SAML2 external federation login provider in both. This Login Provider ID value from Safeguard for Privileged Passwords must then be entered into the Safeguard for Privileged Sessions Script Reference field when creating the matching SAML2 login method. |
Use these toolbar buttons to manage identity and authentication provider configurations.
Table 63: Identity and Authentication: Toolbar
 Add |
Add a identity or authentication provider configuration. For more information, see Adding identity and authentication providers. |
 Remove |
Remove the selected identity or authentication provider. The provider can be deleted if there are no associated users. |
 Edit |
Modify the selected identity or authentication provider. |
|
 Syncronize Now
|
Run the directory addition (incremental) synchronization process for directory users (identity providers) and directory user groups. All changes except for deletions are synced. A Tasks window displays the progress and outcome of the task. You can click  Details to see more information or click  Stop to cancel the task.
The directory deletion and addition (full) synchronization process must be run from the API (IdentityProviders/Synchronize). |
|
 Update Signing Certificates and Metadata
|
For external federation providers that have been configured with a URL pointing to the metadata, you can manually trigger Safeguard for Privileged Passwords to request the metadata from the URL if you know it has changed and don't want to wait for the daily automatic update. This may be necessary in cases where the external STS doesn't support having multiple active signing certificates and you want to minimize any downtime from not being able to log in. |
 Download Safeguard Federation Metadata |
Download a copy of Safeguard for Privileged Passwords's Federation Metadata XML file. You will need this file to create the corresponding trust relationship on your STS server. The federation metadata XML file typically contains a digital signature and cannot be modified in any way, including white space. If you receive an error regarding a problem with the metadata, ensure the file has not been edited. |
 Refresh |
Update the list of identity and authentication providers. |
Authentication provider combinations
Some authentication providers can only be used for primary authentication and others can only support secondary authentication. See the table that follows for details on allowable authentication provider combinations.
It is the responsibility of either the Authorizer Administrator or the User Administrator to configure a user account to use two-factor authentication when logging into Safeguard for Privileged Passwords. For more information, see Requiring secondary authentication log in.
Using Local as the identity provider
Table 64: Allowable local identity provider combinations
|
Local: The specified login name and password will be used for authentication. |
None
OneLogin MFA
Radius
Active Directory
LDAP
FIDO2 |
|
Certificate: The specified certificate thumbprint will be used for authentication. |
None
OneLogin MFA
Radius
Active Directory
LDAP
FIDO2 |
|
External Federation: The specified email address or name claim will be used for authentication. |
None
OneLogin MFA
Radius
Active Directory
LDAP
FIDO2 |
|
Radius: The specified login name will be used for authentication.
NOTE: The Radius server may be configured to integrate with your company's existing identity and authentication solution and may provide its own means of two-factor authentication. |
None
OneLogin MFA
Active Directory
LDAP
FIDO2 |
Using Active Directory as the identity provider
Table 65: Allowable Active Directory identity provider combinations
|
Active Directory: The samAccountName or X509 certificate will be used for authentication.
NOTE: The user must authenticate against the domain from which their account exists. |
None
OneLogin MFA
Radius
LDAP
FIDO2 |
|
External Federation: The specified email address or name claim will be used for authentication. |
None
OneLogin MFA
Radius
Active Directory
LDAP
FIDO2 |
|
Radius: The specified login name will be used for authentication.
NOTE: The Radius server may be configured to integrate with your company's existing identity and authentication solution and may provide its own means of two-factor authentication. |
None
OneLogin MFA
Active Directory
LDAP
FIDO2 |
Using LDAP as the identity provider
Table 66: Allowable LDAP identity provider combinations
|
LDAP: The specified username attribute will be used for authentication. |
None
OneLogin MFA
Radius
Active Directory
FIDO2 |
|
External Federation: The specified email address or name claim will be used for authentication. |
None
OneLogin MFA
Radius
Active Directory
LDAP
FIDO2 |
|
Radius : The specified login name will be used for authentication.
NOTE: The Radius server may be configured to integrate with your company's existing identity and authentication solution and may provide its own means of two-factor authentication. |
None
OneLogin MFA
Active Directory
LDAP
FIDO2 |
Using Starling as the identity provider
Table 67: Allowable Starling identity provider combinations
|
Starling |
None |
Using SCIM as the identity provider
Table 68: Allowable SCIM identity provider combinations
|
Local: The specified username and password will be used for authentication.
NOTE: A Safeguard for Privileged Passwords user administrator must manually set the password for any newly provisioned SCIM users. |
None
OneLogin MFA
Radius
Active Directory
LDAP
FIDO2 |
|
External Federation: The specified email address or name claim will be used for authentication. |
None
OneLogin MFA
Radius
Active Directory
LDAP
FIDO2 |
