The following describes how to configure a local Credential Store that stores the credentials used to login to the target host.

Prerequisites

NOTE: Users accessing connections that use Credential Stores to authenticate on the target server must authenticate on SPS using gateway authentication or an AA plugin. Therefore gateway authentication or an AA plugin must be configured for these connections.

For more information, see Configuring gateway authentication in the Administration Guide and Integrating external authentication and authorization systems in the Administration Guide.

To configure a local Credential Store that stores the credentials used to login to the target host

  1. Navigate to Policies > Credential Stores.

  2. Click and enter a name for the Credential Store.

  3. Select Local.

  4. Select Encryption key > Built-in. That way the credentials will be encrypted with a built-in password, and the Credential Store is automatically accessible when SPS boots up. To use custom passwords to encrypt the Credential Store, see Configuring password-protected Credential Stores.

    Figure 105: Policies > Credential Stores > Local — Configuring local Credential Stores

  1. Add credentials to the Credential Store.

    1. Click and enter the destination host and the username. For the destination host, you can use hostname, IP address, or subnet as well. To use the same credentials for every destination host, enter the 0.0.0.0/0 subnet. To use the credentials only on the hosts of a specific domain, enter *.domain. Note that:

      • Usernames are case sensitive.

      • To authenticate users of a Windows domain, enter the name of the domain into the Host field.

      Use an IPv4 address.

    2. Set the credentials. SPS will use these credentials to login to the destination host if the credential store is selected in a Connection policy. If more than one credential is specified to a host-username pair, SPS will attempt to use the credentials as the destination host requests it.

      • To add a password, click Passwords > , then enter the password corresponding to the username.

      • To upload a private key, click SSH Keys > >, then paste or upload a private key.

        NOTE: If the private key is protected by a passphrase, enter the passphrase. The passphrase is needed only once during the upload, it is not required for the later operation of the Credential Store.

      • To generate a keypair on SPS click SSH Keys > > , set the length and type of the key, then click Generate. After that, click the fingerprint of the key to download the public part of the keypair. There is no way to download the private key from the SPS web interface.

        NOTE:

        TIP: One Identity recommends using 2048-bit RSA keys (or stronger).

      • To upload a certificate and the corresponding private key, click X509 Keys > > , then paste or upload a certificate and the private key.

        NOTE: If the private key is protected by a passphrase, enter the passphrase. The passphrase is needed only once during the upload, it is not required for the later operation of the Credential Store.

      NOTE: SPS accepts passwords that are not longer than 150 characters and supports the following characters:

      • Letters A-Z, a-z

      • Numbers 0-9

      • The space character

      • Special characters: !"#$%&'()*+,-./:;<>=?@[]\^-`{}_|

    3. Repeat the previous step to add further credentials to the username as necessary.

  2. Repeat the previous step to add further hosts or usernames as necessary.

    NOTE: Credential Stores can be used together with usermapping policies to simplify the administration of users on the target hosts.

    For more information, see Configuring usermapping policies.

  1. Click .

  2. Navigate to the Connection policy where you want to use the Credential Store (for example, to Traffic Controls > SSH > Connections), select the Credential Store to use in the Credential Store field, then click .

    NOTE: The Connection Policy will ignore the settings for server-side authentication (set under Relayed authentication methods) if a Credential Store is used in the Connection Policy.

    Figure 106: Traffic Controls > Protocol name > Connections — Select a Credential Store to use