To reduce potential downtime, the Appliance Administrator can configure Offline Workflow Mode to be performed automatically. Offline Workflow Mode allows an appliance that has lost consensus (quorum) to operate in isolation from the cluster to process access requests using cached policy data.
To ensure the outage is not a short-lived outage, the default time before the appliance is automatically switched to Offline Workflow Mode is 15 minutes. The time threshold can be changed to five minutes or more.
If automatic Offline Workflow Mode is enabled, you can enable automatic Resume Online Workflow so the appliance automatically resumes online operations once consensus is restored. The minutes to wait after consensus is restored before automatically resuming online workflow defaults to 15 minutes. The time threshold can be changed to five minutes or more.
When Offline Workflow Mode settings are configured to run automatically, an Appliance Administrator can override the automatic settings and manually place an appliance in Offline Workflow Mode or manually restore an appliance to online workflow, as needed.
The user views status messages that clearly communicate the appliance state and the ability to request passwords and SSH keys.
For general information on Offline Workflow Mode, see About Offline Workflow Mode.
Go to Offline Workflow:
web client: Navigate to 
Cluster > Offline Workflow.
The Offline Workflow page displays the following information.
Table 38: Offline Workflow: Properties
|
Enable Automatic Offline Workflow |
To automatically place the appliance in Offline Workflow Mode when the appliance loses connection and cannot establish consensus. |
| Automatic Offline Workflow Threshold Minutes |
The number of minutes after consensus is lost before the appliance is automatically switched over to Offline Workflow Mode. The default is 15 minutes and can be changed to five minutes or more. The threshold set does not persist after a reboot. |
| Automatic Resume Online Workflow |
If you selected Enable Automatic Offline Workflow, you can select Automatic Resume Online Workflow so the appliance automatically resumes online operations once consensus is restored. |
| Automatic Resume Online Workflow Threshold |
The number of minutes after consensus is restored that the appliance is automatically switched over to online workflow. The default is 15 minutes and can be changed to five minutes or more. |
Use these toolbar buttons to define and maintain your managed networks.
Table 39: Offline Workflow: Toolbar
 Refresh |
Updates the information displayed on the page |
 Enable Offline Workflow |
Triggers Offline Workflow Mode |
 Resume Online Operations |
Triggers moving the appliance from Offline Workflow Mode back to online operations |
Use the Offline Workflow page to configure automatic settings to control Offline Workflow Mode. You can manually override the automatic settings. For more information, see Manually override automatic Offline Workflow..
To configure automatic settings to control Offline Workflow Mode
- Go to Offline Workflow:
- web client: Navigate to Cluster > Offline Workflow.
- On the Offline Workflow dialog, select Enable Automatic Offline Workflow so the appliance will be automatically placed in Offline Workflow Mode when the appliance loses connection and cannot establish consensus with the cluster for the specified number of minutes entered (see next step).
- Identify the number of Minutes after consensus is lost before the appliance is automatically switched over to Offline Workflow Mode. The Automatic Offline Workflow Threshold defaults to 15 minutes and can be changed to a minimum of five minutes or more.
- If you selected the first check box to enabled automatic Offline Workflow Mode, you can select Automatic Resume Online Workflow so the appliance automatically resumes online operations once consensus with the cluster is restored for the specified number of minutes entered (see next step).
- Identify the number of Minutes after consensus is restored that the appliance is automatically switched over to online workflow. The Automatic Resume Online Workflow Threshold defaults to 15 minutes and can be changed to a minimum of five minutes or more.
- Click Save.
Use the Offline Workflow page to manually enable offline workflow or resume online operations.
For details on either of these operations, see Manually control Offline Workflow Mode.
Before resuming online operations, see Considerations to resume online operations.
To manually Enable Offline Workflow
This option is only available when the appliance has lost consensus with the cluster.
- Go to Enable Offline Workflow:
- web client: Navigate to Cluster > Offline Workflow.
- Click Enable Offline Workflow to manually trigger Offline Workflow Mode.
- In the dialog box, type in Enable Offline Workflow and click Enter. The appliance is in Offline Workflow Mode and enters maintenance.
- You can verify requests and view health checks on the Cluster Management window. For more information, see Cluster Management..
The Asset Administrator can link a SPS (SPS) cluster to a Safeguard for Privileged Passwords (SPP) cluster of one appliance or more for session recording and auditing. The actual link must be between the Safeguard for Privileged Passwords primary and the SPS cluster master. This means that the SPS cluster is aware of each node in an Safeguard for Privileged Passwords cluster and vice-versa.
Once linked, all sessions are initiated by the Safeguard for Privileged Passwords appliance via an access request and managed by the SPS appliance and sessions are recorded via the Sessions Appliance.
|
|
CAUTION: When linking your One Identity Safeguard for Privileged Sessions (SPS) deployment to your Safeguard for Privileged Passwords (SPP) deployment, ensure that the SPS and SPP versions match exactly, and keep the versions synchronized during an upgrade. For example, you can only link SPS version 6.6 to SPP version 6.6, and if you upgrade SPS to version 6.7, you must also upgrade SPP to 6.7.
Make sure that you do not mix Long Term Supported (LTS) and feature releases. For example, do not link an SPS version 6.0.1 to an SPP version 6.1. |
NOTE: If you have a single node SPS cluster where the Central Management node is also the Search Master, Safeguard for Privileged Passwords will be unable to launch sessions. There has to be at least one SPS appliance in the cluster that is capable of recording sessions. See the One Identity SPS Administration Guide, Managing SPS (SPS) clusters.
Safeguard for Privileged Passwords link guidance
Before initiating the link, review the steps and considerations in the link guidance. For more information, see For more information, see Safeguard for Privileged Passwords and SPS appliance link guidance..
Pay attention to the roles assigned to the SPS nodes. The following caution is offered to avoid losing session playback from Safeguard for Privileged Passwords.
|
|
CAUTION: Do not switch the role of a SPS node from the Search Local role to Search Minion role. If you do, playback of the sessions recorded while in the Search Local role may not be played back from the Safeguard for Privileged Passwords appliance, and may only be played back via the SPS web user interface. Recordings made with the node in Search Minion role are pushed to the Search Master node and are available for download to Safeguard for Privileged Passwords. For details about SPS nodes and roles, see the One Identity SPS Administration Guide: One Identity Safeguard for Privileged Sessions - Technical Documentation. |
If the Safeguard for Privileged Sessions Central Management node is down
Safeguard for Privileged Passwords continues to launch sessions on the managed hosts when the Safeguard for Privileged Sessions Central Management node is down. However, as long as the Central Management node is down, Safeguard for Privileged Passwords cannot validate existing policies nor can it validate the Safeguard for Privileged Sessions cluster topology. For more information, see Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster in the One Identity Safeguard for Privileged Sessions Administration Guide.
Viewing, deleting, or editing link connections
Once the link is complete, in the web client, navigate to go to Cluster > Session Appliances.
The Session Appliances pane displays the following session details.
Table 40: Session Appliances: Properties
|
Host Name |
The host name of the Safeguard for Privileged Sessions appliance host cluster master. |
|
Managed Hosts |
Other nodes in the Safeguard for Privileged Sessions cluster identified by the managed host name and IP address. Hover over any  Warning icon to see if the Managed Host is Unavailable or Unknown. |
|
Network Address |
The network DNS name or IP address of the session connection. |
|
Connection User |
The user name for Safeguard for Privileged Passwords. Do not include spaces in the user name. |
|
Thumbprint |
A unique hash value that identifies the certificate. |
|
Description |
(Optional) Descriptive text about the Safeguard for Privileged Sessions session connection (for example, 20 on cluster - 172 primary node). |
Double-click a Host Name row to bring up the Session Module Connection dialog.
Table 41: Session Module Connection: Properties
|
Node ID |
The name of the Safeguard for Privileged Sessions Appliance used to authenticate the linked SPS session connection. |
|
Host Name |
The host name of the Safeguard for Privileged Sessions appliance host cluster master. |
|
Connection User name |
The user name for Safeguard for Privileged Passwords. Do not include spaces in the user name. |
|
Description |
(Optional) Descriptive text about the Safeguard for Privileged Sessions session connection (for example, 20 on cluster - 172 primary node). |
|
Network Address |
The network DNS name or IP address of the session connection. |
|
Use Host Name For Launch (not IP address) |
If checked, the connection string used to launch a session uses the host name of the Safeguard for Privileged Sessions appliance rather than the IP address. |
Use these toolbar buttons to manage sessions.
Table 42: Sessions Management: Toolbar
|
 Remove
|
Remove the selected linked Safeguard for Privileged Sessions session connection. For details on soft versus hard deletes, see Connection deletion: soft delete versus hard delete. |
 Edit |
Modify the selected linked Safeguard for Privileged Sessions session connection Description or Network Address on the Session Module Connection dialog. |
| Refresh |
Update the list of linked Safeguard for Privileged Sessions session connections. |
