One Identity Safeguard for Privileged Sessions 6.0 LTS - REST API Reference Guide

• all: Sends notification emails on all backup-related events.
• errors-only: Sends notification emails only on backup-related errors.
• none: Sends no backup-related notification emails.

This is meaningful only if notification_event is set to all.

True if the list of files are included in the notification e-mail.

This is meaningful only if notification_event is set to all and send_filelist is set to True.

The maximum number of files that are included in the notification e-mail.

• rsync: Rsync over SSH
• smb: Copy data to a remote server using SMB/CIFS
• nfs: Copy data to a remote server using NFS

Only if type is set to smb.

The domain name of the target server

Only if type is set to smb.

The SMB protocol to use when SPS connects to the server. Servers are usually backwards compatible with earlier protocol versions (for example, a server that supports version 2.1 supports versions 2.0 and 1.0 as well).

Only if type is set to smb.

The name and directory path of the share in the following format:

share_name/path/to/directory

Only if type is set to smb.

Only if type is set to rsync.

The username used to log on to the remote server

Only if type is set to rsync.

This key will be used to authenticate SPS on the remote server. The public key of this keypair must be imported to the remote server. For details on private keys, see Private keys stored on SPS. For example:

"auth_key": {
  "key": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
  "meta": {
    "href": "/api/configuration/private_keys/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
  }
},

Only if type is set to rsync.

Only if type is set to rsync.

The port number of the SSH server running on the remote machine

• ip: IP address
• fqdn: Hostname

Only if type is set to smb.

• password: To log on using a username and password.
• anonymous: To log on anonymously.

Only if selection is set to password.

The username used to log on to the remote server

Only if type is set to rsync.

When editing this policy, for usability purposes, you can enter the public key of the host in the host_key element without using the selection and value elements. For example:

"host_key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDmIDa1PuJFzgvZvPs9hzgvMd/9WIn4J7RBFuO769g/OgTvCRTgrF8IM/0iN0YzcUM3IGyPnJ1OlLE2Gb6CxVvEcjP6pme7JroAWo039wQHR3Rxl1KoEmC+0EOImQycIdAS7grWNwD2VB2S7iyFErZhqRxhGJPKbR/kF3lQ3dGtt3pr4+R6wnU9lZ7RSETfB+N09FE4f5Nqy+VEShgdc66ElFRXXVilmiTnIMAyim3T7UVNgRdZYIUAZ79tkyTp6I+DZ7k7BG9TYwdBjhwr0eVL56ILxpXylpzWONuMhHxLKsL42NfmeagjVUD1CJVOrfaGjCVGEeS3iQs6GVVxe78n"

When querying, the public key of the host will always be displayed in the selection and value elements.

To apply the Content policy only for users belonging to specific groups, list those groups in the gateway_groups or remote_groups fields. If the gateway_groups or remote_groups field is set, the content policy is applied only to connections of these usergroups.

For example:

"gateway_groups": ["group1", "group2"],

Log the event in the system logs. Possible values: true or false

Immediately terminate the connection. Possible values: true or false

Send an e-mail or SNMP alerts about the event. Possible values: true or false

A list of strings or regular expressions. SPS will perform an action if the match expression is found in the connection, unless it is listed in the ignore list. For example:

"ignore": [
"mmc.exe",
"cmd.exe"
                            
Use Perl Compatible Regular Expressions (PCRE).
The following characters must be escaped using a backslash character: '(single-quote). For example, instead of .*' use .*\'
SPS uses substring search to find the expression in the content. That is, SPS finds the expression even if there is more content before or after the matching part. For example, the conf pattern will match the following texts: conf, configure, reconfigure, arcconf, and so on.
Using complicated regular expressions or using many regular expressions will affect the performance of SPS.
If the multiple expressions are set, SPS processes them one after the other, and stops processing the content if the first match is found, even if other expressions would also match the content. Therefore, when using multiple expressions, start with the most specific one, and add general expressions afterward.

A list of strings or regular expressions. SPS will perform an action if the match expression is found in the connection, unless it is listed in the ignore list. For example:

"match": [
"mmc.exe",
"cmd.exe"
                            
Use Perl Compatible Regular Expressions (PCRE).
The following characters must be escaped using a backslash character: '(single-quote). For example, instead of .*' use .*\'
SPS uses substring search to find the expression in the content. That is, SPS finds the expression even if there is more content before or after the matching part. For example, the conf pattern will match the following texts: conf, configure, reconfigure, arcconf, and so on.
Using complicated regular expressions or using many regular expressions will affect the performance of SPS.
If the multiple expressions are set, SPS processes them one after the other, and stops processing the content if the first match is found, even if other expressions would also match the content. Therefore, when using multiple expressions, start with the most specific one, and add general expressions afterward.

Name of the DN to be used as the base of queries regarding users.

Name of the DN to be used as the base of queries regarding groups.

References the password SPS uses to authenticate on the server. You can configure passwords at the /api/configuration/passwords/ endpoint.

To modify or add a password, use the value of the returned key as the value of the password element, and remove any child elements (including the key).

Set this element to null if you use passwords to authenticate.

Configure this element if you want SPS to generate server-side encryption keys on-the-fly, and store them in a separate attribute on the LDAP server.

Set this element to null if you use passwords to authenticate.

The name of the LDAP attribute that stores the public keys of the users.

Defines the type of encryption SPS uses to communicate with the LDAP server. Possible values are:

• disabled

  The communication is not encrypted.

• ssl

  TLS/SSL encryption. To use a TLS-encrypted with certificate verification to connect to the LDAP server, use the full domain name (for example ldap.example.com) as the server address, otherwise the certificate verification might fail. The name of the LDAP server must appear in the Common Name of the certificate.

  TLS-encrypted connection to Microsoft Active Directory is supported only on Windows 2003 Server and newer platforms. Windows 2000 Server is not supported.

• starttls

  Opportunistic TLS.

Must be used with the selection child element.

Configures the X.509 certificate SPS uses to authenticate on the LDAP server.

Must be used with the client-authentication parent element.

Set to true if the LDAP server requires mutual authentication.

Must be used if the enabled element is set to true.

References the identifier of the X.509 certificate stored on SPS. You can configure X.509 certificates at the /api/configuration/x509/ endpoint.

To modify or add an X.509 host certificate, use the value of the returned key as the value of the x509_identity element, and remove any child elements (including the key).

Defines the type of encryption SPS uses to communicate with the LDAP server. Possible values are:

• disabled

  The communication is not encrypted.

• ssl

  TLS/SSL encryption. To use a TLS-encrypted with certificate verification to connect to the LDAP server, use the full domain name (for example ldap.example.com) as the server address, otherwise the certificate verification might fail. The name of the LDAP server must appear in the Common Name of the certificate.

  TLS-encrypted connection to Microsoft Active Directory is supported only on Windows 2003 Server and newer platforms. Windows 2000 Server is not supported.

• starttls

  Opportunistic TLS.

Must be used with the enabled child element.

Configuration settings for verifying the LDAP server's certificate.

Must be used with the server_certificate_check parent element.

Set to true to verify the LDAP server's certificate using the certificate of a Certificate Authority (CA).

Defines the address type (IP or domain name). Possible values are:

• fqdn

  The LDAP server address is provided as a fully qualified domain name.

• ip

  The LDAP server address is provided as an IP address.

Configures which LDAP schema to use: AD or POSIX. Possible values are:

• ad: Microsoft Active Directory server. For details and examples, see LDAP servers.

• posix: The server uses the POSIX LDAP scheme.

  Must be used with the member_uid_attribute and username_attribute elements. For details and examples, see LDAP servers.

POSIX: Enables POSIX primary and supplementary group membership checking.

AD: Enables Active Directory specific non-primary group membership checking.

Must be used if the selection element is set to ad.

Enable nested groups allows AD nested group support.

Must be used if the value of the selection element is set to posix.

The POSIX group membership attribute name is the name of the attribute in a posixGroup group object, which lists the plain usernames that are members of the group. These groups are usually referred to as supplementary groups of the referred user. Can be null.

The Enable checking for group DNs in user objects setting allows checking a configurable attribute in the user object. This attribute contains a list of group DNs the user is additionally a member of. This user attribute is usually memberOf.

To enable memberof_check, set it to true.

Must be used if the memberof_check is set it to true. The name of the user attribute (for example, memberOf) that contains the group DNs.

Must be used if the selection element is set to posix.

Attribute name of the username (user ID).

Add object_class / attribute pairs. SPS will search for the user DN in the group's attribute defined here. If it finds the user DN there, SPS considers the user the member of that group.

For example:

"user_dn_in_groups": [
    {
        "object_class": "groupOfNames",
        "attribute": "member"
    },
    {
        "object_class": "groupOfUniqueNames",
        "attribute": "uniqueMember"
    }
]

References the identifier of the signing CA's X.509 certificate. You can configure certificates at the /api/configuration/x509/ endpoint.

To modify or add an X.509 certificate, use the value of the returned key as the value of the x509_identity element, and remove any child elements (including the key).