An Authentication and Authorization (AA) plugin must be used in One Identity Safeguard for Privileged Sessions (SPS) connection policies that are intended for use with One Identity Safeguard Remote Access (SRA).
In the SRA use case, the authentication of the end-user is performed on the web when the end-user navigates to remote-access.cloud.oneidentity.com. In SPS terminology, the end-user authentication is called gateway authentication. Gateway authentication is required to be able to audit the end-user. SPS can delegate the gateway authentication to SRA, if a suitable AA plugin is in use.
There are two options:
To configure the AA plugin
-
Navigate to Policies > AA plugin configurations.
-
Create a new configuration item and configure the selected plugin.
The following example is applicable if you downloaded the dummy SPS_AA_skeleton plugin:
Figure 8: SPS_AA_skeleton plugin
Create connection policies for RDP and SSH connections as needed. The connection policies define what is reachable via the One Identity Safeguard for Privileged Sessions appliance and what policies are enforced.
NOTE: When creating RDP connections in SPS, the checkbox for the Act as a Remote Desktop Gateway functionality must be left empty, as SRA does not support the usage of RDP gateways.
Figure 9: RDP Control > Connections > Act as a Remote Desktop Gateway - Disabling the Remote Desktop Gateway functionality
For more information about RDP gateways, see Using One Identity Safeguard for Privileged Sessions (SPS) as a Remote Desktop Gateway in the One Identity Safeguard for Privileged Sessions Administration Guide.
NOTE: When creating SSH connections, the authentication policy must not include gateway authentication.
Figure 10: SSH Control > Authentication Policies > Gateway authentication method - All possible options (Password, Public key, and Kerberos) must be left unchecked
For more information, see Client-side authentication settings in the One Identity Safeguard for Privileged Sessions Administration Guide.
Some parameters have special meaning and requirements regarding One Identity Safeguard Remote Access (SRA).
Name
The name of the connection policy will be displayed on the SRA Connections page. The name appears on the connection tiles if the target of the connection policy is a fixed address. In case of inband target selection, the name is displayed below a horizontal separator line and becomes the name of the group of targets reachable via this connection policy. In the example, linux_servers is the name of the connection policy:
Figure 11: Setting the name and target address of the connection policy
In this example, linux_servers is the group containing one connection towards the 192.168.122.1 target.
Figure 12: Connection groups
From
The From parameter of the connection policy defines the IPv4 or IPv6 networks where the clients may connect from. In case of SRA, the client could be anywhere on the Internet, so to cover all IPv4 clients, fill this field with 0.0.0.0/0.
|
|
CAUTION: To handle clients connecting from internal networks (that is, LAN or VPN) differently, you must add a similar connection policy right above the connection policy for SRA. The To and Port fields must match and the From field should specify the internal network, for example, 10.0.0.0/8 or similar. This is especially useful when introducing a different kind of (gateway) authentication for locally connected clients that bypass SRA. |
To
The To parameter specifies what address the clients make requests to. In the case of SRA, set this also to 0.0.0.0/0 to enable the automated handling of this parameter.
Target
Only the options Use fixed address and Inband destination selection are compatible with SRA. In case of inband destination selection, the connection tiles will display only the target domains that either specify specific IPv4 or IPv6 addresses, or contain a hostname. Subdomains and networks are ignored.
For more information on the HTTPS proxy setting, see the One Identity Safeguard for Privileged Sessions Administration Guide or part of it in Configuring connections in the Appendix.
One Identity Safeguard for Privileged Sessions requires an HTTPS access to One Identity Safeguard Remote Access in the cloud. If the One Identity Safeguard for Privileged Sessions appliance has no direct connectivity to the Internet (for example, it is behind a firewall), you can configure a HTTPS proxy in Basic Settings > Network configuration page.
For more information on the HTTPS proxy setting, see the One Identity Safeguard for Privileged Sessions Administration Guide, or to the relevant part of it in HTTPS proxy section of the Appendix.
