지금 지원 담당자와 채팅
지원 담당자와 채팅

Safeguard Authentication Services 5.0.5 - Administration Guide

Privileged Access Suite for Unix Introducing One Identity Safeguard Authentication Services Unix administration and configuration Identity management Migrating from NIS Managing access control Managing local file permissions Certificate Autoenrollment Integrating with other applications Managing Unix hosts with Group Policy
Safeguard Authentication Services Group Policy
Group Policy Concepts Unix policies One Identity policies
Display specifiers Troubleshooting Glossary

Server-side extensions

Server-side extensions are software packages that extend the functionality of existing Microsoft Group Policy management tools. Group Policy provides one extension for the Group Policy Object Editor (GPOE):

  • Namespace extensions

    Group Policy extends the namespace of the Group Policy Object Editor: that is, Group Policy adds several Unix-specific nodes to the scope and resultant views of the Group Policy Object Editor.

vgptool

The vgptool command-line utility provides the same functionality as winlogon.exe. vgptool collects policy information by querying Active Directory for the SYSVOL path of GPOs, based on the location of the Unix host object in Active Directory. Once it collects the policy information, vgptool follows the same rules and standards of Group Policy application as Microsoft Group Policy, including enforced links, block inheritance, non-tattooing of policy settings, enabled or disabled links, link order, ACL filtering, and enabled/disabled GPOs. Safeguard Authentication Services also supports loopback policy processing.

Like gpupdate.exe, vgptool invokes client-side extension plug-ins to apply policy settings. You can register new client-side extensions with vgptool Refer to the vgptool man page for details. vgptool runs only when invoked from the Unix command line or when it is run by the Safeguard Authentication Services service as part of a policy refresh event.

Client-side extensions

Group Policy processes the policy settings information in GPOs by delegating to client-side extensions (CSEs). The /opt/quest/lib/cse_mod directory stores the client-side extensions to the Group Policy framework. Several default CSEs come ready to process GPOs immediately after installing Group Policy. Group Policy provides the following CSEs:
  • Licensing Extension

    Provides support for licensing policies.

  • Safeguard Authentication Services Configuration Extension

    Provides support for the Safeguard Authentication Services-related policies.

  • Microsoft Security Extension

    Provides support for some Windows security settings.

  • Macintosh Settings Extension

    Provides support for macOS management settings.

  • Sudo Extension

    Provides support for sudo policy option.

  • Dynamic File Copy Extension

    Provides support for dynamic file copy.

  • Unix Settings Extension

    Provides support for the Unix file and script policies.

  • SSH Extension

    Provides support for OpenSSH.

  • Samba Extension

    Provides support for Samba.

  • One Identity Defender Extension

    Provides support for One Identity Defender policies.

  • One Identity Privilege Manager for Unix

    Provides support for One Identity Privilege Manager for Unix policies.

  • Administrative Templates Extension

    Provides support for Administrative Templates.

  • Group Policy Extension

    Provides support for the Group Policy-related policies.

Administrative templates on Unix

In Windows-only environments, administrators extend Group Policy through Administrative Templates. Administrative Templates provide policy description information as well as information used to build a graphical user interface to manage those policies. Group Policy stores this information in human-readable text-file format with an ADM extension.

Once you load the Administrative Templates into the Group Policy Object Editor (GPOE), the GPOE namespace is extended with new Unix-specific nodes.

On Unix, ADM policies are supported using Perl scripts that translate Windowsregistry.pol files into Unix configuration file settings. Group Policy refers to the translator scripts as xlators.

You can write custom xlator scripts in any language.

관련 문서

The document was helpful.

평가 결과 선택

I easily found the information I needed.

평가 결과 선택