The Asset Administrator can join a Safeguard for Privileged Sessions (SPS) cluster to a Safeguard for Privileged Password (SPP) cluster of one appliance or more for session recording and auditing. The actual join must be between the SPP primary and the SPS cluster master. This means that the Safeguard for Privileged Sessions (SPS) cluster is aware of each node in an SPP cluster and vice-versa.

Once joined, all sessions are initiated by the SPP appliance via an access request and managed by the SPS appliance and sessions are recorded via the Sessions Appliance.

Safeguard for Privileged Passwords join guidance

Before initiating the join, review the steps and considerations in the join guidance. For more information, see SPP and SPS sessions appliance join guidance.

Pay attention to the roles assigned to the SPS nodes. The following caution is offered to avoid losing session playback from SPP.

CAUTION: Do not switch the role of an SPS node from the Search Local role to Search Minion role. If you do, playback of the sessions recorded while in the Search Local role may not be played back from the SPP appliance, and may only be played back via the SPS web user interface. Recordings made with the node in Search Minion role are pushed to the Search Master node and are available for download to SPP. For details about SPS nodes and roles, see the One Identity Safeguard for Privileged Sessions Administration Guide: One Identity Safeguard for Privileged Sessions - Technical Documentation.

Standard operating procedure after the initial join

If you add another SPS cluster after the initial join, follow these standard operating procedures:

1. Add join connections. See Viewing, deleting, or editing join connections later in this topic.

2. Identify the session settings on the entitlements access request policy (SPS Connection Policy which is the IP address of the cluster master). For more information, see Creating an access request policy.

3. Assign the managed networks. For more information, see Managed networks.

If the SPS Central Management node is down

SPP continues to launch sessions on the managed hosts when the SPS Central Management node is down. However, as long as the Central Management node is down, SPP cannot validate existing policies nor can it validate the SPS cluster topology. See the Safeguard for Privileged Sessions Administration Guide, Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster.

Connection deletion: soft delete versus hard delete

Depending on your goals, you can perform a soft delete or a hard delete.

Soft delete the connection

When a session connection is deleted from the desktop client, the connection information is soft deleted so that a rejoin of the same SPS appliance can reuse the same values. This approach of soft deleting and reusing the same connection values on a rejoin avoids "breaking" all of the Access Request Polices that referenced the previous session connection.

If the session connection is deleted, a caution displays when you navigate to Administrative Tools | Entitlements | Access Request Policies and go to the Session Settings tab. For more information, see Session Settings tab.

Hard delete the connection

A hard delete can be performed to permanently remove the session connection. This is usually only done in cases where either a rejoin is not desired or retaining the previous session connection values is preventing an SPS appliance from joining or rejoining.

A hard delete can be performed from the API using the following steps for using PowerShell or Swagger.

Hard delete with PowerShell

The latest version of Safeguard PowerShell includes two cmdlets to perform the hard delete.

split-safeguardSessionCluster -SessionMaster <name or ID of session master>

Remove-SafeguardSessionSplitCluster -SessionMaster <name or ID of session master>

See OneIdentity/safeguard-ps.

Hard delete with Swagger

1. In a browser, navigate to https://<your-ip-address>/service/core/swagger.
2. Authenticate to the service using the Authorize button.
3. Navigate to Cluster->GET /v3/cluster/SessionModules and click Try it out!.
4. Identify if the unwanted session connection exists on the list:
   1. If the unwanted session connection exists in the list, then:
      1. Note the ID of the session connection.
      2. Navigate to Cluster DELETE /v3/cluster/SessionModules.
      3. Enter the ID.
      4. Click Try it out!”.
      5. Go to step 3.
   2. If the unwanted session connection does not exist in the list, then:
      1. Set the includeDisconnected parameter to true.
      2. Click Try it out!.
      3. If the unwanted session connection exists in the list, then go to step 4a to delete the entry a second time which will result in a hard delete.
5. The process is complete and the session connection is permanently removed.

Viewing, deleting, or editing join connections

Once the join is complete, navigate to Administrative Tools | Settings | Cluster | Session Appliances to view, delete, or edit join connections. The Session Appliances pane displays the following session details.

Table 148: Session Appliances: Properties

Property	Description
Host Name	The host name of the SPS appliance host cluster master.
Network Address	The network DNS name or IP address of the session connection.
Description	(optional) Descriptive text about the SPS session connection (for example, 20 on cluster - 172 primary node).
Connection User	The user name for Safeguard for Privileged Passwords (SPP). Do not include spaces in the user name.
Thumbprint	A unique hash value that identifies the certificate.
Managed Hosts	Other nodes in the SPS cluster identified by the managed host name and IP address. Hover over any Warning icon to see if the Managed Host is Unavailable or Unknown.

Click a Host Name row to bring up the Session Module Connection dialog.

Table 149: Session Module Connection: Properties

Property	Description
Node ID	The name of the Safeguard for Privileged Sessions Appliance used to authenticate the joined SPS session connection.
Host Name	The host name of the SPS appliance host cluster master.
SPP Username	The user name for Safeguard for Privileged Passwords (SPP). Do not include spaces in the user name.
Description	(optional) Descriptive text about the SPS session connection (for example, 20 on cluster - 172 primary node).
Network Address	The network DNS name or IP address of the session connection.
Use Host Name (not IP address)	If checked, the connection string used to launch a session uses the host name of the SPS appliance rather than the IP address.

Use these toolbar buttons to manage sessions.

Table 150: Sessions Management: Toolbar

Option	Description
Delete Selected	Remove the selected joined SPS session connection. For details on soft versus hard deletes, see Connection deletion: soft delete versus hard delete earlier in this topic.
Edit	Modify the selected joined SPS session connection Description or Network Address on the Session Module Connection dialog.
Refresh	Update the list of joined SPS session connections.
Session Module Password Access Enabled Toggle on Toggle off	CAUTION: This functionality supports the join with Safeguard for Privileged Sessions (SPS) version 6.2.0 or later. The toggle function is used to enable an SPS initiated session to get the session credentials from SPP. For information see the One Identity Safeguard for Privileged Sessions Administration Guide at this link: One Identity Safeguard for Privileged Sessions - Technical Documentation.