One Identity Safeguard for Privileged Passwords 7.5.2 - Administration Guide

To add an application registration

1. Log in to the Safeguard for Privileged Passwords web client as a Security Policy Administrator.
2. Navigate to Security Policy Management > Application to Application.

3. Click Add. The New Registration dialog displays.

4. Specify the following information: 
   1. Name: Enter a name for the application registration.
   2. Description: Enter information about the application registration.

   3. Certificate User: Click Browse to select a certificate user who is associate with the third-party application being registered.

      A certificate user must be specified. If not specified when you initially add an application registration, click Edit on the Application to Application page to specify the certificate user.

      NOTE: For SignIR, connect as a certificate user using A2A API key for the retrievable account you want to monitor that is assigned an A2A registration for Retrievable Accounts. The connected certificate user will receive event notifications for any events related to that account (for example, password change, update, and delete). For more information, see Making a request using the Application to Application service..

   4. Visible To Certificate Users: Select this check box to make the registration, including the API keys, visible by the certificate user that is configured for the A2A registration.

5. Click OK. This will save the initial application registration information and open a new dialog with additional settings.

6. The Access Request Broker tab displays a list of users for which the third-party application can create an access request on behalf of.

   • Click to add a user or user group to the list.

   • Click Edit Restrictions to specify IP address restrictions for all of the users and user groups in the list.

     A restriction is a list of IP addresses or range of IP addresses that are allowed to call the Application to Application service to perform this task. That is, if a restriction is added to a Credential Retrieval or Access Request Broker task, the service will only allow requests that initiate from the IP addresses specified in the restriction list.

     The IP address notation can be:

     • An IPv4 or IPv6 address (for example, 10.5.32.4).

     • An address range in CIDR notation (for example, 10.5.0.0/16).

   • Click to remove the selected user from the list.

7. The Credential Retrieval tab displays a list for which the third-party can retrieve credentials from Safeguard for Privileged Passwords without going through the normal workflow process.

   • Click to add an account to the list.

   • Click Restrictions in the Restrictions column to specify IP address restrictions for the selected account.

     A restriction is a list of IP addresses or range of IP addresses that are allowed to call the Application to Application service to perform this task. That is, if a restriction is added to a Credential Retrieval or Access Request Broker task, the service will only allow requests that initiate from the IP addresses specified in the restriction list.

     The IP address notation can be:

     • An IPv4 or IPv6 address (for example, 10.5.32.4).

     • An address range in CIDR notation (for example, 10.5.0.0/16).

   • Click to remove the selected account from the list.
8. Click OK to save and close the dialog.