Chat now with support
Chat with Support

Safeguard Authentication Services 5.0.2 - Installation Guide

Privileged Access Suite for Unix Introducing One Identity Safeguard Authentication Services Installing and configuring Safeguard Authentication Services Installing and joining from the Unix command line Getting started with Safeguard Authentication Services
Getting acquainted with the Control Center Learning the basics
Troubleshooting Enterprise package deployment

Starling Attributes: Configure LDAP attributes for use with push notifications

You can specify the user mobile number and user email address attributes to be used by the Starling push notifications.

Modifications to the Starling schema attributes configuration are global and apply to all Safeguard Authentication Services clients in the forest. For users configured to use Starling, this could cause user logins to fail.

To configure custom LDAP attributes for use with Starling push notifications

  1. From the Control Center, navigate to the Starling Attributes in one of the following two ways:
    • Preferences | Starling Two-Factor Authentication and click the Starling Attributes link.
    • Preferences | Schema Attributes
  2. Click the Unix Attributes link in the upper right to display the Customize Schema Attributes dialog.

  3. Enter the LDAP display name for one or both of the Starling attributes used by the Starling push notifications:

    • User Mobile Number
    • User Email Address
  4. Click OK.
  5. Click Yes to confirm that you want to modify the Starling schema attributes configuration.
  6. Back on the Starling Two-Factor Authentication preference pane, the Starling attributes to be used are displayed.

Logging in with Starling Two-Factor Authentication

Once Starling Two-Factor Authentication is enabled (that is, Safeguard Authentication Services is joined to Starling and users are authorized to use Starling Two-Factor Authentication), anytime an authorized user attempts to log in to an integrated Unix-based host, they will see an additional login screen informing them that an additional authentication step is required.

The default prompt contains the following:

Enter a token or select one of the following options:

  1. Starling Push
  2. Phone call
  3. Send an SMS

Token or option (1-3) [1]: <Token or option number>

This default prompt can be modified in vas.conf.

vas.conf example:

[STARLING] OPTIONS

The behavior of QAS Starling can be modified by using the following options in the [starling] section.

[starling]

prompt = <boolean>

prompt = <message-text>

Default value: "Enter a token or select one of the following options:\n\n 1. Starling Push\n 2. Phone

call\n 3. Send an SMS\n \nToken or option (1-3)[1]: "

This is the message that is initially displayed during a Starling authentication.

This prompt can span multiple lines, line separation is specified by adding \n to the prompt string.

NOTE: Changing the prompt will not change what is accepted as input.

[starling]

prompt = "Enter 1 for a push request, 2 for a phone call, 3 for a txt, or enter a token.\n "

NOTE: In order to display the prompts, the application must be able to handle pam conversations, such as sshd(keyboard-interactive). If the application can not handle pam conversations, such as sshd(password), a push authentication is sent instead of a prompt.

Unjoining from Starling

Unjoining Safeguard Authentication Services from Starling disables Starling Two-Factor Authentication in Safeguard Authentication Services.

To unjoin Safeguard Authentication Services from Starling

  1. From the Control Center, navigate to Preferences | Starling Two-Factor Authentication.
  2. In the Join to Starling and enable Two-Factor Authentication pane, click Starling Join Settings. 
  3. On the Starling Two-Factor Authentication dialog, click Unjoin Starling.

A Starling Organization Admin account or Collaborator account can rejoin Safeguard Authentication Services at any time.

Disabling Starling 2FA for a specific PAM service

To disable Starling 2FA for a specific PAM service, edit the PAM configuration file (/etc/pam.conf or /etc/pam.d/<service>). Modify the auth pam_vas line for the desired service.

To disable Starling 2FA for a specific PAM service

  1. As root, add the following line to the PAM configuration file, on the first auth pam_vas line for the service:

    disable_starling

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating