Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 7.0 LTS - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Home Privileged access requests Appliance Management
Appliance Backup and Retention Certificates Cluster Enable or Disable Services External Integration Real-Time Reports Safeguard Access
Asset Management
Account Automation Accounts Assets Partitions Discovery Profiles Tags Registered Connectors Custom platforms
Security Policy Management
Access Request Activity Account Groups Application to Application Cloud Assistant Asset Groups Entitlements Linked Accounts User Groups Security Policy Settings Reasons
User Management Reports Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions About us

Password fails for Unix host

Some Unix systems silently truncate passwords to their maximum allowed length. For example, Macintosh OS X only allows a password of 128 characters. If an Asset Administrator creates a profile with an Account Password Rule that sets the password length to 136 characters, when Safeguard for Privileged Passwords changes the password for an account governed by that profile, the asset's operating system truncates the new password to the allowable length and does not return an error; however, the full 136-character password is stored in Safeguard for Privileged Passwords. This causes the following issues:


  • Check Password for that account will fail. When Safeguard for Privileged Passwords compares the password on the Unix host with the password in Safeguard for Privileged Passwords, they never match because the Unix host truncated the password generated by Safeguard for Privileged Passwords.


  • A user will not be able to log in to the Unix host account successfully with the password provided by Safeguard for Privileged Passwords unless they truncate the password to the allowable length imposed by the operating system.

Password or SSH key is pending a reset

If a user receives a persistent message that states either of the following types of messages, the account password or SSH key is stuck in a pending password/SSH key change state:

  • You cannot checkout the password or SSH key for this account while another request is pending password or SSH key reset
  • This account has password or SSH key requests which have not yet expired or have to be reviewed. It cannot be deleted now"

Possible solutions:

  • Ensure that the service account for the asset associated with this account is working. Then manually change the account password or SSH key . See: Checking, changing, or setting an account password and Checking, changing, or setting an SSH key.
  • Or, if the service account for the asset is working properly and the policy governing the account allows emergency access and has enabled multiple users simultaneous access, you can instruct the user to request the password or SSH key using Emergency Access.

You can allow new access requests whether a prior request is approved or not approved. In other words, no requests will be blocked based on the approval status of a prior request. Setting the Pending reviews do not block access check box only pertains to future requests. For more information, see Workflow tab (create access request policy).

Password or SSH key profile did not run

The password and SSH key management settings Appliance Management | Enable or Disable Services enable the automatic profile check and change schedules in partitions.

Ensure the password and SSH key management settings are enable for profiles to run on schedule:

  • Check Password Management Enabled
  • Change Password Management Enabled
  • Check SSH Key Management Enabled
  • Change SSH Key Management Enabled

Recovery Kiosk (Serial Kiosk)

Safeguard for Privileged Passwordsprovides a Recovery Kiosk (Serial Kiosk) with the following options.

  • Support bundle: Allows you to generate and send a support bundle to a Windows share.

To start the Recovery Kiosk

On the terminal or laptop running the Recovery Kiosk, you must configure your serial port settings as follows:

  1. Connect a serial cable from a laptop or terminal to the serial port on the back of the appliance marked with |0|0|.

  2. On the laptop or terminal, configure the serial port settings as follows:

    • Speed: 115200
    • Data bits: 8
    • Parity: None
    • Stop bit: 1

  3. These options display on the Recovery Kiosk screen:

    • Appliance Information

    • Power Options

      • Reboot
      • Shut Down
    • Admin Password Reset
    • Factory Reset (Not available for virtual appliances.)
    • Support Bundle
  4. Use the up-arrow and down-arrow to select one of these options.
  5. Use the right-arrow to initiate the option.
  6. Use the left-arrow to return to the option.
Kiosk keyboard shortcuts

Safeguard for Privileged Passwords provides these keyboard shortcuts. If you make the window too small to accommodate the kiosk elements, Safeguard for Privileged Passwords tells you how to readjust the window size.

  • Ctrl + D: Resets the kiosk to its original state. Clears challenges and options.

    Caution: When resetting the Bootstrap Administrator's password or performing a factory reset, if you reset the kiosk before you receive the response from One Identity Support, you must submit a new challenge.

  • Ctrl + R: Redraws the kiosk to fit a resized window. If you resize the window, press Ctrl + R to reorganize the kiosk elements to fit properly into the newly-sized window.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating