Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

One Identity Safeguard for Privileged Passwords 7.5.1 - Administration Guide

Table of Contents

Introduction to One Identity Safeguard for Privileged Passwords

Overview of the entities

Appliance specifications

System requirements and versions

Web client system requirements Web management console system requirements Supported platforms Licenses Long Term Support (LTS) and Feature Releases

Using API and PowerShell tools

Customize the response using API query parameters

Using Safeguard PowerShell

Using the virtual appliance and web management console

Setting up the virtual appliance Virtual appliance backup and recovery Support Kiosk

Cloud deployment considerations

AWS deployment Azure deployment OCI deployment Virtual appliance backup and recovery

Setting up Safeguard for Privileged Passwords for the first time

Step 1: Create the Authorizer Administrator Step 2: Authorizer Administrator creates administrators Step 3: Appliance Administrator configures the appliance Step 4: User Administrator adds users Step 5: Asset Administrator adds managed systems Step 6: Security Policy Administrator adds access request policies

Using the web client

Change password FIDO2 keys

Application switcher Log out Search box

Search by attribute

My Requests Personal password vault Approvals Reviews Favorites

Privileged access requests

Configuring alerts

Email notifications

Password release request workflow

Requesting a password release

Taking action on a password release request

Approving a password release request Reviewing a completed password release request

SSH key release request workflow

Requesting an SSH key release

Taking action on an SSH key release request

Approving an SSH key release request Reviewing a completed SSH key release request

API key release request workflow

Requesting an API key release

Taking action on an API key release request

Approving an API key release request Reviewing a completed API key release request

Session request workflow

About sessions and recordings Requesting session access

Taking action on a session request

Approving a session request Launching the SSH client Launching an RDP session Configuring and launching a Remote Desktop Application session Reviewing a session request

File release request workflow

Requesting a file release

Taking action on a file release request

Enterprise vault

Creating an enterprise vault entry Sharing your enterprise vault with another user or user group Setting a password for your enterprise vault Setting up a time-based one-time password (TOTP) authenticator

Appliance Management

Appliance Diagnostics Appliance Information

Shutting down the appliance Restarting the appliance Setting the appliance name and Host DNS Suffix

Debug Licensing settings Factory Reset Lights Out Management (BMC) Network Diagnostics

ARP Netstat NS Lookup Ping Show Routes Telnet Throughput Trace Route

Networking Operating System Licensing SSH Algorithms Patch Updates Power Support bundle Time Time Zone

Backup and Retention

About backups Archive servers

Adding an archive server

Audit Log Maintenance Backup and Restore

Run Now Download a backup Upload a backup Restore a backup Archive backup Backup settings Backup protection settings

Backup Retention Authorize VM Compatible Backups

About Certificate Signing Requests (CSRs) Audit Log Signing Certificate

Creating an audit log Certificate Signing Request Installing an audit log certificate

Certificate Signing Request Hardware Security Module Certificates

Installing a Hardware Security Module client certificate Assigning a Hardware Security Module client certificate Uploading a Hardware Security Module server certificate

SMTP Certificate

Creating an SMTP Certificate Signing Request Installing an SMTP certificate

SSL/TLS Certificates

Creating an SSL/TLS Certificate Signing Request Installing an SSL/TLS certificate Assigning an SSL/TLS certificate to appliances

Syslog Client Certificate

Creating a syslog client Certificate Signing Request Installing a syslog client certificate

Trusted CA Certificates

Adding a trusted certificate Removing a trusted certificate

Cluster Management

Unlocking a locked cluster Task delegation in a cluster Password distribution in a cluster

Managed Networks

Adding a managed network Deleting a managed network Resolving IP address

Offline Workflow (automatic)

Enable automatic Offline Workflow Manually override automatic Offline Workflow

Session Appliances with SPS link

Connection deletion: soft delete versus hard delete

Global Services External Integration

Enabling email notifications

Add an email event

Email Templates Hardware Security Module SNMP

Configuring SNMP subscriptions Verifying SNMP configuration

Join Starling After joining Starling Unjoin Starling

Configuring and verifying a syslog server

Add a syslog event subscriber

ServiceNow ticketing system integration Remedy ticketing system integration Not integrated with ticketing system

Trusted Servers, CORS, and Redirects

Real-Time Reports Safeguard Access

Messaging settings

Login Notification Message of the Day

Local Login Control OAuth 2.0 Grant Types Local Password Rule

Modifying user password requirements

Identity and Authentication

Authentication provider combinations Adding identity and authentication providers

Branding Customization

Appliance Management Settings

Asset Management

Account Automation Accounts

Properties (account) Owners tab (account) Dependent Assets (account) Access Request Policies (account) Check and Change Log tab (account) Discovered Services tab (account) Discovered SSH Keys (account) History tab (account) Managing accounts

Adding an account Adding a cloud platform account Manually adding a tag to an account Deleting an account Adding users or user groups to an account Checking, changing, or setting an account password Viewing password archive Checking, changing, or setting an SSH key Viewing SSH key archive Adding an API key Checking, changing, or setting an API key Viewing API Key Archive Setting a TOTP authenticator Removing a TOTP authenticator

Properties tab (asset) Accounts tab (asset) Account Dependencies tab (asset) Access Request Policies (asset) Owners tab (asset) Discovered SSH Keys (asset) Discovered Services tab (asset) History tab (asset) Managing assets

Adding an asset

General tab (add asset) Connection tab (add asset)

About service accounts About Test Connection SSH Key Directory Account Starling Connect Local System Account Password (local service account) Access Key None

Management tab (add asset) Attributes tab (edit asset)

Checking an asset's connectivity Assigning an asset to a partition Assigning a profile to an asset Manually adding a tag to an asset Adding an account to an asset Adding account dependencies Adding users or user groups to an asset Deleting an asset Account Discovery tab (add asset) Downloading a public SSH key

About profiles Properties tab (partitions) Assets tab (partitions) Accounts tab (partitions) Owners tab (partitions) Password Profiles tab (partitions) SSH Key Profiles tab (partitions) History tab (partitions) Managing partitions

Adding a partition Adding assets to a partition Adding an account to a partition Removing assets from a partition Adding users or user groups to a partition Creating a password profile Creating an SSH key profile Setting a default partition Setting a default profile Assigning assets or accounts to a password profile and SSH key profile Deleting a partition

Asset Discovery

Asset Discovery job workflow Adding an Asset Discovery job

General tab (asset discovery) Information tab (asset discovery) Asset Discovery Rules tab (asset discovery)

Add Condition (asset discovery) Edit Connection Template (asset discovery) Add Asset Profile (asset discovery)

Schedule tab (asset discovery)

Deleting an Asset Discovery job

Asset Discovery Results Account Discovery

Account Discovery job workflow Adding an Account Discovery job

Adding an Account Discovery rule

Deleting an Account Discovery job

Account Discovery Results Discovered Accounts Service Discovery Results Discovered Services SSH Key Discovery

SSH Key Discovery job workflow Adding an SSH Key Discovery job SSH Key Discovery Results Discovered SSH Keys

Password Profiles (profiles)

Properties tab (profiles) Assets tab (profiles) Accounts tab (profiles) View Password Profile Components (profiles)

Managing password profiles

Adding a password profile Password Profiles

Adding check password settings

Change Password

Adding change password settings

Account Password Rules

Adding an account password rule

Password sync groups

Adding a password sync group

Setting a default password profile Deleting a password profile

SSH Key Profiles (profiles)

View SSH Key Profile Components (profiles)

Managing SSH key profiles

Adding an SSH key profile SSH Key Profiles

Check SSH Key settings

Adding SSH key check settings

Change SSH Key settings

Adding SSH key change settings

Discover SSH Key settings

Adding SSH key discovery

SSH Key Sync Groups settings

Adding SSH key sync groups

Setting a default SSH key profile Deleting an SSH key profile

Adding a tag for tagging of assets or asset accounts Deleting an asset or asset account tag Modifying an asset or asset account tag Copying an asset or asset account tag to another partition Viewing asset and asset account tag assignments

Registered Connectors

Adding a registered connector

Custom platforms

Creating a custom platform script Adding a custom platform

Importing objects

Creating an import file Template CSV file

Security Policy Management

Access Request Activity Account Groups

Properties tab (account group) Accounts tab (account group) Access Request Policies tab (account group) History tab (account group) Managing account groups

Adding an account group Adding a dynamic account group

General tab (add dynamic account group) Account Rules tab (add dynamic account group)

Adding one or more accounts to an account group Adding accounts to an access request policy Deleting an account group

Application to Application

About Application to Application functionality Setting up Application to Application Adding an application registration Deleting an application registration Regenerating an API key Making a request using the Application to Application service

Cloud Assistant

Adding authorized user for Cloud Assistant

Properties tab (asset group) Assets tab (asset group) Access Request Policies tab (asset group) History tab (asset group) Managing asset groups

Adding an asset group Adding a dynamic asset group

General tab (add dynamic asset group) Asset Rules tab (add dynamic asset group)

Adding assets to an asset group Deleting an asset group

General tab (entitlements) Users tab (entitlements) Access Request Policies tab (entitlements) History tab (entitlements) Managing entitlements

Adding an entitlement How Safeguard for Privileged Passwords evaluates policy when a user submits an access request Creating an access request policy

General tab (create access request policy) Security tab (create access request policy) Scope tab (create access request policy) Workflow tab (create access request policy)

Adding users or user groups to an entitlement Deleting an access request policy Modifying an access request policy Copying an access request policy Deleting an entitlement

Linked Accounts

Users (linked accounts) Accounts (linked accounts) Managing linked accounts

Linking a user to an account Linking an account to a user Removing a linked account from a user Removing a user from a linked account

Properties tab (user groups) Users tab (user groups) Entitlements tab (user groups) History tab (user groups) Managing user groups

Adding a user group Adding a directory user group Adding users to a user group Adding a user group to an entitlement Deleting a user group

Security Policy Settings

Reasons

User Management

Properties tab (user) User Groups tab (user) Entitlements tab (user) History (user) Managing users

Identity tab (add user) Authentication tab (add user) Permissions tab (add user)

Requiring secondary authentication log in Adding a user to user groups Adding a user to entitlements Activating or deactivating a user account Deleting a user Setting a local user's password Unlocking a local user's account

Properties tab (user groups) Users tab (user groups) Entitlements tab (user groups) History tab (user groups) Managing user groups

Adding a user group Adding a directory user group Adding a SCIM user group Adding users to a user group Adding a user group to an entitlement Deleting a user group

Activity Center

Applying search criteria Saving search criteria and loading previously saved search criteria Generating an activity audit log report Scheduling an activity audit log report Editing or deleting a saved search or scheduled report Viewing event details Auditing request workflow Sorting report results

Entitlement reports Exporting a detailed user entitlement report Ownership reports

Disaster recovery and clusters

Enrolling replicas into a cluster Unjoining replicas from a cluster Maintaining and diagnosing cluster members

About Offline Workflow Mode

Manually control Offline Workflow Mode

Failing over to a replica by promoting it to be the new primary Activating a read-only appliance Diagnosing a cluster member Patching cluster members

About cluster patching

Using a backup to restore a clustered appliance Resetting a cluster that has lost consensus Performing a factory reset Unlocking a locked cluster

Troubleshooting tips

Appliance states

Administrator permissions

Appliance Administrator permissions Asset Administrator permissions Auditor permissions Authorizer Administrator permissions Help Desk Administrator permissions Operations Administrator permissions Security Policy Administrator permissions User Administrator permissions Enterprise Vault

Preparing systems for management

Preparing ACF - Mainframe systems Preparing Amazon Web Services platforms Preparing Cisco devices Preparing Dell iDRAC devices Preparing VMware ESXi hosts Preparing Fortinet FortiOS devices Preparing F5 Big-IP devices Preparing HP iLO servers Preparing HP iLO MP (Management Processors) Preparing IBM i (AS/400) systems Preparing JunOS Juniper Networks systems Preparing MongoDB Preparing MySQL servers Preparing Oracle databases Preparing PAN-OS (Palo Alto) networks Preparing PostgreSQL Preparing RACF mainframe systems Preparing SAP HANA Preparing SAP Netweaver Application Servers Preparing SPS for credential management Preparing Sybase (Adaptive Server Enterprise) servers Preparing SonicOS devices Preparing SonicWALL SMA or CMS appliances Preparing SQL Servers Preparing Top Secret mainframe systems Preparing Unix-based systems Preparing Windows systems Preparing WinRM systems Preparing Windows SSH systems VMware vCenter Server Minimum required permissions for Windows assets

Troubleshooting

Appliance is sick Connectivity failures

Change password or SSH key fails Incorrect authentication credentials Missing or incorrect SSH host key No cipher supported error Service account has insufficient privileges

Cannot connect to remote machine through SSH or RDP Cannot delete account Cannot play session message Domain user denied access to Safeguard for Privileged Passwords LCD status messages

Appliance LCD and controls

My Mac keychain password or SSH key was lost Password fails for Unix host Password or SSH key is pending a reset Password or SSH key profile did not run Recovery Kiosk (Serial Kiosk)

Appliance information (Recovery Kiosk) Backups Power options

Rebooting the appliance Shutting down the appliance

Admin password reset Factory reset from the Recovery Kiosk Support bundle

Replica not adding System services did not update or restart after password or SSH key change Test Connection failures

Test Connection failures on archive server Certificate issue Cipher support Domain controller issue Networking issue Windows WMI connection

Timeout errors causing operations to fail User locked out User not notified

Frequently asked questions

How do I audit transaction activity How do I configure external federation authentication

How do I add an external federation provider trust How do I create a relying party trust for the STS How do I add an external federation user

How do I manage accounts on unsupported platforms How do I modify the appliance configuration settings How do I prevent Safeguard for Privileged Passwords messages when making RDP connections How do I set up telnet and TN3270/TN5250 session access requests How do Safeguard for Privileged Passwords database servers use SSL What are the access request states What do I do when an appliance goes into quarantine When does the rules engine run for dynamic grouping and tagging Why did the password or SSH key change during an open request

Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions

Timeout errors causing operations to fail

Troubleshooting > Timeout errors causing operations to fail

If you experience any timeout errors, wait a few minutes and retry the operation.

If you are performing clustering operations in the background, for example adding replicas to a cluster, wait for the cluser operations to complete before performing other operations in Safeguard for Privileged Passwords.

TIP: A timeout error can appear as a Request failed. A task was canceled. error message.

User locked out

Troubleshooting > User locked out

If a user has not logged on to Safeguard for Privileged Passwords for a set number of days, Safeguard for Privileged Passwords disables the user account.

NOTE: This is set using the Deactivate After setting in Appliance Management > Safeguard Access > Local Login Control. For more information, see Local Login Control..

Related Topics

Unlocking a local user's account

User not notified

Troubleshooting > User not notified

If a user did not receive an email notification, first check to see if you have set everything up in Safeguard for Privileged Passwords correctly for the email notifications to work properly. For more information, see Enabling email notifications..

Notification lists

Safeguard for Privileged Passwords does not dynamically maintain the email addresses for an escalation notification contact list.

If you change a Safeguard for Privileged Passwords user's email address or delete a Safeguard for Privileged Passwords user after creating a policy, you must update the email addresses in escalation notification contact lists manually. For example, when you create a policy, you can indicate who to contact when emergency access has been used. If a user has changed an email address, the notification will not be received by that individual. Furthermore, if a user has been deleted from Safeguard for Privileged Passwords, the user will still receive the notification.

Frequently asked questions

Frequently asked questions

The following topics will help you find answers to some of your questions about managing Safeguard for Privileged Passwords:

How do I audit transaction activity

How do I configure external federation authentication

How do I add an external federation provider trust

How do I create a relying party trust for the STS

How do I add an external federation user

How do I manage accounts on unsupported platforms

How do I modify the appliance configuration settings

How do I prevent Safeguard for Privileged Passwords messages when making RDP connections

How do I set up telnet and TN3270/TN5250 session access requests

How do Safeguard for Privileged Passwords database servers use SSL

What are the access request states

What do I do when an appliance goes into quarantine

When does the rules engine run for dynamic grouping and tagging

Why did the password or SSH key change during an open request

Related Topics

Troubleshooting

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2024 One Identity LLC. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center