Chat now with support
Chat with Support

Enterprise Single Sign-On 8.0.6 - Quest ESSO Console Administrator Guide

1. Overview 2 Authenticating to Quest ESSO Console and Managing Protection Modes 3 Searching the Directory Tree 4 Managing Administrators 5 Managing Security Profiles
5.1 Managing Time Slices 5.2 Managing Password Format Control Policies 5.3 Managing User Security Profiles 5.4 Managing Access Point Security Profiles 5.5 Managing Application Security Profiles 5.6 Defining Security Profiles Default Values 5.7 Managing User and Access Point Security Profiles Priorities
6 Managing Directory Objects
6.1 Managing Applications 6.2 Managing Users 6.3 Managing Access Points 6.4 Managing Representative Objects 6.5 Managing Clusters of Access Points 6.6 Selecting a Domain Controller
7 Importing/Exporting Security Profiles and Directory Objects 8 Managing Smart Cards
8.1 Assigning Smart Cards to Users 8.2 Formatting Smart Cards 8.3 Forcing a new PIN 8.4 Disabling Temporarily Smart Cards 8.5 Unlocking Smart Cards 8.6 Sending Smart Cards to a Blacklist 8.7 Extending the Validity of a Smart Card 8.8 Allowing Users to Renew their Smart Card Certificates 8.9 Displaying Smart Card Properties 8.10 Displaying the List of Supported Smart Cards 8.11 Managing Smart Card Configuration Profiles 8.12 Managing Loan Cards 8.13 Managing Smart Cards' Authentication Parameters 8.14 Managing Batches of Smart Cards
9 Managing SA Server Devices 10 Managing RFID Tokens 11 Managing Biometric Enrolment 13 Enabling the Public Key Authentication Method 14 Managing the Emergency Plan 15 Managing Audit Events 16 Managing Reports 17 Customizing Configuration Files 18 Creating Scripts Appendix A: Regular Expressions - Basic Syntax Appendix B: Listing Audit Events and Error Codes Appendix C: Correspondence Between Profile and Administration Rights

15.1 Displaying Audit Events

Subject
Depending on your needs, you can display audit events in the following ways:
•
Globally, using the Audit panel, to display the whole Quest ESSO audit events.
•
Contextually, using the Directory panel (Events tab of a selected object), to display only the audit events associated directly or indirectly with the selected object.
For example, let us consider an application object. The Events tab of this object displays any administration action directly associated with this object (as the modification of an option or of the administrator's list for example), but also any event linked to the creation of accounts associated with this application.
The following procedure focuses on how to display globally audit events. For details on how to display the audit records of a specific object, see Section 5.5.1.3, "Displaying Password Generation Policy Event Logs" and Section 6., "Managing Directory Objects".
Before Starting
•
To perform the task described in this section, you must have at least the following administration role:
•
In classic administration mode: "Auditor".
•
In advanced administration mode, your role must contain the following right: "Audit: Visualization".
For more information on administration role, see Section 4., "Managing Administrators".
•
By default, Quest ESSO category events are displayed. If you also want to display all Identity & Access Manager audit events, set the following registry key (DWORD) to 1:
FrameWork\Audit\ShowIAMCategories (REG_DWORD)
Procedure
1.
In the Audit panel, select the time range corresponding to the events you want to display, and click Apply.
By default, the audit report displays all the audit events of the last two days.
All the audit events corresponding to the time range selected are displayed.
2.
If your auditor role is restricted to one or more audit populations, select the wanted population in the drop-down list, or select the Select all populations check box.
For more information on audit populations, see 15.2 Defining an Audit Population.
3.
To filter the displayed list, click the Advanced Filter button.
The Audit base filter window appears (for details on how to build a filter, see 15.3 Managing and Applying Audit Filters).
4.
To display more details about an event, double-click the corresponding line.
The Event detail window appears.
To interpret audit events, see 15.4 Interpreting Audit Events.

15.2 Defining an Audit Population

Subject
An audit population is a group, directory or organization that you want to explicitly mark for audit, so that audit events on objects (users or access points) that are members of the group, directory or organization can be displayed.
When you audit a group/directory/organization without having defined it as an audit population, the only displayed events are the one related to the group/directory/organization, and events related to its members are not available.
Once the audit population is defined, you can:
•
Associate it with an auditor administrator, to restrict his/her audit visibility: see Section 4.2, "Delegating Administration Roles".
•
Use it as an audit filter condition: see 15.3 Managing and Applying Audit Filters.
Procedure
1.
In the tree structure of the Directory panel, select the group, organization or directory that you want to mark as audit population.
2.
Click the Events tab.
The tab appears.
3.
In the Audit Population area:
•
Select the Mark events with label check box.
•
Type a label for the population (or let the default label in place).
•
Click Set.
The select group/organization/directory is marked for audit with the chosen label.
To gather several groups/organizations/directories in a single audit population, use the same label for all of them

15.3 Managing and Applying Audit Filters

•
15.3.1 Creating an Audit Filter
•
15.3.2 Saving an Audit Filter
•
15.3.3 Loading an Audit Filter
•
15.3.4 Applying an Audit Filter

15.3.1 Creating an Audit Filter

Subject
The Audit panel allows you to build audit filters that you can save and apply on existing event records.
Before Starting
To perform the task described in this section, you must have at least the following administration role:
•
In classic administration mode: "Security Object administrator".
•
In advanced administration mode, your role must contain the "Audit filter: Vizualisation" right.
For more information on administration role, see Section 4., "Managing Administrators".
Procedure
1.
In the Audit panel, click Advanced Filter.
The audit database search filter window appears.
This window allows you to select the category of event to filter:
a)
Access point: this category allows you to apply a filter on access points according to their name or their identifier.
b)
Application: this category allows you to apply a filter on applications according to their name or their identifier.
c)
Audit ID: this category allows you to apply a filter on audit identifiers.
d)
Category: this category allows you to choose the family of audit events you want to be displayed in the audit report:
•
SSO: SSO audit events.
•
Authentication: Authentication audit events.
•
System: Access point audit events.
•
Admin: Administration audit events.
e)
Detailed content: this category allows you to choose the event attributes you want to be displayed.
Example: cache authentication, DN, delegates...
f)
Error Code: this category allows you to filter events according to their error status.
g)
Event Code: this category allows you to defines the audit events that must be included in the audit report.
h)
Extended information: this category allows you to define a regular expression that will be applied to the Extended information field.
This field contains event-specific information.
More information on regular expressions, see Appendix A. "Regular Expressions - Basic Syntax".
i)
Population: this category only appears if your audit administration role is not restricted to a set of audit populations (for more details, see "Administration Tab Description" in Section 4.2, "Delegating Administration Roles").
It allows you to filter events according to existing audit populations.
Select the category on which you want to apply a filter condition and click Add a Condition.
The OR logic operator applies to the conditions of a given category and the AND logic operator applies between categories
Depending on the category chosen, an audit filter selection window appears.
2.
Follow the guidelines given in the window to choose the condition you want to apply, and click OK.
The audit filter is created. You can now save it (as explained in 15.3.2 Saving an Audit Filter) and/or directly apply it to the event report (as explained in Section 15.3.4 Applying an Audit Filter).
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating