Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 2.5 - Administration Guide

Introduction System requirements Installing the One Identity Safeguard for Privileged Passwords desktop client Setting up Safeguard for Privileged Passwords for the first time Getting acquainted with the console Privileged access requests Toolbox Accounts Account Groups Assets Asset Groups Directories Entitlements Partitions Settings
Access Request settings Appliance settings Asset Management settings Backup and Retention settings Certificate settings Cluster settings External Integration settings Messaging settings Profile settings Access settings Sessions settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions
How do I access the API How do I audit transaction activity How do I configure external federation authentication How do I manage accounts on unsupported platforms How do I modify the appliance configuration settings How do I prevent Safeguard for Privileged Passwords messages when making RDP connections How do I see which assets and/or accounts are governed by a profile How do I set the appliance system time How do I setup discovery jobs How do Safeguard for Privileged Passwords database servers use SSL What are the access request states What do I do when an appliance goes into quarantine What is required for One Identity Safeguard for Privileged Passwords, embedded sessions module What is required to integrate with Starling Identity Analytics & Risk Intelligence What needs to be set up to use Application to Application What role-based email notifications are generated by default When does the rules engine run for dynamic grouping and tagging Why did the password change during an open request Why join Safeguard for Privileged Passwords to One Identity Starling
Safeguard Desktop Player Appendix: Safeguard ports

Password fails for Unix host

Some Unix systems silently truncate passwords to their maximum allowed length. For example, Macintosh OS X only allows a password of 128 characters. If an Asset Administrator creates a profile with an Account Password Rule that sets the password length to 136 characters, when Safeguard for Privileged Passwords changes the password for an account governed by that profile, the asset's operating system truncates the new password to the allowable length and does not return an error; however, the full 136-character password is stored in Safeguard for Privileged Passwords. This causes the following issues:


  • Check Password for that account will fail. When Safeguard for Privileged Passwords compares the password on the Unix host with the password in Safeguard for Privileged Passwords, they never match because the Unix host truncated the password generated by Safeguard for Privileged Passwords.


  • A user will not be able to log into the Unix host account successfully with the password provided by Safeguard for Privileged Passwords unless he truncates the password to the allowable length imposed by the operating system.

Password is pending review

Safeguard for Privileged Passwords can resolve a situation when a user needs to request an account password but cannot because there is a previous password release request still in the “Pending Review” state and the designated reviewer is not available. If the request is left in this state, Safeguard for Privileged Passwords prevents users from checking out the account password. In such a situation, the Security Policy Administrator can close the request without review.

To close a password without review

  1. Log in as a user with Security Policy Administrator permissions.
  2. On the Home page, click Refresh.
  3. Open Administrator to review the pending request.

    Note: The Administrator control is only available in the Safeguard for Privileged Passwords desktop client application, not in the web client.

  4. Select Close Request.
  5. Type an explanation in the Comment box of up to 255 characters (required).
  6. Select Close Request.

You can query and view all requests closed without review in the Activity Center. Filter the events by Password Request Closed, then export the search results to see the old state and new state.

Related Topics

Password is pending a reset

Password is pending a reset

If a user receives a persistent message that states, "You cannot checkout the password for this account while another request is pending password reset" or "This account has password requests which have not yet expired or have to be reviewed. It cannot be deleted now", the account password is stuck in a pending password change state.

Ensure that the service account for the asset associated with this account is working. Then manually change the account password. For more information, see Checking, changing, or setting an account password.

Or, if the service account for the asset is working properly and the policy governing the account allows emergency access and has enabled multiple users simultaneous access, you can instruct the user to request the password using Emergency Access.

Related Topics

Password is pending review

Profile did not run

The password management settings Settings | Access Request | Enable or Disable Services enable the automatic profile check and change schedules in directories and partitions.

Ensure the password management settings are enable for profiles to run on schedule:

  • Check Password Management Enabled
  • Change Password Management Enabled

For more information, see Enable or Disable Services (Access request and password management services).

Related Documents