Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 2.5 - Administration Guide

Introduction System requirements Installing the One Identity Safeguard for Privileged Passwords desktop client Setting up Safeguard for Privileged Passwords for the first time Getting acquainted with the console Privileged access requests Toolbox Accounts Account Groups Assets Asset Groups Directories Entitlements Partitions Settings
Access Request settings Appliance settings Asset Management settings Backup and Retention settings Certificate settings Cluster settings External Integration settings Messaging settings Profile settings Access settings Sessions settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions
How do I access the API How do I audit transaction activity How do I configure external federation authentication How do I manage accounts on unsupported platforms How do I modify the appliance configuration settings How do I prevent Safeguard for Privileged Passwords messages when making RDP connections How do I see which assets and/or accounts are governed by a profile How do I set the appliance system time How do I setup discovery jobs How do Safeguard for Privileged Passwords database servers use SSL What are the access request states What do I do when an appliance goes into quarantine What is required for One Identity Safeguard for Privileged Passwords, embedded sessions module What is required to integrate with Starling Identity Analytics & Risk Intelligence What needs to be set up to use Application to Application What role-based email notifications are generated by default When does the rules engine run for dynamic grouping and tagging Why did the password change during an open request Why join Safeguard for Privileged Passwords to One Identity Starling
Safeguard Desktop Player Appendix: Safeguard ports

Managing users

Use the controls and tabbed pages on the Users page to perform the following tasks to manage Safeguard for Privileged Passwords users:

Adding a user

It is the responsibility of either the Authorizer Administrator or the User Administrator to add Safeguard for Privileged Passwords users.

To add a user

  1. Navigate to Administrative Tools | Users.
  2. In Users, click Add User from the toolbar.
  3. In the User dialog, provide information in each of the tabs:

    Identity tab

    Where you define the identity provider and the user's contact information.

    Authentication tab

    Where you define the authentication provider, login name and password, if necessary.

    Location tab Where you set the user's time zone.
    Permissions tab Where you set the user's administrator permissions.
Related Topics

Adding users or user groups to an entitlement

Adding users to a user group

Identity tab

On the Identity tab, choose a provider from the list of available providers. When adding a user from an external provider such as Microsoft Active Directory, Safeguard for Privileged Passwords imports read-only contact information from the source, however, you can change the user photo.

Use valid combinations of identity and authentication providers. For more information, see Identity and Authentication.

Table 239: User: Identity tab properties
Property Description
Identity Provider

The source of the user's identity. Safeguard for Privileged Passwords comes with a built-in identity provider called Local that will allow you to manually enter user information which is stored directly in Safeguard for Privileged Passwords. Or you can select an Active Directory or LDAP server that you have previously configured and then browse for a user. Safeguard for Privileged Passwords will periodically synchronize with the directory to keep the information up to date.

Indicate how the user's identity is managed by Safeguard for Privileged Passwords:

  • Local
  • Active Directory
  • LDAP
Browse

(Active Directory or LDAP)

If the identity provider is Active Directory or LDAP, click the Browse button to choose a user. The remaining fields are auto-populated.

First Name

(Local provider)

Enter the user's first name.

Limit: 30 characters; no double quotes.

Last Name

(Local provider)

Enter the user's last name.

Limit: 30 characters; no double quotes

Work Phone

(Local provider)

Enter the user's work telephone number.

Limit: 30 characters

Mobile Phone

(Local provider)

Enter the user's mobile telephone number.

Limit: 30 characters

NOTE: A valid mobile phone number in E.164 format is required for approvers using the Approval Anywhere feature and for two-factor authentication using Starling. However, you can use the Use alternate mobile phone number option on the Authentication tab to specify a valid mobile phone number, instead of adding it here.

E.164 format: +<country code><area code><phone number>

Email Address

(Local provider)

Enter the user's email address.

Limit: 255 characters

NOTE: Required for approvers using the Approval Anywhere feature and for two-factor authentication using Starling.

Description

(Local provider)

Enter information about this user.

Limit: 255 characters.

Authentication tab

On the Authentication tab, specify the authentication settings for the user. An authentication provider can be the same or different as the user's identity provider.

Use valid combinations of identity and authentication providers. For more information, see Identity and Authentication.

Table 240: User: Authentication tab properties
Property Description
Authentication Provider

Indicate how this user is to authenticate to Safeguard for Privileged Passwords. The options are:

  • Certificate: With a certificate

    NOTE: Safeguard for Privileged Passwords allows you to map a public-key certificate to a user account. You can then use the certificate to make authenticated requests to the appliance by means of the API. For more information, see How do I access the API.

  • Local: With a user name and password (default)
  • <Directory name>: With directory account credentials (only available if one or more directories have been added to Safeguard for Privileged Passwords, such as Active Directory or LDAP, and the identity provider of the user is also that directory).
  • <External Federation service provider name>: With the credentials required by the External Federation or Radius server (only available if one or more of those authentication providers have been configured in Safeguard for Privileged Passwords).

Login name

(Local or Radius as Primary)

If using Local or Radius as Primary for authentication, enter the user's login name.

If using directory authentication, the login name is auto-populated.

Limit: 255 characters

Set Password

(editing an existing Local provider)

If you are editing an existing user for a Local provider, you may click Set Password to change a user's password. This button is not available when creating a new user or editing a user account from an external identity provider like Microsoft Active Directory.

Password

(Local provider)

If adding a Local user, enter a password for the user. You must comply with the password requirements specified in the dialog. For more information, see Password Rules.

Limit: 64 characters

Certificate Thumbprint (SHA-1)

(Certificate user)

If adding a Certificate user, enter the unique hash value (40 hexadecimal characters) of the certificate. You can copy and paste the Thumbprint value directly from the certificate, including the spaces.

Email Address or Name Claim

(external federation)

If adding an external federation user account, enter the email address or name claim that will be returned from the STS of an authenticated user. A case-insensitive comparison will be performed on the value when the user is logging in.

NOTE: You must configure or ensure that the STS includes either the email address claim or name claim. Safeguard for Privileged Passwords will first look for the email address claim in the claims token. If that claim does not exist, it will use the name claim. You must create the user account in Safeguard for Privileged Passwords according to what claim is returned by your STS, with precedence given to the email address claim.

Require Certificate Authentication

(Active Directory provider)

Select this check box to require that the user logs into Safeguard for Privileged Passwords using their domain issued user certificate or SmartCard.

NOTE: This option is only available when the Authentication Provider is a Microsoft Active Directory.

Require Secondary Authentication

Select this check box to require that this user logs into Safeguard for Privileged Passwords with two-factor authentication. For more information, see Requiring user to log in using secondary authentication.

Then choose the Secondary Authentication Provider for this user. Use valid combinations of identity and authentication providers. For more information, see Identity and Authentication.

Login Name

(if a directory is selected for secondary authentication)

When a directory is selected for secondary authentication, Browse to select the account on the secondary authentication provider this user must use when logging into Safeguard for Privileged Passwords with two-factor authentication.

If Radius as a secondary authentication provider is selected, enter the name of the account on the secondary authentication provider this user must use when logging into Safeguard for Privileged Passwords with two-factor authentication.

Use alternate mobile phone number

(if Starling Two-Factor Authentication)

When Starling Two-Factor Authentication is selected, this option is available to enter an alternate Mobile phone number. The Number on file is the mobile phone number specified on the user's Identity tab.

NOTE: The Approval Anywhere and one-touch approval features require a valid mobile phone number for the user. If the user does not have their mobile number published in Active Directory, use this option to specify a valid mobile phone number for the user.

Related Documents