The Security Policy administrator configures the security policies that govern the access rights to accounts and assets, including the requirements for checking out passwords, such as the maximum duration, if password reasons are required, if emergency access is allowed, and so forth. This user may not know any details about the assets.
This user configures time restrictions for entitlements and who can request, approve and review access requests.
Navigation | Permissions |
---|---|
Dashboard | Access Requests |
Full control to manage access requests. |
Activity Center |
View and export security-related activity events, including access request events. Audit access request workflow. |
Reports |
View and export entitlement reports. |
Administrative Tools | Toolbox |
Access to the Account Groups, Asset Groups, Entitlements, Users, and User Groups view. Access to the Tasks pane. |
Administrative Tools | Account Groups |
Add, modify or delete account groups. Add accounts to account groups. Assign policies to account groups. |
Administrative Tools | Asset Groups |
Add, modify or delete asset groups. Add assets to asset groups. Assign policies to asset groups. |
Administrative Tools | Entitlements |
Add, modify or delete entitlements. Add users or user groups to entitlements. Define and maintain access request policies. Assign policies to entitlements. |
Administrative Tools | Settings: |
|
|
Add, modify, or delete reason codes. |
|
If Safeguard for Privileged Passwords (SPP) is joined to Safeguard for Privileged Sessions (SPS), view the appliance information for the join. |
|
Add, modify, or delete application registrations. |
|
Configure Approval Anywhere service for access request approvals. |
|
If Safeguard for Privileged Passwords is joined to Starling, view the Starling join information. |
|
If Safeguard for Privileged Passwords is configured to work with an external ticket system, view the ticket information. |
|
Login notification: View only. Set message of the day. |
Administrative Tools | Users |
Add users to user groups. Add users to entitlements. Link directory accounts to a user. View and export the history of users. |
Administrative Tools | User Groups |
Add, modify or delete local user groups. Add local or directory users to user groups. Assign entitlements to user groups. |
The User Administrator:
|
NOTE: User Administrators cannot modify administrator passwords, including their own. |
|
Important: User Administrators can change the permissions for their own account which may affect their ability to grant Help Desk Administrator permissions to other users. When you make changes to your own permissions, they take effect next time you log in. |
Navigation | Permissions |
---|---|
Activity Center |
View and export user activity events. |
Administrative Tools | Toolbox |
Access to the Users and User Groups view. Access to Tasks pane. |
Administrative Tools | Settings: | |
|
View only. |
|
Login notification: View only. Set message of the day. |
|
View only. |
|
View only. |
|
View only. |
Administrative Tools | Users |
Add, modify, delete or import local and directory users. Set passwords and unlock accounts for non-administrator users. Enable or disable non-administrative users. Set Help Desk Administrator permissions. |
Administrative Tools | User Groups |
Add or delete directory groups, if a directory has been added to Safeguard for Privileged Passwords. |
Before you add systems to Safeguard for Privileged Passwords (Adding an asset), you must ensure they are properly configured.
Generally, to prepare an asset for Safeguard for Privileged Passwords:
Create a functional account (called a "service" account in Safeguard for Privileged Passwords) on the asset and assign it a password.
|
Note: To add an asset to Safeguard for Privileged Passwords, it must have a service account. For more information, see About service accounts. |
For platforms that support SSL server certificate validation, add the server’s signing authority certificate to the Trusted Certificates store in Safeguard for Privileged Passwords. For more information, see Trusted Certificates.
The following topics can help you prepare your hosts for management by Safeguard for Privileged Passwords:
Prepare ACF - Mainframe systems
Prepare Amazon Web Services platforms
Prepare Fortinet FortiOS devices
Prepare HP iLO MP (Management Processors)
Prepare IBM i (AS/400) systems
Prepare JunOS - Juniper Networks systems
Prepare PAN-OS (Palo Alto) networks
Prepare RACF - Mainframe systems
Prepare SAP Netweaver Application Servers
Prepare Sybase (Adaptive Server Enterprise) servers
Prepare SonicWALL SMA or CMS appliances
Safeguard for Privileged Passwords supports a variety of platforms. For more information, see Supported platforms.
This applies to both ACF2 - Mainframe and ACF2 - Mainframe LDAP platforms.
To prepare IBM ACF-mainframe systems for Safeguard for Privileged Passwords
If not already installed, install a telnet server on the z/OS system. If required, secure telnet with SSL.
|
Note: Please refer to your IBM z/OS system documentation for details on installing and configuring the telnet server (and SSL). |
Safeguard for Privileged Passwords automatically accepts any server certificate that the connection offers and does not verify the trust chain on the telnet certificate. In addition, Safeguard for Privileged Passwords does not support client certificate selection so if telnet requires that the client present a certificate that is signed by a recognized authority, Safeguard for Privileged Passwords cannot support that configuration.
© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy