One Identity Safeguard for Privileged Passwords 2.9 - Administration Guide

Manually override automatic Offline Workflow

Use the Offline Workflow page to manually enable offline workflow or resume online operations.

For details on either of these operations, see Manually control Offline Workflow Mode.

Before resuming online operations, see Considerations to resume online operations.

To manually Enable Offline Workflow

This option is only available when the appliance has lost consensus with the cluster.

1. Navigate to Administrative Tools | Settings | Cluster | Offline Workflow.
2. Click Enable Offline Workflow to manually trigger Offline Workflow Mode.
3. In the dialog box, type in Enable Offline Workflow and click Enter. The appliance is in Offline Workflow Mode and enters maintenance. 
4. You can verify requests and view health checks on the Cluster Management window. For more information, see Cluster Management.

To manually Resume Online Operations

Sessions Appliances with SPS join

The Asset Administrator can join a Safeguard for Privileged Sessions (SPS) cluster to a Safeguard for Privileged Password (SPP) cluster of one appliance or more for session recording and auditing. The actual join must be between the SPP primary and the SPS cluster master. This means that the Safeguard for Privileged Sessions (SPS) cluster is aware of each node in an SPP cluster and vice-versa.

Once joined, all sessions are initiated by the SPP appliance via an access request and managed by the SPS appliance and sessions are recorded via the Sessions Appliance.

Safeguard for Privileged Passwords join guidance

Before initiating the join, review the steps and considerations in the join guidance. For more information, see Appendix C: SPP and SPS sessions appliance join guidance.

Pay attention to the roles assigned to the SPS nodes. The following caution is offered to avoid losing session playback from SPP.

Standard operating procedure after the initial join

If you add another SPS cluster after the initial join, follow these standard operating procedures:

1. Add join connections. See Viewing, deleting, or editing join connections later in this topic.

2. Identify the session settings on the entitlements access request policy (SPS Connection Policy which is the IP address of the cluster master). For more information, see Creating an access request policy.

3. Assign the managed networks. For more information, see Managed Networks.

Connection deletion: soft delete versus hard delete

Depending on your goals, you can perform a soft delete or a hard delete.

Soft delete the connection

When a session connection is deleted from the desktop client, the connection information is soft deleted so that a rejoin of the same SPS appliance can reuse the same values. This approach of soft deleting and reusing the same connection values on a rejoin avoids "breaking" all of the Access Request Polices that referenced the previous session connection.

If the session connection is deleted, a caution displays when you navigate to Administrative Tools | Entitlements | Access Request Policies and go to the Session Settings tab. For more information, see Session Settings tab.

Hard delete the connection

A hard delete can be performed to permanently remove the session connection. This is usually only done in cases where either a rejoin is not desired or retaining the previous session connection values is preventing an SPS appliance from joining or rejoining. A hard delete can only be performed from the API using the following steps:

1. In a browser, navigate to https://<your-ip-address>/service/core/swagger.
2. Authenticate to the service using the Authorize button.
3. Navigate to Cluster->GET /v3/cluster/SessionModules and click Try it out!.
4. Identify if the unwanted session connection exists on the list:
   1. If the unwanted session connection exists in the list, then:
      1. Note the ID of the session connection.
      2. Navigate to Cluster DELETE /v3/cluster/SessionModules.
      3. Enter the ID.
      4. Click Try it out!”.
      5. Go to step 3.
   2. If the unwanted session connection does not exist in the list, then:
      1. Set the includeDisconnected parameter to true.
      2. Click Try it out!.
      3. If the unwanted session connection exists in the list, then go to step 4a to delete the entry a second time which will result in a hard delete.
5. The process is complete and the session connection is permanently removed.

Viewing, deleting, or editing join connections

Once the join is complete, navigate to Administrative Tools | Settings | Cluster | Session Appliances to view, delete, or edit join connections. The Session Appliances pane displays the following session details.

Click a Host Name row to bring up the Session Module Connection dialog.

Use these toolbar buttons to manage sessions.

Table 149: Sessions Management: Toolbar

Option	Description
Delete Selected	Remove the selected joined SPS session connection. For details on soft versus hard deletes, see Connection deletion: soft delete versus hard delete earlier in this topic.
Edit	Modify the selected joined SPS session connection Description or Network Address on the Session Module Connection dialog.
Refresh	Update the list of joined SPS session connections.
Session Module Password Access Enabled Toggle on Toggle off	CAUTION: This functionality supports the join with Safeguard for Privileged Sessions (SPS) version 6.2.0 or later. The toggle function is used to enable an SPS initiated session to get the session credentials from SPP. For information see the One Identity Safeguard for Privileged Sessions Administration Guide at this link: One Identity Safeguard for Privileged Sessions - Technical Documentation.

Reversing the SPP to SPS join

Once a Safeguard for Privileged Passwords (SPP) cluster node has been configured to use the Safeguard Sessions Appliance, it can be reversed by a factory reset of the Safeguard Passwords Appliance. The factory reset redeploys the Safeguard Passwords Appliance session module. For more information, see Factory Reset from the desktop client.

Another way to reverse the join to Safeguard for Privileged Sessions is to restore a backup that was taken before the first join of Safeguard for Privileged Sessions (SPS).

For more information, see Backup and Retention settings.

External Integration settings

The Appliance Administrator can configure the appliance to send event notifications to various external systems, the integration with an external ticketing system, and configure both external and secondary authentication service providers. However, it is the Security Policy Administrator's responsibility to configure the Approval Anywhere feature.

Navigate to Administrative Tools | Settings | External Integration.