One Identity Safeguard for Privileged Passwords 2.9 - Administration Guide

Requiring secondary authentication log in

You can require a user to log in using two-factor authentication by enabling the Require Secondary Authentication option in the user record.

To require a user to log in using secondary authentication

1. Setup a secondary authentication provider in Settings | External Integration | Identity and Authentication. For more information, see Adding identity and authentication providers. Or, you may use Starling 2FA. For more information, see Starling.

2. Configure the Safeguard for Privileged Passwords user to Require Secondary Authentication. For more information, see Authentication tab (add user).
   1. On the Authentication tab of a user's properties, select the Require Secondary Authentication check box.
   2. Choose the Authentication Provider.

   3. Depending on the type of authentication provider selected, specify the additional information this user must use when logging into Safeguard for Privileged Passwords with two-factor authentication.

3. Log in with secondary authentication.

   When you log into Safeguard for Privileged Passwords as a user that requires secondary authentication, you log in as usual, using the password that is set for the Safeguard for Privileged Passwords user account. Safeguard for Privileged Passwords then displays one or more additional login screens. Depending on how the system administrator has configured the secondary authentication provider, you must enter additional credentials for your secondary authentication service provider account, such as a secure password and/or security token code.

   Note: The type and configuration of the secondary authentication provider (RSA SecureID, FIDO2, One Identity Starling Two-Factor Authentication, etc.) determines what you must provide for secondary authentication. Check with your system administrator for more information about how to log into Safeguard for Privileged Passwords with secondary authentication.

For more information, see To manage your FIDO2 keys.

Configuring user for Starling Two-Factor Authentication when logging into Safeguard

It is the responsibility of the Authorizer Administrator or the User Administrator to configure a user account to use two-factor authentication when logging into Safeguard for Privileged Passwords.

To configure users to use Starling Two-Factor Authentication when logging into Safeguard for Privileged Passwords

1. Log into Safeguard for Privileged Passwords as an Authorizer Administrator or User Administrator.
2. Navigate to Administrative Tools | Users.
3. Add or edit users, ensuring the following settings are configured:
   1. Authentication tab:
      • Require Secondary Authentication: Select this check box.

      • Authentication Provider: Select the Starling 2FA service provider.

        NOTE: If the Starling 2FA service provider is not listed, you must first join Safeguard for Privileged Passwords to Starling. For more information, see Starling.

      • Use alternate mobile phone number: Optionally, select this check box and enter an alternate mobile number to be used for two-factor authentication notifications.

        NOTE: If you want to use one-touch approvals, this feature requires a valid mobile phone number for the user. If the user does not have their mobile number published in Active Directory, use this option to specify a valid mobile phone number for the user.

   2. Contact Information tab:
      • Mobile Phone: Enter a valid mobile phone number in E.164 format.
      • Email Address: Enter a valid email address.

Now whenever any of these users attempt to log into Safeguard for Privileged Passwords, after entering their password, a message appears on the login screen informing them that an additional authentication step is required.

Adding a user to user groups

It is the responsibility of the Security Policy Administrator to add users to user groups to assign to password policies.

To add a user to a user group

1. Navigate to Administrative Tools | Users.
2. In Users, select a user from the object list and open the User Groups tab.
3. Click Add User Groups from the details toolbar.
4. Select one or more groups from the list in the User Groups dialog and click OK.

If you do not see the user group you are looking for and are a Security Policy Administrator, you can click Create New in the User Groups selection dialog and add the user group. For more information about creating user groups, see Adding a user group.

Assigning a user to partitions

It is the responsibility of the Asset Administrator to select one or more users to manage the assets and accounts in a partition. Assigning a user to a partition makes that user the "delegated owner" of that partition, giving that person authorization to manage the assets and accounts in that partition. A delegated partition owner has a subset of the permissions that an Asset Administrator has. For more information, see Administrator permissions.

To assign a user to partitions

1. Navigate to Administrative Tools | Users.
2. In Users, select a user from the object list and open the Partitions tab.
3. Click Assign Partition(s) from the details toolbar.
4. Select one or more partitions from the list in the Partitions selection dialog and click OK.

If you do not see the partition you are looking for and are an Asset Administrator, you can click Create New in the Partitions dialog. For more information about creating partitions, see Adding a partition.