Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 6.9 - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Getting started with the desktop client Using the desktop client Search box Privileged access requests Toolbox Accounts Account Groups Assets Asset Groups Discovery Entitlements Partitions Settings
Access Request settings Appliance settings Asset Management settings Backup and Retention settings Certificates settings Cluster settings Enable or Disable Services settings External Integration settings Messaging settings (desktop client) Password Management settings Real-Time Reports Safeguard Access settings SSH Key Management settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP 2.7 or later migration guidance Appendix C: SPP and SPS join guidance Appendix D: Regular Expressions About us

Adding a registered connector

desktop client only

It is the responsibility of the Asset Administrator to configure registered connectors.

To add a registered connector

IMPORTANT: Before adding a registered connector, read the Starling Connect documentation for instructions on configuring the connector within Starling Connect for use with Safeguard for Privileged Passwords. The connectors currently available for use with Safeguard for Privileged Passwords are listed in the Starling Connect documentation.

  1. Navigate to Administrative Tools | Settings | Asset Management | Registered Connectors.
  2. Click  Add.
  3. These fields display:
    1. Registered Connectors: Select the connector (already configured in Starling Connect) to register with Safeguard for Privileged Passwords.
    2. Starling Connector Version: Select the version for the Starling connector.
    3. Display: Enter a display name for the connector.
    4. Visible To All Partitions: Select this check box to make the registered connector visible to all partitions.
    5. Visible To Partitions: Available when Visible To All Partitions is not selected, use this section to define which partitions this registered connector will be visible to:
      • (Add): Use this button to add a new partition.
      • (Remove): Use this button to remove a previously selected partition.
  4. To add the registered connector, click OK.

    The connector will now be registered as a platform and be available as a platform type in the definition of an asset.

IMPORTANT: When using a registered connector with Safeguard for Privileged Passwords, there may be additional considerations involved when configuring certain functionalities. For example, Azure AD uses throttling to limit the number of password changes that can occur within a set period of time. This can mean errors are reported within Safeguard for Privileged Passwords when a large number of accounts associated with a registered Azure AD connector are all scheduled to automatically update their passwords due to their password management settings.

Tags

desktop client only

Asset Administrators can define rules that will dynamically add tags to assets and asset accounts so that they can be easily identified and added to dynamic groups. Use the Administrative Tools | Settings | Asset Management | Tags pane to create and manage dynamic tags for assets and asset accounts.

In addition, Asset Administrators can manually add static tags to assets and accounts on the General tab of the Assets or Accounts view. For more information, see Manually adding a tag to an asset and Manually adding a tag to an account.

The Tags pane provides a centralized view of all the tags defined for assets and asset accounts, regardless of how they were assigned. It displays the following details.

Table 139: Tags: Properties
Property Description

Name

The name assigned to the tag when it was created.

Asset Partition

The asset partition to which the tag belongs.

Account Rules

Indicates whether there is a rule associated with the selected tag. A check mark in this column indicates that the tag has an account rule.

Asset Rules

Indicates whether there is a rule associated with the selected tag. A check mark in this column indicates that the tag has an asset rule.

Description

Information about the tag.

Assigned Owners

Information on the owner(s).

Use these toolbar buttons to manage tags.

Table 140:  Tags: Toolbar
Option Description

New

Add a dynamic tag. For more information, see Adding a tag for dynamic tagging of assets or asset accounts.

Delete

Remove the selected tag. For more information, see Deleting an asset or asset account tag.

Refresh

Update the list of tags.

Edit

Modify the selected tag. For more information, see Modifying an asset or asset account tag.

NOTE: You cannot modify the partition assignment of an existing tag using the Edit operation. Use the Copy operation to clone the tag and assign it to an additional partition. Use the Delete operation to remove the tag from the existing partition.

Copy

Clone the selected tag and assign it to one or more additional partitions. For more information, see Copying an asset or asset account tag to another partition.

NOTE: If the tag already exists in the partition, the tag will be replaced with the cloned one.

Occurrences

View a list of assets and asset accounts that are assigned to the selected tag. For more information, see Viewing asset and asset account tag assignments.

Search

Search for a specific tag or set of tags in this list.

Related Topics

When does the rules engine run for dynamic grouping and tagging

Adding a tag for dynamic tagging of assets or asset accounts

desktop client only

Use the New button on the Tags pane in the Asset Management settings page to add a dynamic tag for an asset or asset account.

To add an asset or asset account dynamic tag

  1. Navigate to Administrative Tools | Settings | Asset Management | Tags.
  2. Click the New toolbar button.

    The Tag dialog displays.

  3. On the General tab, enter the following information:

    • Name: Enter a unique name for the tag.
    • Description: Enter information about the tag.
    • Partition: Click Browse to select the partition to which this tag is to be assigned.
  4. On the Account Rules tab, enter the conditions for an account rule.

    • Include an account rule for this tag: Select this check box if you want to include an account rule.
    • Rule editor: Use the rule editor to define conditions for tagging asset accounts.

      Table 141: Asset Account Rules tab: Rule editor controls
      Property Description

      AND | OR

      Click AND to group multiple search criteria together, where all criteria must be met in order to be included.

      Click OR to group multiple search criteria together; where at least one of the criteria must be met in order to be included.

      Attribute

      In the first query clause box, select the attribute to be searched. Valid attributes include:

      • Allow Password Requests
      • Allow Session Requests
      • Allow SSH key Requests
      • Asset Name
      • Asset Tag
      • Description
      • Directory Container (If you use the operator Equal, one level is found.)
      • Disabled
      • Discovered Group Distinguished Name (Use this selection to specify the search is for the domain to which the group belongs.)
      • Discovered Group Name (Use this selection to not specify the domain in the search. To specify the domain, select Discovered Group Distinguished Name.)
      • Discovery Job Name
      • Distinguished Name
      • Domain Name
      • Name
      • NETBIOS Name
      • Partition Name
      • Specify the platform. Here is how the search works:
        • Platform: This is the broadest search which will return the most results. The value you enter matches if it is found in one or more of the following:
          • DisplayName (Platform Name) such as Windows
          • PlatformType such as MicrosoftAD, Ubuntu, RacfLdap
          • PlatformFamily such as Windows, Linux, AIX
          • Platform.Version (Platform Version) such as Server 2016, 10

          For example, typing in Other could return these platforms: Windows Other, Other Other, and Other.

        • Platform Name: For a more granular search, enter the name of the platform, such as Windows. If you enter Windows without entering a Platform Version, there may be a match on Windows Server 2019, Windows Server 2016, and Windows 10.
        • Platform Version: Enter the version of the platform, such as Server 2016. For a precise search, enter both the Platform Name and the Platform Version, For example, if you enter the Platform Name as Windows and the Platform Version as Server 2016, then only Windows Server 2016 will be selected.

        For more information, see Supported platforms.

      • Service Account
      • SID
      • Tag

      Operator

      In the middle clause query box, select the operator to be used in the search. The operators available depend upon the data type of the attribute selected.

      For string attributes, the operators may include:

      • Contains (Default)
      • Does not contain
      • Starts with
      • Ends with
      • Equals
      • Not equal

      For boolean attributes, the operators may include:

      • Is True
      • Is False

      Search string

      In the last clause query box, enter the search string or value to be used to find a match.

      |

      Click to the left of a search clause to add an additional clause to the search criteria.

      Click to remove the search clause from the search criteria.

      Add Grouping | Remove

      Click the Add Grouping button to add an additional set of conditions to be met.

      A new grouping is added under the last query clause in a group and appears in a bordered pane showing that it is subordinate to the higher level query conditions.

      Click the Remove button to remove a grouping from the search criteria.

      Preview

      Click Preview to run the query in order to review the results of the query before adding the dynamic tag.

  5. On the Asset Rules tab, enter the conditions for an asset rule.

    • Don't include an asset rule for this tag: Select this check box if you do not want to include an asset rule. Selecting this check box disabled the rule editor controls on this page. Proceed to the next tab.
    • Rule editor: Use the rule editor to define conditions for tagging assets.

      Table 142: Asset Rules tab: Rule editor controls
      Property Description

      AND | OR

      Click AND to group multiple search criteria together, where all criteria must be met in order to be included.

      Click OR to group multiple search criteria together, where at least one of the criteria must be met in order to be included.

      Attribute

      In the first query clause box, select the attribute to be searched. Valid attributes include:

      • Allow Session Requests
      • Description
      • Directory Container (If you use the operator Equal, one level is found.)
      • Disabled
      • Discovered Group Distinguished Name (Use this selection to specify the search is for the domain to which the group belongs.)
      • Discovered Group Name (Use this selection to not specify the domain in the search. To specify the domain, select Discovered Group Distinguished Name.)
      • Discovery Job Name
      • A profile selection: Profiles can be inherited. For example, an account can be assigned to a specific profile (Profile Name) or it can inherit the profile from its parent asset (Effective Profile Name). When inherited, Profile Name will be null. Effective Profile Name will always have a value.
        • Effective Profile Name
        • Profile Name
      • Name (default)
      • Network Address
      • Partition Name
      • Platform
      • Tag

      Operator

      In the middle clause query box, select the operator to be used in the search. The operators available depend on the data type of the attribute selected.

      For string attributes, the operators may include:

      • Contains (Default)
      • Does not contain
      • Starts with
      • Ends with
      • Equals
      • Not equal

      For boolean attributes, the operators may include:

      • Is True
      • Is False

      Search string

      In the last clause query box, enter the search string or value to be used to find a match.

      |

      Click to the left of a search clause to add an additional clause to the search criteria.

      Click to remove the search clause from the search criteria.

      Add Grouping | Remove

      Click the Add Grouping button to add an additional set of conditions to be met.

      A new grouping is added under the last query clause in a group and appears in a bordered pane showing that it is subordinate to the higher level query conditions.

      Click the Remove button to remove a grouping from the search criteria.

      Preview

      Click Preview to run the query in order to review the results of the query before adding the dynamic tag.

  6. On the Assigned Owners tab, enter the users or groups associated with the tag. This does NOT mean the users and/or groups associated with the tag are the owners of the tag itself. Instead, when the tag is assigned to an asset or account, the listed users or groups will become owners of that asset or account.

    Table 143: Assigned Owners tab: Rule editor controls
    Property Description

    |

    Click to Add User or User Group.

    Click to remove a previously added user or group.

    Refresh

    Update the list of users and groups.
  7. On the Summary tab, review your selections.

    • Account Rules: Open the Account Rules tab to review the conditions for an asset account rule.
    • Asset Rules: Open the Asset Rules tab to review the conditions for an asset rule.
  8. Click Add to create the tag, close the dialog, and return to the Tags pane.

Deleting an asset or asset account tag

desktop client only

A tag can be assigned to multiple object types. That is, you can have the same tag assigned to assets and asset accounts including directory accounts. When deleted, all references to a tag will be removed, no matter how it was assigned (dynamically or manually).

To delete an asset or asset account tag

  1. Navigate to Administrative Tools | Settings | Asset Management | Tags.
  2. Select the tag to be deleted.
  3. Click the toolbar button.
  4. On the Remove Selected confirmation dialog, click Yes.
  5. If the tag is being used, removing the tag may result in changes to your policy configuration; therefore, you are given the opportunity to confirm or cancel the remove operation.

    • To remove the tag, enter Force Delete and click OK.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating