Use the controls and tabbed pages on the Users page to perform the following tasks to manage Safeguard for Privileged Passwords users:
Use the controls and tabbed pages on the Users page to perform the following tasks to manage Safeguard for Privileged Passwords users:
It is the responsibility of either the Authorizer Administrator or the User Administrator to add Safeguard for Privileged Passwords users.
To add a user
In the New User dialog, provide information in each of the tabs:
On the Identity tab, choose an identity provider from the list of available providers. When adding a user from an external identity provider such as Microsoft Active Directory, Safeguard for Privileged Passwords imports read-only contact information from the source, however, you can change the user photo.
Use valid combinations of identity and authentication providers. For more information, see Identity and Authentication.
Property | Description |
---|---|
Identity Provider |
The source of the user's identity. Safeguard for Privileged Passwords comes with a built-in identity provider called Local that will allow you to manually enter user information that is stored directly in Safeguard for Privileged Passwords. Or you can select an Active Directory or LDAP server that you have previously configured and then browse for a user. Safeguard for Privileged Passwords will periodically synchronize with the directory to keep the information up to date. Indicate how the user's identity is managed by Safeguard for Privileged Passwords:
|
Browse
(Active Directory |
If the identity provider is Active Directory |
Username (Local provider) |
Enter the user's name that displays in the application. This is not the Login name which is set on the Authentication tab (add user). |
First Name (Local provider) |
Enter the user's first name. Limit: 30 characters; no double quotes. |
Last Name (Local provider) |
Enter the user's last name. Limit: 30 characters; no double quotes |
Work Phone (Local provider) |
Enter the user's work telephone number. Limit: 30 characters |
Mobile Phone (Local provider) |
Enter the user's mobile telephone number. Limit: 30 characters |
(Local provider) |
Enter the user's email address. Limit: 255 characters NOTE: Required for approvers using the |
Description (Local provider) |
Enter information about this user. Limit: 255 characters. |
Time Zone |
Select the user's time zone. Because Microsoft Active Directory does not have a Time Zone attribute, when you add a directory group, the default time zone is set for all imported accounts to (UTC) Coordinated Universal Time. To reset the time zone, open each imported account in Users and modify the Time Zone on this Location tab. |
On the Authentication tab, specify the authentication settings for the user. An authentication provider can be the same or different as the user's identity provider.
Use valid combinations of identity and authentication providers. For more information, see Identity and Authentication.
Property | Description |
---|---|
Authentication Provider |
Indicates how this user is to authenticate to Safeguard for Privileged Passwords. The options are:
|
If Certificate provider: Certificate, Certificate Thumbprint (SHA-1) |
If adding a Certificate user, enter the unique hash value (40 hexadecimal characters) of the certificate. You can copy and paste the Thumbprint value directly from the certificate, including the spaces. |
If external federation provider: Email Address or Name Claim |
If adding an external federation user account, enter the email address or name claim that will be returned from the STS of an authenticated user. A case-insensitive comparison will be performed on the value when the user is logging in. NOTE: You must configure or ensure that the STS includes either the email address claim or name claim. Safeguard for Privileged Passwords will first look for the email address claim in the claims token. If that claim does not exist, it will use the name claim. You must create the user account in Safeguard for Privileged Passwords according to what claim is returned by your STS, with precedence given to the email address claim. |
If local or Radius as Primary provider: Login name |
If using Local or Radius as Primary for authentication, this is the user's login name. This defaults to the value entered on the Identity tab, Username field. If using directory authentication, the login name is auto-populated. |
Set Password button (editing an existing Local provider) |
If you are editing an existing user for a Local provider, you may click Set Password to change a user's password. This button is not available when creating a new user or editing a user account from an external identity provider like Microsoft Active Directory. |
Password (adding a Local provider) |
If adding a Local user, enter a password for the user. You must comply with the password requirements specified in the dialog. For more information, see Local Password Rule. |
Require Certificate Authentication (Active Directory provider if provider is MS AD) |
Select this check box to require that the user logs into Safeguard for Privileged Passwords using their domain issued user certificate or SmartCard. This option is only available when the Authentication Provider is a Microsoft Active Directory. |
Password Never Expires |
Select this check box to set a password that does not expire. |
User must change password at next login |
This check box is only available when using Local for authentication. When selected, this check box requires the user to change their password during their next login. |
Require Secondary Authentication |
Select this check box to require that this user logs in to Safeguard for Privileged Passwords with two-factor authentication. For more information, see Requiring secondary authentication log in. Then choose the Secondary Authentication Provider for this user. Use valid combinations of identity and authentication providers. For more information, see Identity and Authentication. |
Login Name (for secondary authentication; not used for FIDO2) |
A best practice is to have the users log in to validate the correct user is set up. |
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center