Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

One Identity Safeguard for Privileged Passwords 7.1 - Administration Guide

Table of Contents

Introduction to Safeguard for Privileged Passwords

Overview of the entities

Appliance specifications

System requirements and versions

Web client system requirements Web management console system requirements Supported platforms Licenses Long Term Support (LTS) and Feature Releases

Using API and PowerShell tools

Customize the response using API query parameters

Using Safeguard PowerShell

Using the virtual appliance and web management console

Setting up the virtual appliance Virtual appliance backup and recovery Support Kiosk

Cloud deployment considerations

AWS deployment Azure deployment Virtual appliance backup and recovery

Setting up Safeguard for Privileged Passwords for the first time

Step 1: Create the Authorizer Administrator Step 2: Authorizer Administrator creates administrators Step 3: Appliance Administrator configures the appliance Step 4: User Administrator adds users Step 5: Asset Administrator adds managed systems Step 6: Security Policy Administrator adds access request policies

Using the web client

Change password FIDO2 keys

Application switcher Log out Search box

Search by attribute

My Requests Personal password vault Approvals Reviews Favorites

Privileged access requests

Configuring alerts

Email notifications

Password release request workflow

Requesting a password release

Taking action on a password release request

Approving a password release request Reviewing a completed password release request

SSH key release request workflow

Requesting an SSH key release

Taking action on an SSH key release request

Approving an SSH key release request Reviewing a completed SSH key release request

Session request workflow

About sessions and recordings Requesting session access

Taking action on a session request

Approving a session request Launching the SSH client Launching an RDP session Configuring and launching a Remote Desktop Application session Reviewing a session request

Appliance Management

Appliance Diagnostics Appliance Information

Shutting down the appliance Restarting the appliance Setting the appliance name and Host DNS Suffix

Debug Licensing settings Factory Reset Lights Out Management (BMC) Network Diagnostics

ARP Netstat NS Lookup Ping Show Routes Telnet Throughput Trace Route

Networking Operating System Licensing SSH Algorithms Patch Updates Power Support bundle Time Time Zone

Backup and Retention

About backups Archive servers

Adding an archive server

Audit Log Maintenance Backup and Restore

Run Now Download a backup Upload a backup Restore a backup Archive backup Backup settings Backup protection settings

Backup Retention Authorize VM Compatible Backups

About Certificate Signing Requests (CSRs) Audit Log Signing Certificate

Creating an audit log Certificate Signing Request Installing an audit log certificate

Certificate Signing Request Hardware Security Module Certificates

Installing a Hardware Security Module client certificate Assigning a Hardware Security Module client certificate Uploading a Hardware Security Module server certificate

SMTP Certificate

Creating an SMTP Certificate Signing Request Installing an SMTP certificate

SSL/TLS Certificates

Creating an SSL/TLS Certificate Signing Request Installing an SSL/TLS certificate Assigning an SSL/TLS certificate to appliances

Syslog Client Certificate

Creating a syslog client Certificate Signing Request Installing a syslog client certificate

Trusted CA Certificates

Adding a trusted certificate Removing a trusted certificate

Cluster Management

Unlocking a locked cluster Task delegation in a cluster Password distribution in a cluster

Managed Networks

Adding a managed network Deleting a managed network Resolving IP address

Offline Workflow (automatic)

Enable automatic Offline Workflow Manually override automatic Offline Workflow

Session Appliances with SPS link

Enable or Disable Services External Integration

Enabling email notifications

Add an email event

Email Templates Hardware Security Module SNMP

Configuring SNMP subscriptions Verifying SNMP configuration

Join Starling After joining Starling Unjoin Starling

Configuring and verifying a syslog server

Add a syslog event subscriber

ServiceNow ticketing system integration Remedy ticketing system integration Not integrated with ticketing system

Trusted Servers, CORS, and Redirects

Real-Time Reports Safeguard Access

Messaging settings

Login Notification Message of the Day

Local Login Control Local Password Rule

Modifying user password requirements

Identity and Authentication

Authentication provider combinations Adding identity and authentication providers

Branding Customization

Appliance Management Settings

Asset Management

Account Automation Accounts

Properties (account) Owners tab (account) Dependent Assets (account) Check and Change Log tab (account) Discovered Services tab (account) Discovered SSH Keys (account) History tab (account) Managing accounts

Adding an account Adding a cloud platform account Manually adding a tag to an account Deleting an account Adding users or user groups to an account Checking, changing, or setting an account password Viewing password archive Checking, changing, or setting an SSH key Viewing SSH key archive

Properties tab (asset) Accounts tab (asset) Account Dependencies tab (asset) Owners tab (asset) Discovered SSH Keys (asset) Discovered Services tab (asset) History tab (asset) Managing assets

Adding an asset

General tab (add asset) Connection tab (add asset)

About service accounts About Test Connection SSH Key Directory Account Starling Connect Local System Account Password (local service account) Access Key None

Management tab (add asset) Attributes tab (edit asset)

Checking an asset's connectivity Assigning an asset to a partition Assigning a profile to an asset Manually adding a tag to an asset Adding an account to an asset Adding account dependencies Adding users or user groups to an asset Deleting an asset Account Discovery tab (add asset) Downloading a public SSH key

About profiles Properties tab (partitions) Assets tab (partitions) Accounts tab (partitions) Owners tab (partitions) Password Profiles tab (partitions) SSH Key Profiles tab (partitions) History tab (partitions) Managing partitions

Adding a partition Adding assets to a partition Adding an account to a partition Removing assets from a partition Adding users or user groups to a partition Creating a password profile Creating an SSH key profile Setting a default partition Setting a default profile Assigning assets or accounts to a password profile and SSH key profile Deleting a partition

Asset Discovery

Asset Discovery job workflow Adding an Asset Discovery job

General tab (asset discovery) Information tab (asset discovery) Asset Discovery Rules tab (asset discovery)

Add Condition (asset discovery) Edit Connection Template (asset discovery) Add Asset Profile (asset discovery)

Schedule tab (asset discovery)

Deleting an Asset Discovery job

Asset Discovery Results Account Discovery

Account Discovery job workflow Adding an Account Discovery job

Adding an Account Discovery rule

Deleting an Account Discovery job

Account Discovery Results Discovered Accounts Service Discovery Results Discovered Services SSH Key Discovery

SSH Key Discovery job workflow Adding an SSH Key Discovery job SSH Key Discovery Results Discovered SSH Keys

Password Profiles (profiles)

Properties tab (profiles) Assets tab (profiles) Accounts tab (profiles) View Password Profile Components (profiles)

Managing password profiles

Adding a password profile Password Profiles

Adding check password settings

Change Password

Adding change password settings

Account Password Rules

Adding an account password rule

Password sync groups

Adding a password sync group

Setting a default password profile Deleting a password profile

SSH Key Profiles (profiles)

View SSH Key Profile Components (profiles)

Managing SSH key profiles

Adding an SSH key profile SSH Key Profiles

Check SSH Key settings

Adding SSH key check settings

Change SSH Key settings

Adding SSH key change settings

Discover SSH Key settings

Adding SSH key discovery

SSH Key Sync Groups settings

Adding SSH key sync groups

Setting a default SSH key profile Deleting an SSH key profile

Adding a tag for tagging of assets or asset accounts Deleting an asset or asset account tag Modifying an asset or asset account tag Copying an asset or asset account tag to another partition Viewing asset and asset account tag assignments

Registered Connectors

Adding a registered connector

Custom platforms

Creating a custom platform script Adding a custom platform

Security Policy Management

Access Request Activity Account Groups

Properties tab (account group) Accounts tab (account group) Access Request Policies tab (account group) History tab (account group) Managing account groups

Adding an account group Adding a dynamic account group

General tab (add dynamic account group) Account Rules tab (add dynamic account group)

Adding one or more accounts to an account group Adding accounts to an access request policy Deleting an account group

Application to Application

About Application to Application functionality Setting up Application to Application Adding an application registration Deleting an application registration Regenerating an API key Making a request using the Application to Application service

Cloud Assistant

Adding authorized user for Cloud Assistant

Properties tab (asset group) Assets tab (asset group) Access Request Policies tab (asset group) History tab (asset group) Managing asset groups

Adding an asset group Adding a dynamic asset group

General tab (add dynamic asset group) Asset Rules tab (add dynamic asset group)

Adding assets to an asset group Deleting an asset group

General tab (entitlements) Users tab (entitlements) Access Request Policies tab (entitlements) History tab (entitlements) Managing entitlements

Adding an entitlement How Safeguard for Privileged Passwords evaluates policy when a user submits an access request Creating an access request policy

General tab (create access request policy) Security tab (create access request policy) Scope tab (create access request policy) Workflow tab (create access request policy)

Adding users or user groups to an entitlement Deleting an access request policy Modifying an access request policy Copying an access request policy Deleting an entitlement

Linked Accounts

Users (linked accounts) Accounts (linked accounts) Managing linked accounts

Linking a user to an account Linking an account to a user Removing a linked account from a user Removing a user from a linked account

Properties tab (user groups) Users tab (user groups) Entitlements tab (user groups) History tab (user groups) Managing user groups

Adding a user group Adding a directory user group Adding users to a user group Adding a user group to an entitlement Deleting a user group

Security Policy Settings

Reasons

User Management

Properties tab (user) User Groups tab (user) Entitlements tab (user) History (user) Managing users

Identity tab (add user) Authentication tab (add user) Permissions tab (add user)

Requiring secondary authentication log in Adding a user to user groups Adding a user to entitlements Activating or deactivating a user account Deleting a user Setting a local user's password Unlocking a local user's account

Properties tab (user groups) Users tab (user groups) Entitlements tab (user groups) History tab (user groups) Managing user groups

Adding a user group Adding a directory user group Adding users to a user group Adding a user group to an entitlement Deleting a user group

Activity Center

Applying search criteria Saving search criteria and loading previously saved search criteria Generating an activity audit log report Scheduling an activity audit log report Editing or deleting a saved search or scheduled report Viewing event details Auditing request workflow Sorting report results

Entitlement reports Exporting a detailed user entitlement report Ownership reports

Disaster recovery and clusters

Enrolling replicas into a cluster Unjoining replicas from a cluster Maintaining and diagnosing cluster members

About Offline Workflow Mode

Manually control Offline Workflow Mode

Failing over to a replica by promoting it to be the new primary Activating a read-only appliance Diagnosing a cluster member Patching cluster members

About cluster patching

Using a backup to restore a clustered appliance Resetting a cluster that has lost consensus Performing a factory reset Unlocking a locked cluster

Troubleshooting tips

Appliance states

Administrator permissions

Appliance Administrator permissions Asset Administrator permissions Auditor permissions Authorizer Administrator permissions Help Desk Administrator permissions Operations Administrator permissions Security Policy Administrator permissions User Administrator permissions

Preparing systems for management

Preparing ACF - Mainframe systems Preparing Amazon Web Services platforms Preparing Cisco devices Preparing Dell iDRAC devices Preparing VMware ESXi hosts Preparing Fortinet FortiOS devices Preparing F5 Big-IP devices Preparing HP iLO servers Preparing HP iLO MP (Management Processors) Preparing IBM i (AS/400) systems Preparing JunOS Juniper Networks systems Preparing MongoDB Preparing MySQL servers Preparing Oracle databases Preparing PAN-OS (Palo Alto) networks Preparing PostgreSQL Preparing RACF mainframe systems Preparing SAP HANA Preparing SAP Netweaver Application Servers Preparing Safeguard for Privileged Sessions for credential management Preparing Sybase (Adaptive Server Enterprise) servers Preparing SonicOS devices Preparing SonicWALL SMA or CMS appliances Preparing SQL Servers Preparing Top Secret mainframe systems Preparing Unix-based systems Preparing Windows systems Preparing WinRM systems Preparing Windows SSH systems Minimum required permissions for Windows assets

Troubleshooting

Appliance is sick Connectivity failures

Change password or SSH key fails Incorrect authentication credentials Missing or incorrect SSH host key No cipher supported error Service account has insufficient privileges

Cannot connect to remote machine through SSH or RDP Cannot delete account Cannot play session message Domain user denied access to Safeguard for Privileged Passwords LCD status messages

Appliance LCD and controls

My Mac keychain password or SSH key was lost Password fails for Unix host Password or SSH key is pending a reset Password or SSH key profile did not run Recovery Kiosk (Serial Kiosk)

Appliance information (Recovery Kiosk) Power options

Rebooting the appliance Shutting down the appliance

Admin password reset Factory reset from the Recovery Kiosk Support bundle

Replica not adding System services did not update or restart after password or SSH key change Test Connection failures

Test Connection failures on archive server Certificate issue Cipher support Domain controller issue Networking issue Windows WMI connection

Timeout errors causing operations to fail User locked out User not notified

Frequently asked questions

How do I audit transaction activity How do I configure external federation authentication

How do I add an external federation provider trust How do I create a relying party trust for the STS How do I add an external federation user account

How do I manage accounts on unsupported platforms How do I modify the appliance configuration settings How do I prevent Safeguard for Privileged Passwords messages when making RDP connections How do I set up telnet and TN3270/TN5250 session access requests How do Safeguard for Privileged Passwords database servers use SSL What are the access request states What do I do when an appliance goes into quarantine When does the rules engine run for dynamic grouping and tagging Why did the password or SSH key change during an open request

Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions About us

Networking issue

If you are having system connectivity issues, here are some things to consider:

Are there security rules on the network (such as firewalls or routers) that might be preventing this traffic?
Is traffic from Safeguard for Privileged Passwords routable to the network address of the managed system?
Are there any problems with cables, hubs, or switches, and so forth?

You could be experiencing network issues like these:

Network outage
Router misconfiguration
Unplugged wire
Switch not working

If Safeguard for Privileged Passwords suspends event notifications, try logging out and logging back in to re-subscribe to SignalR.

Windows WMI connection

To enable Safeguard for Privileged Passwords to manage Windows assets, you must configure your firewall to allow Windows Management Instrumentation (WMI).

Timeout errors causing operations to fail

If you experience any timeout errors, wait a few minutes and retry the operation.

If you are performing clustering operations in the background, for example adding replicas to a cluster, wait for the cluser operations to complete before performing other operations in Safeguard for Privileged Passwords.

TIP: A timeout error can appear as a Request failed. A task was canceled. error message.

User locked out

If a user has not logged on to Safeguard for Privileged Passwords for a set number of days, Safeguard for Privileged Passwords disables the user account.

NOTE: This is set using the Deactivate After setting in Appliance Management > Safeguard Access > Local Login Control. For more information, see Local Login Control.

Related Topics

Unlocking a local user's account

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2024 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center