The Access Request Policies tab displays the password and SSH key request policies that govern the accounts in the selected entitlement.
To access Access Request Policies:
- web client: Navigate to Security Policy Management > Entitlements > (Edit) > Access Request Policies.
IMPORTANT: The selection made on the Entitlement > Access Request Policy tab takes precedence over the selections on Appliance Management > Cluster > Managed Networks page. If a Managed Networks rule includes nodes from different SPS clusters, SPP will only select the nodes from the same cluster that was assigned on the Session Settings page of the Access Request Policy tab.
Click New Access Policy from the details toolbar to add a policy to the selected entitlement.
Use these buttons on the details toolbar to manage your access request policies.
The History tab allows you to view or export the details of each operation that has affected the selected entitlement.
To access History:
Table 195: Entitlements: History tab properties
||The date and time of the event.|
||The display name of the user that triggered the event.|
||The network DNS name or IP address of the managed system that triggered the event.|
||The name of the selected entitlement.|
The type of operation made to the selected entitlement:
- Add Membership
- Remove Membership
NOTE: A membership operation indicates a relationship change with a related or parent object such as a user or user group was added or removed from the membership of an entitlement.
||The name of the related object.|
|Related Object Type
||The type of the related object.|
||The name of the object to which the selected entitlement is a child.|
|Parent Object Type
||The parent object type.|
Use the controls and tabbed pages on the Entitlements page to perform the following tasks to manage Safeguard for Privileged Passwords entitlements:
It is the responsibility of the Security Policy Administrator to add entitlements to Safeguard for Privileged Passwords.
To add an entitlement
- Navigate to Security Policy Management > Entitlements.
- Click New Entitlement from the toolbar.
In the New Entitlement dialog, provide the following information on the General tab:
Name: Enter a unique name for the entitlement. Limit: 50 characters.
Description: Enter descriptive text about the entitlement. Limit: 255 characters.
Priority: Enter the priority of this entitlement compared to other entitlements.
If a user desires to access an account in the scope of two different entitlements, then the entitlement with the highest priority (that is, the lowest number) takes precedence. For more information, see How Safeguard for Privileged Passwords evaluates policy when a user submits an access request.
Have the Entitlement Expire on Date and Time: Select this option to enforce an expiration date, then enter the date and time.
When an entitlement expires, all the access request policies associated with the entitlement also expire. To set an expiration date on a policy, see Creating an access request policy.
An entitlement's time restrictions enforce when Safeguard for Privileged Passwords uses a policy. A policy's time restrictions enforce when a user can access the account passwords. If the entitlement and the policy both have time restrictions, the user can only check out the password for the overlapping time frame.
Time restrictions control when the entitlement or policy is in effect relative to a user's time zone. Although Safeguard for Privileged Passwords Appliances run on Coordinated Universal Time (UTC), the user's time zone enforces the time restrictions set in the entitlement or policy. This means that if the appliance and the user are in different time zones, Safeguard for Privileged Passwords enforces the policy in the user's time zone set in their account profile.
User can change their time zone, by default. Or, the User Administrator can prohibit a user from changing the time zone, possibly to ensure adherence to policy. For more information, see Time Zone.
Use Time Windows: Select this option to enforce time windows.
Select and drag to highlight the hours you want to allow. Colored tiles are blocked times. Clear are available times.
Select one of the following save options:
Save & Close: This option saves the entitlement then returns you to the Entitlements page.
Save & Continue: This option saves the entitlement then sends you to the Access Request Policies tab (entitlements) for further configuration options. These settings are also available when selecting to edit an entitlement.