Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 5.8.0 - Administration Guide

Preface Introduction The concepts of SPS The Welcome Wizard and the first login Basic settings User management and access control Managing SPS
Controlling SPS: reboot, shutdown Managing Safeguard for Privileged Sessions clusters Managing a high availability SPS cluster Upgrading SPS Managing the SPS license Accessing the SPS console Sealed mode Out-of-band management of SPS Managing the certificates used on SPS
General connection settings HTTP-specific settings ICA-specific settings RDP-specific settings SSH-specific settings Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search (classic) interface Using the Search interface Searching session data on a central node in a cluster Advanced authentication and authorization techniques Reports The SPS RPC API The SPS REST API SPS scenarios Troubleshooting SPS Configuring external devices Using SCP with agent-forwarding Security checklist for configuring SPS Jumplists for in-product help Third-party contributions About us

Authenticating users with X.509 certificates

Purpose:

SPS provides a method to authenticate the users of the web interface with X.509 client certificates. The client certificate is validated against a CA list, and the username is exported from the client certificate for identification. One Identity recommends using 2048-bit RSA keys (or stronger).

To authenticate SPS users on the SPS web interface with X.509 client certificates, complete the following steps.

Prerequisites:

  • You will have to upload the CA certificates that issued the certificates of the users, so this CA certificate must be available on your computer in PEM format.

  • The certificates of the users must contain the username used to authenticate on SPS. You must know which certificate field will contain the usernames (for example, CN or UID).

  • The certificates must be imported into the browsers of the users. SPS offers the possibility to authenticate with a certificate only if a personal certificate is available in the browser.

Steps:

  1. Figure 69: Policies > Trusted CA Lists — Creating Trusted CA lists

    Navigate to Policies > Trusted CA Lists and create a Trusted CA List.

    1. If the user certificates contain the username in the Common Name field, make sure that the Strict Hostname Check is disabled.

    2. Upload the CA certificate.

    3. Adjust other settings as needed. For details on creating a trusted CA list, see Verifying certificates with Certificate Authorities.

    4. Click Commit.

  2. Navigate to AAA > Settings > Authentication settings.

    Figure 70: AAA > Settings > Authentication settings — Configuring X.509 authentication

  3. Select X.509.

  4. Select the trusted CA list created in the first step in Authentication CA.

  5. Enter the DN field name of the username in X.509 DN field name of username field (in most cases, CN or UID. This field is case-sensitive, so make sure that you use the proper case.

  6. To allow the admin user to be able to log in without using X.509 authorization, select Enable fallback for admin. This will fallback to password authentication.

  7. Click Commit.

Managing user rights and usergroups

In SPS, user rights can be assigned to usergroups. SPS has numerous usergroups defined by default, but custom user groups can be defined as well. Every group has a set of privileges: which pages of the SPS web interface it can access, and whether it can only view (read) or also modify (read & write/perform) those pages or perform certain actions.

 NOTE:

Every group has either read or read & write/perform privileges to a set of pages.

Figure 71: AAA > Access Control — Managing SPS users

Assigning privileges to usergroups for the SPS web interface

Purpose:

To assign privileges to a new group, complete the following steps:

Steps:

  1. Navigate to AAA > Access Control and click .

  2. Find your usergroup. If you start typing the name of the group you are looking for, the autocomplete function will make finding your group easier for you.

  3. Click located next to the name of the group. The list of available privileges is displayed.

  4. Select the privileges (pages of the SPS interface) to which the group will have access and click Save.

    		 NOTE:

    To export the configuration of SPS, the Export configuration privilege is required.

    To import a configuration to SPS, the Import configuration privilege is required.

    To update the firmware and set the active firmware, the Firmware privilege is required.

  5. Select the type of access (read or read & write) from the Type field.

  6. Click Commit.

Modifying group privileges

Purpose:

To modify the privileges of an existing group, complete the following steps:

Steps:

  1. Navigate to AAA > Access Control.

  2. Find the group you want to modify and click . The list of available privileges is displayed.

  3. Select the privileges (pages of the SPS interface) to which the group will have access and click Save.

    Figure 72: AAA > Access Control > Edit — Modifying group privileges

    		 Caution:

    Assigning the Search privilege to a user on the AAA page automatically enables the Search in all connections privilege, and grants the user access to every audit trail, even if the user is not a member of the groups listed in the Access Control option of the particular connection policy.

  4. Select the type of access (read or read & write) from the Type field.

  5. Click Commit.

The admin user is available by default and has all privileges. It is not possible to delete this user.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating