Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 5.8.0 - Administration Guide

Preface Introduction The concepts of SPS The Welcome Wizard and the first login Basic settings User management and access control Managing SPS
Controlling SPS: reboot, shutdown Managing Safeguard for Privileged Sessions clusters Managing a high availability SPS cluster Upgrading SPS Managing the SPS license Accessing the SPS console Sealed mode Out-of-band management of SPS Managing the certificates used on SPS
General connection settings HTTP-specific settings ICA-specific settings RDP-specific settings SSH-specific settings Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search (classic) interface Using the Search interface Searching session data on a central node in a cluster Advanced authentication and authorization techniques Reports The SPS RPC API The SPS REST API SPS scenarios Troubleshooting SPS Configuring external devices Using SCP with agent-forwarding Security checklist for configuring SPS Jumplists for in-product help Third-party contributions About us

How Authentication and Authorization plugins work

If a Connection Policy has an Authentication and Authorization plugin (AA plugin) configured, then SPS executes the plugin as the last step of the connection authorization phase. SPS can request the client to perform other types of authentication before executing the plugin. Using an AA plugin in a Connection Policy is treated as gateway authentication if:

  • the plugin authenticates the user

  • authentication is successful

  • the plugin returns the gateway_user and gateway_groups elements, identifying the user it has authenticated

Other types of gateway authentication will come before authentication by the AA plugin, so information from any other type of gateway authentication (for example, the username and usergroups of this authentication) will already be available and therefore can be used by the plugin. If the Authentication and Authorization plugin does perform gateway authentication, you can use a Credential Store as well.

The plugin can interactively request additional information from the client in the SSH, Telnet, and RDP protocols.

Optionally, the plugin can return the gateway_user and gateway_groups elements. SPS will only update the gateway username and gateway groups fields in the connection database if the plugin returns the gateway_user and gateway_groups elements. The returned gateway username and gateway groups override any such attributes already available on SPS about the connection, so make sure that the plugin uses the original values appropriately.

If the plugin returns the gateway_user and gateway_groups elements, you may have to configure an appropriate Usermapping Policy in the Connection Policy. If the plugin returns a gateway_user that is different from the remote user, the connection will fail without a Usermapping Policy. For details on Usermapping Policies, see "Configuring usermapping policies" in the Administration Guide.

NOTE: In SPS 5.8, a user's group membership is determined by querying only the relevant groups configured for the connection from the LDAP/AD server, instead of retrieving all groups of a given user.

This may cause problems when using AD/LDAP-based gateway authentication together with an AA plugin. The AA plugin authorize() hook may be called with only a subset of groups as group membership lookup does not consider groups referenced in the AA plugin code.

As a possible workaround, you can add a rule to the channel policy assigned to the connection that never matches (for example, set the From address to 0.0.0.0/32), but contains all the gateway groups that the plugin requires. This channel rule will never match, but it will cause SPS to evaluate if a user is a member of those groups, and will make them available for the plugin if so.

Note that only groups queried by SPS are affected. Gateway groups returned by the AA plugin authenticate() hook are passed to the authorize() hook unchanged.

Authorizing connections to the target hosts with a SPS plugin

Purpose:

To configure SPS to use an Authentication and Authorization plugin before accessing the target host, complete the following steps.

Prerequisites:
Steps:
  1. To upload the custom plugin you received, navigate to Basic Settings > Plugins, browse for the file and click Upload. Note that it is not possible to upload or delete plugins if SPS is in sealed mode.

    Your plugin .zip file may contain an optional sample configuration file. This file serves to provide an example configuration that you can use as a basis for customization if you wish to adapt the plugin to your site's needs.

  2. If your plugin supports configuration, then you can create multiple customized configuration instances of the plugin for your site. Create an instance by completing the following steps:

    1. Go to Policies > AA Plugin Configurations. Select the plugin to use from the Plugin list.

    2. The Configuration textbox displays the example configuration of the plugin you selected. You can edit the configuration here if you wish to create a customized instance of the plugin.

      NOTE:

      Plugins created and issued before the release of SPS 5 F1 do not support configuration. If you create a configuration for a plugin that does not support this, the affected connection will stop with an error message.

      Figure 253: Policies > AA Plugin Configurations — Creating a customized plugin configuration instance

  3. Navigate to the Connection policy where you want to use the plugin (for example, to RDP Control > Connections), select the plugin configuration instance to use in the AA plugin field, then click Commit.

  4. If the plugin sets or overrides the gateway username of the connection, configure a Usermapping policy and use it in the Connection policy. For details, see "Configuring usermapping policies" in the Administration Guide.

  5. Verify that the configuration works properly: try to establish a test connection. For details, see "Performing authentication with AA plugin in Remote Desktop connections" in the Administration Guide. If the plugin is configured to store any metadata about the connection, these data will be available in the Additional metadata field of the SPS Search interface.

Performing authentication with AA plugin in terminal connections

Purpose:

To establish a terminal connection (SSH, TELNET, or TN3270) to a server, complete the following steps.

Steps:
  1. Connect to the server.

    To encode additional data as part of the username, you can use the @ as a field separator, for example:

    ssh token_id=id@user@server

    Replace id with your actual token ID.

  2. If SPS prompts you for further information (for example, a one-time password), enter the requested information.

  3. Authenticate on the server.

  4. If authentication is successful, you can access the server.

Performing authentication with AA plugin in Remote Desktop connections

Purpose:

To establish a Remote Desktop (RDP) connection to a server when the AA plugin is configured, complete the following steps.

Steps:
  1. Open your Remote Desktop client application.

  2. If you have to provide additional information to authenticate on the server, you must enter this information in your Remote Desktop client application into the User name field, before the regular content (for example, your username) of the field.

    To encode additional data, you can use the following special characters:

    • % as a field separator

    • ~ as the equal sign

    • ^ as a colon (for example, to specify the port number or an IPv6 IP address)

    For example, to add a token ID before your username, use the following format:

    domain\token_id~12345%Administrator

    Note how domain information is provided. If your server is in a domain, make sure that you specify the domain in this format: putting it in front, followed by a backslash (\).

  3. Connect to the server.

  4. If SPS prompts you for further information (for example, a one-time password), enter the requested information.

  5. Authenticate on the server.

  6. If authentication is successful, you can access the server.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating