Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 5.9.0 - Administration Guide

Preface Introduction The concepts of SPS The Welcome Wizard and the first login Basic settings User management and access control Managing SPS
Controlling SPS: reboot, shutdown Managing Safeguard for Privileged Sessions clusters Managing a high availability SPS cluster Upgrading SPS Managing the SPS license Accessing the SPS console Sealed mode Out-of-band management of SPS Managing the certificates used on SPS
General connection settings HTTP-specific settings ICA-specific settings RDP-specific settings SSH-specific settings Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search (classic) interface Using the Search interface Searching session data on a central node in a cluster Advanced authentication and authorization techniques Reports The SPS RPC API The SPS REST API SPS scenarios Troubleshooting SPS Configuring external devices Using SCP with agent-forwarding Security checklist for configuring SPS Jumplists for in-product help Third-party contributions About us

Assigning privileges to usergroups for the SPS web interface

Purpose:

To assign privileges to a new group, complete the following steps:

Steps:
  1. Navigate to AAA > Access Control and click .

  2. Find your usergroup. If you start typing the name of the group you are looking for, the autocomplete function will make finding your group easier for you.

  3. Click Edit located next to the name of the group. The list of available privileges is displayed.

  4. Select the privileges (pages of the SPS interface) to which the group will have access and click Save.

    NOTE:

    To export the configuration of SPS, the Export configuration privilege is required.

    To import a configuration to SPS, the Import configuration privilege is required.

    To update the firmware and set the active firmware, the Firmware privilege is required.

  5. Select the type of access (read or read & write) from the Type field.

  6. Click Commit.

Modifying group privileges

Purpose:

To modify the privileges of an existing group, complete the following steps:

Steps:
  1. Navigate to AAA > Access Control.

  2. Find the group you want to modify and click Edit. The list of available privileges is displayed.

  3. Select the privileges (pages of the SPS interface) to which the group will have access and click Save.

    Figure 73: AAA > Access Control > Edit — Modifying group privileges

    Caution:

    Assigning the Search privilege to a user on the AAA page automatically enables the Search in all connections privilege, and grants the user access to every audit trail, even if the user is not a member of the groups listed in the Access Control option of the particular connection policy.

  4. Select the type of access (read or read & write) from the Type field.

  5. Click Commit.

The admin user is available by default and has all privileges. It is not possible to delete this user.

Finding specific usergroups

The Filter ACLs section of the AAA > Access Control page provides you with a simple searching and filtering interface to search the names and privileges of usergroups.

Figure 74: AAA > Access Control — Finding specific usergroups

  • To filter on a specific usergroup, enter the name of the group into the Group field and select Search.

  • To select usergroups who have a specific privilege, click , select the privilege or privileges you are looking for, and click Search.

  • To filter for read or write access, use the Type option.

Using usergroups

How you should name usergroups depends on the way you manage your SPS users.

  • Local users: If you use only local users, create or modify usergroups on the AAA > Group Management page, assign or modify privileges on the AAA > Access Control page, and add users to the groups on the AAA > Local Users or the AAA > Group Management page.

  • LDAP users and LDAP groups: If you manage your users from LDAP, and also have LDAP groups that match the way you want to group your SPS users, create or modify your usergroups on the AAA > Access Control page and ensure that the name of your LDAP group and the SPS usergroup is the same. For example, to make members of the admins LDAP group be able to use SPS, create a usergroup called admins on the AAA > Access Control page and edit the privileges of the group as needed.

  • RADIUS users and local groups: This is the case when you manage users from RADIUS, but you cannot or do not want to create groups in LDAP. Create your local groups on the AAA > Access Control page, and add your RADIUS users to these groups on the AAA > Group Management page.

Related Documents