One Identity Safeguard for Privileged Sessions 6.10.0 - Administration Guide

Built-in usergroups of One Identity Safeguard for Privileged Sessions (SPS)

One Identity Safeguard for Privileged Sessions (SPS) has the following usergroups by default. Note that you can modify and delete these usergroups as you see fit.

Figure 94: Users & Access Control > Appliance Access — Built-in usergroups of SPS

• basic-view: View the settings in the Basic Settings menu, including the system logs of SPS. Members of this group can also execute commands on the Troubleshooting tab.

• basic-write: Edit the settings in the Basic Settings menu. Members of this group can manage SPS as a host.

• auth-view: View the names and privileges of the SPS administrators, the configured usergroups, and the authentication settings in the Users & Access Control menu. Members of this group can also view the history of configuration changes.

• auth-write: Edit authentication settings and manage users and usergroups.

  Caution: Members of the auth-write group, or any other group with write privileges to the Users & Access Control menu are essentially equivalent to system administrators of SPS, because they can give themselves any privilege. Users with limited rights should never have such privileges. If a user with write privileges to the Users & Access Control menu gives himself new privileges (for example gives himself group membership to a new group), then he has to relogin to the SPS web interface to activate the new privilege.

• search: Browse and download various logs and alerts in the Search menu. The members of this group have access to the audit trail files as well. Note that to open encrypted audit trail files, the proper encryption keys are required.

• changelog: View the history of SPS configuration changes in the Users & Access Control > Configuration History menu.

• report: Browse, create and manage reports, and add statistics-based chapters to the reports in the Reports menu. Users with this privilege can access every report. To grant access to users only to specific reports, use the Reports are accessible by the following groups option of the report. For details, see Configuring custom reports.

  NOTE: To control exactly which statistics-based chapters and reports can the user include in a report, use the Use static subchapters privileges.

• policies-view: View the policies and settings in the Policies menu.

• policies-write: Edit the policies and settings in the Policies menu.

• ssh-view: View all connection and policy settings in the SSH Control menu.

• ssh-write: Edit all connection and policy settings in the SSH Control menu.

• rdp-view: View all connection and policy settings in the RDP Control menu.

• rdp-write: Edit all connection and policy settings in the RDP Control menu.

• telnet-view: View all connection and policy settings in the Telnet Control menu.

• telnet-write: Edit all connection and policy settings in the Telnet Control menu.

• vnc-view: View all connection and policy settings in the VNC Control menu.

• vnc-write: Edit all connection and policy settings in the VNC Control menu.

• indexing: Allows hosts running external indexers to access and download audit trails for automatic indexing. Note that the members of this group can access the SPS web interface as well, and download any audit trail directly.

• ica-view: View all connection and policy settings in the ICA Control menu.

• ica-write: Edit all connection and policy settings in the ICA Control menu.

• api: View and edit rights for the Access RPC API privilege, to access SPS through RPC.

• http-view: View all connection and policy settings in the HTTP Control menu.

• http-write: Edit all connection and policy settings in the HTTP Control menu.

• indexer-view: View all connection and policy settings in the Indexer menu.

• indexer-write: Edit all connection and policy settings in the Indexer menu.

Creating rules for restricting access to search audit data

If you want users to access audit data on the Search interface only for sessions for which they are granted permission, complete the following steps.

The following describes how you can create rules to restrict the search by providing access privileges for users to audit data.

Prerequisites

1. You have created a local user group as described in Managing local user groups.

2. You have added search access rights to your local user group as described in Assigning privileges to user groups for the One Identity Safeguard for Privileged Sessions (SPS) web interface.

   NOTE: Ensure that you clear the Search in all connections check box as shown below.

   Figure 96: Users & Access Control > Appliance Access — Add search access rights to local user groups

   

3. You have created a local user, and added the user to the local user group. For more information, see Managing user rights and usergroups.

To create search rules to access audit data

1. If you have multiple SPS appliances and they are organized into a cluster where one of the nodes is the Search Master (or Central Search) node, log in to that node.

2. Navigate to Users & Access Control > Audit Data Access.
3. Click Create new.

   Figure 97: Users & Access Control > Audit Data Access — Create new audit data access rule (ADAR)

   

4. In the Name field, enter a name for your rule.
5. In the Groups field, enter an existing local user group for which you want to restrict access to audit data.
6. In the Query field, enter the correct query syntax to define which audit data this user group can access.

7. Optionally, for a quick visualization of the audit data that each group can access with this search query, click Preview.

   TIP: If required, modify the query syntax using the Query field, and the preview is updated accordingly.
   

Displaying the privileges of users and user groups

One Identity Safeguard for Privileged Sessions (SPS) version 3.2 and later provides an interface to query the user-rights and privileges of individual users and user groups. To display the privileges of a user or usergroup, navigate to Users & Access Control > Access Rights Report, enter the name of the user or group into the respective field, then click Filter. Note that:

• It is not possible to filter on both the username and the group at the same time.

• Partial matches are also displayed.

• Usergroups can be local usergroups, userlists, or LDAP usergroups.

Web interface permissions

For usergroups accessing the SPS web interface, a table is displayed that lists the pages of the SPS web interface that the user or usergroup can access. The following information is displayed:

• Page: The name of the page or group of pages, for example, Basic Settings.

• Element: If a group has access only to a section of a page, the name of the element is listed here. For example, a particular Channel Policy.

• Group: The name of the usergroup.

• Permission: The type of access that the user or usergroup has to the page: read or read and write/perform.

Figure 101: Users & Access Control > Access Rights Report — Displaying web interface permissions

Connection permissions

To review which servers a user or usergroup can access, SPS collects the main information about the connections the user or group is permitted to use. The following information is displayed.

Figure 102: Users & Access Control > Connection permissions — Displaying connection permissions

• Gateway group: Lists the group memberships required to access the connection. Group memberships can be restricted at the following places:

  • Connection > Gateway authentication > Groups

  • Channel Policies > Gateway group

  • Policies > Usermapping Policies > Groups

• Source: Refers to the following field from the session database:

  Source IP: The IP address of the client.

• To: Refers to the following field from the session database:

  Destination IP: The IP address of the server as requested by the client.

• To port: Refers to the following field from the session database:

  Destination port: The port number of the server as requested by the client.

• Target: Refers to the following field from the session database:

  Server IP: The IP address of the server connected by SPS.

• Target port: Refers to the following field from the session database:

  Server port: The port number of the server connected by SPS.

• Remote user: Refers to the following field from the session database:

  Username on server: The username used to log in to the remote server. This username can differ from the client-side username if usermapping is used in the connection. For details on usermapping, see Configuring usermapping policies.

• Remote group: The group that can access the destination server, as set in the Usermapping Policy (if any).

• Protocol: The protocol used in the connection (Citrix ICA, HTTP, RDP, SSH, Telnet, or VNC).

• Connection: Refers to the following field from the session database:

  Connection policy ID: The identifier of the connection policy.

• Authorizer: Refers to the following field from the session database:

  Four-eyes authorizer: The username of the user who authorized the session. Available only if 4-eyes authorization is required for the channel. For details on 4-eyes authorization, see Configuring four-eyes authorization.

• Auth type: The authentication method used in the client-side connection during gateway authentication.

• Channel: The type of the channel, for example, session-shell.

• Time: The name of the Time Policy used in the connection.

• LDAP: The name of the LDAP Server used in the connection (if any).

• Credential store: The name of the Credential Store used in the connection (if any).

• Audit: Indicates if the connection is recorded into audit trails.

Usergroup memberships

When searching for users, the table displays the group memberships of the matching users. When searching for usergroups, the table displays the members of the matching groups. The following information is displayed:

• User: The username of the user.

• Group: The name of the usergroup or userlist.

• Exception: Usernames that are denied in case of default-deny userlists managed locally on SPS.

Figure 103: Users & Access Control > Connection permissions — Displaying usergroup and userlist memberships

Listing and searching configuration changes

One Identity Safeguard for Privileged Sessions (SPS) automatically tracks every change of its configuration. To display the history of changes, select Users & Access Control > Configuration History. The changes are displayed on a search interface. For more information on using and customizing this interface, see Using the internal search interface.

The following information is displayed about each modification:

Figure 104: Users & Access Control > Configuration History — Browsing configuration changes

• Timestamp: The date of the modification.

• Author: Username of the administrator who modified the configuration of SPS.

• Page: The menu item that was modified.

• Field name: The name of the field or option that was modified.

• New value: The new value of the configuration parameter.

• Message: The changelog or commit log that the administrator submitted. This field is available only if the Require commit log option is enabled (see below).

• Old value: The old value of the configuration parameter.

• Swap: Signs if the order of objects was modified on the page (for example the order of two policies in the list).

To request the administrators to write an explanation to every configuration change, navigate to Users & Access Control > Settings > Accounting settings and select the Require commit log option.