How you should name usergroups depends on the way you manage your One Identity Safeguard for Privileged Sessions (SPS) users.
Local users: If you use only local users, create or modify usergroups on the AAA > Group Management page, assign or modify privileges on the AAA > Access Control page, and add users to the groups on the AAA > Local Users or the AAA > Group Management page.
LDAP users and LDAP groups: If you manage your users from LDAP, and also have LDAP groups that match the way you want to group your SPS users, create or modify your usergroups on the AAA > Access Control page and ensure that the name of your LDAP group and the SPS usergroup is the same. For example, to make members of the admins LDAP group be able to use SPS, create a usergroup called admins on the AAA > Access Control page and edit the privileges of the group as needed.
RADIUS users and local groups: This is the case when you manage users from RADIUS, but you cannot or do not want to create groups in LDAP. Create your local groups on the AAA > Access Control page, and add your RADIUS users to these groups on the AAA > Group Management page.
One Identity Safeguard for Privileged Sessions (SPS) has the following usergroups by default. Note that you can modify and delete these usergroups as you see fit.
Figure 78: AAA > Access Control — Built-in usergroups of SPS
If you use LDAP authentication on the SPS web interface and want to use the default usergroups, you have to create these groups in your LDAP database and assign users to them. For details on using usergroups, see Using usergroups.
basic-view: View the settings in the Basic Settings menu, including the system logs of SPS. Members of this group can also execute commands on the Troubleshooting tab.
basic-write: Edit the settings in the Basic Settings menu. Members of this group can manage SPS as a host.
auth-view: View the names and privileges of the SPS administrators, the configured usergroups, and the authentication settings in the AAA menu. Members of this group can also view the history of configuration changes.
auth-write: Edit authentication settings and manage users and usergroups.
Members of the auth-write group, or any other group with write privileges to the AAA menu are essentially equivalent to system administrators of SPS, because they can give themselves any privilege. Users with limited rights should never have such privileges.
If a user with write privileges to the AAA menu gives himself new privileges (for example gives himself group membership to a new group), then he has to relogin to the SPS web interface to activate the new privilege.
search: Browse and download various logs and alerts in the Search menu.
changelog: View the history of SPS configuration changes in the AAA > Accounting menu.
report: Browse, create and manage reports, and add statistics-based chapters to the reports in the Reports menu. Users with this privilege can access every report. To grant access to users only to specific reports, use the Reports are accessible by the following groups option of the report. For details, see Configuring custom reports.
To control exactly which statistics-based chapters and reports can the user include in a report, use the Use static subchapters privileges.
policies-view: View the policies and settings in the Policies menu.
policies-write: Edit the policies and settings in the Policies menu.
ssh-view: View all connection and policy settings in the SSH Control menu.
ssh-write: Edit all connection and policy settings in the SSH Control menu.
rdp-view: View all connection and policy settings in the RDP Control menu.
rdp-write: Edit all connection and policy settings in the RDP Control menu.
telnet-view: View all connection and policy settings in the Telnet Control menu.
telnet-write: Edit all connection and policy settings in the Telnet Control menu.
vnc-view: View all connection and policy settings in the VNC Control menu.
vnc-write: Edit all connection and policy settings in the VNC Control menu.
indexing: Allows hosts running external indexers to access and download audit trails for automatic indexing. Note that the members of this group can access the SPS web interface as well, and download any audit trail directly.
ica-view: View all connection and policy settings in the ICA Control menu.
ica-write: Edit all connection and policy settings in the ICA Control menu.
api: View and edit rights for the Access RPC API privilege, to access SPS through RPC.
http-view: View all connection and policy settings in the HTTP Control menu.
http-write: Edit all connection and policy settings in the HTTP Control menu.
indexer-view: View all connection and policy settings in the Indexer menu.
indexer-write: Edit all connection and policy settings in the Indexer menu.
One Identity Safeguard for Privileged Sessions (SPS) automatically tracks every change of its configuration. To display the history of changes, select AAA > Accounting. The changes are displayed on a search interface. For more information on using and customizing this interface, see Using the internal search interface.
The following information is displayed about each modification:
Figure 79: AAA > Accounting — Browsing configuration changes
Timestamp: The date of the modification.
Author: Username of the administrator who modified the configuration of SPS.
Page: The menu item that was modified.
Field name: The name of the field or option that was modified.
New value: The new value of the configuration parameter.
Message: The changelog or commit log that the administrator submitted. This field is available only if the Require commit log option is enabled (see below).
Old value: The old value of the configuration parameter.
Swap: Signs if the order of objects was modified on the page (for example the order of two policies in the list).
To request the administrators to write an explanation to every configuration change, navigate to AAA > Settings > Accounting settings and select the Require commit log option.
The internal search interface is for browsing and filtering the configuration changes and reports of One Identity Safeguard for Privileged Sessions (SPS).
Figure 80: AAA > Accounting — The internal search interface
The bars display the number of results in the selected interval. Use the and icons to zoom, and the arrows to display the previous or the next intervals. To explicitly select a date, select Jump to and set the date in the calendar. You can change the length of the displayed interval with the Scale option.
Hovering the mouse above a bar displays the number of entries and the start and end date of the period that the bar represents. Click a bar to display the entries of that period in the table. Use Shift+Click to select multiple bars.
If data is too long to fit on one line, it is automatically wrapped and only the first line is displayed. To expand a row, click . To shrink the row back to its original size, click . To expand/shrink all rows, click the respective button on the header of the table. The rows can also be expanded/shrunk by double clicking on the respective row.