Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 6.4.0 - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS) The Welcome Wizard and the first login Basic settings
Supported web browsers and operating systems The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving and cleanup Forwarding data to third-party systems Joining to One Identity Starling
User management and access control Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing Safeguard for Privileged Sessions (SPS) clusters Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings MSSQL-specific settings RDP-specific settings SSH-specific settings Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search interface Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) RPC API The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS) Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help Configuring SPS to use an LDAP backend Glossary

Filtering

The tables can be filtered for any parameter, or a combination of parameters. To filter the list, enter the filter expression in the input field of the appropriate column, and pressEnter, or click on an entry in the table.

NOTE:

When you use filters, the bars display the statistics of the filtered results.

Filtering displays also partial matches. For example, filtering the Author column on the AAA > Accounting screen for adm displays all changes performed by users whose username contains the adm string.

You can use the icon to perform an exact search, and the icon for inverse filtering ("does not include"). To clear filters from a column, click .

To restore the original table, click Clear all filters.

Exporting the results

To save the table of search results as a file, click Export as CSV. This saves the table as a text file containing comma-separated values. Note that if an error occurs when exporting the data, the exported CSV file will include a line (usually as the last line of the file) starting with a zero and the details of the problem, for example 0;description_of_the_error.

Caution:

Do not use Export as CSV to export large amounts of data, as exporting data can be very slow, especially if the system is under heavy load.

Customizing columns of the internal search interface

The following describes how to customize the data displayed on the interface.

To customize the data displayed on the interface

  1. Navigate to the database you want to browse, for example AAA > Accounting.

  2. Click Customize Columns. A pop-up window containing the list of visible and available columns is displayed.

    Figure 81: AAA > Accounting — Customizing columns of the general search interfaces

  3. The displayed parameters are enlisted in the Visible columns field. All other available parameters are enlisted in the Available columns field.

    • To add parameters to the Visible columns field, select the desired parameter(s) and click Add.

    • To remove parameters from the Visible columns field, select the desired parameter(s) and click Remove.

    • To freeze columns (to make them permanently visible, even when scrolling horizontally), enable the Freeze option next to the desired parameter.

    NOTE:

    To select multiple parameters, pressCtrlwhile clicking the items.

  4. Click OK. The selected information is displayed.

Displaying the privileges of users and user groups

One Identity Safeguard for Privileged Sessions (SPS) version 3.2 and later provides an interface to query the user-rights and privileges of individual users and user groups. To display the privileges of a user or usergroup, navigate to AAA > Permission Query, enter the name of the user or group into the respective field, then click Filter. Note that:

  • It is not possible to filter on both the username and the group at the same time.

  • Partial matches are also displayed.

  • Usergroups can be local usergroups, userlists, or LDAP usergroups.

Web interface permissions

For usergroups accessing the SPS web interface, a table is displayed that lists the pages of the SPS web interface that the user or usergroup can access. The following information is displayed:

  • Page: The name of the page or group of pages, for example, Basic Settings.

  • Element: If a group has access only to a section of a page, the name of the element is listed here. For example, a particular Channel Policy.

  • Group: The name of the usergroup.

  • Permission: The type of access that the user or usergroup has to the page: read or read and write/perform.

Figure 82: AAA > Permission Query — Displaying web interface permissions

Connection permissions

To review which servers a user or usergroup can access, SPS collects the main information about the connections the user or group is permitted to use. The following information is displayed.

NOTE:

To display the usergroups that can access a specific Connection Policy, open the Connection Policy, then select Show connection permissions > Show on the Connections page.

Figure 83: AAA > Connection permissions — Displaying connection permissions

  • Gateway group: Lists the group memberships required to access the connection. Group memberships can be restricted at the following places:

    • Connection > Gateway authentication > Groups

    • Channel Policies > Gateway group

    • Policies > Usermapping Policies > Groups

  • Source: Refers to the following field from the session database:

    Source IP: The IP address of the client.

  • To: Refers to the following field from the session database:

    Destination IP: The IP address of the server as requested by the client.

  • To port: Refers to the following field from the session database:

    Destination port: The port number of the server as requested by the client.

  • Target: Refers to the following field from the session database:

    Server IP: The IP address of the server connected by SPS.

  • Target port: Refers to the following field from the session database:

    Server port: The port number of the server connected by SPS.

  • Remote user: Refers to the following field from the session database:

    Username on server: The username used to log in to the remote server. This username can differ from the client-side username if usermapping is used in the connection. For details on usermapping, see Configuring usermapping policies.

  • Remote group: The group that can access the destination server, as set in the Usermapping Policy (if any).

  • Protocol: The protocol used in the connection (Citrix ICA, HTTP, RDP, SSH, Telnet, or VNC).

  • Connection: Refers to the following field from the session database:

    Connection policy ID: The identifier of the connection policy.

  • Authorizer: Refers to the following field from the session database:

    Four-eyes authorizer: The username of the user who authorized the session. Available only if 4-eyes authorization is required for the channel. For details on 4-eyes authorization, see Configuring four-eyes authorization.

  • Auth type: The authentication method used in the client-side connection during gateway authentication.

  • Channel: The type of the channel, for example, session-shell.

  • Time: The name of the Time Policy used in the connection.

  • LDAP: The name of the LDAP Server used in the connection (if any).

  • Credential store: The name of the Credential Store used in the connection (if any).

  • Audit: Indicates if the connection is recorded into audit trails.

Usergroup memberships

When searching for users, the table displays the group memberships of the matching users. When searching for usergroups, the table displays the members of the matching groups. The following information is displayed:

  • User: The username of the user.

  • Group: The name of the usergroup or userlist.

  • Exception: Usernames that are denied in case of default-deny userlists managed locally on SPS.

Figure 84: AAA > Connection permissions — Displaying usergroup and userlist memberships

Related Documents