Credential Stores offer a way to store user credentials (for example, passwords, private keys, certificates) and use them to log in to the target server, without the user having access to the credentials. That way, the users only have to perform gateway authentication on SPS with their usual password (or to an LDAP database), and if the user is allowed to access the target server, SPS automatically logs in using the Credential Store.
For more information on gateway authentication, see Configuring gateway authentication.
NOTE: Keyboard-interactive authentication is not supported when using credential stores.
Figure 7: Authenticating using Credential Stores
Credential Stores can be stored locally on SPS, or on a remote device. For remote Credential Stores, SPS integrates with external authentication and authorization systems using plugins.
-
To configure a local Credential Store, see Configuring local Credential Stores.
-
To configure a local, password-protected Credential Store, see Configuring password-protected Credential Stores.
-
To unlock a local, password-protected Credential Store, see Unlocking Credential Stores.
-
To configure a custom Credential Store plugin, see Using a custom Credential Store plugin to authenticate on the target hosts.
NOTE: After performing a successful gateway authentication, if the credential store does not contain a password for the user, the user is prompted for the server-side password as a fallback.
In case of authenticating to RDP servers using Network Level Authentication (NLA), the server-side password is prompted at the start of the connection. If there is no password in the credential store for the user and the server-side password is incorrect, the connection is terminated.