Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 2.5 - Administration Guide

Introduction System requirements Installing the One Identity Safeguard for Privileged Passwords desktop client Setting up Safeguard for Privileged Passwords for the first time Getting acquainted with the console Privileged access requests Toolbox Accounts Account Groups Assets Asset Groups Directories Entitlements Partitions Settings
Access Request settings Appliance settings Asset Management settings Backup and Retention settings Certificate settings Cluster settings External Integration settings Messaging settings Profile settings Access settings Sessions settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions
How do I access the API How do I audit transaction activity How do I configure external federation authentication How do I manage accounts on unsupported platforms How do I modify the appliance configuration settings How do I prevent Safeguard for Privileged Passwords messages when making RDP connections How do I see which assets and/or accounts are governed by a profile How do I set the appliance system time How do I setup discovery jobs How do Safeguard for Privileged Passwords database servers use SSL What are the access request states What do I do when an appliance goes into quarantine What is required for One Identity Safeguard for Privileged Passwords, embedded sessions module What is required to integrate with Starling Identity Analytics & Risk Intelligence What needs to be set up to use Application to Application What role-based email notifications are generated by default When does the rules engine run for dynamic grouping and tagging Why did the password change during an open request Why join Safeguard for Privileged Passwords to One Identity Starling
Safeguard Desktop Player Appendix: Safeguard ports

Assets

A Safeguard for Privileged Passwords asset is a computer, server, network device, or application managed by a Safeguard for Privileged Passwords Appliance.

It is the responsibility of the Asset Administrator to add assets and accounts to Safeguard for Privileged Passwords.The Auditor has permission to access Assets.

Before adding assets to Safeguard for Privileged Passwords, you must ensure they are properly configured. For more information, see Preparing systems for management.

Each asset can have associated accounts (user, group, and service) identified on the Accounts tab. If an asset is deleted, associated accounts are deleted.

All assets must be governed by a profile identified on the General tab. All new assets are automatically governed by the default profile unless otherwise specified.

An asset can only be in one partition at a time identified on the General tab. When you add an asset to a partition, all accounts associated with that asset are automatically added to that partition.

Asset discovery jobs run automatically against the directories you have added For information about configuring asset discovery in Safeguard for Privileged Passwords, see Asset discovery job workflow.

The Assets view displays the following information about the selected system.

Table 48: Assets: Tabs
Tab Description
General tab Displays general, management and connection settings for the selected asset.
Accounts tab Displays the accounts associated with this asset.
Account Dependencies tab Windows only: Displays the directory accounts that the selected Windows server depends on to perform services and tasks.

Access Request Policies tab

Displays the entitlements and access request policies associated with the selected asset.

Asset Groups tab

Displays the asset groups that contain the selected asset.
History tab Displays the details of each operation that has affected the selected asset.

Use these toolbar buttons to manage assets.

Table 49: Assets: Toolbar
Option Description

Add | Asset

Add assets to Safeguard for Privileged Passwords. For more information, see Adding an asset.
Delete Selected

Remove the selected asset. For more information, see Deleting an asset.

Important: When you delete an asset, you also permanently delete all the Safeguard for Privileged Passwords accounts associated with the asset.

Refresh Update the list of assets.
Import Assets Add assets to Safeguard for Privileged Passwords. For more information, see Importing objects.
Discovery Add or manage asset discovery jobs. For more information, see Discovery.

Download SSH Key

Add the SSH key to the selected asset. For more information, see Downloading a public SSH key.

Access Request

Allows you to enable or disable access request services for the selected asset. Menu options include:

  • Enable Session Request
  • Disable Session Request
Show Ignored Display the hidden assets.
Hide Ignored Hide assets marked as "Ignore".

Right click on an asset to use these context menu options.

Table 50: Assets context menu options
Option Description
Discover SSH Host Key

This option only applies to assets that exchange SSH host keys, such as Unix-based assets and Linux-based assets.

Retrieves the latest SSH host key for the selected asset. The Discover SSH Host Key dialog also tells you when the SSH host key is up to date.

If the SSH host key is not discovered on the asset (either via a discovery or import), certain tasks will not be available for accounts associated with the asset, such as Check System, Check Password, Change Password.

Check Connection

Select to verify that Safeguard for Privileged Passwords can log into the asset using the current service account credentials. For more information, see Checking an asset's connectivity.

Download SSH Key Add the SSH key to the selected asset.

Manage - Ignore

Select Manage to have Safeguard for Privileged Passwords manage an "ignored" asset. This option is only available for assets that have been ignored.

Select Ignore to prevent Safeguard for Privileged Passwords from managing the selected asset. When you ignore an asset, Safeguard for Privileged Passwords disables it and removes all associated accounts. If you choose to Manage the asset later, Safeguard for Privileged Passwords re-enables all the associated accounts.

Access Requests

Select Enable Session Request to allow session requests for the selected asset.

Select Disable Session Request to disallow session requests for the selected asset.

Discover Accounts Runs a discovery job to find accounts on the selected asset. From the tasks pane, select Show Accounts to open the Partitions view to view the accounts found.
Delete Selected

Remove the selected asset from Safeguard for Privileged Passwords.

Important: When you delete an asset, you also permanently delete all the Safeguard for Privileged Passwords accounts associated with the asset.

General tab

Navigation: Administrative Tools | Assets | General

The General tab lists information about the selected asset.

Large tiles at the top of the tab display the number of Accounts, Account Dependencies (when applicable), Access Request Policies and Asset Groups associated with the selected asset. Clicking a tile heading opens the corresponding tab.

NOTE: The Asset Groups tile is only visible to the Auditor.

Table 51: Assets General tab: General properties
Property Description
Name The asset name.
Partition The name of the partition where the selected asset resides.
Profile

The name of the profile that manages the asset's accounts.

NOTE: All assets must be governed by a profile. All new assets are automatically governed by the default profile unless otherwise specified.

License Type

Indicates your license model.

Last Successful Account Discovery

The date and time of the last successful account discovery job.

Next Account Discovery

The date and time of the next automated account discovery job as set in the Account Discovery schedule of the partition profile. (For more information, see Creating a partition profile.)

Directory

The name of the directory where the asset was discovered.

This property is only displayed for assets discovered from a directory.

Domain Name

The name of the domain where the asset was discovered.

This property is only displayed for assets discovered from a directory.

NetBios name

The NetBios name of the asset that was discovered.

This property is only displayed for assets discovered from a directory.

Distinguished Name

The distinguished name of the asset that was discovered.

This property is only displayed for assets discovered from a directory.

Table 52: Assets General tab: Management properties
Property Description
Product The platform of the selected managed system.
Version The operating system version.

Architecture

The operating system architeture.

Network Address The network DNS name or IP address of the managed system.
Enable Session Request True or False, indicating whether session access requests are enabled for the asset.
RDP Session Port The access port on the target server used for RDP session access requests.
SSH Session Port The access port on the target sever used for SSH session access requests.

Managed Network

The managed network that is assigned for work load balancing. For more information, see Managed Networks.

Table 53: Assets General properties: Connection properties
Property Description
Authentication Type How the console connects with the managed system. For more information, see Connection tab.
Service Account Name The account used by Safeguard for Privileged Passwords to securely manage accounts and passwords on the asset.
Connection Timeout The session timeout period.
Privilege Elevation Command Displays the elevation command (such as sudo) if it is populated on the Connection tab.
Port The port used by SSH to log into the managed system.
SSH Host Key Fingerprint The fingerprint of the SSH key that Safeguard for Privileged Passwords uses to authenticate to the asset.
SSH Key Comment Human-readable information about the SSH key.
SSH Host Key Fingerprint

The managed system's public host key fingerprint.

When an asset requiring an SSH host key does not have one, Check Password will fail. For more information, see Connectivity failures.

CheckSystem (custom platform script)

True if the service account has access to the remote host. See the wiki: Writing a custom platform script.

CheckPassword (custom platform script)

True if the given account user and password are valid on the remote host. See the wiki: Writing a custom platform script.

ChangePassword (custom platform script)

True if the password for the given user on the remote host. See the wiki: Writing a custom platform script.

Tags: Tag assignments for the selected asset.

The tiles listed under in the Tags pane display both the dynamic tags assigned to the asset through tagging rules and static tags that were added manually. In addition to viewing tag assignments, Asset Administrators can add and remove statically assigned tags using this pane.

Description: Information about the selected asset.

Related Topics

Assigning an asset to a partition

Assigning a profile to an asset

Modifying an asset

Accounts tab

Navigation: Administrative Tools | Assets | Accounts

An asset's Accounts tab displays the accounts associated with this asset.

Click Add Account from the details toolbar to associate an account with the selected asset.

Table 54: Assets: Accounts tab properties
Property Description

Name

Name of an account associated with the selected asset.

NOTE: While you can associate an account with only one asset, you can log into an asset with more than one account.

Profile

The name of the profile that manages the account.

Service Account

A check in this column indicates that the account is a service account.

Password Request

A check in this column indicates that password release requests are enabled for the account.

NOTE: Click Access Requests from the details toolbar to enable or disable a user's ability to request access to the selected account.

Session Request

A check in this column indicates that session access requests are enabled for the account.

NOTE: Click Access Requests from the details toolbar to enable or disable a user's ability to request access to the selected account.

Needs a Password

Displays if a password is not set for the account. For more information, see Checking, changing, or setting an account password.

Description

Descriptive information entered when the account was added.

Use these buttons on the details toolbar to manage your asset accounts.

Table 55: Assets: Accounts tab toolbar
Option Description
Add Account

Add accounts to the selected asset. For more information, see Adding an account to an asset.

Delete Selected

Remove the selected account from the asset.

Refresh

Update the list of asset accounts.

Account Security

Menu options include: Check Password, Change Password, and Set Password. For more information, see Checking, changing, or setting an account password.

Password Archive

Display the password history for the selected asset account. For more information, see Viewing password archive.

Access Requests

Select an option to enable or disable access request services for the selected account. Menu options include:

  • Enable Password Request
  • Disable Password Request
  • Enable Session Request
  • Disable Session Request

NOTE: Access request services are enabled by default for all accounts added directly to Safeguard for Privileged Passwords, except for service accounts. Access request services are disabled by default for all discovered accounts.

Set Profile

Select a profile to manage the selected asset account.

Search

To locate a specific asset account or set of accounts in this list, enter the character string to be used to search for a match. For more information, see Search box.

Account Dependencies tab

Navigation: Administrative Tools | Assets | Account Dependencies

The Account Dependencies tab displays the directory accounts that the selected Windows server depends on to perform services and tasks. The Account Dependencies tab is only applicable for a Windows platform when one or more directories have been added to Safeguard for Privileged Passwords.

Click  Add Account from the details toolbar to associate account dependencies with the selected asset.

Table 56: Assets: Account Dependencies tab properties
Property Description

Name

Name of a directory account.

Directory

The directory in which the account resides.

Domain Name

The forest root domain name for the directory.

Distinguished Name

The distinguished name for a directory account.

Description

Description of the dependent account.

Related Topics

Adding account dependencies

Related Documents