One Identity Safeguard 2.5 - Administration Guide

Introduction System requirements Installing the One Identity Safeguard for Privileged Passwords desktop client Setting up Safeguard for Privileged Passwords for the first time Getting acquainted with the console Privileged access requests Toolbox Accounts Account Groups Assets Asset Groups Directories Entitlements Partitions Settings
Access Request settings Appliance settings Asset Management settings Backup and Retention settings Certificate settings Cluster settings External Integration settings Messaging settings Profile settings Access settings Sessions settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions
How do I access the API How do I audit transaction activity How do I configure external federation authentication How do I manage accounts on unsupported platforms How do I modify the appliance configuration settings How do I prevent Safeguard for Privileged Passwords messages when making RDP connections How do I see which assets and/or accounts are governed by a profile How do I set the appliance system time How do I setup discovery jobs How do Safeguard for Privileged Passwords database servers use SSL What are the access request states What do I do when an appliance goes into quarantine What is required for One Identity Safeguard for Privileged Passwords, embedded sessions module What is required to integrate with Starling Identity Analytics & Risk Intelligence What needs to be set up to use Application to Application What role-based email notifications are generated by default When does the rules engine run for dynamic grouping and tagging Why did the password change during an open request Why join Safeguard for Privileged Passwords to One Identity Starling
Safeguard Desktop Player Appendix: Safeguard ports

Modifying a directory account tag

Use the Edit button on the Directory Tags pane on the Asset Management settings page to modify a directory account tag.

To modify a directory account tag

  1. Navigate to Administrative Tools | Settings | Asset Management | Directory Tags.
  2. Select the tag to be modified.
  3. Select the toolbar button.

    The Directory Tag dialog displays allowing you to modify the selected tag.

  4. On the General tab, you can modify the following settings:

    • Name
    • Description

    NOTE: You cannot modify the directory assignment of an existing tag using the Edit operation. Use the Copy operation to clone the tag and assign it to an additional directory. Use the Delete operation to remove the tag from the existing directory.
  5. On the Directory Account Rules tab, you can modify the conditions for the directory account rule.

    • Don't include a directory account rule for this tag: Select this check box if you do not want to include a directory account rule. Selecting this check box disables the rule editor controls on this page. Proceed to the next tab.
    • Rule editor: Use the rule editor to modify the conditions for tagging directory accounts.

      Table 157: Directory Account Rules tab: Rule editor controls
      Property Description

      AND | OR

      Click AND to "and" multiple search criteria together; where all criteria must be met in order to be included.

      Click OR to "or" multiple search criteria together; where at least one of the criteria must be met in order to be included.

      Attribute

      In the first query clause box, select the attribute to be searched. Valid attributes include:

      • Name (Default)
      • Description
      • Platform
      • Disabled
      • Tag
      • Service Name
      • Domain Name
      • NETBIOS Name
      • Distinguished Name
      • SID

      Operator

      In the middle clause query box, select the operator to be used in the search. The operators available depend upon the data type of the attribute selected.

      For string attributes, the operators may include:

      • Contains (Default)
      • Does not contain
      • Starts with
      • Ends with
      • Equals
      • Not equal

      For boolean attributes, the operators may include:

      • Is True
      • Is False

      Search string

      In the last clause query box, enter the search string or value to be used to find a match.

      |

      Click to the left of a search clause to add an additional clause to the search criteria.

      Click to remove the search clause from the search criteria.

      Add Grouping | Remove

      Click the Add Grouping button to add an additional set of conditions to be met.

      A new grouping is added under the last query clause in a group and appears in a bordered pane showing that it is subordinate to the higher level query conditions.

      Click the Remove button to remove a grouping from the search criteria.

      Preview

      Click Preview to run the query in order to review the results of the query before adding the dynamic tag.

    Click Preview at the bottom of the dialog to preview the effects the currently defined rule conditions will have on a group.

  6. On the Summary tab, review your changes and click OK.

Copying a directory account tag to another directory

Dynamic tags for directory accounts belong to a directory. Use the Copy button on the Directory Tags pane on the Asset Management settings page to clone a directory account tag and assign it to a different directory.

NOTE: You cannot modify the directory assignment of an existing tag using the Edit operation. Use the Copy operation to clone the tag and assign it to an additional directory. Use the Delete operation to remove the tag from the existing directory.

To copy a directory account tag to another directory

  1. Navigate to Administrative Tools | Settings | Asset Management | Directory Tags.
  2. Click the toolbar button.

    The Copy to dialog displays allowing you to select one or more directories.

  3. Select the check box for the directories to which the selected tag is to be assigned.

    If you do not see the directory you are looking for, you can create a new directory by clicking Create New. Clicking displays the Directory dialog allowing you to add a directory to Safeguard for Privileged Passwords. For more information, see Adding a directory. You must have Directory Administrator permissions to add directories to Safeguard.

  4. Click OK.

    If a tag with the same name already exits in the selected directory, you will be asked if you want to replace the tag.

Viewing directory account tag assignments

Use the Occurrences button on the Directory Tags pane on the Asset Management page to view a list of all directory accounts assigned to a dynamic tag.

To view directory account tag assignments

  1. Navigate to Administrative Tools | Settings | Asset Management | Directory Tags.
  2. Select a tag definition from the list.
  3. Click the toolbar button.

    The Occurrences dialog displays, which contains a list of all the directory accounts assigned to the selected dynamic tag. This dialog includes the object name.

  4. Use the Search box to locate a specific tag or set of tags in this list. Enter the character string to be used to search for a match.
  5. Click Close to close the dialog and return to the Directory Tags pane.

Tags

Asset administrators can define rules that will dynamically add tags to assets and asset accounts so that they can be easily identified and added to dynamic groups. Use the Administrative Tools | Settings | Asset Management | Tags pane to create and manage dynamic tags for assets and asset accounts.

In addition, Asset administrators can manually add tags to assets and accounts on the General tab of the Assets or Accounts view. For more information, see Manually adding a tag to an asset and Manually adding a tag to an account.

The Tags pane provides a centralized view of all the tags defined for assets and asset accounts, regardless of how they were assigned. It displays the following details.

Table 158: Tags: Properties
Property Description

Name

The name assigned to the tag when it was created.

Asset Partition

The asset partition to which the tag belongs.

Rules

Indicates whether there is a rule associated with the selected tag. A check mark in this column indicates that the tag has an asset or asset account rule.

Description

Information about the tag.

Use these toolbar buttons to manage tags.

Table 159:  Tags: Toolbar
Option Description

New

Add a dynamic tag. For more information, see Adding a tag for dynamic tagging of assets or asset accounts.

Delete

Remove the selected tag. For more information, see Deleting an asset or asset account tag.

Refresh

Update the list of tags.

Edit

Modify the selected tag. For more information, see Modifying an asset or asset account tag.

NOTE: You cannot modify the partition assignment of an existing tag using the Edit operation. Use the Copy operation to clone the tag and assign it to an additional partition. Use the Delete operation to remove the tag from the existing partition.

Copy

Clone the selected tag and assign it to one or more additional partitions. For more information, see Copying an asset or asset account tag to another partition.

NOTE: If the tag already exists in the partition, the tag will be replaced with the cloned one.

Occurrences

View a list of assets and asset accounts that are assigned to the selected tag. For more information, see Viewing asset and asset account tag assignments.

Search

Search for a specific tag or set of tags in this list.

Related Topics

When does the rules engine run for dynamic grouping and tagging

Related Documents