Chat now with support
Chat with Support

Safeguard Authentication Services 4.1.5 - Upgrade Guide

One Identity Privileged Access Suite for Unix Introducing One Identity Authentication Services What's new in Authentication Services 4.1 Upgrade from 3.5 to 4.1 considerations Upgrade the web console Upgrade Authentication Services Windows components Configure Active Directory for Authentication Services Configure Unix agent components Upgrade Authentication Services client components manually Getting started with Authentication Services Troubleshooting

Version 3 compatibility mode

When upgrading to or installing Authentication Services 4.1, you can choose not to configure Active Directory for Authentication Services and run your Authentication Services client agent in "Version 3 Compatibility Mode". While this prevents you from running the Control Center and accessing its many features and tools, you can join a host to an Active Directory domain when operating in "Version 3 Compatibility Mode".

Note: When you run the join command without first creating a One Identity Application Configuration, Authentication Services displays a warning.

Without the Authentication Services application configuration the following information is stored locally:

  • Application Licenses
  • Settings controlling default values and behavior for Unix-enabled users and groups
  • Schema configuration
Default User Login Name Changes

In VAS 3.5.x, the default user login name was the User Principal Name; Authentication Services 4.1 uses the sAMAccountName as the default user login name. After upgrading to 4.1, if you want to continue to login with the User Principal Name, then you must ensure that the username-attr-name in the vas.conf file is set to the User Principal Name before you begin the client agent upgrade.

Note: This is not necessary if the value of the User Principal Name prefix and the sAMAccountName are the same across your enterprise, which is the Active Directory default.

There are two ways to change the username-attr-name in the vas.conf file:

  1. Manually configure each client agent to use the User Principal Name.

    To manually configure each client agent to use the User Principal Name

    1. Before you upgrade each client agent, open the /etc/opt/quest/vas/vas.conf file and find the username-attr-name attribute in the [vasd] section.
    2. If there is no value set for this attribute, then set it to: 
      username-attr-name = userPrincipalName

    Note: If the attribute is already explicitly set to another value (such as: username-attr-name = uid), do not change it.

    Alternatively, you can run the following command on each client to change the setting in vas.conf: 

    vastool configure vas vasd username-attr-name userprincipalname

  2. Use Group Policy to automatically configure all the clients in your environment.

    To automatically configure all the clients in your environment

    1. Open the Group Policy Management Editor and navigate to Computer Configuration | Policies | Unix Settings | Quest Authentication Services | Client Configuration.

      Note: Your version of Group Policy Management Editor may not have the Policies directory layer.

    2. Double click Authentication Services Configuration to open the Properties.
    3. Enter username-attr-name in the vas.conf Settings box and click Search.
    4. Enter userPrincipalName and click OK.
Best Practice

Because Version 3 Compatibility Mode does not allow you run the Control Center and access its many features and tools, One Identity recommends that you create the application configuration so you can utilize full Authentication Services 4.1 functionality.

There are two ways to create the application configuration:

  1. When you start the Control Center from a Windows workstation, the Set up Authentication Services Active Directory Configuration Wizard starts automatically to lead you through the process of configuring Active Directory for Authentication Services.
  2. Alternatively, you can run vastool configure ad from the Unix command line to create the One Identity Application Configuration in Active Directory.

Configure Unix agent components

The Control Center gives you access to the tools you need to perform Unix identity management tasks.

Note: If the Control Center is not currently open, you can either double-click the desktop icon or access it by means of the Start menu.

Follow the steps outlined on the Control Center Home page to get your Unix agents ready.

Note: Of course, you can install Authentication Services without using Management Console for Unix. You can find those instructions in the Installing and Joining from the Unix Command Line section of the Authentication Services Installation Guide, located in Control Center Tools view or in the docs directory of the installation media. However, for the purposes of the examples in this guide, it is assumed that you will install and configure the Authentication Services Unix agent components by means of Management Console for Unix.

To start the mangement console

  1. From the Control Center, click the Management Console link in the left-navigation pane.

Setup Management Console for Unix

The first time you launch the mangement console, the Setup Management Console for Unix wizard leads you through some post-installation configuration steps. Choose one of these options:

  • Skip the Active Directory configuration, I'll do that later from the console

    This option allows you to use the core features of the console and limits access to the console to the default supervisor account only.

  • Walk me through the configuration steps for using AD user accounts for logon to the console

    When you configure the console for Active Directory, you unlock additional Active Directory features.

    Note: To use the mangement console with Authentication Services, or to use roles to allow access to the console using Active Directory, you must configure the console for Active Directory log on.

Choose an option and click Next.

Note: If you choose the Skip option, the Identify Console dialog displays. (For more information, see Identify Console.)

If you choose the Walk me through option, it allows you to configure the console for Active Directory log on. (See Configure the Console for Active Directory on the mangement console online Help for details.)

Note: If you can not configure the console for Active Directory during your initial installation of Management Console for Unix, choose the Skip option. After the installation, log into the console as supervisor and configure the console for Active Directory from System Settings. (See Active Directory Configuration in the mangement console online Help for more information.)

Configure the console for Active Directory logon

The Setup Management Console for Unix wizard opens the Configure Console for Active Directory Logon dialog when you choose the Walk me through the configuration steps for using AD user accounts for logon to the console option.

To configure the mangement console for Active Directory logon

  1. On the Configure console for Active Directory Logon dialog, enter a valid Active Directory domain in the forest, in the form example.com.

  2. Enter the credentials for an Active Directory account that has log-on rights.

    Enter a sAMAccountName, which uses the default domain or a User Principal Name, as in username@domain. The wizard uses these credentials to configure the mangement console for use with Active Directory.

    Note: This is a read-only operation; no changes are made to Active Directory.

  3. Click Connect to Active Directory.

  4. When you see the message that indicates the console connected to Active Directory successfully, click Next.

    The Set up console access by role dialog opens.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating