Chat now with support
Chat with Support

Safeguard Authentication Services 4.2.3 - Upgrade Guide

Privileged Access Suite for Unix Introducing One Identity Authentication Services Upgrade the web console Upgrade Authentication Services Windows components Configure Active Directory for Authentication Services Configure Unix agent components Upgrade Authentication Services client components manually Getting started with Authentication Services Troubleshooting

Preferences

Authentication Services stores certain preferences and settings in Active Directory. This information is used by Authentication Services clients and management tools so that behavior remains consistent across all platforms and tools. The Preferences window allows you to configure these settings and preferences:

Licensing

The Licensing section of the Preferences window in the Control Center displays a list of installed license files. You can add and remove license files at any time. The license files are stored in Active Directory and Authentication Services Unix hosts automatically download and apply new license files from Active Directory.

Refer to About Authentication Services licenses for more information about licensing requirements.

Adding licenses using the Control Center

To add licenses using the Control Center

  1. Open the Control Center and click Preferences on the left navigation pane.
  2. Expand the Licensing section.

    The list box displays all licenses currently installed in Active Directory.

  3. Click Actions | Add a license.
  4. Browse for the license file and click Open.

    The license appears in the list box.

    Note: Unix hosts check for new licenses when the host is joined to the domain or every 24 hours by default. This can be changed by modifying the configuration-refresh-interval setting in vas.conf.

  5. To remove a license, select it and click Remove license.
  6. To restore a removed license, click Undo Remove.

Global Unix Options

The Global Unix Options section displays the currently configured options for Unix-enabling users and groups.

Click Modify Global Unix Options to change these settings.

Note: Authentication Services uses the Global Unix Options when enabling users and groups for Unix login.

Table 13: Unix user defaults
Option Description

Require unique user login names

Select to require a unique user login name attribute within the forest.

Require unique UID on users

Select to require a unique user's Unix ID (UID) number within the forest.

Minimum UID Number

Enter a minimum value for the Unix User ID (UID) number.

Typically, you set this to a value higher than the highest UID among local Unix users to avoid conflicts with users in Active Directory and local user accounts.

Maximum UID Number

Enter a maximum value for the Unix User ID (UID) number.

Typically, you would not change this value unless you have a legacy Unix platform that does not support the full 32-bit integer range for UID number.

Primary GID Number

Enter the default value for the Primary GID number when Unix-enabling a user.

Set primary GID to UID

Select to set the primary GID number to the User ID number.

Default Comments (GECOS)

Enter any text in this box.

Login Shell

Enter the default value for the login shell used when Unix-enabling a user.

Home Directory

Enter the default prefix used when generating the home directory attribute when Unix-enabling a user.

The default value is /home/; use a different value if your Unix user home directories are stored in another location on the file system. Authentication Services uses the user's effective Unix name when generating the full home directory path.

Use lowercase user name for home directory

Select to use a lower-case representation of the user's effective Unix name when generating the full home directory path as a user is Unix-enabled.

Table 14: Unix group defaults
Option Description
Require unique Group Names Select to require a unique Unix group name attribute within the forest.
Require unique GID Number Select to require a unique Unix Group ID (GID) attribute within the forest.
Minimum GID Number

Enter the minimum value for the Unix Group ID (GID).

Typically, this is set to a value higher than the highest GID among local Unix groups to avoid conflicts with groups in Active Directory and local group accounts.

Maximum GID Number

Enter the maximum value for the Unix Group ID (GID).

Typically, you would not change this value unless you have a legacy Unix platform that does not support the full 32-bit integer range for GID.

These options control the algorithms used to generate unique user and group IDs.

Table 15: Unique IDs
Option Description
Object GUID Hash

An ID generated from a hash of the user or group object GUID attribute.

This is a fast way to generate an ID that is usually unique. If the generated value conflicts with an existing value, the ID is re-generated by searching the forest.

Samba Algorithm

An ID generated from the SID of the domain and the RID of the user or group object.

This method works well when there are few domains in the forest. If the generated value conflicts with an existing value, the ID is re-generated by searching the forest.

Legacy Search Algorithm An ID generated by searching for existing ID values in the forest. This method generates an ID that is not currently in use.

Modifications you make to these Global Unix Options take effect after you restart the Microsoft Management Console (MMC).

BEST PRACTICE: It is a best practice to either use the generated default IDs or set the ID manually. Mixing the two methods can lead to ID conflicts.

Related Documents