Joining Safeguard Authentication Services to Starling allows you to use features from Starling Two-Factor Authentication.
To join Safeguard Authentication Services with Starling
On the Starling Two-Factor Authentication dialog, use the Product TIMs drop-down to select a valid Safeguard Authentication Services license.
NOTE: The other fields on this dialog are read-only and contain the following information after you successfully join to Starling:
Click Join to Starling.
NOTE: The following additional information may be required:
After the join has successfully completed, you will be returned to the Safeguard Authentication Services Control Center and the Join to Starling and enable Two-Factor Authentication pane will display the following:
The Starling Proxy Settings must be configured if your company policies do not allow devices to connect directly to the web. Once configured, Safeguard Authentication Services uses the configured proxy server for outbound web requests to Starling.
NOTE: One Identity recommends you use an automatic configuration script (proxy PAC file). To specify a previously configured PAC file, select the Use automatic configuration script check box and enter the address of the proxy.pac file.
To configure Starling to use a proxy server
On the Starling Proxy Configuration dialog, enter the following information about the proxy server to be used:
To specify a previously configured PAC file (recommended):
To use username/password to specify the proxy server:
Password: Enter the password associated with the user name specified. The password will be displayed in clear text.
You can specify the user mobile number and user email address attributes to be used by the Starling push notifications.
Modifications to the Starling schema attributes configuration are global and apply to all Safeguard Authentication Services clients in the forest. For users configured to use Starling, this could cause user logins to fail.
To configure custom LDAP attributes for use with Starling push notifications
Enter the LDAP display name for one or both of the Starling attributes used by the Starling push notifications:
Once Starling Two-Factor Authentication is enabled (that is, Safeguard Authentication Services is joined to Starling and users are authorized to use Starling Two-Factor Authentication), anytime an authorized user attempts to log in to an integrated Unix-based host, they will see an additional login screen informing them that an additional authentication step is required.
The default prompt contains the following:
Enter a token or select one of the following options:
Token or option (1-3) : <Token or option number>
This default prompt can be modified in vas.conf.
The behavior of QAS Starling can be modified by using the following options in the [starling] section.
prompt = <boolean>
prompt = <message-text>
Default value: "Enter a token or select one of the following options:\n\n 1. Starling Push\n 2. Phone
call\n 3. Send an SMS\n \nToken or option (1-3): "
This is the message that is initially displayed during a Starling authentication.
This prompt can span multiple lines, line separation is specified by adding \n to the prompt string.
NOTE: Changing the prompt will not change what is accepted as input.
prompt = "Enter 1 for a push request, 2 for a phone call, 3 for a txt, or enter a token.\n "
NOTE: In order to display the prompts, the application must be able to handle pam conversations, such as sshd(keyboard-interactive). If the application can not handle pam conversations, such as sshd(password), a push authentication is sent instead of a prompt.