Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 6.0.6 - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS) The Welcome Wizard and the first login Basic settings
Supported web browsers and operating systems The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving and cleanup Forwarding data to third-party systems Joining to One Identity Starling
User management and access control Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing Safeguard for Privileged Sessions (SPS) clusters Managing a high availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings RDP-specific settings SSH-specific settings Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search interface Searching session data on a central node in a cluster Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) RPC API The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS) Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help LDAP user and group resolution in SPS Appendix: Deprecated features Glossary

Authenticating users with X.509 certificates

One Identity Safeguard for Privileged Sessions (SPS) provides a method to authenticate the users of the web interface with X.509 client certificates. The client certificate is validated against a CA list, and the username is exported from the client certificate for identification. One Identity recommends using 2048-bit RSA keys (or stronger).

To authenticate SPS users on the SPS web interface with X.509 client certificates, complete the following steps.

Prerequisites
  • You will have to upload the CA certificates that issued the certificates of the users, so this CA certificate must be available on your computer in PEM format.

  • The certificates of the users must contain the username used to authenticate on SPS. You must know which certificate field will contain the usernames (for example, CN or UID).

  • The certificates must be imported into the browsers of the users. SPS offers the possibility to authenticate with a certificate only if a personal certificate is available in the browser.

Figure 73: Policies > Trusted CA Lists — Creating Trusted CA lists

To authenticate users with X.509 certificates

  1. Navigate to Policies > Trusted CA Lists and create a Trusted CA List.

  2. If the user certificates contain the username in the Common Name field, make sure that the Strict Hostname Check is disabled.

  3. Upload the CA certificate.

  4. Adjust other settings as needed. For details on creating a trusted CA list, see Verifying certificates with Certificate Authorities.

  5. Click Commit.

  6. Navigate to AAA > Settings > Authentication settings.

    Figure 74: AAA > Settings > Authentication settings — Configuring X.509 authentication

  7. Select X.509.

  8. Select the trusted CA list created in the first step in Authentication CA.

  9. Select which field of the user certificate contains the username in the Parse username from field. In most cases, it is the commonName or userid field, but SPS supports the emailAddress and userPrincipalName fields as well.

  10. To allow the admin user to be able to log in without using X.509 authorization, select Enable fallback for admin. This will fallback to password authentication.

  11. Click Commit.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating