When gateway authentication is required for a connection, the user must authenticate on One Identity Safeguard for Privileged Sessions (SPS) as well. This additional authentication can be performed:
Out-of-band, on the SPS web interface, for every protocol.
Inband, using the incoming connection, for the SSH, Telnet, and RDP protocols.
For details about the concepts of gateway authentication, see The gateway authentication process. You can use gateway authentication to authenticate the real person when the user is using a shared account to access the target server.
For SSH, Telnet, and RDP connections, gateway authentication can be performed also inband, without having to access the SPS web interface.
Gateway authentication can be used together with other advanced authentication and authorization techniques like four-eyes authorization, client- and server-side authentication, and so on.
If the username used within the protocol to access the remote server is different from the username used to perform gateway authentication (for example, because the user uses a shared account in the remote server, but a personal account for gateway authentication), usermapping must be configured for the connection. For details on usermapping, see Configuring usermapping policies.
To configure a credential store for gateway authentication, see Using credential stores for server-side authentication.