Safeguard Authentication Services 5.0.2 - Evaluation Guide

Setting up Starling users

A new Group Policy Object has been added to Safeguard Authentication Services to manage the group file for Starling, which is located in /etc/opt/quest/vas/users.starling.

This file can be manually created or set using the GPO.

To enable Starling for users using the GPO

1. Open your Group Policy management system.
2. Select the applicable group policy.
3. Navigate to Computer configuration | Unix Settings | Starling.
4. Double-click users.starling.
5. Add the groups that contain the users to be enabled to use Starling 2FA.

It may take up to 90 minutes to apply this configuration change. Use vgptool apply to apply the changes quicker.

Joining Safeguard Authentication Services with Starling

Joining Safeguard Authentication Services to Starling allows you to use features from Starling Two-Factor Authentication.

To join Safeguard Authentication Services with Starling

1. From the Control Center, navigate to Preferences | Starling Two-Factor Authentication.
2. In the Join to Starling and enable Two-Factor Authentication pane, click Starling Join Settings. 

3. On the Starling Two-Factor Authentication dialog, use the Product TIMs drop-down to select a valid Safeguard Authentication Services license.

   NOTE: The other fields on this dialog are read-only and contain the following information after you successfully join to Starling:

   • Product Name: Displays Safeguard Authentication Services.
   • Product Instance: Displays the unique identifier for Starling.

4. Click Join to Starling.

   NOTE: The following additional information may be required:

   • If you do not have an existing session with Starling, you will be prompted to authenticate.
   • If your Starling account belongs to multiple organizations, you will be prompted to select which organization Safeguard Authentication Services will be joined with.

   After the join has successfully completed, you will be returned to the Safeguard Authentication Services Control Center and the Join to Starling and enable Two-Factor Authentication pane will display the following:

   • Product Instance: Displays the unique identifier for Starling. You can click the Copy button to the right of this field to copy the product instance identifier to your desktop.
   • Starling Join State: Displays either Joined or Unjoined.

Configuring Starling to use a proxy server

The Starling Proxy Settings must be configured if your company policies do not allow devices to connect directly to the web. Once configured, Safeguard Authentication Services uses the configured proxy server for outbound web requests to Starling.

To configure Starling to use a proxy server

1. From the Control Center, navigate to Preferences | Starling Two-Factor Authentication.
2. In the Starling Proxy Configuration pane, click Starling Proxy Settings.

3. On the Starling Proxy Configuration dialog, enter the following information about the proxy server to be used:

   To specify a previously configured PAC file (recommended):

   • Use automatic configuration script: Select this check box.
   • Address: Enter the address of the proxy.pac file.

   To use username/password to specify the proxy server:

   • Address: Enter the URL for the proxy server.
   • Port: Enter the port number to be used.
   • Username: Enter the user name of a service account that is to be used to access the proxy server.

   • Password: Enter the password associated with the user name specified. The password will be displayed in clear text.

4. Click OK to save your selections.

Starling Attributes: Configure LDAP attributes for use with push notifications

You can specify the user mobile number and user email address attributes to be used by the Starling push notifications.

Modifications to the Starling schema attributes configuration are global and apply to all Safeguard Authentication Services clients in the forest. For users configured to use Starling, this could cause user logins to fail.

To configure custom LDAP attributes for use with Starling push notifications

1. From the Control Center, navigate to the Starling Attributes in one of the following two ways:
   • Preferences | Starling Two-Factor Authentication and click the Starling Attributes link.
   • Preferences | Schema Attributes
2. Click the Unix Attributes link in the upper right to display the Customize Schema Attributes dialog.

3. Enter the LDAP display name for one or both of the Starling attributes used by the Starling push notifications:

   • User Mobile Number
   • User Email Address
4. Click OK.
5. Click Yes to confirm that you want to modify the Starling schema attributes configuration.
6. Back on the Starling Two-Factor Authentication preference pane, the Starling attributes to be used are displayed.