The Asset Administrator can join a Safeguard for Privileged Sessions (SPS) cluster to a Safeguard for Privileged Password (SPP) cluster of one appliance or more for session recording and auditing. The actual join must be between the SPP primary and the SPS cluster master. This means that the Safeguard for Privileged Sessions (SPS) cluster is aware of each node in an SPP cluster and vice-versa.
Once joined, all sessions are initiated by the SPP appliance via an access request and managed by the SPS appliance and sessions are recorded via the Sessions Appliance.
NOTE: If you have a single node SPS cluster where the Central Management node is also the Search Master, SPP will be unable to launch sessions. There has to be at least one SPS appliance in the cluster that is capable of recording sessions. See the SPS Administration Guide, Managing Safeguard for Privileged Sessions (SPS) clusters.
Safeguard for Privileged Passwords join guidance
Before initiating the join, review the steps and considerations in the join guidance. For more information, see SPP and SPS sessions appliance join guidance.
Pay attention to the roles assigned to the SPS nodes. The following caution is offered to avoid losing session playback from SPP.
|
|
CAUTION: Do not switch the role of an SPS node from the Search Local role to Search Minion role. If you do, playback of the sessions recorded while in the Search Local role may not be played back from the SPP appliance, and may only be played back via the SPS web user interface. Recordings made with the node in Search Minion role are pushed to the Search Master node and are available for download to SPP. For details about SPS nodes and roles, see the One Identity Safeguard for Privileged Sessions Administration Guide: One Identity Safeguard for Privileged Sessions - Technical Documentation. |
Standard operating procedure after the initial join
If you add another SPS cluster after the initial join, follow these standard operating procedures:
- Add join connections. See Viewing, deleting, or editing join connections later in this topic.
-
Identify the session settings on the entitlements access request policy (SPS Connection Policy which is the IP address of the cluster master). For more information, see Creating an access request policy.
- Assign the managed networks. For more information, see Managed Networks.
- Enable the Session Module Password Access Enabled toggle. Navigate to Settings | Access Request | Enable or Disable Services, Sessions Module
If the SPS Central Management node is down
SPP continues to launch sessions on the managed hosts when the SPS Central Management node is down. However, as long as the Central Management node is down, SPP cannot validate existing policies nor can it validate the SPS cluster topology. See the Safeguard for Privileged Sessions Administration Guide, Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster.
Connection deletion: soft delete versus hard delete
Depending on your goals, you can perform a soft delete or a hard delete.
Soft delete the connection
When a session connection is deleted from the desktop client, the connection information is soft deleted so that a rejoin of the same SPS appliance can reuse the same values. This approach of soft deleting and reusing the same connection values on a rejoin avoids "breaking" all of the Access Request Polices that referenced the previous session connection.
If the session connection is deleted, a caution displays when you navigate to Administrative Tools | Entitlements | Access Request Policies and go to the Session Settings tab. For more information, see Session Settings tab.
Hard delete the connection
A hard delete can be performed to permanently remove the session connection. This is usually only done in cases where either a rejoin is not desired or retaining the previous session connection values is preventing an SPS appliance from joining or rejoining.
A hard delete can be performed from the API using the following steps for using PowerShell or Swagger.
Hard delete with PowerShell
The latest version of Safeguard PowerShell includes two cmdlets to perform the hard delete:
split-safeguardSessionCluster -SessionMaster <name or ID of session master>
Remove-SafeguardSessionSplitCluster -SessionMaster <name or ID of session master>
See OneIdentity/safeguard-ps.
Hard delete with Swagger
- In a browser, navigate to https://<your-ip-address>/service/core/swagger.
- Authenticate to the service using the Authorize button.
- Navigate to Cluster->GET /v3/cluster/SessionModules and click Try it out!.
- Identify if the unwanted session connection exists on the list:
- If the unwanted session connection exists in the list, then:
- Note the ID of the session connection.
- Navigate to Cluster DELETE /v3/cluster/SessionModules.
- Enter the ID.
- Click Try it out!”.
- Go to step 3.
- If the unwanted session connection does not exist in the list, then:
- Set the includeDisconnected parameter to true.
- Click Try it out!.
- If the unwanted session connection exists in the list, then go to step 4a to delete the entry a second time which will result in a hard delete.
- The process is complete and the session connection is permanently removed.
Viewing, deleting, or editing join connections
Once the join is complete, go to Session Appliances:
web client: Navigate to 
Settings | 
Cluster | Session Appliances.
desktop client: Navigate to Administrative Tools | Settings | Cluster | Session Appliances.
The Session Appliances pane displays the following session details.
Table 152: Session Appliances: Properties
|
Host Name |
The host name of the SPS appliance host cluster master. |
|
Network Address |
The network DNS name or IP address of the session connection. |
|
Description |
(optional) Descriptive text about the SPS session connection (for example, 20 on cluster - 172 primary node). |
|
Connection User |
The user name for Safeguard for Privileged Passwords (SPP). Do not include spaces in the user name. |
|
Thumbprint |
A unique hash value that identifies the certificate. |
|
Managed Hosts |
Other nodes in the SPS cluster identified by the managed host name and IP address. Hover over any  Warning icon to see if the Managed Host is Unavailable or Unknown. |
Double-click a Host Name row to bring up the Session Module Connection dialog.
Table 153: Session Module Connection: Properties
|
Node ID |
The name of the Safeguard for Privileged Sessions Appliance used to authenticate the joined SPS session connection. |
|
Host Name |
The host name of the SPS appliance host cluster master. |
|
Connection Username |
The user name for Safeguard for Privileged Passwords (SPP). Do not include spaces in the user name. |
|
Description |
(Optional) Descriptive text about the SPS session connection (for example, 20 on cluster - 172 primary node). |
|
Network Address |
The network DNS name or IP address of the session connection. |
|
Use Host Name For Launch (not IP address) |
If checked, the connection string used to launch a session uses the host name of the SPS appliance rather than the IP address. |
Use these toolbar buttons to manage sessions.
Table 154: Sessions Management: Toolbar
|
 Remove
web client
 Delete Selected
desktop client |
Remove the selected joined SPS session connection. For details on soft versus hard deletes, see Connection deletion: soft delete versus hard delete earlier in this topic. |
 Edit |
Modify the selected joined SPS session connection Description or Network Address on the Session Module Connection dialog. |
 Refresh |
Update the list of joined SPS session connections. |
web client only. For the desktop client, including Session settings but not the Audit Log Stream Service, see Access Request settings.
One Identity Safeguard for Privileged Passwords allows you to enable or disable access request and password and SSH key management services. These settings control password or SSH key release requests, manual account password or SSH key validation, and reset tasks, as well as the automatic profile check and change tasks in Partitions. You can also enable or disable discovery tasks, directory sync, and the Audit Log Stream Service.
Services are enabled by default except for the Audit Log Stream Service.
By default, services are disabled for service accounts and for accounts and assets found as part of a discovery job. Service accounts can be modified to adhere to these schedules and discovered accounts can be activated when managed.
It is the responsibility of the Appliance Administrator to manage these settings.
Navigate to Settings| 
Enable or Disable Services to see the settings listed below.
- Click a toggle to change a setting:
toggle on and 
toggle off.
- Click Refresh to update the information on the page.
Table 155: Enable or Disable Services settings
|
Requests |
|
Password requests |
Password requests are enabled by default, indicating that authorized users can make password release requests
Click the Password requests toggle to disable this service so passwords can not be requested.
NOTE: Disabling the password request service will place any open requests on hold until this service is reenabled. |
|
SSH Key requests |
SSH key requests are enabled by default, indicating that authorized users can make SSH key release requests
Click the SSH Key requests toggle to disable this service so SSH keys can not be requested.
NOTE: Disabling the password request service will place any open requests on hold until this service is reenabled. |
|
Password Management |
|
Check password management |
Check password management is enabled by default, indicating that Safeguard for Privileged Passwords automatically performs the password check task if the profile is scheduled, and allows you to manually check an account's password.
Click the Check password management toggle to disable the password validation service.
Note: Safeguard for Privileged Passwords enables automatic password management services by default. Typically, you would only disable them during an organization-wide maintenance window.
When disabling a password management service, Safeguard for Privileged Passwords allows all currently running tasks to complete; however, no new tasks will be allowed to start. |
|
Change password management |
Change password management is enabled by default, indicating that Safeguard for Privileged Passwords automatically performs the password change task if the profile is scheduled, and allows you to manually reset an account's password.
Click the Change password management toggle to disable the password reset service.
Note: Safeguard for Privileged Passwords enables automatic password management services by default. Typically, you would only disable them during an organization-wide maintenance window.
When disabling a password management service, Safeguard for Privileged Passwords allows all currently running tasks to complete; however, no new tasks will be allowed to start. |
|
SSH Key Management |
|
Check SSH Key |
SSH key check is enabled by default, indicating that SSH key check is managed per the profile governing the partition's assigned assets and the assets' accounts.
Click the Check SSH Key toggle to disable the check service. |
|
Change SSH Key |
SSH key change is enabled by default, indicating that SSH key change is managed per the profile governing the partition's assigned assets and the assets' accounts.
Click the Change SSH Key toggle to disable the change service. |
|
Discovery |
|
Asset discovery |
Asset discovery is enabled by default, indicating that available Asset Discovery jobs find assets by searching directory assets, such as Active Directory, or by scanning network IP ranges. For more information, see Discovery. |
|
Account discovery |
Account discovery is enabled by default, indicating that available Account Discovery jobs find accounts by searching directory assets such as Active Directory or by scanning local account databases on Windows and Unix assets (/etc/passwd) that are associated with the account discovery job. For more information, see Discovery. |
|
Service discovery |
Service discovery is enabled by default, indicating that available Service Discovery jobs find Windows services that run as accounts managed by Safeguard. For more information, see Discovery. |
|
SSH Key discovery |
SSH key discovery is enabled by default. With the toggle on, SSH keys in managed accounts are discovered. For more information, see SSH Key Discovery. |
|
Directory |
|
Directory sync |
Directory sync is enabled by default, indicating that additions or deletions to directory assets are synchronized. You can set the number of minutes for synchronization. For more information, see Management tab (add asset). |
|
Audit |
|
|
Audit Log Stream Service
web client |
The Audit Log Stream Service is disabled by default.
desktop client: To set this in the desktop client, see Appliance settings.
Use this toggle to send Safeguard for Privileged Passwords data to Safeguard for Privileged Sessions (SPS) to audit the Safeguard privileged management software suite. The feature is disabled by default.
To accept SPP data, the SPS Appliance Administrator must turn on audit log syncing. For information, see the Safeguard for Privileged Sessions Administration Guide.
SPP and SPS must be joined to use this feature. For more information, see SPP and SPS sessions appliance join guidance.
While the synchronization of SPP and SPS is ongoing, SPS is not guaranteed to have all of the audit data at any given point due to some latency. |
The Appliance Administrator can:
- Configure the appliance to send event notifications to various external systems.
- Integrate with an external ticketing system or track generic ticket numbers.
- Configure both external and secondary authentication service providers.
However, it is the Security Policy Administrator's responsibility to configure the Approval Anywhere feature.
Go to External Integration:
- web client: Navigate to Settings |
External Integration.
- desktop client: Navigate to Administrative Tools | Settings | External Integration.
Table 156: External Integration settings
| Application to Application desktop client |
Where you configure application registrations to use the Application to Application service, which allows third-party applications to retrieve credentials from Safeguard for Privileged Passwords |
| Approval Anywhere |
Where you define the Safeguard for Privileged Passwords users who are authorized to use Approval Anywhere to approve access requests |
| Email |
Where you configure Safeguard for Privileged Passwords to automatically send email notifications when certain events occur |
| Email Templates |
Where you configure Safeguard for Privileged Passwords email templates |
| Identity and Authentication |
Where you configure the identity providers and authentication providers to use when logging into Safeguard for Privileged Passwords
Web client: Settings|  Safeguard Access | Identity and Authentication |
| SNMP |
Where you configure Safeguard for Privileged Passwords to send SNMP traps to your SNMP console when certain events occur |
| Starling |
Where you join Safeguard for Privileged Passwords to Starling to take advantage of other Starling services, such as Starling Two-Factor Authentication (2FA) and Starling Identity Analytics & Risk Intelligence |
| Syslog |
Where you configure Safeguard for Privileged Passwords to send event notifications to a syslog server with details about the event |
| Syslog Events
web client |
Where, using an existing syslog server, you create a subscriber and assign events. |
| Ticketing systems |
Where you configure Safeguard for Privileged Passwords to integrate with your company's external ticket system or track generic tickets and not integrate with an external ticketing system |
|
Trusted Servers, CORS, and Redirects |
Where you can restrict login redirects and Cross Origin Resource Sharing (CORS) requests to a specified list of IP addresses, host names (including DNS wildcards), and CIDR notation networks. |
desktop client only
In order for third-party applications to use the Application to Application service to integrate with the Safeguard for Privileged Passwords vault, you must first register the application in Safeguard for Privileged Passwords. This can be done using the Administrative Tools | Settings | External Integration | Application to Application pane described below. Once the application is registered, you can enable or disable the service. For more information, see Enable or disable A2A and audit log stream .
The Application to Application pane displays a list of previously registered third-party applications. From this page, the Security Policy Administrator can add new application registrations, and modify or remove existing registrations. The Application to Application pane displays the following details about application registrations.
Table 157: Application to Application: Properties
|
Name |
The name assigned to the application's registration. |
|
Certificate User |
The name of the certificate user associated with the registered application.
NOTE: If there is no certificate user listed for an application registration, contact your Security Policy Administrator to add one. The Application to Application service on the third-party application will not work with the Safeguard for Privileged Passwords vault until a certificate user has been specified. |
|
Enable/Disable
 Toggle on
 Toggle off
|
Indicates whether the application registration is enabled. The toggle appears blue with the switch to the right when the service is enabled, and gray with the switch to the left when the service is disabled. Click the toggle to enable or disable an application registration.
NOTE: When an application registration is disabled, Application to Application access is disabled for that third-party application until the registration is enabled again. |
|
Description |
Information about the application's registration. |
Use these toolbar buttons to manage application registrations.
Table 158: Application to Application: Toolbar
|
 Add
|
Add an application registration to Safeguard for Privileged Passwords. For more information, see Adding an application registration. |
|
Delete Selected |
Remove the selected application registration from Safeguard for Privileged Passwords. For more information, see Deleting an application registration. |
|
Refresh |
Update the list of application registrations. |
|
Edit |
Modify the selected application registration. |
|
 API Keys
|
Display the API keys that were generated for Access Request Broker or Credential Retrieval. An API key can then be copied and used in the third-party application to authenticate with Safeguard for Privileged Passwords.
NOTE: For credential retrieval, the registration process generates an API key for each managed account. However, for access request broker, the registration process generates a single API key for all users or user groups that are added. |
