Always securely log out of the web client.
To log out
- In the upper right corner, next to your user name, click
.
- Click Log out to securely exit the Safeguard for Privileged Passwords web client.
Introduction
System requirements and versions
Desktop client system requirements
Web client system requirements
Web management console system requirements
Supported platforms
License: hardware, virtual, expiration
Long Term Support (LTS) and Feature Releases
Using API and PowerShell tools
Using the virtual appliance and web management console
Cloud deployment considerations
Setting up Safeguard for Privileged Passwords for the first time
Step 1: Create the Authorizer Administrator
Step 2: Authorizer Administrator creates administrators
Step 3: Appliance Administrator configures the appliance
Step 4: User Administrator adds users
Step 5: Asset Administrator adds managed systems
Step 6: Security Policy Administrator adds access request policies
Using the web client
Home
My Requests (web client)
Approvals (web client)
Reviews (web client)
Favorites (web client)
Settings, version, and desktop Windows client (web client)
Change password (web client)
FIDO2 keys (web client)
Log out (web client)
Getting started with the desktop client
Using the desktop client
Settings (desktop client)
User information and log out
Desktop client favorite request
Desktop client navigation pane
Search box
Privileged access requests
Home
Dashboard
Activity Center
Applying search criteria
Saving search criteria
Generating an activity audit log report
Scheduling an activity audit log report
Editing or deleting a saved search or scheduled report
Viewing event details
Auditing request workflow
Filtering report results
Sorting report results
Reports
Administrative Tools
Configuring alerts
Password release request workflow
Toolbox
Accounts
Requesting a password release
Approving a password release request
Reviewing a completed password release request
Session request workflow
General tab (account)
Access Request Policies tab (account)
Account Groups tab (account)
Dependent Assets (account)
Check and Change Log tab (account)
History tab (account)
Managing accounts
Account Groups
General tab (account group)
Accounts tab (account group)
Access Request Policies tab (account group)
History tab (account group)
Managing account groups
Assets
Adding an account group
Adding a dynamic account group
General tab (add dynamic account group)
Account Rules tab (add dynamic account group)
Summary tab (add dynamic account group)
Adding one or more accounts to an account group
Adding accounts to an access request policy
Modifying an account group
Deleting an account group
General tab (asset)
Accounts tab (asset)
Account Dependencies tab (asset)
Access Request Policies tab (asset)
Asset Groups tab (asset)
Discovered Services tab (asset)
History tab (asset)
Managing assets
Asset Groups
Adding an asset
General tab (add asset)
Management tab (add asset)
Account Discovery tab (add asset)
Connection tab (add asset)
Checking an asset's connectivity
Assigning an asset to a partition
Assigning a profile to an asset
Manually adding a tag to an asset
Adding an account to an asset
Adding account dependencies
Adding an asset to asset groups
Modifying an asset
Deleting an asset
Importing objects
Downloading a public SSH key
About service accounts
About Test Connection
SSH Key
Directory Account
Local System Account
Password (local service account)
Access Key
None
Attributes tab (add asset)
General tab (asset group)
Assets tab (asset group)
Access Request Policies tab (asset group)
History tab (asset group)
Managing asset groups
Discovery
Asset Discovery
Entitlements
Asset Discovery job workflow
Adding an Asset Discovery job
Asset Discovery Results
Account Discovery
General tab (asset discovery)
Information tab (asset discovery)
Rules tab (asset discovery)
Editing an Asset Discovery job
Deleting an Asset Discovery job
Add Condition (asset discovery)
Edit Connection Template (asset discovery)
Add Asset Profile (asset discovery)
Schedule tab (asset discovery)
Summary tab (asset discovery)
Account Discovery job workflow
Adding an Account Discovery job
Editing an Account Discovery job
Deleting an Account Discovery job
Account Discovery Results
Discovered Accounts
Service Discovery Results
Discovered Services
General tab
Users tab
Access Request Policies tab
History tab
Managing entitlements
Partitions
Adding an entitlement
Creating an access request policy
General tab
Scope tab
Requester tab
Approver tab
Reviewer tab
Access Config tab
Session Settings tab
Time Restrictions tab
Emergency tab
Adding users or user groups to an entitlement
Deleting an access request policy
Modifying an access request policy
Copying an access request policy
Viewing and editing policy details
Modifying an entitlement
Deleting an entitlement
About partition profiles
General tab (partitions)
Assets tab (partitions)
Accounts tab (partitions)
Profiles tab (partitions)
History tab (partitions)
Managing partitions
Settings
Access Request settings
Appliance settings
Users
Appliance Diagnostics
Appliance Information
Enable or Disable Services
Factory Reset from the desktop client
Licensing
Lights Out Management (BMC)
Network Diagnostics
Networking
Operating system licensing
Support Bundle
Time
Updates
Asset Management settings
Backup and Retention settings
Certificate settings
About certificates
Audit Log Signing Certificate
Certificate Signing Request
SSL Certificates
Cluster settings
External Integration settings
Installing an SSL certificate
Creating a Certificate Signing Request (CSR)
Assigning a certificate to appliances
Trusted Certificates
Application to Application
Messaging settings
Profile settings
Safeguard Access settings
About Application to Application functionality
Setting up Application to Application
Adding an application registration
Deleting an application registration
Regenerating an API key
Making a request using the Application to Application service
Approval Anywhere
Email
Identity and Authentication
SNMP
Starling
Syslog
Ticketing system
General tab (user)
User Groups tab (user)
Partitions tab (user)
Entitlements tab (user)
Linked Accounts tab (user)
History (user)
Managing users
User Groups
Adding a user
Identity tab (add user)
Authentication tab (add user)
Location tab (add user)
Permissions tab (add user)
Requiring secondary authentication log in
Adding a user to user groups
Assigning a user to partitions
Adding a user to entitlements
Linking a directory account to a user
Modifying a user
Enabling or disabling a user
Deleting a user
Importing objects
Setting a local user's password
Unlocking a user's account
General tab (user groups)
Users tab (user groups)
Entitlements tab (user groups)
History tab (user groups)
Managing user groups
Disaster recovery and clusters
Enrolling replicas into a cluster
Unjoining replicas from a cluster
Maintaining and diagnosing cluster members
Administrator permissions
About Offline Workflow Mode
Failing over to a replica by promoting it to be the new primary
Activating a read-only appliance
Diagnosing a cluster member
Patching cluster members
Using a backup to restore a clustered appliance
Resetting a cluster that has lost consensus
Performing a factory reset
Unlocking a locked cluster
Troubleshooting tips
Appliance Administrator permissions
Asset Administrator permissions
Auditor permissions
Authorizer Administrator permissions
Help Desk Administrator permissions
Operations Administrator permissions
Security Policy Administrator permissions
User Administrator permissions
Preparing systems for management
Preparing ACF - Mainframe systems
Preparing Amazon Web Services platforms
Preparing Cisco devices
Preparing Dell iDRAC devices
Preparing VMware ESXi hosts
Preparing Fortinet FortiOS devices
Preparing F5 Big-IP devices
Preparing HP iLO servers
Preparing HP iLO MP (Management Processors)
Preparing IBM i (AS/400) systems
Preparing JunOS Juniper Networks systems
Preparing MongoDB
Preparing MySQL servers
Preparing Oracle databases
Preparing PAN-OS (Palo Alto) networks
Preparing PostgreSQL
Preparing RACF mainframe systems
Preparing SAP HANA
Preparing SAP Netweaver Application Servers
Preparing Sybase (Adaptive Server Enterprise) servers
Preparing SonicOS devices
Preparing SonicWALL SMA or CMS appliances
Preparing SQL Servers
Preparing Top Secret mainframe systems
Preparing Unix-based systems
Preparing Windows systems
Preparing Windows SSH systems
Troubleshooting
Connectivity failures
Frequently asked questions
Change password fails
Incorrect authentication credentials
Missing or incorrect SSH host key
No cipher supported error
Service account has insufficient privileges
Cannot connect to remote machine through SSH or RDP
Cannot delete account
Cannot play session message
Domain user denied access to Safeguard for Privileged Passwords
LCD status messages
My Mac keychain password was lost
Password fails for Unix host
Password is pending review
Password is pending a reset
Profile did not run
Recovery Kiosk (Serial Kiosk)
Appliance information (Recovery Kiosk)
Power options
Admin password reset
Factory reset from the Recovery Kiosk
Support bundle
Replica not adding
System services did not update or restart after password change
Test Connection failures
Test Connection failures on archive server
Certificate issue
Cipher support
Domain controller issue
Networking issue
Windows WMI connection failure
Timeout errors causing operations to fail
User locked out
User not notified
How do I audit transaction activity
How do I configure external federation authentication
Appendix A: Safeguard ports
Appendix B: SPP 2.7 or later migration guidance
Appendix C: SPP and SPS join guidance
Appendix D: Regular Expressions
SPP glossary
How do I add an external federation provider trust
How do I create a relying party trust for the STS
How do I add an external federation user account
How do I manage accounts on unsupported platforms
How do I modify the appliance configuration settings
How do I prevent Safeguard for Privileged Passwords messages when making RDP connections
How do I set up telnet and TN3270/TN5250 session access requests
How do I set the appliance system time
How do Safeguard for Privileged Passwords database servers use SSL
What are the access request states
What do I do when an appliance goes into quarantine
When does the rules engine run for dynamic grouping and tagging
Verifying syslog server configuration
Why did the password change during an open request
Log out (web client)
Getting started with the desktop client
To define and enforce security policy for your enterprise, you must first install the desktop client application which gives you access to the Administrative Tools.
These topics explain how to install, start, and uninstall the Safeguard for Privileged Passwords desktop client application:
Installing the desktop client
During initial installation and when applying a patch, make sure the desktop client file is the one supplied with the appliance version. If the versions are not compatible, errors will occur.
NOTE: PuTTY is used to launch the SSH client for SSH session requests and is included in the install. The desktop client looks for any user-installed PuTTY in the following locations:
- Any reference to putty in the PATH environment variable
- c:/Program Files/Putty
- c:/Program Files(x86)/Putty
- c:/Putty
If PuTTY is not found, the desktop client uses the version of PuTTY that it installed at:
<user-home-dir>/AppData/Local/Safeguard/putty.
If the user later installs PuTTY in any of the locations above, the desktop client uses that version which ensures the user has the latest version of PuTTY.
Installing the Safeguard for Privileged Passwords desktop client application
-
To download the Safeguard for Privileged Passwords desktop client Windows installer .msi file, open a browser and navigate to:
https://<Appliance IP>/Safeguard.msi
Save the Safeguard.msi file in a location of your choice.
- Run the MSI package.
- Select Next in the Welcome dialog.
- Accept the End-User License Agreement and select Next.
- Select Install to begin the installation.
- Select Finish to exit the desktop client setup wizard.
- Check your desktop resolution. The desktop client works the best at a resolution of 1024 x 768 or greater.
|
|
CAUTION: If the Desktop Player is not installed and a user tries to play back a session from the Activity Center, a message like the following will display: No Desktop Player. The Safeguard Desktop Player is not installed. Would you like to install it now? The user will need to click Yes to go to the download page to install the player following step 2 below. |
- Once the Safeguard for Privileged Passwords installation is complete, go to the Windows Start menu, Safeguard folder, and click Download Safeguard Player to be taken to the One Identity Safeguard for Privileged Sessions - Download Software web page.
-
Follow the Install Safeguard Desktop Player section of the player user guide found here:
- Go to One Identity Safeguard for Privileged Sessions - Technical Documentation.
- Scroll to User Guide and click One Identity Safeguard for Privileged Sessions [version] Safeguard Desktop Player User Guide.
-
For Safeguard Desktop player version 1.8.6 and later, ensure your signed web certificate has a Subject Alternative Name (SAN) that includes each IP address of each of your cluster members. If the settings are not correct, the Safeguard Desktop Player will generate a certificate warning like the following when replaying sessions: Unable to verify SSL certificate. To resolve this issue, import the appropriate certificates including the root CA.
New Desktop Player versions
When you have installed a version of the Safeguard Desktop Player application, you will need to uninstall the previous version to upgrade to a newer player version.
Starting the desktop client
The following steps assume the One Identity Safeguard for Privileged Passwords Appliance has been configured and licensed. As a Safeguard for Privileged Passwords user, if you get an appliance is unlicensed notification, contact your Appliance Administrator.
To start the desktop client application
- From the Windows Start menu, choose Safeguard.
-
On the server selection screen, enter or select the server's network DNS name or IP address to connect to the appliance over the network and click Connect.
NOTE: When entering an IPv6 address, enclose the IPv6 address in square brackets.
- You will see a message like: You'll now be redirected to your web browser to complete the login process. You can select: Don't show this message again. Then, click OK.
-
On the user login screen, enter your credentials and click Log in.
-
User Name: Enter your user or display name. Do not include spaces in the User Name.
NOTE: When using directory account credentials, you have the option to enter your domain\name.
- Password: Enter the password associated with the user entered above.
-
-
If your Safeguard for Privileged Passwords user account requires you to log in with secondary authentication, enter the secure password token code, or other authentication for your authentication service provider account and click Submit.
NOTE: The type and configuration of the secondary authentication provider (for example, RSA SecureID, FIDO2, One Identity Starling Two-Factor Authentication, and so on) determines what you must provide for secondary authentication. Check with your system administrator for more information about how to log in to Safeguard for Privileged Passwords with secondary authentication.
- When login is successful, you can close the web browser and return to the Safeguard application.
To remove server DSN names or IP addresses no longer used
The DSN name or IP address on the server selection screen may be no longer used. If you want to remove one or more selections, you can edit the user.config file using a text editor like Notepad.
-
Go to:
C:\Users\<YourSafeguardUserName>\AppData\Local\One_Identity_LLC\Client.Desktop.UI.exe_Url_<UniqueGUID\<ClientVersion>\user.config
- Make a backup copy of user.config in case you want to return to the file.
-
Open the file and edit the following section to list only the addresses you want:
<setting name="ClusterHistory" serializeAs="Xml">
<value>
<ArrayOfString xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<string>10.5.33.57</string>
</ArrayOfString>
</value>
</setting>
- Save the updated file.
- Log on to verify the correct selections display.