In the web client, expand the Appliance Management section in the left navigation pane. Settings are available to Appliance Administrators, Operations Administrators, and the Bootstrap Administrator (Auditors have read-only access).
Introduction
System requirements and versions
Web client system requirements
Web management console system requirements
Supported platforms
Licenses
Long Term Support (LTS) and Feature Releases
Using API and PowerShell tools
Using the virtual appliance and web management console
Cloud deployment considerations
Setting up Safeguard for Privileged Passwords for the first time
Step 1: Create the Authorizer Administrator
Step 2: Authorizer Administrator creates administrators
Step 3: Appliance Administrator configures the appliance
Step 4: User Administrator adds users
Step 5: Asset Administrator adds managed systems
Step 6: Security Policy Administrator adds access request policies
Using the web client
Home page
Privileged access requests
Configuring alerts
Password release request workflow
Appliance Management
Requesting a password release
Approving a password release request
Reviewing a completed password release request
SSH key release request workflow
Requesting an SSH key release
Approving an SSH key release request
Reviewing a completed SSH key release request
API key release request workflow
Requesting an API key release
Approving an API key release request
Reviewing a completed API key release request
Session request workflow
Appliance
Asset Management
Appliance Diagnostics
Appliance Information
Debug
Licensing settings
Factory Reset
Lights Out Management (BMC)
Network Diagnostics
Networking
Operating System Licensing
SSH Algorithms
Patch Updates
Power
Support bundle
Time
Time Zone
Backup and Retention
About backups
Archive servers
Audit Log Maintenance
Backup and Restore
Certificates
Run Now
Download a backup
Upload a backup
Restore a backup
Archive backup
Backup settings
Backup protection settings
Backup Retention
Authorize VM Compatible Backups
About Certificate Signing Requests (CSRs)
Audit Log Signing Certificate
Certificate Signing Request
Hardware Security Module Certificates
Cluster
Installing a Hardware Security Module client certificate
Assigning a Hardware Security Module client certificate
Uploading a Hardware Security Module server certificate
SMTP Certificate
SSL/TLS Certificates
Creating an SSL/TLS Certificate Signing Request
Installing an SSL/TLS certificate
Assigning an SSL/TLS certificate to appliances
Syslog Client Certificate
Trusted CA Certificates
Cluster Management
Managed Networks
Offline Workflow (automatic)
Session Appliances with Safeguard for Privileged Sessions link
Global Services
External Integration
Email
Email Events
Email Templates
Hardware Security Module
SNMP
Starling
Syslog
Syslog Events
Ticket systems
Real-Time Reports
Safeguard Access
ServiceNow ticketing system integration
Remedy ticketing system integration
Not integrated with ticketing system
Trusted Servers, CORS, and Redirects
Messaging settings
Local Login Control
OAuth 2.0 Grant Types
Local Password Rule
Identity and Authentication
Branding Customization
Appliance Management Settings
Account Automation
Accounts
Security Policy Management
Properties (account)
Owners tab (account)
Dependent Assets (account)
Access Request Policies (account)
Check and Change Log tab (account)
Discovered Services tab (account)
Discovered SSH Keys (account)
History tab (account)
Managing accounts
Assets
Adding an account
Adding a cloud platform account
Manually adding a tag to an account
Deleting an account
Adding users or user groups to an account
Checking, changing, or setting an account password
Viewing password archive
Checking, changing, or setting an SSH key
Viewing SSH key archive
Adding an API key
Checking, changing, or setting an API key
Viewing API Key Archive
Setting a TOTP authenticator
Removing a TOTP authenticator
Properties tab (asset)
Accounts tab (asset)
Account Dependencies tab (asset)
Access Request Policies (asset)
Owners tab (asset)
Discovered SSH Keys (asset)
Discovered Services tab (asset)
History tab (asset)
Managing assets
Partitions
Adding an asset
General tab (add asset)
Connection tab (add asset)
Checking an asset's connectivity
Assigning an asset to a partition
Assigning a profile to an asset
Manually adding a tag to an asset
Adding an account to an asset
Adding account dependencies
Adding users or user groups to an asset
Deleting an asset
Account Discovery tab (add asset)
Downloading a public SSH key
About service accounts
About Test Connection
SSH Key
Directory Account
Starling Connect
Local System Account
Password (local service account)
Access Key
None
Management tab (add asset)
Attributes tab (edit asset)
About profiles
Properties tab (partitions)
Assets tab (partitions)
Accounts tab (partitions)
Owners tab (partitions)
Password Profiles tab (partitions)
SSH Key Profiles tab (partitions)
History tab (partitions)
Managing partitions
Discovery
Adding a partition
Adding assets to a partition
Adding an account to a partition
Removing assets from a partition
Adding users or user groups to a partition
Creating a password profile
Creating an SSH key profile
Setting a default partition
Setting a default profile
Assigning assets or accounts to a password profile and SSH key profile
Deleting a partition
Asset Discovery
Profiles
Asset Discovery job workflow
Adding an Asset Discovery job
Asset Discovery Results
Account Discovery
Account Discovery Results
Discovered Accounts
Service Discovery Results
Discovered Services
SSH Key Discovery
General tab (asset discovery)
Information tab (asset discovery)
Asset Discovery Rules tab (asset discovery)
Deleting an Asset Discovery job
Add Condition (asset discovery)
Edit Connection Template (asset discovery)
Add Asset Profile (asset discovery)
Schedule tab (asset discovery)
Password Profiles (profiles)
Tags
Properties tab (profiles)
Assets tab (profiles)
Accounts tab (profiles)
View Password Profile Components (profiles)
Managing password profiles
Adding a password profile
Password Profiles
Setting a default password profile
Deleting a password profile
SSH Key Profiles (profiles)
Managing SSH key profiles
Adding a tag for tagging of assets or asset accounts
Deleting an asset or asset account tag
Modifying an asset or asset account tag
Copying an asset or asset account tag to another partition
Viewing asset and asset account tag assignments
Registered Connectors
Custom platforms
Importing objects
Access Request Activity
Account Groups
User Management
Properties tab (account group)
Accounts tab (account group)
Access Request Policies tab (account group)
History tab (account group)
Managing account groups
Application to Application
About Application to Application functionality
Setting up Application to Application
Adding an application registration
Deleting an application registration
Regenerating an API key
Making a request using the Application to Application service
Cloud Assistant
Asset Groups
Properties tab (asset group)
Assets tab (asset group)
Access Request Policies tab (asset group)
History tab (asset group)
Managing asset groups
Entitlements
General tab (entitlements)
Users tab (entitlements)
Access Request Policies tab (entitlements)
History tab (entitlements)
Managing entitlements
Linked Accounts
User Groups
Adding an entitlement
How SPP evaluates policy when a user submits an access request
Creating an access request policy
General tab (create access request policy)
Security tab (create access request policy)
Scope tab (create access request policy)
Workflow tab (create access request policy)
Adding users or user groups to an entitlement
Deleting an access request policy
Modifying an access request policy
Copying an access request policy
Deleting an entitlement
Properties tab (user groups)
Users tab (user groups)
Entitlements tab (user groups)
History tab (user groups)
Managing user groups
Security Policy Settings
Users
Reports
Properties tab (user)
User Groups tab (user)
Entitlements tab (user)
History (user)
Managing users
User Groups
Properties tab (user groups)
Users tab (user groups)
Entitlements tab (user groups)
History tab (user groups)
Managing user groups
Time Zone
Activity Center
Disaster recovery and clusters
Applying search criteria
Saving search criteria and loading previously saved search criteria
Generating an activity audit log report
Scheduling an activity audit log report
Editing or deleting a saved search or scheduled report
Viewing event details
Auditing request workflow
Sorting report results
Entitlement reports
Exporting a detailed user entitlement report
Ownership reports
Enrolling replicas into a cluster
Unjoining replicas from a cluster
Maintaining and diagnosing cluster members
Administrator permissions
About Offline Workflow Mode
Failing over to a replica by promoting it to be the new primary
Activating a read-only appliance
Diagnosing a cluster member
Patching cluster members
Using a backup to restore a clustered appliance
Resetting a cluster that has lost consensus
Performing a factory reset
Unlocking a locked cluster
Troubleshooting tips
Appliance Administrator permissions
Asset Administrator permissions
Auditor permissions
Authorizer Administrator permissions
Help Desk Administrator permissions
Operations Administrator permissions
Security Policy Administrator permissions
User Administrator permissions
Preparing systems for management
Preparing ACF - Mainframe systems
Preparing Amazon Web Services platforms
Preparing Cisco devices
Preparing Dell iDRAC devices
Preparing VMware ESXi hosts
Preparing Fortinet FortiOS devices
Preparing F5 Big-IP devices
Preparing HP iLO servers
Preparing HP iLO MP (Management Processors)
Preparing IBM i (AS/400) systems
Preparing JunOS Juniper Networks systems
Preparing MongoDB
Preparing MySQL servers
Preparing Oracle databases
Preparing PAN-OS (Palo Alto) networks
Preparing PostgreSQL
Preparing RACF mainframe systems
Preparing SAP HANA
Preparing SAP Netweaver Application Servers
Preparing Safeguard for Privileged Sessions for credential management
Preparing Sybase (Adaptive Server Enterprise) servers
Preparing SonicOS devices
Preparing SonicWALL SMA or CMS appliances
Preparing SQL Servers
Preparing Top Secret mainframe systems
Preparing Unix-based systems
Preparing Windows systems
Preparing WinRM systems
Preparing Windows SSH systems
VMware vCenter Server
Minimum required permissions for Windows assets
Troubleshooting
Appliance is sick
Connectivity failures
Frequently asked questions
Change password or SSH key fails
Incorrect authentication credentials
Missing or incorrect SSH host key
No cipher supported error
Service account has insufficient privileges
Cannot connect to remote machine through SSH or RDP
Cannot delete account
Cannot play session message
Domain user denied access to SPP
LCD status messages
My Mac keychain password or SSH key was lost
Password fails for Unix host
Password or SSH key is pending a reset
Password or SSH key profile did not run
Recovery Kiosk (Serial Kiosk)
Appliance information (Recovery Kiosk)
Backups
Power options
Admin password reset
Factory reset from the Recovery Kiosk
Support bundle
Replica not adding
System services did not update or restart after password or SSH key change
Test Connection failures
Test Connection failures on archive server
Certificate issue
Cipher support
Domain controller issue
Networking issue
Windows WMI connection
Timeout errors causing operations to fail
User locked out
User not notified
How do I audit transaction activity
How do I configure external federation authentication
Appendix A: Safeguard ports
Appendix B: SPP and SPS join guidance
Appendix C: Regular Expressions
How do I add an external federation provider trust
How do I create a relying party trust for the STS
How do I add an external federation user
How do I manage accounts on unsupported platforms
How do I modify the appliance configuration settings
How do I prevent SPP messages when making RDP connections
How do I set up telnet and TN3270/TN5250 session access requests
How do SPP database servers use SSL
What are the access request states
What do I do when an appliance goes into quarantine
When does the rules engine run for dynamic grouping and tagging
Why did the password or SSH key change during an open request
Appliance Management
Appliance Management
Appliance
Use the Appliance settings to view general information about the appliance, run diagnostic tools, and reset or update the One Identity Safeguard for Privileged Passwords hardware appliance.
SPP can be set up to use a virtual appliance. For more information, see Using the virtual appliance and web management console..
One Identity Safeguard for Privileged Passwordsprovides the following information to help you resolve many common problems you may encounter as you deploy and use your appliance.
| Setting | Description | ||
|---|---|---|---|
|
Where you execute a trusted, secure diagnostics package to help solve a configuration issue, synchronization issue, clustering issue, or other internal issues. | |||
|
Where you view general information about the appliance, as well as its performance utilization and the memory usage. You can also edit the Appliance Name and Host DNS Suffix. | |||
|
Where you enable or disable debug logging to a syslog server. | |||
|
Where you add or update a SPP license. | |||
|
Where you run diagnostic tests on your appliance. | |||
| Networking | Where you view and configure the primary network interface, and if applicable, the sessions network interface. | ||
| Operating System Licensing |
Available on virtual machine only. Not available on hardware. Where you configure the operating system for the virtual appliance. | ||
|
Where you upload and install a patch update file. | |||
|
Where you shut down or restart your appliance in the web client. | |||
|
Where you configure SSH Algorithms to manage account passwords and SSH keys. | |||
| Support bundle |
Where you create a support bundle containing system and configuration information to send to One Identity Support to analyze and diagnose issues with your appliance. | ||
| Time |
Where you enable Network Time Protocol (NTP) and set the primary and secondary NTP servers. A replica in the cluster will always reference the primary appliance as its NTP server. You can also manually set the time on a primary but not a cluster.
| ||
|
Available on hardware only. Not available on a virtual machine. Where you perform a factory reset to revert your appliance to its original state when it first came from the factory. | |||
|
Available on hardware only. Not available on a virtual machine. Where you enable and disable lights out management, which allows you to remotely manage the power state and serial console to SPP using the baseboard management controller (BMC). |
In addition to the appliance options, One Identity Safeguard for Privileged Passwords provides these troubleshooting tools:
| Tool | Description |
|---|---|
| View the details of specific events or user activity. For more information, see Activity Center.. | |
| LCD status messages | Use the LCD screen on the appliance to view the status of the appliance as it is starting up or shutting down. For more information, see LCD status messages.. |
| Recovery Kiosk (Serial Kiosk) | A terminal or laptop connected directly to the appliance to view basic appliance information, restart the appliance remotely, shut down the appliance, reset the bootstrap administrator’s password to its initial value, perform a factory rest, or to generate and send a support bundle to a Windows share. For more information, see Recovery Kiosk (Serial Kiosk).. |
Appliance Diagnostics
Appliance Administrators can execute a trusted, secure appliance diagnostics package to help solve issues with configuration, synchronization, and clustering, as well as other other internal challenges. The appliance diagnostics package is available from the web Support Kiosk, not the Serial Kiosk (Recovery Kiosk). The appliance diagnostics package can be used even when the appliance is in quarantine. To protect against external threats, Safeguard rejects illegitimate appliance diagnostics packages. The manifest file in the appliance diagnostics package lists criteria that may include the minimum Safeguard version, appliance ID, and expiration time-stamp UTC. New product code and database changes are not included in an appliance diagnostics package.
- The state of the appliance displays (for example, Online). Click
Refresh to update the state.
- If no appliance diagnostics package has been loaded, click Upload Diagnostics, select the appliance diagnostics package file that has an .sgd extension, then click Open.
- If the upload criteria is not met, the appliance diagnostics package is not uploaded and a message like the following displays: The minimum Safeguard version needed to run this diagnostic package is <version>.
- If the upload is successful, the Diagnostic Package Information displays with the Status of Staged. You can:
- Select Execute and wait until the Status changes to Completed or Error.
- Select Remove to delete the appliance diagnostics package and the associated log file.
- Once uploaded, you can perform these activities.
- If the Expiration Date has not passed, you can select Execute to execute the appliance diagnostics package again.
- Select Delete to delete the appliance diagnostics package, the associated log file, and stop any appliance diagnostics package that is running. Before uploading a different appliance diagnostics package, you must delete the current one because there can be only one appliance diagnostics package per appliance.
- Select Download Log to save the log file. Audit log entries are available through the Activity Center during and after execution and are part of the appliance history. A log is also available during and after execution until the diagnostic package has been deleted.
Appliance Information
It is the responsibility of the Operations Administrator or the Appliance Administrator to monitor the status of the appliance.
To go to Appliance Information:
To refresh:
The following information displays.
| Property | Description |
|---|---|
| Appliance Name |
The name of the appliance. |
|
Host DNS Suffix |
The host DNS suffix name. The Appliance Administrator can modify the name. Click |
|
Host |
The appliance network server IP address. |
| Appliance Version | The version of the SPP Appliance. |
| Uptime | The amount of time (hours and minutes) the appliance has been running. |
|
Last Boot Date |
The last date the appliance was booted up. |
Edit to enable the Appliance Name text box. Enter a new appliance name and click Save.General tab information
Disk is a graphical display of the amount of used and free disk space. When the disk usage is over 80%, the log reflects: DiskUsageWarningEvent.
| Property | Description |
|---|---|
| Manufacturer | The system manufacturer. |
| Model | The system model. |
| Bios Description | The system bios description. |
| Bios Serial Number | The system's bios serial number. |
| Serial Number | The media access control address (MAC address) assigned to the network interface for communications. |
| Ship Date | The appliance ship date. |
| Processor | The processor information. |
| Virtual Memory | The virtual memory allocation. |
| Physical Memory |
The physical memory allocation. |
|
TLS 1.2 only |
Click this toggle to disable earlier versions of the Transport Layer Security (TLS) protocol and use only TLS v1.2. NOTE: You must reboot your appliance after enabling TLS 1.2 only.
|
enabled and 
disabledPerformance tab
| Property | Description |
|---|---|
|
Total CPU and Core_n |
Displays the CPU information and the performance utilization of your appliance. |
| Memory | Displays the memory usage of your appliance; what is currently in use and what is free. |
|
Disk Space |
Displays the disk space used and free. |