One Identity Safeguard Administration Guide

2.11.1

One Identity LLC

Browser built in viewer
PDF Viewer
Universal Document Viewer
Google Docs View
Google Drive View
Download Document [pdf]

File Info : application/pdf, 675 Pages, 4.32MB

OneIdentitySafeguardforPrivilegedPasswords 2.11.1 AdministrationGuide en-us

Safeguard for Privileged Passwords 2.11.1
Administration Guide

Copyright 2020 One Identity LLC.
ALL RIGHTS RESERVED.
This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser's personal use without the written permission of One Identity LLC .
The information in this document is provided in connection with One Identity products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of One Identity LLC products. EXCEPT AS SET FORTH IN THE TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, ONE IDENTITY ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. IN NO EVENT SHALL ONE IDENTITY BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF ONE IDENTITY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. One Identity makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. One Identity does not make any commitment to update the information contained in this document.
If you have any questions regarding your potential use of this material, contact:
One Identity LLC. Attn: LEGAL Dept 4 Polaris Way Aliso Viejo, CA 92656
Refer to our Web site (http://www.OneIdentity.com) for regional and international office information.
Patents
One Identity is proud of our advanced technology. Patents and pending patents may apply to this product. For the most current information about applicable patents for this product, please visit our website at http://www.OneIdentity.com/legal/patents.aspx.
Trademarks
One Identity and the One Identity logo are trademarks and registered trademarks of One Identity LLC. in the U.S.A. and other countries. For a complete list of One Identity trademarks, please visit our website at www.OneIdentity.com/legal. All other trademarks are the property of their respective owners.
Legend
WARNING: A WARNING icon highlights a potential risk of bodily injury or property damage, for which industry-standard safety precautions are advised. This icon is often associated with electrical hazards related to hardware.
CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if instructions are not followed.
Safeguard for Privileged Passwords Administration Guide Updated - March 2020 Version - 2.11.1

Contents

Introduction

Introduction to Safeguard for Privileged Passwords

Overview of the entities

Key features

Appliance specifications

System requirements

Desktop client system requirements

Web client system requirements

Web management console system requirements

Supported platforms

Product licensing

Using the virtual appliance and web management console

Setting up the virtual appliance

Virtual appliance backup and recovery

Support Kiosk

Using the cloud

Before you start: platforms and resources

Restricting access to the web management kiosk for cloud deployments

Using Azure

Virtual appliance backup and recovery

Setting up Safeguard for Privileged Passwords for the first time

Step 1: Create the Authorizer Administrator

Step 2: Authorizer Administrator creates administrators

Step 3: Appliance Administrator configures the appliance

Step 4: User Administrator adds users

Step 5: Asset Administrator adds managed systems

Step 6: Security Policy Administrator adds access request policies

Search box

Search by attribute

Select a drop-down to sort

Safeguard for Privileged Passwords 2.11.1 Administration Guide 3

Using the web client

My Requests (web client)

Approvals (web client)

Reviews (web client)

Favorites (web client)

Settings, version, and Windows client (web client)

Change password (web client)

FIDO2 keys (web client)

Log out (web client)

Installing the desktop client

Starting the desktop client

Uninstalling the desktop client

Using the desktop client

Settings (desktop client)

User information and log out (desktop client)

Desktop client favorite request

Desktop client navigation pane

Home

Dashboard

Access Requests

Account Automation

Activity Center

Applying search criteria

Saving search criteria

Generating an activity audit log report

Scheduling an activity audit log report

Editing or deleting a saved search or scheduled report

Viewing event details

Auditing request workflow

Filtering report results

Sorting report results

Reports

100

Running an entitlement report

101

Safeguard for Privileged Passwords 2.11.1 Administration Guide 4

Converting time stamps Administrative Tools
Toolbar options
Privileged access requests Configuring alerts
Toast notifications Email notifications Password release request workflow Requesting a password release
Taking action on a password release request Approving a password release request Reviewing a completed password release request Session request workflow About sessions and recordings Requesting session access
Taking action on a session request Approving a session request Launching the SSH client Launching an RDP session Reviewing a session request Replaying a session Following and terminating a "live" session
Toolbox Viewing task status Stopping a task
Accounts General tab (account) Access Request Policies tab (account) Account Groups tab (account) Dependent Assets (account) Check and Change Log tab (account) History tab (account) Managing accounts
Adding an account

102 103 105
107 108 108 108 110 111 113 115 117 118 118 120 123 127 129 130 132 133 134
136 136 137
138 139 141 142 143 144 145 146 147

Safeguard for Privileged Passwords 2.11.1 Administration Guide 5

Adding a cloud platform account Manually adding a tag to an account Adding an account to one or more account groups Modifying an account Deleting an account Importing objects
Creating an import file Checking, changing, or setting an account password Viewing password archive
Account Groups General tab (account group) Accounts tab (account group) Access Request Policies tab (account group) History tab (account group) Managing account groups
Adding an account group Adding a dynamic account group
General tab (add dynamic account group) Account Rules tab (add dynamic account group) Summary tab (add dynamic account group) Adding one or more accounts to an account group Adding accounts to an access request policy Modifying an account group Deleting an account group
Assets General tab (asset) Accounts tab (asset) Account Dependencies tab (asset) Access Request Policies tab (asset) Asset Groups tab (asset) Discovered Services tab (asset) History tab (asset) Managing assets
Adding an asset

148 150 151 152 152 152 155 156 157
159 160 160 161 162 164 164 164 165 166 168 168 169 169 169
171 174 178 180 180 181 182 183 184 185

Safeguard for Privileged Passwords 2.11.1 Administration Guide 6

General tab (add asset) Management tab (add asset) Account Discovery tab (add asset) Connection tab (add asset) Attributes tab (add asset) Checking an asset's connectivity Assigning an asset to a partition Assigning a profile to an asset Manually adding a tag to an asset Adding an account to an asset Adding account dependencies Adding an asset to asset groups Modifying an asset Deleting an asset Importing objects Downloading a public SSH key
Asset Groups General tab (asset group) Assets tab (asset group) Access Request Policies tab (asset group) History tab (asset group) Managing asset groups
Adding an asset group Adding a dynamic asset group
General tab (add dynamic asset group) Asset Rules tab (add dynamic asset group) Summary tab (add dynamic asset group) Adding assets to an asset group Modifying an asset group Deleting an asset group
Discovery Asset Discovery
Asset Discovery job workflow Adding an Asset Discovery job

186 187 190 192 203 204 205 205 206 207 208 210 210 211 211 214
215 216 216 217 218 219 219 220 221 221 223 223 224 224
225 226 228 228

Safeguard for Privileged Passwords 2.11.1 Administration Guide 7

General tab (asset discovery) Information tab (asset discovery) Rules tab (asset discovery) Schedule tab (asset discovery) Summary tab (asset discovery) Editing an Asset Discovery job Deleting an Asset Discovery job Asset Discovery Results Account Discovery Account Discovery job workflow Adding an Account Discovery job Adding an Account Discovery rule Editing an Account Discovery job Deleting an Account Discovery job Account Discovery Results Discovered Accounts Service Discovery Results Discovered Services
Entitlements General tab Users tab Access Request Policies tab History tab Managing entitlements
Adding an entitlement General tab Time Restrictions tab
Creating an access request policy General tab Scope tab Requester tab Approver tab Reviewer tab Access Config tab Session Settings tab

229 230 231 237 238 238 239 239 240 243 244 246 249 250 251 251 253 254
258 259 260 261 263 265 265 265 267 268 269 270 271 272 274 276 277

Safeguard for Privileged Passwords 2.11.1 Administration Guide 8

Time Restrictions tab Emergency tab Adding users or user groups to an entitlement Deleting an access request policy Modifying an access request policy Copying an access request policy Viewing and editing policy details Modifying an entitlement Deleting an entitlement
Partitions About partition profiles General tab (partitions) Assets tab (partitions) Accounts tab (partitions) Profiles tab (partitions) History tab (partitions) Managing partitions
Adding a partition Adding assets to a partition Removing assets from a partition Creating a profile Modifying a partition profile Setting a default partition Setting a default partition profile Assigning assets or accounts to a partition profile Modifying a partition Deleting a partition
Settings Access Request settings
Enable or Disable Services (Access and management services) Reasons Appliance settings Appliance Diagnostics Appliance Information

279 279 280 281 282 282 282 283 283
285 286 287 288 289 290 291 292 292 293 294 294 295 296 297 297 298 299
300 301 301 303 304 306 307

Safeguard for Privileged Passwords 2.11.1 Administration Guide 9

Setting the appliance name

309

Shutting down the appliance

309

Restarting the appliance

310

Enable or Disable Services

310

Factory Reset from the desktop client

311

Licensing

312

Lights Out Management (BMC)

313

Network Diagnostics

314

Ping

314

NS Lookup

315

Trace Route

316

Telnet

316

Show Routes

317

Networking

318

Operating system licensing

320

Support bundle

321

Time

321

Updates

322

Asset Management settings

324

Custom platforms

324

Creating a custom platform script

325

Adding a custom platform

326

Related Topics
Modifying a user group

Users tab (user groups)
The Users tab displays the members of the selected group. Click Add User from the details toolbar to add one or more users to the selected local user group.

Safeguard for Privileged Passwords 2.11.1 Administration Guide User Groups

468

NOTE: For directory groups, group membership is read-only. That is, you cannot add or remove users from a directory group using the Users tab.
Navigate to Administrative Tools | User Groups | Users.

Table 198: User Groups: Users tab properties

Property

Description

User Name

The user's display name.

Name

The user's first and last name, if the information exists in the user's properties; otherwise, the user's display name.

Provider

The name of the authentication provider: Local, Certificate, or the name of an external provider such as a Microsoft Active Directory domain name.

Distinguished Name The distinguished name of the user.

Use these buttons on the details toolbar to manage the users in your user groups.

Table 199: User Groups: Users tab toolbar

Option

Description

Add User

Add one or more users to the selected user group. For more information, see Adding users to a user group on page 476.

Remove Selected

Remove the selected user from the user group.

Refresh

Update the list of users in the user groups.

Details

View additional details about the selected user.

To locate a specific user or set of users in this list, enter the character string to be used to search for a match. For more information, see Search box on page 63.

Related Topics
Adding users to a user group Modifying a user group

Entitlements tab (user groups)
The Entitlements tab displays the entitlements to which the users associated with the selected user group are users.

Safeguard for Privileged Passwords 2.11.1 Administration Guide User Groups

469

NOTE: The Entitlements tab is only available to a user with Auditor or Security Policy Administrator permissions.
Click Add Entitlement to add the selected user group as a user of one or more entitlements.
Navigate to Administrative Tools | User Groups | Entitlements.

Table 200: User Groups: Entitlements tab properties

Property

Description

Name

The name assigned to the entitlement.

Accounts

The number of unique accounts in this entitlement.

Users

The number of unique users and user groups in this entitlement.

Access Request Policies

The number of unique policies in this entitlement.

Use these buttons on the details toolbar to manage the entitlements associated with the selected user group.

Table 201: User Groups: Entitlements tab toolbar

Option

Description

Add Entitlement

Add the selected user group to one or more entitlements. For more information, see Adding a user group to an entitlement on page 477.

Remove Selected

Remove the user group from the selected entitlement.

Refresh

Update the list of entitlements.

Details

View additional details about the selected entitlement.

To locate a specific entitlement or set of entitlements in this list, enter the character string to be used to search for a match. For more information, see Search box on page 63.

Related Topics
Adding a user group to an entitlement Modifying a user group

Safeguard for Privileged Passwords 2.11.1 Administration Guide User Groups

470

History tab (user groups)

The History tab allows you to view or export the details of each operation that has affected the selected group. The top of the History tab contains the following information:
l Items: Total number of entries in the history log.

Refresh: Update the list displayed.

Export: Export the data to a .csv file.

l Search: For more information, see Search box on page 63.

Navigate to Administrative Tools | User Groups | History.

Table 202: User Groups: History tab properties

Property

Description

Date/Time

The date and time of the event

User

The display name of the user that triggered the event

Source IP

The network DNS name or IP address of the managed system that triggered the event

Object Name

The name of the selected group

Event

The type of operation made to the selected user group:

l Create l Delete l Update l Add Membership l Remove Membership l Directory Group Sync Complete

NOTE: A membership operation indicates a relationship change with a related or parent object such as a user was added or removed from the membership of the selected user group or the selected group was added or removed from an entitlement.

Related Object

The name of the related object

Safeguard for Privileged Passwords 2.11.1 Administration Guide User Groups

471

Property

Description

Related Object Type The type of the related object

Parent

The name of the object to which the selected user group is a child

Parent Object Type The parent object type

Select an event to display this additional information for some types of events (for example, create and update events).

Table 203: Additional History tab properties

Property

Description

Property

The property that was updated

Old Value

The value of the property before it was updated

New Value

The new value of the property

Managing user groups
Use the controls and tabbed pages on the User Groups page to perform the following tasks to manage Safeguard for Privileged Passwords user groups:
l Adding a user group l Adding a directory user group l Adding users to a user group l Adding a user group to an entitlement l Modifying a user group l Deleting a user group
Adding a user group
It is the responsibility of the Security Policy Administrator to add groups of local users to Safeguard for Privileged Passwords.
NOTE: It is the responsibility of the Authorizer Administrator or the User Administrator to add directory groups. For more information, see Adding a directory user group on page 473.

Safeguard for Privileged Passwords 2.11.1 Administration Guide User Groups

472

To add a user group 1. Navigate to Administrative Tools | User Groups. 2. Click Add User Groups from the toolbar. 3. In the User Groups dialog, enter the following information: a. Name: Enter a unique name for the user group. Limit: 50 characters b. Description: (Optional) Enter information about this user group. Limit: 255 characters
Related Topics
Adding users to a user group
Adding a directory user group
An Asset Administrator (or delegate) must: 1. Add a directory asset. 2. Add the domain as an identity provider via Settings | External Integration | Identity and Authentication. For more information, see Identity and Authentication on page 394.
Next, the Authorizer Administrator or the User Administrator can add directory user groups. The Security Policy Administrator can add local user groups. For more information, see Adding a user group on page 472.
Import consideration
All users who are part of a directory import user group must have complete and valid attributes. If the attributes for a user are not complete and valid, the user is not imported and the import continues. For example, if you set the directory user group authentication properties to require secondary authentication and use the Starling 2FA provider, each user's email address and mobile phone number attributes must have values to be included during the import.
Port
The standard global catalog port, 3268 (LDAP), must be open on the firewall for every Windows global catalog server in the environment and SPP Appliance to communicate for directory management tasks (for example, adding a directory account, a directory user account, or a directory user group). LDAP uses port 389 for unencrypted connections. For more information, see the Microsoft publication How the Global Catalog Works.

Safeguard for Privileged Passwords 2.11.1 Administration Guide User Groups

473

Time
Because Microsoft Active Directory does not have a Time Zone attribute, when you add a directory user group, Safeguard for Privileged Passwords sets the default time zone for all imported accounts to (UTC) Coordinated Universal Time. To reset the time zone, open each imported account in Users and modify the Time Zone on the Location tab.
To add a directory user group
1. Navigate to Administrative Tools | User Groups.
2. Click Add Directory Group from the toolbar.
3. In the Directory Group tab:
a. Select a directory.
b. In the Contains field, enter a full or partial directory group name and click Search.
To search for a directory group, you must enter text into the search box. The text search is not case-sensitive and does not allow wild cards. Safeguard for Privileged Passwords searches each domain of a forest. You can search on partial strings. For example, if you enter "ad" in the search box, it will find any directory group that contains "ad."
c. Browse to select a container within the directory as the Filter Search Location.
d. The Include objects from sub containers check box is selected by default indicating that child objects will be included in your search. Clear this check box to exclude child objects from your search.
e. Select a group name from the results displayed in the Select the group to add grid.
f. At the bottom of the Directory Group dialog, select the Automatically link Managed Directory Accounts check box to have existing managed directory accounts set as linked accounts on the imported user. For details on linked accounts, see Linked Accounts tab (user).
Based on the setting of the directory asset's Managed Objects attribute, the attribute values are used to match up with existing managed directory accounts in Safeguard. The Safeguard user's set of linked accounts will periodically synchronize with the directory and be overwritten with the values from the directory. Any changes to the linked accounts made manually to the user are lost at the next directory synchronization (see Sync additions every under Management tab (add asset)).
4. In the Authentication tab, set the primary and secondary authentication. If you are importing users, Safeguard sets the primary and secondary authentication providers for new users. If a directory user group member already exists as a user in Safeguard, their authentication properties are not changed. To change authentication settings on existing Safeguard users that are members of the group, you must manually invoke the /UserGroups/{id}/SynchronizeAndUpdateProviders API method. Directory groups require the forest root domain to be visible and available for

Safeguard for Privileged Passwords 2.11.1 Administration Guide User Groups

474

identity and authentication set on Administrative Tools | Settings | External Integration | Identity and Authentication. For more information, see Available Domains for Identity and Authentication (for Active Directory) on page 400.
a. The Authentication Provider field defaults to the directory (or the forest root name for Active Directory) from which the group came.
All newly created Safeguard users that are imported from the directory user group will have their primary authentication provider set to use the directory domain from which their user originates. For an Active Directory forest with multiple domains, the domains must be marked as Available Domains for Identity and Authentication. If a user is a member of a group, but their domain is not marked as Available for Identity and Authentication, the user will not be imported. For more information, see Adding identity and authentication providers on page 398.
You can use either an External Federation or Radius server as each user's primary authentication provider. During an import process, the directory attribute that was specified for External Federation Authentication or Radius Authentication will be used to set the user's Email Address or Name Claim (for External Federation) or Login name (for Radius) property. See the External Federation settings attribute and Radius settings attribute for more information.
b. Select the Require Certificate Authentication check box to require that the user logs in to Safeguard using their domain issued user certificate or SmartCard. This option is only available when the directory user group comes from Microsoft Active Directory and the Authentication Provider is also set as that directory.
c. You can require the user to log in with two-factor authentication. Users being imported must have their contact information complete in order to successfully create a user in Safeguard. For example, their mobile phone attribute must contain a valid phone number in E.164 format when using Starling 2FA as the secondary authentication provider.
i. Select the Require Secondary Authentication check box. For more information, see Requiring secondary authentication log in on page 457.
ii. Choose the secondary Authentication Provider for all users of the directory user group. Use valid combinations of identity and authentication providers. For more information, see Identity and Authentication on page 394.
5. On the Permissions tab, select any administration permissions to be assigned to each member of the user group. Newly created Safeguard users are assigned the selected permissions. If the user exists in Safeguard, the selected permissions are added to the existing user permissions. A user's permissions include all permissions for every directory user group to which they are assigned. For more information, see the Permissions tab (add user) under Managing Users.

Safeguard for Privileged Passwords 2.11.1 Administration Guide User Groups

475

When rerunning a directory user group import or during the periodic directory synchronization, a Safeguard user may be identified as no longer a member of a directory user group that was imported. In this case, the administrator permissions assigned to the group are removed from the user, regardless of whether they were added to the user during the group import process or if they were manually added to the user. If the user is a member of another directory user group, any overlapping administrator permissions will remain assigned to the user.
IMPORTANT: Any user imported through a directory group will not have Directory permissions. You will need to manually assign the user to a partition. For more information, see Partitions tab (user) on page 446. 6. Click Add Group. On an import, the directory user group is created and the assigned users appear when the import process is complete. 7. After adding the information, you can edit the following directory group settings and the directory synchronization process will be triggered in the background.
l Directory Group tab: Select or clear the Automatically link Managed Directory Accounts check box.
l Authentication tab: Change the authentication providers. NOTE: Changing the authentication providers will only effect newly imported users. Existing users will not have their authentication providers updated. To change authentication settings on existing Safeguard users that are members of the group, you must manually invoke the /UserGroups/ {id}/SynchronizeAndUpdateProviders API method.
l Permissions tab: Change the permissions.
Adding users to a user group
It is the responsibility of the Security Policy Administrator to associate both local or directory users to user groups. User groups belong to the identity group. You can not add or remove users to or from a directory user group. This has to be done in Active Directory on the Directory Group object represented.
Table Section Outside Table: NOTE: Directory group membership is still maintained in the directory, such as Active Directory.
To add users to a user group
1. Navigate to Administrative Tools | User Groups. 2. In User Groups, select a user group from the object list and open the Users tab. 3. Click Add User from the details toolbar. 4. Select one or more users from the list in the Users selection dialog and click OK.
IMPORTANT: You cannot add a group to a user group's membership; group

Safeguard for Privileged Passwords 2.11.1 Administration Guide User Groups

476

membership cannot be nested. If you do not see the user you are looking for and you have Authorizer Administrator or User Administrator permissions, you can click Create New to create users. For more information, see Adding a user.
Adding a user group to an entitlement
When you add user groups to an entitlement, you are specifying which people can request access to the accounts and assets governed by an entitlement's policies. It is the responsibility of the Security Policy Administrator to add user groups to entitlements.
To add a user group to entitlements 1. Navigate to Administrative Tools | User Groups. 2. In User Groups, select a user group from the object list and open the Entitlements tab. 3. Click Add Entitlement from the details toolbar. 4. Select one or more entitlements from the Entitlements selection dialog and click OK.
If you do not see the entitlement you are looking for and you have Security Policy Administrator permissions, you can click Create New and add the entitlement. For more information about creating entitlements, see Adding an entitlement.
Modifying a user group
Only the Security Policy Administrator can modify user groups.
To modify a user group 1. Navigate to Administrative Tools | User Groups. 2. In User Groups, select a user group. 3. Select the view of the user group's information you want to modify (General, Users, or Entitlements). For example: l To change a local user group's name or description, double-click the General information box on the General tab or click the Edit icon. NOTE: You can double-click a user group name to open the General settings edit window.

Safeguard for Privileged Passwords 2.11.1 Administration Guide User Groups

477

l To add (or remove) users to the selected local user group, click the Users tab. You can multi-select members to add or remove more than one from a user group.
l To add (or remove) the selected user group to an entitlement, click the Entitlements tab.
4. To view or export the details of each operation that has affected the selected user group, switch to the History tab. For more information, see History tab (user groups) on page 471.
Deleting a user group
It is the responsibility of the Security Policy Administrator to delete groups of local users from Safeguard for Privileged Passwords. It is the responsibility of the Authorizer Administrator or the User Administrator to delete directory groups. When you delete a user group, Safeguard for Privileged Passwords does not delete the users associated with it.
To delete a user group 1. Navigate to Administrative Tools | User Groups. 2. In User Groups, select a user group from the object list. 3. Click Delete Selected. 4. Confirm your request.

Safeguard for Privileged Passwords 2.11.1 Administration Guide User Groups

478

Disaster recovery and clusters

Safeguard for Privileged Passwords Appliances can be clustered to ensure high availability. Clustering enables the recovery or continuation of vital technology infrastructure and systems following a natural or human-induced disaster. This reduces down time and data loss.
Another benefit of clustering is load distribution. Clustering in a managed network ensures the load is distributed to ensure minimal cluster traffic and to ensure appliances that are closest to the target asset are used to perform the task. The Appliance Administrator defines managed networks (network segments) to effectively manage assets, account, and service access requests in a clustered environment to distribute the task load.
Primary and replica appliances
A Safeguard for Privileged Passwords cluster consists of three or five appliances. An appliance can only belong to a single cluster. One appliance in the cluster is designated as the primary. Non-primary appliances are referred to as replicas. All vital data stored on the primary appliance is also stored on the replicas. In the event of a disaster, where the primary appliance is no longer functioning, you can promote a replica to be the new primary appliance. Network configuration is done on each unique appliance, whether it is the primary or a replica.
The replicas provide a read-only view of the security policy configuration. You cannot add, delete, or modify the objects or security policy configuration on a replica appliance. You can perform password change and check operations and make password release and session access requests. Users can log in to replicas to request access, generate reports, or audit the data. Also, passwords and sessions can be requested from any appliance in a Safeguard cluster.
Supported cluster configurations
Current supported cluster configurations follow.
l 3 Node Cluster (1 Primary, 2 Replicas): Consensus is achieved when two of the three appliances are online and able to communicate. Valid states are: Online or ReplicaWithQuorum. For more information, see Appliance states on page 502.
l 5 Node Cluster (1 Primary, 4 Replicas): Consensus is achieved when three of the five appliances are online and able to communicate. Valid states are: Online or ReplicaWithQuorum. For more information, see Appliance states on page 502.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

479

Consensus and quorum failure
Some maintenance tasks require that the cluster has consensus (quorum). Consensus means that the majority of the members (primary or replica appliances) are online and able to communicate. Valid states are: Online or ReplicaWithQuorum. For more information, see Appliance states on page 502. Supported clusters have an odd number of appliances so the cluster has a consensus equal to or greater than 50% of the appliances are online and able to communicate. If a cluster loses consensus (also known as a quorum failure), the following automatically happens:
l The primary appliance goes into Read-only mode. l Password check and change is disabled.
When connectivity is restored between a majority of members in a cluster, consensus is automatically regained. If the consensus members include the primary appliance, it automatically converts to read-write mode and enables password check and change.
Health checks and diagnostics
The following tools are available to perform health checks and diagnose the cluster and appliances.
l Perform a health check to monitor cluster health and appliance states. For more information, see Maintaining and diagnosing cluster members on page 485.
l Diagnose the cluster and appliance. You can view appliance information, run diagnostic tests, view and edit network settings, and generate a support bundle. For more information, see Diagnosing a cluster member on page 492.
Shut down and restart an appliance
You can shut down and restart an appliance.
l Shut down an appliance. For more information, see Shutting down the appliance on page 309.
l Restart an appliance. For more information, see Restarting the appliance on page 310.
Run access request workflow on an isolated appliance in Offline Workflow Mode
You can enable Offline Workflow Mode either automatically or manually to force an appliance that no longer has quorum to process access requests using cached policy data in isolation from the remainder of the cluster. The appliance will be in Offline Workflow Mode.
l For general information on Offline Workflow Mode, see About Offline Workflow Mode. l To manually enable offline workflow or manually resume online workflow, see
Manually control Offline Workflow Mode.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

480

l To configure automatic Offline Workflow Mode and, optionally, automatically Resume Online Workflow, see Offline Workflow (automatic). When automation is turned on, you can still also manually control Offline Workflow Mode.
Primary appliance failure: failover and backup restore
If a primary is not communicating, perform a manual failover. If that is not possible, you can use a backup to restore an appliance.
l Failover: If the primary is not communicating, you can perform a manual failover if there is a quorum (the majority has consensus). For more information, see Failing over to a replica by promoting it to be the new primary on page 491.
l Backup restore: Perform a backup restore if no appliance can be restored using failover. For more information, see Using a backup to restore a clustered appliance on page 495.
Unjoin and activate
If the cluster appliances are able to communicate, you can unjoin the replica, then activate the primary so replicas can be joined.
l You can unjoin a replica in any state and place it in Standalone Read-only mode (StandaloneReadOnly state). For more information, see Unjoining replicas from a cluster on page 483.
l You can activate an appliance that has been been unjoined and placed in Standalone Read-only mode (StandaloneReadOnly state) if the appliance is not managed in anther Safeguard cluster. For more information, see Activating a read-only appliance on page 492.
Cluster reset
If the appliance is offline or the cluster members are unable to communicate, you must use Cluster Reset to rebuild the cluster. If there are appliances that must be removed from the cluster but there is no quorum to safely unjoin, a cluster reset force-removes nodes from the cluster. For more information, see Resetting a cluster that has lost consensus on page 497.
Factory reset
Perform a factory reset to recover from major problems or to clear the data and configuration settings on a hardware appliance. All data and audit history is lost and the hardware appliance goes into maintenance mode. You can perform a factory reset from:
l The desktop client. For more information, see Performing a factory reset on page 498.
l The Recovery Kiosk. For more information, see Factory reset from the Recovery Kiosk on page 553.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

481

l The virtual appliance Support Kiosk. For more information, see Support Kiosk on page 49.
Enrolling replicas into a cluster
Prior to the Appliance Administrator enrolling cluster members into a Safeguard for Privileged Passwords cluster, review the enrollment considerations that follow.
Considerations to enroll cluster members
l If there is an appliance in Offline Workflow Mode, resume online operations before adding another replica. For more information, see About Offline Workflow Mode on page 486.
l Update all appliances to the same appliance build (patch) prior to building your cluster. During the cluster patch operation, access request workflow is available so authorized users can request password releases and session access.
l To enroll an appliance into a cluster, the appliance must communicate over port 655 UDP/TCP and port 443 TCP, and must have IPv4 or IPv6 network addresses (not mixed).For more information, see Safeguard ports on page 587.
l You can only enroll replica appliances to a cluster when logged in to the primary appliance (using an account with Appliance Administrator permissions).
l You can only add one appliance at a time. The maintenance operation must be complete before adding additional replicas.
l Enrolling a replica can take as little as five minutes or as long as 24 hours depending on the amount of data to be replicated and your network.
l During an enroll replica operation, the replica appliance goes into Maintenance mode. The existing members of the cluster can still process access requests as long as the member has quorum. On the primary appliance, you will see an enrolling notice in the status bar of the cluster view, indicating that a cluster-wide operation is in progress. This cluster lock prevents you from doing additional maintenance activities. Once the maintenance operation (enroll replica operation) is complete, the diagram in the cluster view (left pane) shows the link latency on the connector. The appliances in the cluster are unlocked and users can once again use the features available in Safeguard for Privileged Passwords. TIP: The Activity Center contains events for the start and the completion of the enrollment process.
l The primary appliance's objects and security policy configuration are replicated to all replica appliances in the cluster. Any objects (such as users, assets, and so on) or security policy configuration defined on the replica will be removed during enroll.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

482

Existing configuration data from the primary will be replicated to the replica during the enroll. Future configuration changes on the primary are replicated to all replicas.
To enroll a replica
1. It is recommended that you make a backup of your primary appliance before enrolling replicas to a cluster.
2. Log in to the primary appliance as an Appliance Administrator. 3. In Administrative Tools, navigate to Settings | Cluster | Cluster
Management. 4. Click Add Replica to join a Safeguard for Privileged Passwords Appliance
to a cluster. 5. In the Add Replica dialog, enter a network DNS name or the IP address of the
replica appliance into the Network Address field, and click Connect. 6. Safeguard for Privileged Passwords connects to the replica and displays the login
screen for the replica appliance. a. Enter a valid account with Appliance Administrator permissions. b. In the Add Replica confirmation dialog, enter the words Add Replica and click OK to proceed with the operation.
Safeguard for Privileged Passwords displays (synchronizing icon) and (lock icon) next to the appliance it is enrolling and puts the replica appliance in Maintenance mode while it is enrolling into the cluster. On all of the appliances in the cluster, you will see an "enrolling" banner at the top of the cluster view, indicating that a cluster-wide operation is in progress and all appliances in the cluster are locked down. Once the maintenance operation (enroll replica operation) is complete, the diagram in the cluster view (left pane) shows the link latency on the connector. The appliances in the cluster are unlocked and users can once again make access requests. 7. Log in to the replica appliance as the Appliance Administrator. Notice that the appliance has a state of Replica (meaning it is in a Read-Only mode) and contains the objects and security policy configuration defined on the primary appliance.
Unjoining replicas from a cluster
Safeguard for Privileged Passwords allows the Appliance Administrator to unjoin replica appliances from a cluster. Prior to unjoining a replica from a Safeguard for Privileged Passwords cluster, review the unjoin considerations that follow.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

483

Considerations to unjoin cluster members
l You can only unjoin replica appliances from a cluster.
l To promote a replica to be the new primary and then unjoin the 'old' primary appliance, you can use the Failover option if the cluster has consensus (the majority of the appliances are online and able to communicate). For more information, see Failing over to a replica by promoting it to be the new primary on page 491. If the cluster does not have consensus, use the Cluster Reset option to rebuild your cluster. For more information, see Resetting a cluster that has lost consensus on page 497.
l To perform an unjoin operation, the replica appliance to be unjoined can be in any state; however, the remaining appliances in the cluster must achieve consensus (online and able to communicate).
l You can unjoin a replica appliance when logged in to any appliance in the cluster that is online, using an account with Appliance Administrator permissions.
l When you unjoin a replica appliance from a cluster, the appliance is removed from the cluster as a stand-alone appliance that retains all of the data and security policy configuration information it contained prior to being unjoined. After the replica is unjoined, the appliance is placed in a Read-only mode with the functionality identified in Read-only mode functionality. You can activate an appliance in Read-only mode so you can add, delete and modify data, apply access request workflow, and so on. For more information, see Activating a read-only appliance on page 492.
To unjoin a replica from a cluster
1. Log in to an appliance in the cluster, as an Appliance Administrator.
2. In Administrative Tools, navigate to Settings | Cluster | Cluster Management.
3. In the cluster view (left pane), select the replica node to be unjoined from the cluster.
4. In the details view (right pane), click Unjoin.
5. In the Unjoin confirmation dialog, enter the word Unjoin and click OK to proceed.
Safeguard for Privileged Passwords displays (synchronizing icon) and (lock icon) next to the appliance it is unjoining and puts the replica appliance in Maintenance mode while it is unjoining from the cluster.
Once the operation has completed, the replica appliance no longer appears in the cluster view (left pane).
NOTE: If you log in to the replica appliance using the desktop client while Safeguard for Privileged Passwords is processing an unjoin operation, you will see the Maintenance mode screen. At the end of the Maintenance mode, you will see a Restart Desktop Client button, indicating that the unjoin operation completed successfully.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

484

Maintaining and diagnosing cluster members
When a node is selected in the Cluster view (left pane) of the Cluster settings page, the appliance details and cluster health view (right pane) displays details about the selected appliance. From this pane you can run the following maintenance and diagnostic tasks against the selected appliance.
l Unjoin: Click Unjoin to remove a replica from the cluster. For more information, see Unjoining replicas from a cluster on page 483.
l Failover: Click Failover to promote a replica to the primary appliance. For more information, see Failing over to a replica by promoting it to be the new primary on page 491.
l Activate: Click Activate to activate a read-only appliance so it can add, modify and delete data. For more information, see Activating a read-only appliance on page 492.
CAUTION: Activating an appliance that is in Read-Only mode will take it out of the Read-only state and enable password check and change for managed accounts. Ensure that no other Safeguard for Privileged Passwords Appliance is actively monitoring these accounts, otherwise access to managed accounts could be lost.
l Diagnose: Click Diagnose to open the Diagnostics pane where you can perform the following: l View appliance information. For more information, see Appliance Information on page 307. l Run diagnostic tests against the appliance. For more information, see Network Diagnostics on page 314. l Perform a factory reset. For more information, see Factory Reset from the desktop client on page 311. l View or edit networking settings. For more information, see Networking on page 318. l Generate a support bundle. For more information, see Support bundle on page 321. l View or edit time settings. For more information, see Time on page 321.
l Check Health: Click Check Health to capture and display the current state of the selected appliance.
l Restart: Click Restart to restart the selected appliance. Confirm your intentions by entering a Reason and clicking Restart.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

485

To fix more serious issues with a cluster, you can perform additional operations depending on the state of the cluster members. Some such operations include:
l Patching cluster members l Using a backup to restore a clustered appliance l Performing a factory reset l Resetting a cluster that has lost consensus l About Offline Workflow Mode
About Offline Workflow Mode
To ensure password consistency and individual accountability for privileged accounts, when an appliance loses consensus in the cluster, access requests are disabled. In the event of an extended network partition, the Appliance Administrator can either automatically or manually place an appliance in Offline Workflow Mode to run access request workflow on that appliance in isolation from the rest of the cluster. When the network issues are resolved and connectivity is reestablished, the Appliance Administrator can either automatically or manually resume online operations to merge audit logs, drop any in-flight access requests, and return the appliance to full participation in the cluster.
Offline workflow considerations
l In Offline Workflow Mode, an appliance functions apart from the other members of the cluster. Users can request passwords and sessions.
l Settings for Offline Workflow are set on an individual appliance.
Passwords in Offline Workflow Mode
l In Offline Workflow Mode, the appliance is enabled to request, approve, and release passwords and sessions without a quorum, using cached policy data.
l In Offline Workflow Mode, when policy requires change after check-in, the requirement is bypassed to allow for subsequent check out. In this case, the Access Request Password Reset By-passed Event is generated, stating: An access request subsequent check out is available as password reset was by-passed.
l Password changes will be rescheduled and will possibly complete when network connectivity is restored even while the appliance is in Offline Workflow Mode.
l Users may still request a password from the primary or another replica on the cluster with consensus; password check and changes works as usual. The result is that passwords may get out of sync on the appliance running Offline Workflow Mode. This is expected behavior and the password will remain out of sync until the partition is healed.
l On a network partition where one or more appliances are in Offline Workflow Mode, it is possible for two individuals to have the same password at the same time. Tying

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

486

actions back to a single responsible individual is not possible. It will still be possible to identify each person that had access to the password at the time.
Policies in Offline Workflow Mode
l Policy will be enforced as it existed at the time the appliance, now in Offline Workflow Mode, lost network connectivity to the rest of the cluster.
l Policy requiring a password change after check-in is bypassed and subsequent checkout from the appliance in Offline Workflow Mode is allowed.
l Policy is Read-only. Therefore, update and delete configuration operations are not allowed on the appliance in Offline Workflow Mode.
l Policy changes are only allowed if directed at an online primary within the cluster. Policy changes on the online primary do not affect the appliance in Offline Workflow Mode. Once the offline workflow appliance has resumed online operations the policy changes will be distributed.
Work flow in Offline Workflow Mode
l Regular work flow approval rules apply.
l Time-based constraints and emergency access apply.
l For the few minutes the appliance is switching to or from Offline Workflow Mode, Application to Application and any command line password-fetching operations will be suspended.
l Platform tasks (including Suspend and Restore Accounts) are disabled in Offline Workflow Mode.
User experience: Enable Offline Workflow Mode
Users that are requesting a password in Safeguard are returned to the Home page. Password requests prior to the switch to Offline Workflow Mode are not displayed.

l When the switch to Offline Workflow Mode starts, this message displays: Safeguard is switching to Offline Workflow Mode. Please wait until this process is complete before proceeding with any current work. The bottom of the Home page

displays this information: (Switching to Offline Workflow Mode...) and

Disconnected. If the user clicks Refresh, the banner is replaced with: is unavailable.

The service

l When the switch to Offline Workflow Mode is complete, a banner with this

information is displayed: Safeguard is currently in Offline Workflow Mode. Previous access requests are temporarily unavailable. You may submit new requests to continue working in Offline Workflow Mode. The bottom of the Home page displays these messages: (Offline Workflow Mode) and the connection status:

Connecting then Connected.

Administrators can view the workflow status on the Cluster View pane where a message like this displays: Offline Workflow Enabled (This appliance is running access workflow in isolation from the cluster.) For more information, see Cluster view pane on page 363.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

487

User experience: Resume Online Operations
When the switch to Resume Online Operations has begun, this message displays: Safeguard is returning to normal operations. Please wait until this process is complete before proceeding with any current work. The bottom of the Home page displays this information: (Returning to normal operations) and Disconnected. Once online operations are restored, the bottom of the Home page displays this
information: Connected. Notifications
l The Appliance Administrator is notified when an appliance has lost consensus (quorum) via the ApplianceStateChangedEvent. l A primary will change from Online to PrimaryNoQuorum. l A replica will change from Online to one of the following: l ReplicaNoQuorum (connected to primary, does not have quorum) l ReplicaDisconnected (disconnected from primary, does not have quorum) l ReplicaWithQuorum (disconnected from primary, has quorum) For more information, see Appliance states on page 502.
l The following events can be configured for email notifications and are written to the audit log: l ClusterPrimaryQuorumLostEvent l ClusterPrimaryQuorumRestoredEvent l ClusterReplicaQuorumLostEvent l ClusterReplicaQuorumRestoredEvent
l All access request notifications are still generated. l The Notification service identifies whether access workflow is available on an
appliance via the IsPasswordRequestAvailable and IsSessionsRequestAvailable properties. The following API endpoint can be used to make this determination: https://<hostname or IP>/service/notification/v2/Status/Availability
Audit logs in Offline Workflow Mode
l Prior to network connectivity being restored, everything that happens on the appliance running in Offline Workflow Mode is only audited on that appliance.
l The audit logs merge when network connectivity is restored between the offline member and any other member in the cluster, even while in Offline Workflow Mode.
l The audit data on any cluster member operating in Offline Workflow Mode will be lost unless the appliance is returned to the cluster using the resume online operations steps.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

488

l All cluster members that were capable of processing access and session requests must have network connectivity restored to the remainder of the cluster to ensure the cluster wide audit history is maintained.
Avoid modifications to the cluster configuration
l It is recommended that no changes to cluster membership are made while an appliance is in Offline Workflow Mode. The online operations must be automatically or manually resumed before adding or removing other nodes to ensure the appliance can seamlessly reintegrate with the cluster. The Appliance Administrator is advised to resume the online operations as soon as possible for individual password accountability, policy adherence, and audit integrity.
Cluster patching is not allowed During a cluster patch, Offline Workflow Mode cannot be triggered manually or automatically on any of the clustered appliances. Considerations to resume online operations
l The network partition must be corrected before resuming online operations with full functionality.
l You can resume online operations of an appliance in Offline Workflow Mode without a quorum. To resume online operations, it is highly recommended that network connectivity is restored between a majority of the cluster members, including the member in Offline Workflow Mode.
l When resuming online operations, any access requests that are in flight on the appliance that is running in Offline Workflow Mode will be dropped.
l While it is possible to resume online operations if the appliance is not connected, making access requests will no longer be available.
Automatic versus manual workflow
l You can configure automatic triggering of Offline Workflow Mode and automatic resumption of online workflow. For more information, see Offline Workflow (automatic) on page 370.
l You can manually enable Offline Workflow Mode and manually resume online workflow. Manually control Offline Workflow Mode.
Manually control Offline Workflow Mode
The Appliance Administrator can manually control Offline Workflow Mode using the following steps. Manual intervention is possible when automatic Offline Workflow Mode is enabled. For more information, see Offline Workflow (automatic) on page 370.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

489

To manually enable Offline Workflow Mode
1. Navigate to Administrative Tools | Settings | Cluster | Cluster Management.
2. In the cluster view (left pane) of the offline appliance, click the member of the cluster that is offline.
3. In the appliance details and cluster health pane (right pane), review the errors and warnings to verify the appliance has lost consensus.
4. On the offline appliance, click Enable Offline Workflow. (This option is only available when the appliance has lost consensus with the cluster.)
A message like the following displays:
This appliance will run access workflow in isolation from the cluster to work around loss of consensus with the cluster. Users will be able to request, approve and release passwords and sessions via this appliance using cached data. When connectivity is restored, you should resume online operations to reintegrate this appliance with the cluster and merge audit logs.
Type 'Enable Offline Workflow' in the box below to confirm.
See KB263580 for more information. 5. In the dialog, type Enable Offline Workflow and click Enter. The appliance is in
Offline Workflow Mode and enters maintenance. In the Activity Center, the Event for the appliance goes from Enable Offline Workflow Started to Enable Offline Workflow Completed.
6. You can verify that new requests are enabled and view the following health checks on the Cluster Management window:
l If there is communication to the other members in the cluster, while connected to the member in Offline Worflow mode, a message like this displays at the top of the messages: Cluster connectivity detected. When communication is reestablished, you can manually resume online operations to the appliance.
l A warning icon displays next to an appliance in Offline Workflow Mode. An
error icon is displayed if viewed from any other member in the cluster if the member is unable to communicate with the member in Offline Workflow Mode. At any time, you can click Check Health to update the information.
l A warning message like the following will display: Request Workflow: Access workflow on this appliance is operating in offline isolation from the cluster. This warning will persist until online operations are resumed by an Appliance Administrator.
To manually resume online operations
Before resuming online operations, see Considerations to resume online operations.
1. Navigate to Administrative Tools | Settings | Cluster | Cluster Management.
2. In the cluster view (left pane), click the member of the cluster that is offline.
3. On the appliance in Offline Workflow Mode, click Resume Online Operations.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

490

(This operation is only available when the appliance is in Offline Workflow Mode.) A message like the following displays: The appliance will be reconfigured for online operations. The appliance will attempt to reintegrate with the cluster and merge audit logs. Refer to the to the Admin Guide for more information. Type 'Resume Online Operations' in the box below to confirm. 4. In the dialog, type in Resume Online Operations and click Enter. 5. When maintenance is complete, click Restart Desktop Client. The appliance is returned to Maintenance mode.
6. You can verify health checks on the Cluster Management window. If a warning icon still displays next to the appliance, select the appliance and click Check Health to rerun the cluster health check and display the most up-to-date health information.
Failing over to a replica by promoting it to be the new primary
Safeguard for Privileged Passwords allows you to failover to a replica appliance by promoting it to be the new primary.
NOTE: You can promote a replica to be the new primary anytime the cluster has consensus (that is, the majority of the cluster nodes are online and able to communicate). If you have a quorum failure (that is, the majority of the cluster members do not achieve consensus), you must perform a cluster reset instead. For more information, see Resetting a cluster that has lost consensus on page 497.
To promote a replica to be the new primary in a cluster
1. log in to a healthy cluster member as an Appliance Administrator. 2. In Administrative Tools, select Settings | Cluster | Cluster Management. 3. In the cluster view (left pane), select the replica node that is to become the
new primary. 4. In the details view (right pane), click Failover. 5. In the Failover confirmation dialog, enter the word Failover and click OK to
proceed. During the failover operation, all of the appliances in the cluster are placed in Maintenance mode. Once the failover operation completes, the selected replica appliance appears as the primary with a state of online. All other appliances (including the "old" primary) in the cluster appear as replicas with a state of online.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

491

Activating a read-only appliance
Appliances that have been unjoined from a Safeguard for Privileged Passwords cluster or restored from a backup are placed in a Read-only mode. You can activate an appliance in Read-only mode so you can add, delete, and modify data, apply access request workflow, and so on. The appliance in Read-only mode must be online in order to use the Activate task. If it is offline or the cluster does not have consensus (that is, the majority of the remaining members are offline/unable to communicate), you must use the Cluster Reset option to rebuild your cluster. For more information, see Resetting a cluster that has lost consensus on page 497.
CAUTION: Activating an appliance that is in Read-Only mode will take it out of the Read-only state and enable password check and change for managed accounts. Ensure that no other Safeguard for Privileged Passwords Appliance is actively monitoring these accounts, otherwise access to managed accounts could be lost.
To activate a read-only appliance
1. Log in to the read-only appliance as an Appliance Administrator. 2. In Administrative Tools, navigate to Settings | Cluster | Cluster Management.
The cluster view (left pane) displays one primary appliance with a yellow warning icon indicating the appliance is in a Read-only mode. 3. In the cluster view (left pane), select the read-only node to be activated. 4. In the details view (right pane), click Activate. 5. In the Activate confirmation dialog, enter the word Activate and click OK to proceed. The appliance's node in the cluster view (left pane) no longer displays the yellow warning icon and the state is now Online.
Diagnosing a cluster member
The diagnostic tools are available to an Appliance Administrator or Operations Administrator for the currently connected appliance and any other appliances (replicas) in the cluster.
To run diagnostics on a clustered appliance
1. In Settings, select Cluster | Cluster Management. 2. From the cluster view (left pane), select the appliance to be diagnosed. 3. In the details pane (right pane), click Diagnose.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

492

The Appliance Information view displays. 4. Select Diagnostics and choose the type of test to be performed.
l Ping: To verify your network connectivity and response time. l NS Lookup: To obtain your domain name or IP address. l Trace Route: To obtain your router information; trace route determines the
paths packets take from one IP address to another. l Telnet: To access remote computers over TCP/IP networks like the internet. l Show Routes: To retrieve routing table information. 5. Enter the requested information in the test dialog that displays.
Patching cluster members
When an appliance update is released, apply the patch so all appliances in the cluster are on the same version. See About cluster patching for more information on how Safeguard for Privileged Passwords handles access requests and system failures during the cluster patching process.
Prior to installing an update patch to a cluster
l Ensure all appliances in the cluster are online and healthy. Any warnings or problems should be addressed before cluster patching. The patch install process will fail if any of the cluster members are unhealthy or cannot be contacted. IMPORTANT: The primary appliance orchestrates the cluster upgrade; therefore, the primary appliance must stay online and have a solid network connection with all of the replica appliances in the cluster. If this cannot be reasonably assured, you should unjoin the replica appliances from the cluster, individually upgrade them, and then re-enroll them into cluster.
l It is highly recommended to take a backup of your primary appliance before applying a patch.
l You may want to unjoin a replica from the cluster to serve as a backup appliance. In case of a catastrophic failure, you can activate the unjoined replica to be the primary. If the cluster patching process is successful, upgrade the unjoined replica, and then re-enroll it back into the cluster.
To patch appliances in a cluster IMPORTANT: The following procedure applies to Safeguard for Privileged Passwords Appliances running version 2.1.x and later. If you need to patch appliances running an earlier version, you will need to unjoin replica appliances, install the patch on each appliance, and then enroll the replica appliances to rebuild your cluster. For more information, see Patching cluster members in the Safeguard for Privileged Passwords 2.0 Administration Guide.
1. Log in to the primary appliance, as an Appliance Administrator. 2. In Administrative Tools, select Settings | Appliance | Updates.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

493

3. Click Upload a File and browse to select an update file.
The patch will be uploaded and distributed to all of the appliances in the cluster.
NOTE: If you make changes to the cluster, such as adding a new replica, while a patch is staged, the update file must be distributed to the new cluster member before the patch install process can begin. Safeguard for Privileged Passwords will not allow the patch install process to begin until all of the cluster members report that they have the update file stored locally.
NOTE: Clicking the Cancel button during the distribution process stops the distribution of the update file to the replicas. At this point, you can click one of the following buttons:
l Remove to remove the update file from all of the appliances in the cluster
l Distribute to Cluster to continue distributing the update file to each replica in the cluster
4. Once the file has been successfully distributed to all of the replicas in the cluster, click the Install Now button.
The primary appliance will go into Maintenance mode to begin the update operation. Once the primary appliance is successfully updated, Safeguard for Privileged Passwords will perform the update operation on each replica, one at a time. During an update operation, the cluster will be locked so that no other cluster operations can interfere with the update operation. Once the update operation is completed on all cluster members, the cluster will automatically unlock so normal operations can resume.
The Cluster view (Settings | Cluster | Cluster Management) shows that an update operation is in progress and the cluster members that are locked, awaiting to install the update file.
In addition, the Updates view (Settings | Appliance | Updates) shows the cluster members involved in the update operation and the progress as cluster members are successfully updated.
About cluster patching
The following information provides insight into how Safeguard for Privileged Passwords processes access requests during the cluster patching process. It also describes what happens if a cluster member loses power or network connectivity during the patching process.
Service guarantees
During a cluster upgrade, the cluster is split logically into the current version (side A) and the upgrade version (side B). Access request workflow is only enabled on one side at a time. Audit logs run on both sides and merge when the cluster patch completes. Initially, access request workflow is only enabled on side A, and replicas in PatchPending state can perform access requests. As appliances upgrade and move to side B, the access workflow migrates to side B when side B has a majority of the appliances. At this point in the

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

494

upgrade process, replicas in PatchPending state can no longer perform access requests; however, all of the upgraded cluster members can perform access requests. There is a small window where access request workflow is unavailable as the data migrates from one side to the other.
Failure scenarios
If the primary appliance loses power or loses network connectivity during the upgrade process, it will try to resume the upgrade on restart. If a replica is disconnected or loses power during an upgrade process, the replica will most likely go into quarantine mode. The primary appliance will skip that appliance and remove it from the cluster. This replica will need to be reset, upgraded, and then re-enrolled into the cluster manually to recover. Configuration for password checkout
The policy may be configured such that a password reset is required before the password can be checked out again. If that is the case, the following can be temporarily configured prior to cluster patching and access request to allow for password checkout when a password has not been reset.
l The policy can be set to allow multiple accesses. l The policy can be set to not require a password change at check in. l Emergency requests can be allowed so the user does not have to wait for the
password to be reset.
Using a backup to restore a clustered appliance
NOTE:When a backup is created, the state of the sessions module is saved. The session module can be either the joined sessions module (SPS) or the embedded sessions module (SPP). Restoring a backup restores the sessions module to the state when the backup was taken regardless of the state when the restore was started. In a clustered environment, the objective of a cluster backup is to preserve and allow the restoration of all operational data, including access request workflow, users/accounts, audit logs, and so on. All appliances in a cluster (primary and replicas) can be backed up. However, a backup should only be restored to an appliance in the worst-case scenario where no appliance can be restored using the failover operation. When a backup is restored to an appliance, the restore on the primary clears the primary's cluster configuration but does not change the replicas' cluster configuration. To avoid issues:
1. If possible, unjoin the replicas from the cluster prior to a backup restore. 2. Restore the backup on the appliance that will be the primary.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

495

3. If you did not unjoin the replicas prior to the backup restore, perform a cluster reset on each replica so they become standalones then join the replicas back into the cluster.
The appliance is restored as a stand-alone primary appliance in Read-only mode with no replicas. However, all the access request workflow, user/account, and audit log data that existed when the backup was taken is retained. This primary appliance can then be activated and replicas can be joined to recreate a cluster.
To take a backup of a physical appliance
1. log in to the appliance as an Appliance Administrator.
2. In Administrative Tools, select Settings | Backup and Restore.
3. Click Run Now to create a copy of the data currently on the primary appliance.
For more information, see Run Now on page 343.
Or you can click Backup Settings, in the upper-right corner of the Backups page, to configure an automatic backup schedule.
For more information, see Backup settings on page 343.
To restore a physical appliance from a backup
An Appliance Administrator can restore backups as far back as Safeguard for Privileged Passwords version 2.2.0.6958. Only the data is restored; the running version is not changed.
If the administrator attempts to restore a version earlier than 2.2.0.6958, a message like the following displays: Restore failed because the backup version '[version]' is older than the minimum supported version '2.2.0.6958' for restore. You cannot restore a backup from a version newer than the one running on the appliance. The restore will fail and a message like the following displays: Restore failed because backup version [version] is newer then the one currently running [version]. The backup version and the running version display in the Activity Center logs that are generated when Safeguard starts, completes, or fails a restore.
NOTE: If you want to use a backup file taken on a different appliance, that backup file must first be downloaded on the appliance where the backup was taken. The downloaded backup file will then need to be uploaded to the appliance that wants to use it before you can use the Restore option.
1. Log in to the appliance to be restored as an Appliance Administrator.
2. In Administrative Tools, select Settings | Backup and Restore.
3. Select the backup to be used and click Restore.
4. When the Restore dialog displays, enter the word Restore and click OK.
For more information, see Restore on page 345.
The appliance is restored as a stand-alone primary appliance in Read-only mode with no replicas.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

496

To rebuild a cluster 1. Log in to the primary appliance as an Appliance Administrator. 2. Activate the Read-only primary appliance. a. In Administrative Tools, navigate to Settings | Cluster | Cluster Management. b. Select the node to be activated from the cluster view (left pane). c. Click Activate. d. Confirm the activate operation. For more information, see Activating a read-only appliance on page 492. 3. One at a time, enroll the replica appliances to rebuild your cluster. a. In Administrative Tools, select Settings | Cluster. b. Click Add Replica to join a replica appliance to the cluster. Once the enroll operation completes, repeat to add your appliances back into the cluster as replicas. NOTE: Enrolling a replica can take up to 24 hours depending on the amount of data to be replicated and your network. For more information, see Enrolling replicas into a cluster on page 482.
Backup and restore
Resetting a cluster that has lost consensus
Resetting the cluster configuration allows you to recover a cluster that has lost consensus. If the cluster regains consensus after connectivity is restored, the primary will return to Read-Write mode and password check and change will be reenabled. However, if it does not regain consensus, the Appliance Administrator must perform a cluster reset to forceremove nodes from the cluster. If you are concerned about network issues, reset the cluster with only the new primary appliance. Once the cluster reset operation is complete, enroll appliances one by one to create a new cluster.
CAUTION: Resetting a cluster should be your last resort. It is recommended that you restore from a backup rather than reset a cluster.
Cautions
To avoid issues, consider the following cautions. l Only reset the cluster if you are certain that consensus has been lost; otherwise, you could introduce a split-brain scenario. (Split-brain scenario is where a cluster gets

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

497

divided into smaller clusters. Each of these smaller clusters believes it is the only active cluster and may then access the same data which could lead to data corruption.) l Ensure that no cluster member has Offline Workflow Mode enabled. For more information, see Offline Workflow (automatic) on page 370.
To reset a cluster
1. Navigate to Administrative Tools | Settings and select Cluster. 2. Click the Reset Cluster button.
The Reset Cluster dialog displays, listing the appliances (primary and replicas) in the cluster. 3. In the Reset Cluster dialog, select the nodes to be included in the reset operation and use the Set Primary button to designate the primary appliance in the cluster.
NOTE: Nodes must have an appliance state of Online or Online Read-only and be able to communicate to be included in the reset operation. If you select a node that is not online or not available, you will get an error and the reset operation will fail. 4. Click Reset Cluster. 5. In the confirmation dialog, enter the words Reset Cluster and click OK. When connected to the new primary appliance, the Configuring Safeguard for Privileged Passwords Appliance progress page displays, showing the steps being performed as part of the maintenance task to reset the cluster. 6. Once the maintenance tasks have completed, click Restart Desktop Client. 7. If an appliance is cluster reset as a standalone appliance, it will be placed in StandaloneReadonly mode (not online) and will require activation to avoid a split-brain scenario. For more information, see Activating a read-only appliance on page 492.
Once reset, the cluster only contains the appliances that were included in the reset operation.
Performing a factory reset
As an Appliance Administrator, you can use the Factory Reset feature to reset a Safeguard for Privileged Passwords Appliance to recover from major problems or to clear the data and configuration settings on the appliance. A factory reset of a physical appliance may be initiated from the Appliance Information settings page in the desktop client, from the Recovery Kiosk, from the virtual appliance Support Kiosk, or using the API. A Safeguard for Privileged Passwords virtual appliance is reset by the recovery steps to redeploy and not a factory reset. For more information, see Virtual appliance backup and recovery on page 56.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

498

CAUTION: Care should be taken when performing a factory reset against a physical appliance, because this operation removes all data and audit history, returning it to its original state when it first came from the factory. The appliance must go through configuration again as if it had just come from the factory. For more information, see Setting up Safeguard for Privileged Passwords for the first time on page 58.
In addition, performing a factory reset may change the default SSL certificate and default SSH host key.
Factory reset on a clustered appliance
Performing a factory reset on a clustered hardware appliance will not automatically remove the appliance from a cluster. The recommended best practice is to unjoin an appliance from the cluster before performing a factory reset on the appliance. After the unjoin and factory reset, the appliance must be configured again. For more information, see Setting up Safeguard for Privileged Passwords for the first time on page 58.
To perform a factory reset from the desktop client
1. Navigate to Administrative Tools | Settings | Appliance | Factory Reset.
2. Click Factory Reset.
3. In the Factory Reset confirmation dialog, enter the words Factory Reset and click OK.
The appliance will go into Maintenance mode to revert the appliance. Once completed, you will be prompted to restart the desktop client. If the appliance was in a cluster, you may need to unjoin the factory reset appliance. The factory reset appliance must be configured again. For more information, see Setting up Safeguard for Privileged Passwords for the first time on page 58. In addition, when you log in to the appliance, you will be prompted to add your Safeguard for Privileged Passwords licenses.
To perform a factory reset from the Recovery Kiosk
1. To perform a hardware factory reset, go to the Recovery Kiosk. For more information, see Recovery Kiosk (Serial Kiosk) on page 549.
2. Select Factory Reset.
3. Press the right arrow.
4. At id, enter your email or name and press the Tab key (or down arrow).
5. At Get Challenge, press the Enter key. Safeguard for Privileged Passwords produces a challenge.
6. Copy and paste the challenge and send it to One Identity Support.
l A challenge response is only good for 48 hours.
l Do not navigate away from the page or refresh during a challenge response operation. Doing so will invalidate the challenge response.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

499

7. When you get the response from One Identity Support, copy and paste the response into the kiosk screen and select Factory Reset.
To perform a factory reset from the Support Kiosk
1. To perform a hardware factory reset, gon the web management console, click Support Kiosk. For more information, see Support Kiosk on page 49.
2. Select Factory Reset. (This option is not available if you are attached to the console of a virtual machine. The options is only available for hardware.)
3. Complete the challenge/response process: a. In Full Name or Email, enter your name or email to receive the challenge question. b. Click Get Challenge. c. To get the challenge response, perform one of the following (see the illustration that follows). l Click Copy Challenge. The challenge is copied to the clipboard. Send that challenge to Safeguard support. Support will send back a challenge response that is good for 48 hours. Do not refresh your screen. l Screenshot the QR code and send it to Support. Support will send back a challenge response that is good for 48 hours. Do not refresh your screen. l Use a QR code reader on your phone to get the challenge response.

4. When you get the response from One Identity Support, copy and paste the response into the kiosk screen and select Factory Reset.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

500

Unlocking a locked cluster
In order to maintain consistency and stability, only one cluster operation can run at a time. To ensure this, Safeguard for Privileged Passwords locks the cluster while a cluster operation is running, such as enroll, unjoin, failover, patch, reset, and routine maintenance. The Cluster view shows that the cluster is locked and that any changes to the cluster configuration are not allowed until the operation completes. The banner that appears at the top of the screen explains the operation in progress and a red lock icon ( ) next to an appliance indicates that the appliance is locking the cluster.
To unlock a locked cluster
1. Click the lock icon in the upper right corner of the warning banner. 2. In the Unlock Cluster confirmation dialog, enter Unlock Cluster and click OK.
This will release the cluster lock that was placed on all of the appliances in the cluster and terminate the operation.
IMPORTANT: Care should be taken when unlocking a locked cluster. It should only be used when you are sure that one or more appliances in the cluster are offline and will not finish the current operation. If you force the cluster unlock, you may cause instability on an appliance, requiring a factory reset and possibly the need to rebuild the cluster. If you are unsure about the operation in progress, do NOT unlock the cluster. Most often, it will eventually time out and unlock on its own.
Troubleshooting tips
If there is a problem with a Safeguard for Privileged Passwords cluster, follow these guidelines:
1. Ensure that the hardware is powered on and online. 2. Check for networking problems. For more information, see Diagnosing a cluster
member on page 492. 3. Check the events in the Activity Center as all cluster operations are logged. Errors
and warnings may resolve on their own. If an error persists for more than 15 minutes, it probably won't resolve itself. Try restarting the appliance to see if the error or warning clears. 4. Contact One Identity Support:
l If an appliance goes into quarantine mode, connect to the Recovery Kiosk and contact support. For more information, see Recovery Kiosk (Serial Kiosk) on page 549.
l Generate and collect support bundles for each appliance in the cluster and contact support. For more information, see Support bundle on page 321.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

501

Appliance states

The following table lists the appliance states and what actions are available when the appliance is in a particular state.

Table 204: Appliance states

Appliance state and description

Actions available

EnrollingReplica (only applies to replica appliances in a cluster)
A transitional state where a replica appliance is being added to a cluster and is not available for access. From this state, the appliance goes into Maintenance mode to complete the enroll operation.

Wait for operation to complete before logging in to appliance.

Initial Setup Required
A virtual appliance has been deployed but cannot be used until it is in the Online state.

The Appliance Administrator must run Initial Setup for the virtual appliance to move to the Online state. For more information, see Setting up the virtual appliance on page 45.

Initializing
A transitional state where the appliance is initializing to start, but is not yet available for access.

Wait for operation to complete before logging in to appliance.

Maintenance
Appliance is performing maintenance tasks and is not available for access.

Wait for maintenance tasks to complete before logging in to appliance.

LeavingCluster (only applies to replica appliances in a cluster)
A transitional state where a replica appliance is being unjoined from a cluster and is not available for access. From this state, the appliance goes into Maintenance mode to complete the unjoin operation.

Wait for operation to complete before logging in to appliance.

Offline Appliance is not available for access.

Wait for appliance to come back online before logging in.

Offline Workflow The appliance is not communicating

Enable Offline Workflow Mode. Once online operations are resumed, the appliance is

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

502

Appliance state and description
with the cluster but has been either automatically or manually placed in Offline Workflow Mode to run access request workflow.

Actions available
returned to Maintenance mode. For more information, see About Offline Workflow Mode on page 486.

Online
The appliance is a primary and has consensus. Or the appliance is a replica and has both consensus and connectivity to the primary.

Log in to appliance.
In this state, access request workflow is available from all clustered appliances that are online and able to communicate.

PatchPending (only applies to replica appliances in a cluster)
Upon cluster patch, the primary appliance instructs all replicas to enter PatchPending state. The primary appliance then patches and upon completion, instructs the PatchPending replicas to install the patch one at a time.

You can log in to a replica with a PatchPending state.
You can initially perform access request workflow on a replica in PatchPending state; however, during the cluster upgrade, when the majority of the cluster members have upgraded, access request worklfow migrates from the PatchPending side of the cluster to the upgraded side of the cluster. During this time, access request workflow is unavailable on any appliance still in the PatchPending state.

PrimaryNoQuorum (only applies to the primary appliance in a cluster)
The primary appliance is in a Readonly mode while attempting to get the lease, but can't because the cluster does not have consensus. The appliance continues to attempt getting the lease and when it does, the appliance state goes back to Online.

If the appliance is powered on, you can log in to an appliance with a PrimaryNoQuorum state; however, it will be in a Read-only mode.
In this state, access request workflow is not available from the primary appliance, but may be available from other appliances in the cluster.
For example, if the primary cannot communicate with the rest of the nodes in the cluster, but the rest of the nodes can communicate between themselves (ReplicaWithQuorum state), then access request workflow will be available from these replica appliances even though it is not available from the primary appliance.

Quarantine

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

503

Appliance state and description

Actions available

Appliance is broken or in an unknown state.

Requires manual intervention to recover.
Go to the Recovery Kiosk to recover. For more information, see Recovery Kiosk (Serial Kiosk) on page 549.

ReplicaDisconnected (applies to replica appliances in a cluster)
A replica appliance is available for access; however, both of the following conditions apply:
l The replica appliance cannot communicate with the primary appliance in the cluster.
l The remaining nodes in the cluster that the replica appliance can communicate with do not have consensus.

You can log in to a replica with a ReplicaDisconnected state, but access request workflow is disabled.
If the replica appliance cannot communicate with the other nodes in the cluster, but the remaining nodes can communicate with each other, then access request workflow will be available from those appliances even though it is not available from the appliance that cannot communicate with them.

ReplicaNoQuorum (applies to replica appliances in a cluster)
A replica appliance can communicate with the primary appliance; however, the remaining nodes in the cluster do not reach consensus. Once the cluster regains consensus, the replica appliance will go into the Online state.

You can log in to a replica with a ReplicaNoQuorum state, but access request workflow is disabled.
In this state, access request workflow is not available from the primary appliance, but may be available from other replicas.
For example, in a cluster of five appliances, if the primary and a single replica cannot communicate with the remaining replicas in the cluster, but the other three replicas in the cluster can communicate between themselves (ReplicaWithQuorum state), then access request workflow will be available from the replicas that are online and communicating even though it is not available from the primary and replica that cannot communicate.

ReplicaWithQuorum (applies to replica appliances in a cluster)
A replica appliance cannot communicate with the primary appliance; however, the remaining nodes in the cluster have reached

You can log in to a replica with a ReplicaWithQuorum state. In this state, access request workflow is available from any clustered appliance that is online and able to communicate. Passwords can be requested and checked in. Scheduled tasks

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

504

Appliance state and description consensus.

Actions available
will not occur until after the cluster patching is complete. Manual check and change is not available.

The policy may be configured such that a password reset is required before the password can be checked out again. If that is the case, the following can be temporarily configured prior to cluster patching and access request to allow for password checkout when a password has not been reset.

l The policy can be set to allow multiple accesses.
l The policy can be set to not require a password change at check in.
l Emergency requests can be allowed so the user does not have to wait for the password to be reset.

TransitioningToPrimary (only applies to replica appliances in a cluster)
A transitional state where a replica appliance is being promoted to be the new primary and is not available for access.

Wait for operation to complete before logging in to appliance.

TransitioningToReplica (only applies to the primary appliance in a cluster.)
A transitional state where a primary appliance is being demoted to a replica and is not available for access.

Wait for operation to complete before logging in to appliance.

ShuttingDown
A transitional state where an appliance is shutting down and is not available for access.

Wait for appliance to come back online before logging in.

StandaloneReadOnly
State used for replicas unjoined from a cluster or a primary appliance restored from a backup. The

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

505

Appliance state and description

Actions available

appliance can be activated.

you can add, delete and modify data, apply access request workflow, and so on.

Unknown
Appliance is broken or in an unknown state.

Requires manual intervention to recover.
Go to the Recovery Kiosk to recover. For more information, see Recovery Kiosk (Serial Kiosk) on page 549.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Disaster recovery and clusters

506

Administrator permissions

To secure control of your IT department's assets (that is, managed systems), Safeguard for Privileged Passwords uses a role-based access control hierarchy. Safeguard for Privileged Passwords's various permission sets restrict the amount of control each type of user has.
NOTE: It is the responsibility of a user with Authorizer Administrator permissions to grant administrator permissions to other Safeguard for Privileged Passwords users; however, the User Administrator can grant Help Desk Administrator permissions to nonadministrative users. Administrator permissions include:
l Appliance Administrator permissions l Asset Administrator permissions l Auditor permissions l Authorizer Administrator permissions l Help Desk Administrator permissions l Operations Administrator permissions l Security Policy Administrator permissions l User Administrator permissions
Appliance Administrator permissions
The Appliance Administrator is responsible for configuring and maintaining the appliance, including the following tasks:
l Racks and stacks the appliance. l Configures the appliance. l (Optional) Sets up and uses the virtual appliance for initial setup, maintenance,
backup, and recovery. For more information, see Using the virtual appliance and web management console on page 44. l Troubleshoots performance, hardware, and networking.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Administrator permissions

507

l Creates and monitors the status of a clustered environment. l Manages licenses, certificates, backups, and sessions settings. l Enables and disables access request and password management services.

Table 205: Appliance Administrator: Permissions

Navigation

Permissions

Activity Center

View and export appliance activity events.

Administrative Tools | Toolbox Access to the Tasks pane.

Administrative Tools | Settings:

l Access Request | Enable Enable or disable the access request and password

or Disable Services

management services.

l Appliance

Monitor the status of the appliance. Shut down or restart the appliance. Run diagnostics on the appliance. Enable or disable Lights Out Management (BMC). Configure networking settings. Perform a factory reset to recover from major problems or clear the data and configuration settings on the appliance. Generate a support bundle to assist technical support. Manage appliance time. Install update files (patches).

l Appliance | Enable or Disable Services

Enable or disable the Application to Application (A2A) service.
Enable or disable SPP audit data to be sent to SPS for auditing the Safeguard privileged management software suite.

l Backup and Retention

Configure backup and retention settings, define archive servers, and manage backups.

l Certificates

Manage the certificates used by Safeguard.

l Cluster

Create and manage a clustered environment. Monitor the status of the clustered environment. Diagnose cluster members.

l External Integration

Configure Approval Anywhere service for access request approvals.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Administrator permissions

508

Navigation
l Messaging l Safeguard Access l Sessions

Permissions
Configures email to send event notifications to external systems. Configure identity providers and authentication providers. Configures the sending of SNMP traps to the SNMP console. Join Safeguard for Privileged Passwords to Starling. Configure Safeguard for Privileged Passwords to send event notifications to a syslog server. Configure the integration with an external ticketing system or generic tickets not tied to an external ticketing system.
Configure login notifications. Set message of the day.
Configure the user login control settings, inactivity timeout, password rules, and sets the time zone.
If a Sessions appliance is joined, view, remove, or modify the configuration. If the sessions module is used:
l Configure session recording storage management.
l Configure the sessions module settings. l Reset the sessions module. l Generate or download an SSH host key.

Asset Administrator permissions
An Asset Administrator manages all partitions, assets, and accounts: l Creates (or imports) assets and accounts. l Creates partitions and partition profiles. l Delegates partition ownership to users. NOTE: A delegated partition owner has a subset of permissions that an Asset Administrator has. That is, the delegated partition owner is authorized to manage a specific partition and the assets and accounts assigned to that partition.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Administrator permissions

509

l Assigns assets to partitions. l Manages account password rules. NOTE: Asset Administrators can only view the user object history for their own account.

Table 206: Asset Administrator: Permissions

Navigation

Permissions

Dashboard | Account Automation

Full control for accounts related to all Safeguard for Privileged Passwords assets.
NOTE: Delegated partition owners have control for accounts related to the assets managed through delegated partition profile.

Activity Center

View and export asset activity events.

Administrative Tools | Toolbox Access to the Accounts, Assets, Partitions and Users view.
Access to the Tasks pane.

Administrative Tools | Accounts

Add, modify, delete, and import accounts. Check, change, and set account passwords. Access password archive. Enable or disable the access request services for an account.

Administrative Tools | Assets

Add, modify, delete, and import assets. Configure and manage Asset Discovery jobs. Download SSH Key.

Administrative Tools | Discovery

Create and run discovery jobs to find assets, accounts, and services in your network environment.

Administrative Tools | Partitions

Add, modify, and delete partitions and partition profiles.
Set partition as default.
Add assets to the scope of a partition profile.

Administrative Tools | Settings:

l Asset Management | Custom Platforms

Add a custom platform that includes uploading the custom platform script.

l Asset Management | Tags

Create and manage dynamic tags for assets and asset accounts.

l Messaging | Message of Login notification: View only. the Day

Safeguard for Privileged Passwords 2.11.1 Administration Guide Administrator permissions

510

Navigation

Permissions

Set message of the day.

l Profile | Account Password Rules

Add, modify, and delete account password complexity rules.

l Profile | Change Password

Add, modify, and delete change password settings.

l Profile | Check Password Add, modify, and delete check password settings.

l Profile | Password Sync Add, modify, and delete password sync groups. Groups

Administrative Tools | Users Delegate partition ownership to users.

Auditor permissions

The Auditor administrator has read-only access to all features, giving him the ability to review all access request activity:
l Monitors appliance information. l Reviews everything. l Exports object history. l Runs entitlement reports.

Table 207: Auditor administrator: Permissions

Navigation

Permissions

Dashboard

View only.

Activity Center

View and export activity events. Audit access request workflow.

Reports

View and export entitlement reports.

Administrative Tools | Toolbox Access to all Administrative Tools views and the Tasks pane.

Administrative Tools | Accounts

View only.

Administrative Tools | Account View only. Groups

Administrative Tools | Assets View Asset Discovery jobs.

Administrative Tools | Asset View only.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Administrator permissions

511

Navigation Groups Administrative Tools | Entitlements Administrative Tools | Partitions Administrative Tools | Settings:
l Access Request l Appliance
l Asset Management l Backup and Retention l Certificates l Cluster l External Integration l Messaging
l Profile l Safeguard Access l Sessions Administrative Tools | Users Administrative Tools | User Groups

Permissions
View only.
View only.
View only. View Appliance Information. Run diagnostics on appliance. View licensing information. View Lights Out Management (BMC) settings. View Networking settings. View Time settings. View update history. View only. View only. View only. View only. View only. Login notification: View only. Set message of the day. View only. View only. View only. View only. View only.

Authorizer Administrator permissions
The Authorizer Administrator is the permissions administrator and performs the following:

Safeguard for Privileged Passwords 2.11.1 Administration Guide Administrator permissions

512

l Creates (or imports) Safeguard for Privileged Passwords users. l Grants administrator permissions to users. l Sets passwords, unlocks, and enables or disables both local and directory user
accounts. l Creates and maintains the Password Rule.
NOTE: Also has User Administrator and Help Desk Administrator permissions. IMPORTANT: Authorizer Administrators can change the permissions for their own account, which may affect their ability to grant permissions to other users. When you make changes to your own permissions, they take effect next time you log in.

Table 208: Authorizer Administrator: Permissions

Navigation

Permissions

Activity Center

View and export user activity events, including authentication events.

Administrative Tools | Toolbox Access to the Users and User Groups view. Access to Tasks pane.

Administrative Tools | Settings

l External Integration | Identity and Authentication

View only of directories used for identity and authentication. External Federation and Radius providers can be configured for authentication use.

l Messaging | Message of the Day

l Safeguard Access | Login View only. Control

l Safeguard Access | Password Rules

Configure user password rules.

l Safeguard Access | Time Set default time zone. Zone

Administrative Tools | Users

Add, modify, delete, and import users. Set administrator permissions. Set passwords and unlock administrator accounts. Delete administrator users. Enable or disable administrator users.

Administration Tools | User Groups

Add or delete directory groups, if a directory has been added to Safeguard for Privileged Passwords.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Administrator permissions

513

Help Desk Administrator permissions

A Help Desk Administrator:
l Sets passwords for non-administrative user accounts. l Unlocks accounts for all user accounts.
NOTE: Help Desk Administrators can only view the user object history for their own account.

Table 209: Help Desk Administrator: Permissions

Navigation

Permissions

Activity Center

View and export user activity events.

Administrative Tools | Toolbox Access to the Users view and the Tasks pane.

Administrative Tools | Settings:

l Messaging | Message of the Day

l Safeguard Access | Login View only. Control

l Safeguard Access | Password Rules

View only.

l Safeguard Access | Time View only. Zone

Administrative Tools | Users

Set passwords and unlock accounts for nonadministrator users.
A Help Desk Administrator can unlock another Help Desk user but cannot set that user's passwrod.

Operations Administrator permissions
The Operations Administrator monitors the status of the appliance and can reboot the appliance.
NOTE: This user can be a non-interactive user; that is, an automated script or external monitoring system.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Administrator permissions

514

Table 210: Operations Administrator: Permissions

Navigation

Permissions

Activity Center

View and export appliance activity events.

Administrative Tools | Toolbox Access to the Tasks pane.

Administrative Tools | Settings:

l Access Request | Enable View only. or Disable Services

l Appliance

Monitor status of the appliance. Shutdown or restart the appliance. Run diagnostics on the appliance. Generate a support bundle to assist technical support. View licensing information. View Networking settings. View Time settings. View update history.

l Backup and Retention

Configure backup and retention settings, define archive servers, and manage backups.

l Certificates

View only.

l Cluster

View only. Monitor the status of the clustered environment.

l External Integration

View only.

l Messaging

l Safeguard Access

View only.

l Sessions

View only.

Security Policy Administrator permissions
The Security Policy administrator configures the security policies that govern the access rights to accounts and assets, including the requirements for checking out passwords, such as the maximum duration, if password reasons are required, if emergency access is allowed, and so on. This user may not know any details about the assets.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Administrator permissions

515

This user configures time restrictions for entitlements and who can request, approve and review access requests.
l Creates account groups, asset groups, and user groups. l Creates entitlements. l Configures access request policies. l Adds users or user groups to entitlements to authorize those accounts to
request passwords. l Can assign linked accounts to users for entitlement access policy governance.

Table 211: Security Policy administrator: Permissions

Navigation

Permissions

Dashboard | Access Requests Full control to manage access requests.

Activity Center

View and export security-related activity events, including access request events.
Audit access request workflow.

Reports

View and export entitlement reports.

Administrative Tools | Toolbox Access to the Account Groups, Asset Groups, Entitlements, Users, and User Groups view.
Access to the Tasks pane.

Administrative Tools | Account Add, modify, or delete account groups.

Groups

Add accounts to account groups.

Assign policies to account groups.

Administrative Tools | Asset Groups

Add, modify, or delete asset groups. Add assets to asset groups. Assign policies to asset groups.

Administrative Tools | Entitlements

Add, modify, or delete entitlements. Add users or user groups to entitlements. Define and maintain access request policies. Assign policies to entitlements.

Administrative Tools | Settings:

l Access Request | Reasons

Add, modify, or delete reason codes.

l Cluster | Session Appliances

If Safeguard for Privileged Passwords (SPP) is joined to Safeguard for Privileged Sessions (SPS), view the appliance information for the join.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Administrator permissions

516

Permissions Add, modify, or delete application registrations.
Configure Approval Anywhere service for access request approvals. If Safeguard for Privileged Passwords is joined to Starling, view the Starling join information. If Safeguard for Privileged Passwords is configured to use tickets (generic tickets or with an external ticketing sytem), view the ticket information. Login notification: View only. Set message of the day. Add users to user groups. Add users to entitlements. Link directory accounts to a user. View and export the history of users. Add, modify, or delete local user groups. Add local or directory users to user groups. Assign entitlements to user groups.

User Administrator permissions
The User Administrator:
l Creates (or imports) Safeguard for Privileged Passwords users. l Grants Help Desk Administrator permissions to users. l Sets passwords, unlocks users, and enables or disables non-administrator user
accounts. l Also has Help Desk Administrator permissions.
NOTE: User Administrators cannot modify administrator passwords, including their own. IMPORTANT: User Administrators can change the permissions for their own account, which may affect their ability to grant Help Desk Administrator permissions to other users. When you make changes to your own permissions, they take effect next time you log in.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Administrator permissions

517

Table 212: User Administrator: Permissions

Navigation

Permissions

Activity Center

View and export user activity events.

Administrative Tools | Toolbox Access to the Users and User Groups view. Access to Tasks pane.

Administrative Tools | Settings:

l External Integration | Identity and Authentication

View only.

l Messaging | Message of Login notification: View only. Set message of the

the Day

day.

l Safeguard Access | Login View only. Control

l Safeguard Access | Password Rules

View only.

l Safeguard Access | Time View only. Zone

Administrative Tools | Users

Add, modify, delete or import local and directory users.
Set passwords and unlock accounts for nonadministrator users. A Help Desk Administrator can unlock another Help Desk user but cannot set that user's passwrod.
Enable or disable non-administrative users.
Set Help Desk Administrator permissions.

Administrative Tools | User Groups

Add or delete directory groups, if a directory has been added to Safeguard for Privileged Passwords.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Administrator permissions

518

Preparing systems for management

Before you add systems to Safeguard for Privileged Passwords (Adding an asset on page 185), you must ensure they are properly configured. Generally, to prepare an asset for Safeguard for Privileged Passwords:
1. Create a functional account (called a "service" account in Safeguard for Privileged Passwords) on the asset and assign it a password. NOTE: To add an asset to Safeguard for Privileged Passwords, it must have a service account. For more information, see About service accounts on page 193.
2. Grant the service account sufficient permissions. 3. Test the service account connectivity. 4. Configure the security protocol. 5. For platforms that support SSL server certificate validation, add the server's signing
authority certificate to the Trusted Certificates store in Safeguard for Privileged Passwords. For more information, see Trusted Certificates on page 360.
The following topics can help you prepare your hosts for management by Safeguard for Privileged Passwords:
Preparing ACF - Mainframe systems Preparing Amazon Web Services platforms Preparing Cisco devices Preparing Dell iDRAC devices Preparing VMware ESXi hosts Preparing Facebook hosts Preparing Fortinet FortiOS devices Preparing F5 Big-IP devices Preparing HP iLO servers Preparing HP iLO MP (Management Processors) Preparing IBM i (AS/400) systems Preparing JunOS Juniper Networks systems Preparing MongoDB

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

519

Preparing MySQL servers Preparing Oracle databases Preparing PAN-OS (Palo Alto) networks Preparing PostgreSQL Preparing RACF mainframe systems Preparing SAP HANA Preparing SAP Netweaver Application Servers Preparing Sybase (Adaptive Server Enterprise) servers Preparing SonicOS devices Preparing SonicWALL SMA or CMS appliances Preparing SQL Servers Preparing Top Secret mainframe systems Preparing Unix-based systems Preparing Windows systems Preparing Windows SSH systems Safeguard for Privileged Passwords supports a variety of platforms. For more information, see Supported platforms on page 37.
Preparing ACF - Mainframe systems
This applies to both ACF2 - Mainframe and ACF2 - Mainframe LDAP platforms.
To prepare IBM ACF-mainframe systems for Safeguard for Privileged Passwords
1. Create a service account on the asset and assign it a password. The service account must have the SECURITY attribute enabled for ACF2 ChangePassword to work properly.
2. Grant the service account the privileges required to use the ALTERUSER command on other profiles.
3. If not already installed, install a telnet server on the z/OS system. If required, secure telnet with SSL. NOTE: Please refer to your IBM z/OS system documentation for details on installing and configuring the telnet server (and SSL).
4. Test the telnet server using a Windows-based 3270 emulator or on Linux, use the telnet-ssl or x3270 programs to test SSL and non-SSL connections to an z/OS system.
5. In Safeguard for Privileged Passwords, create the asset and accounts for the z/OS system using password authentication.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

520

About certificate support for the telnet protocol
Safeguard for Privileged Passwords automatically accepts any server certificate that the connection offers and does not verify the trust chain on the telnet certificate. In addition, Safeguard for Privileged Passwords does not support client certificate selection, so if telnet requires that the client present a certificate that is signed by a recognized authority, Safeguard for Privileged Passwords cannot support that configuration.
Preparing Amazon Web Services platforms
Safeguard for Privileged Passwords supports Amazon Web Services (AWS), a secure cloud services platform. When adding an Amazon Web Services asset, the Network Address must contain the AWS Account ID or Alias.
To prepare Amazon Web Services platforms for Safeguard for Privileged Passwords
1. In Safeguard for Privileged Passwords: a. Add Amazon's certificate and AWS certificate's root certificate authority (CA) to the Trusted Certificates store in Safeguard for Privileged Passwords. b. Configure an Identity and Access Management (IAM) user to use as a service account. c. Assign the IAM service account to the AdministratorAccess security policy.
2. In Amazon: a. Create an access key for the IAM service account. Amazon creates a pair of data items called a Secret Key and a public Access Key ID. Take a note of both the Access Key ID and Secret Key. You will need them when you add the Amazon Web Services asset to Safeguard for Privileged Passwords.
Preparing Cisco devices
Safeguard for Privileged Passwords supports both Cisco Private Internet eXchange (PIX) firewall security appliances and PIX Internetwork Operating System (IOS) routers and switches. Cisco PIX and Cisco IOS use the SSH protocol to connect to the Safeguard for Privileged Passwords Appliance. Safeguard for Privileged Passwords supports both SSH version 1 and version 2.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

521

To prepare a Cicso device for Safeguard for Privileged Passwords 1. Create a service account on the asset and assign it a password. 2. Enable and configure the SSH server to allow the service account to log in remotely. 3. Configure the Privilege Level Password (that is, the system enable password). This password is required when adding the asset to Safeguard for Privileged Passwords. NOTE: Safeguard for Privileged Passwords manages accounts found in the startup configuration file, not in the running configuration file. 4. Add the Cisco device to Safeguard for Privileged Passwords using password authentication.
Preparing Dell iDRAC devices
Safeguard for Privileged Passwords supports the Dell Remote Access Controller that is integrated with Dell PowerEdge servers. Safeguard for Privileged Passwords uses the SSH protocol to connect to iDRAC devices.
To prepare an iDRAC device for Safeguard for Privileged Passwords 1. Use iDRAC to create a service account with administrator privileges and assign it a password. The service account must have login privileges and must be able to configure users. 2. Verify that SSH is enabled in the iDRAC Network settings. 3. In Safeguard for Privileged Passwords, create the asset and accounts for the iDRAC device using password authentication.
Preparing VMware ESXi hosts
Safeguard for Privileged Passwords supports VMware ESXi hosts. IMPORTANT:Safeguard for Privileged Passwords can only manage local users on a VMware host.
To prepare a VMware ESXi host for Safeguard for Privileged Passwords 1. Use an existing account or create a new account as the service account on the asset and assign it a password. The default administrator account is suitable. 2. Grant the service account the privileges required to set user passwords using the web management API.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

522

3. When adding a VMware ESXi host to Safeguard for Privileged Passwords: a. Specify the network address. b. Specify port 443 as the HTTPS port.
Preparing Facebook hosts
Facebook is deprecated. It is suggested you use the sample custom platform script. For more information, see Custom platforms on page 324. Safeguard for Privileged Passwords can manage Facebook account passwords. Verify that a login code for the account is not required by Facebook.
To prepare a Facebook account for Safeguard for Privileged Passwords 1. Log in to your Facebook account. 2. In the upper right corner of the page, click the down arrow to the right of the Quick Help question mark. 3. Click Settings. 4. In the upper left corner of the page, click Security and Login. 5. Scroll to Two-Factor Authentication, Authorized Logins. 6. Click View. Facebook displays the list of devices where you do not have to use a login code. Verify that login code is not required to access the account. If you have no registered devices, you will see the following message: You do not have any registered devices.
For details about adding a Facebook account to Safeguard for Privileged Passwords, see Adding a cloud platform account on page 148.
Preparing Fortinet FortiOS devices
Safeguard for Privileged Passwords supports Fortinet Internet appliances. Safeguard for Privileged Passwords uses the SSH protocol to connect to Fortinet devices.
To prepare a Fortinet FortiOS device for Safeguard for Privileged Passwords 1. Create the service account as a local user on the managed system and assign it a password. 2. Add the service account to the Fortinet Administrators group. This allows the service account to access the device with SSH to manage users. IMPORTANT:Safeguard for Privileged Passwords can only manage passwords for

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

523

users that are members of the Fortinet Administrators group. 3. Enable and configure the SSH server to allow the service account to log in remotely. 4. Add the Fortinet device to Safeguard for Privileged Passwords using password
authentication.
Preparing F5 Big-IP devices
Safeguard for Privileged Passwords supports F5 Big-IP devices. Safeguard for Privileged Passwords uses the SSH protocol to connect to F5 Big-IP devices.
To prepare an F5 Big-IP device for Safeguard for Privileged Passwords 1. Create the service account as a local user on the F5 Big-IP managed system and assign it a password. Assign that service account the Administrator Role on all partitions. This allows the service account to manage users. 2. Enable console access by setting Terminal Access to either Advanced or tmsh, which will allow the service account to log in remotely via SSH. 3. Add the F5 Big-IP device to Safeguard for Privileged Passwords using password or SSH key authentication.
Preparing HP iLO servers
In Safeguard for Privileged Passwords, the HP iLO operating system is an HP Integrated Lights-Out (iLO) HP Proliant server. Safeguard for Privileged Passwords connects to HP iLO systems using SSH. Password check and change is supported. Account discovery is not supported.
To prepare an HP iLO server for Safeguard for Privileged Passwords 1. Create a service account with the Administrate User Accounts privilege and assign it a password. The service account must have login privileges and must be able to configure users. 2. Verify that SSH is enabled. 3. In Safeguard for Privileged Passwords, create the asset and accounts for the HP iLO server using password authentication.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

524

Preparing HP iLO MP (Management Processors)
In Safeguard for Privileged Passwords the HP iLO MP operating system is an HP Integrity Integrated Lights-Out (iLO) Management Processor. Safeguard for Privileged Passwords connects to HP iLO MP systems using SSH.
To prepare an HP iLO Management Processor for Safeguard for Privileged Passwords
1. Create a service account with the Administer User Accounts privilege and assign it a password.
2. Verify that SSH is enabled. 3. In Safeguard for Privileged Passwords, create the asset and accounts for the HP iLO
MP asset type using password authentication.
Preparing IBM i (AS/400) systems
Safeguard for Privileged Passwords supports IBM i (AS/400) systems.
To prepare IBM i systems for Safeguard for Privileged Passwords 1. Create a service account on the asset and assign it a password. 2. Grant the service account the privileges required to use the chgusrprf command on other profiles. 3. If not already installed, install a telnet server on the IBM iSeries (AS/400) system. If required, secure telnet with SSL. NOTE: Please refer to your IBM iSeries (AS/400) system documentation for details on installing and configuring the telnet server (and SSL). 4. Test the telnet server using a Windows-based 3270 emulator or on Linux, use the telnet-ssl or x3270 programs to test SSL and non-SSL connections to an IBM iSeries system. 5. In Safeguard for Privileged Passwords, create the asset and accounts for the IBM iSeries (AS/400) system using password authentication.
About certificate support for the telnet protocol
Safeguard for Privileged Passwords automatically accepts any server certificate that the connection offers and does not verify the trust chain on the telnet certificate. In addition, Safeguard for Privileged Passwords does not support client certificate selection, so if telnet requires that the client present a certificate that is signed by a recognized authority, Safeguard for Privileged Passwords cannot support that configuration.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

525

Preparing JunOS Juniper Networks systems
Safeguard for Privileged Passwords uses the Juniper Networks JunOS operating system to manage Juniper Networks routers and switches. Safeguard for Privileged Passwords connects to JunOS systems using SSH.
CAUTION: If you get the message: Shared configuration database modified, the global configuration is currently being edited. The edits must be committed or discarded so Safeguard can enter configure private mode. To resolve the problem, log in to the box interactively with SSH, run configure, and then run status to review the sessions currently editing the global configuration. Run rollback to discard any edits or commit to commit the changes.
To prepare a Juniper Networks JunOS system for Safeguard for Privileged Passwords
1. Create a service account that is a member of the super-user login class and assign it a password.
2. Verify that SSH is enabled. 3. In Safeguard for Privileged Passwords, create the asset and accounts for the Juniper
Networks JunOS asset type using password authentication.
Preparing MongoDB
Safeguard for Privileged Passwords makes an SSL connection to MongoDB using a TCP port and Bind IP address defined in the mongodb.conf file. You must enter this port number when adding a MongoDB asset to Safeguard for Privileged Passwords.
To configure MongoDB for Safeguard for Privileged Passwords
1. Create a service account and assign it a password. NOTE: The service account must have permissions for remote connections and permissions to change passwords. Consult your MongoDB Security Guide for the appropriate settings for your organization.
2. Verify that you can log in with the service account. 3. In Safeguard for Privileged Passwords, create the asset and accounts for the
MongoDB asset type using password authentication. You must specify the Database instance name and the Port used by the database instance.
NOTE: When you create an account of Dialog User or Communication Data type, Safeguard for Privileged Passwords allows you to set the account password or

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

526

reset the password. Use the Reset Password option to reset the password for this account. If you use the Set Password option and enter the same password used in MongoDB, the password check in Safeguard for Privileged Passwords will fail.
Preparing MySQL servers
To prepare a MySQL server for Safeguard for Privileged Passwords, refer to the documentation for your MySQL server for information about how to setup and secure encryption. To enable SSL server certificate validation, add the server's signing authority certificate to the Trusted Certificates store in Safeguard for Privileged Passwords. For more information, see Trusted Certificates on page 360. For more information about how Safeguard for Privileged Passwords database servers use SSL, see How do Safeguard for Privileged Passwords database servers use SSL on page 578.
SQL accounts supported
Safeguard can support MySQL accounts that have been created with the format <username> or <username>@< range of IP addresses>. The permitted range of IP addresses must include the IP address of the Safeguard appliance. The % character can be used as a wildcard. Examples:
l John : Permit John to log in from any host (default) l John@%: Permit John to log in from any host l John@10.1.%: Permit John to log in from any IP address in 10.1.xx
Preparing Oracle databases
To prepare an Oracle database for Safeguard for Privileged Passwords, refer to the documentation for your Oracle database for information about how to set up and secure encryption. To enable SSL server certificate validation, when configuring the SSL-enabled service on the Oracle server, ensure that the following security setting is configured:
SSL_SERVER_CERT_DN="CN=<address>", where <address> matches the Network Address of the asset in Safeguard for Privileged Passwords.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

527

Preparing PAN-OS (Palo Alto) networks
In Safeguard for Privileged Passwords the PAN-OS operating system is used by Palo Alto Networks appliances. Safeguard for Privileged Passwords connects to PAN-OS systems using SSH.
To prepare a Palo Alto Networks system for Safeguard for Privileged Passwords
1. Create a service account that is a Device Administrator and assign it the Superuser role and a password.
2. Verify that SSH is enabled. 3. In Safeguard for Privileged Passwords, create the asset and accounts for the Palo
Alto Networks asset type using password authentication.
Preparing PostgreSQL
Safeguard for Privileged Passwords makes an SSL connection to PostgreSQL using a TCP port defined in the postgresql.conf file. You must enter this port number when adding a PostgreSQL asset to Safeguard for Privileged Passwords.
To configure PostgreSQL for Safeguard for Privileged Passwords 1. Create a service account and assign it a password. NOTE: The service account must have permissions for remote connections and permissions to change passwords. Consult your PostgreSQL Security Guide for the appropriate settings for your organization. 2. Verify that you can log in with the service account. 3. In Safeguard for Privileged Passwords, create the asset and accounts for the PostgreSQL asset type using password authentication. You must specify the Database instance name and the Port used by the database instance. NOTE: When you create an account of Dialog User or Communication Data type, Safeguard for Privileged Passwords allows you to set the account password or reset the password. Use the Reset Password option to reset the password for this account. If you use the Set Password option and enter the same password used in PostgreSQL, the password check in Safeguard for Privileged Passwords will fail.
Preparing RACF mainframe systems
This applies to both RACF mainframe and RACF mainframe LDAP platforms.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

528

To prepare IBM RACF mainframe systems for Safeguard for Privileged Passwords
1. Create a service account on the asset and assign it a password. 2. Grant the service account the privileges required to use the ALTERUSER command on
other profiles. 3. If not already installed, install a telnet server on the z/OS system. If required,
secure telnet with SSL. NOTE: Please refer to your IBM z/OS system documentation for details on installing and configuring the telnet server (and SSL).
4. Test the telnet server using a Windows-based 3270 emulator or on Linux, use the telnet-ssl or x3270 programs to test SSL and non-SSL connections to an z/OS system.
5. In Safeguard for Privileged Passwords, create the asset and accounts for the z/OS system using password authentication.
About certificate support for the telnet protocol
Safeguard for Privileged Passwords automatically accepts any server certificate that the connection offers and does not verify the trust chain on the telnet certificate. In addition, Safeguard for Privileged Passwords does not support client certificate selection, so if telnet requires that the client present a certificate that is signed by a recognized authority, Safeguard for Privileged Passwords cannot support that configuration.
Preparing SAP HANA
Safeguard for Privileged Passwords makes an SSL connection to SAP HANA using a TCP port between 30015 and 39915, depending on the SAP system number (also known as the "instance number"). For more information, see Safeguard ports on page 587.
To configure SAP HANA for Safeguard for Privileged Passwords
1. Create a service account and assign it a password. This service account must have permissions for remote connections and permissions to change passwords. Consult your SAP security guide for the appropriate settings for your organization.
2. Verify that you can log in with the service account. In SAP, when you create a new account of Dialog User or Communication Data type, you will be prompted to set a new password.
3. In Safeguard for Privileged Passwords, create the asset and accounts for the SAP asset type using password authentication. You must specify the SAP Client ID number as well as the Port used by the SAP instance. When you create an account of Dialog User or Communication Data type, Safeguard for Privileged Passwords allows you to set the account password or reset the

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

529

password. Use the Reset Password option to reset the password for this account. If you use the Set Password option and enter the same password used in SAP, the password check in Safeguard for Privileged Passwords will fail.
Preparing SAP Netweaver Application Servers
Safeguard for Privileged Passwords makes an SSL connection to the SAP Application Server using a TCP port between 3300 and 3399, depending on the SAP system number (also known as the instance number). You can have multiple instances of SAP running on a server, each using a different network port in the range of 3300-3399. The last two digits of the port are called the system number (or instance number). For more information, see Safeguard ports on page 587. When you assign a password to the account, the account is not usable until you log in and change the password from the admin-assigned value. If a privileged user for the asset is of System or Communication User Type, assign RFC authorization for the RFCPING function module for that user. This allows the user to execute its functions remotely, such as changing the password.
To configure a SAP Netweaver Application Server for Safeguard for Privileged Passwords
1. Create a service account and assign it a password. This service account must have permissions for remote connections and permissions to change passwords. Settings may include: l Cross-application Authorization Objects set to Authorization Check for RCF Access l Basis: Administration set to User Master Maintenance: User Groups including Change and Lock The S_A.SYSTEM authorization profile will work, but may have more permissions than are necessary. Consult your SAP security guide for the appropriate settings for your organization.
2. Verify that you can log in with the service account. In SAP, when you create a new account of System or Communication User Type, you will be prompted to set a new password.
3. In Safeguard for Privileged Passwords, create the asset and accounts for the SAP asset type using password authentication. You must specify the SAP Client ID number as well as the Port used by the SAP instance. When you create an account of System or Communication User Type, Safeguard allows you to set the account password or reset the password. Use the Reset Password option to reset the password for this account. If you use the Set

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

530

Password option and enter the same password used in SAP, the password check in Safeguard will fail.
Preparing Sybase (Adaptive Server Enterprise) servers
To prepare a Sybase ASE (Adaptive Server Enterprise) server for Safeguard for Privileged Passwords, refer to the documentation for your Sybase ASE server for information about how to setup and secure encryption. To enable SSL server certificate validation, add the server's signing authority certificate to the Trusted Certificates store in Safeguard for Privileged Passwords. For more information, see Trusted Certificates on page 360. For more information about how Safeguard for Privileged Passwords database servers use SSL, see How do Safeguard for Privileged Passwords database servers use SSL on page 578.
Preparing SonicOS devices
Safeguard for Privileged Passwords supports SonicOS Internet appliances. Safeguard for Privileged Passwords uses the SSH protocol to connect to SonicOS devices.
To prepare a SonicOS device for Safeguard for Privileged Passwords 1. Create the service account as a local user on the managed system and assign it a password. 2. Add the service account to the SonicWALL Administrators group. This allows the service account to access the device with SSH to manage users. IMPORTANT:Safeguard for Privileged Passwords can only manage passwords for users that are members of the SonicWALL Administrators group. 3. Enable and configure the SSH server to allow the service account to log in remotely. 4. Add the SonicOS device to Safeguard for Privileged Passwords using password authentication.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

531

Preparing SonicWALL SMA or CMS appliances
Here are some important notes about configuring a SonicWALL SMA or CMS appliance for Safeguard for Privileged Passwords:
1. Use the local admin account as the service account. 2. Safeguard for Privileged Passwords can only manage the admin account; it cannot
manage other local accounts or accounts from external providers.
Preparing SQL Servers
To prepare a MicrosoftSQL Server for Safeguard for Privileged Passwords, refer to the documentation for your SQL server for information about how to set up and secure encryption. To enable SSL server certificate validation, add the server's signing authority certificate to the Trusted Certificates store in Safeguard for Privileged Passwords. For more information, see Trusted Certificates on page 360. For more information about how Safeguard for Privileged Passwords database servers use SSL, see How do Safeguard for Privileged Passwords database servers use SSL on page 578.
To configure a SQL Server for Safeguard for Privileged Passwords (with an authentication type of Local System Account)
NOTE: To manage a Microsoft SQL server asset with the authentication type of Local System Account, you need a local Windows account that is a Security Admin in SQL. In order to use this authentication type, you must add a Windows asset and an SQL Server asset to Safeguard for Privileged Passwords.
1. Log in to the Safeguard for Privileged Passwords desktop client as an Asset Administrator.
2. Navigate to Administrative Tools | Assets. 3. Add a Windows asset that matches the OS of the server that is hosting the
SQL database. a. On the Connection tab: l Authentication Type: Set to Password. l Service Account: Set to a local user that is a member of the Administrator's group. b. Add other accounts as needed.
Save the asset.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

532

4. Add an SQL Server asset. a. On the Connection tab: l Authentication Type: Set to Local System Account. l Service Account: Click Select Account and select a local system account from the list. The accounts available for selection are Windows accounts that are linked to the Windows asset you added in Step 3. l Run Test Connection and verify the connection works.
Save the asset.
To configure a SQL Server for Safeguard for Privileged Passwords (with an authentication type of Directory Account)
NOTE: To mange a Microsoft SQL asset with the authentication type of Directory Account, you need a domain account that is a Security Admin in SQL. In order to use this authentication type, you must add a directory and directory users to Safeguard for Privileged Passwords.
1. Add a directory and directory users. a. Log in as an Asset Administrator. b. Navigate to Administrative Tools | Assets to add a directory for your domain. c. Once added, select the domain and open the Accounts tab to add domain user accounts. For more information, see Adding an account to an asset on page 207.
2. Add an SQL Server asset and account information. a. Log in to the Safeguard for Privileged Passwords desktop client as an Asset Administrator. b. From Administrative Tools | Assets, add an SQL Server asset. c. On the Connection tab, complete the following: l Authentication Type: Set to Directory Account. l Service Account: Click Select Account and select a domain user account from the list. The accounts available for selection are domain user accounts that are linked to the directory you added in Step 1. l Run Test Connection and verify the connection works.
3. Save the asset.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

533

Preparing Top Secret mainframe systems
Safeguard for Privileged Passwords can manage authorized Top Secret users who have a valid accessor ID (ACID) with the facility TSO who can log on to the TSO interface. This applies to both Top Secret mainframe and Top Secret mainframe LDAP platforms.
To prepare CA Top Secret mainframe systems for Safeguard for Privileged Passwords
1. Create a service account on the asset, assign it a password, and grant it the `TSO' facility.
2. Grant the service account the following authority for ACIDs within its scope: a. Permission to list security record information for an ACID. b. MISC1(SUSPEND) authority, to remove the PSUSPEND attribute from ACIDs. c. Either ACID(MAINTAIN) or MISC8(PWMAINT) authority, to update the password of another ACID.
3. If not already installed, install a telnet server on the z/OS system. If required, secure telnet with SSL. NOTE: Please refer to your IBM z/OS system documentation for details on installing and configuring the telnet server (and SSL).
4. Test the telnet server using a Windows-based 3270 emulator or on Linux, use the telnet-ssl or x3270 programs to test SSL and non-SSL connections to an z/OS system.
5. In Safeguard for Privileged Passwords, create the asset and accounts for the z/OS system using password authentication.
About certificate support for the telnet protocol
Safeguard for Privileged Passwords automatically accepts any server certificate that the connection offers and does not verify the trust chain on the telnet certificate. In addition, Safeguard for Privileged Passwords does not support client certificate selection, so if telnet requires that the client present a certificate that is signed by a recognized authority, Safeguard for Privileged Passwords cannot support that configuration.
Preparing Unix-based systems
Safeguard for Privileged Passwords uses the SSH protocol to connect to Unix-based systems.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

534

To prepare Unix-based systems (AIX, HP-UX, Linux, Macintosh OS X, Solaris, and FreeBSD platforms)
1. Create a service account on the asset with sufficient permissions. You need to at least configure a password for the service account. If you want to use an SSH key generated and configured by Safeguard for Privileged Passwords, then you also need to make sure the service account's home directory exists.
2. Ensure that the service account can run the following list of commands with root privileges non-interactively; that is, without prompting for a password. For example, on a Linux system add the following line in the sudoers file: <SerAcctName> ALL=(root) NOPASSWD: /usr/bin/passwd The commands a service account must run with root privileges non-interactively are: Linux and most Unix-based systems: l egrep l grep l passwd AIX: l sed l grep l passwd l pwdadm Mac OS X l dscl l passwd
3. Enable and configure the SSH server to allow the service account to log in remotely. For example, on a Mac, enable Remote Login for the service account. NOTE: Different versions of Linux and Unix may require slightly different parameters for SSH configuration. Consult a Linux/Unix system administrator or the system documentation for assistance.
Preparing Windows systems
Safeguard for Privileged Passwords supports Windows systems.
To prepare Windows systems for Safeguard for Privileged Passwords 1. Create a service account on the asset and assign it a password: l Directory Configuration If the Windows system is joined to a domain that will be managed in Safeguard

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

535

for Privileged Passwords, you can use a directory account, such as a Microsoft Active Directory account to manage the asset. Enable the Password Never Expires option; once you add the asset to Safeguard for Privileged Passwords, you can have the service account password auto-managed to keep it secure. -ORl Local Configuration If the Windows system is not joined to a domain, then use a local service account that has been granted sufficient permissions. 2. Grant the service account sufficient permissions to change account permissions to to allow changing account passwords. For more information, see Minimum required permissions for Windows assets on page 536. 3. Configure the system's firewall to allow the following predefined incoming rules: l Windows Management Instrumentation (DCOM-In) l Windows Management Instrumentation (WMI-In) l NetLogon Service (NP-In) These rules allow incoming traffic on TCP port 135 and TCP SMB 445, respectively. 4. Ensure the following ports are accessible: l Port 389 is LDAP for connections. LDAP port 389 connections are used for Active Directory Asset Discovery and Directory Account Discovery. l Port 445 SMB is used to perform password check and changes. l When possible, RPC ephemeral ports should also be accessible. For more information, see Service overview and network port requirements for Windows. 5. Change the local security policy: Before Safeguard for Privileged Passwords can reset local account passwords on Windows systems, using a service account that is a non-built-in administrator, you must change the local security policy to disable the User Account Control (UAC) Admin Approval Mode (Run all administrators in Admin Approval Mode) option. For more information, see Change password fails on page 540.
For additional information on ports, see Safeguard ports.
Minimum required permissions for Windows assets
The following minimum permissions are required for Windows assets to perform directory password management and sessions management tasks using Windows Management Instrumentation (WMI).
Asset password management
Using a local account or domain account:

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

536

l Test connection, Check connection, Password check, and Account discovery tasks require the following permissions: l Remote Enable permission on WMI's CIMV2 Namespace l Enable Account permission on WMI's CIMV2 Namespace l Remote Activation permission on computer via DCOM.
To set Remote Enable and Enable Account permissions 1. Open wmimgmt.msc. 2. Right-click WMI Control (Local) and select Properties. 3. Select the Security tab. 4. Expand the Root node. 5. Select the CIMV2 node. 6. Click the Security button. 7. Add user/group and select Remote Enable and Enable Account. 8. Click OK.
To set Remote Activation permissions 1. Open dcomcnfg. 2. Expand Component Services | Computers. 3. Right-click My Computer and select Properties. 4. Open the COM Security tab. 5. Under Launch and Activation Permissions, select Edit Limits. 6. Add user/group and select Allow for Remote Activation. 7. Click OK.
l Password change task requires the following permission: l Member of Local Administrators group
Domain password management
Using a Domain account: l Test connection, Check connection, Password check, and Account discovery tasks require the following permissions: l Member of Domain Users l Password change task requires that the Service account has the following delegated permissions: l LockoutTime (Read/Write) l Account Restrictions (Read/Write) l Reset Password

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

537

Asset session access
Using a local account:
l Member of Remote Desktop Users group l Defined in the "Allow log on through Remote Desktop Services" policy (directly or via
group membership) l Not defined in the "Deny log on through Remote Desktop Services" policy (directly or
via group membership)
Using a Domain account:
l Defined in the Remote Desktop Users group or be a member of a domain security group by a group policy update to the Remote Desktop Users group for that asset
l Defined in the "Allow log on through Remote Desktop Services" policy (directly or via group membership)
l Not defined in the "Deny log on through Remote Desktop Services" policy (directly or via group membership)
Preparing Windows SSH systems
Safeguard for Privileged Passwords supports Windows SSH systems. Windows SSH uses port 22 on the platform.
To prepare Windows SSH systems for Safeguard for Privileged Passwords
1. Ensure the SSH server service is running. 2. Create a service account on the asset and assign it a password:
l Directory Configuration If the Windows SSH system is joined to a domain that will be managed in Safeguard for Privileged Passwords, you can use a directory account, such as a Microsoft Active Directory account to manage the asset. Enable the Password Never Expires option; once you add the asset to Safeguard for Privileged Passwords, you can have the service account password auto-managed to keep it secure. -OR-
l Local Configuration If the Windows SSH system is not joined to a domain, then use a local service account that has been granted sufficient permissions.
3. Ensure the service account is added to the local Administrator's group to allow change password permissions.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Preparing systems for management

538

Troubleshooting
One Identity recommends the following resolutions to some of the common problems you may encounter as you deploy and use Safeguard for Privileged Passwords. For more information about how to troubleshoot Safeguard for Privileged Passwords, refer to the Appliance settings.
Anti-CSRF (cross-site request forgery) token error Connectivity failures Cannot connect to remote machine through SSH or RDP Cannot delete account Cannot play session message Domain user denied access to Safeguard for Privileged Passwords LCD status messages My Mac keychain password was lost Password fails for Unix host Password is pending a reset Profile did not run Recovery Kiosk (Serial Kiosk) Replica not adding System services did not update or restart after password change Test Connection failures Timeout errors causing operations to fail User locked out User not notified
Related Topics
Frequently asked questions

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

539

Anti-CSRF (cross-site request forgery) token error
Cross-site request forgery (CSRF) occurs when unauthorized commands are transmitted from a user that the web application trusts. Anti-CSRF is a type of CSRF protection. It is a random string that is only known by the user's browser and the web application If you receive an Anti Cross-Site Request Forgery token error when attempting to log in to Safeguard for Privileged Passwords using Microsoft Internet Explorer 9 on Windows 7 SP1, this indicates that cookies are blocked.
To resolve this issue 1. In Internet Explorer, open Tools and choose Internet Options. 2. In the Privacy tab, click the Advanced button. 3. Select the Always allow session cookies option.
Connectivity failures
The most common causes of failure in Safeguard for Privileged Passwords are either connectivity issues between the appliance and the managed system, or problems with service accounts. Always verify network connectivity and asset power before troubleshooting. The following topics explain some possible reasons that Check Password, Change Password, and Set Password may fail, and gives you some corrective steps you can take.
l Change password fails: Learn about a possible resolution if Change Password fails. l Incorrect authentication credentials: Learn how to resolve incorrect service account
credentials. l Missing or incorrect SSH host key: Learn how to resolve issues with SSH host keys. l No cipher supported error: Learn how to resolve cipher support issues. l Service account has insufficient privileges: Learn how to resolve service account
privilege issues.
Change password fails
A local account password change can fail when you are using a Windows asset that is configured with a service account with Administrative privileges, other than the built-in Administrator.
NOTE: Before Safeguard for Privileged Passwords can change local account passwords on

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

540

Windows systems, using a member of an administrators group other than built-in Administrator, you must change the local security policy to disable User Account Control (UAC) Admin Approval Mode (Run all administrators in Admin Approval Mode) option.
To configure Windows assets to change account passwords 1. Run secpol.msc from the Run dialog, -ORFrom the Windows Start menu, open Local Security Policy. 2. Navigate to Local Policies | Security Options. 3. Disable the User Account Control: Run all administrators in Admin Approval Mode option. 4. Restart your computer.
For more information, see Preparing Windows systems on page 535.
Incorrect authentication credentials
You must have the correct user name and password to authenticate to an asset.
To resolve incorrect service account credentials 1. Verify the service account credentials match the credentials in Safeguard for Privileged Passwords asset information (Administrative Tools | Assets | Connection). For more information, see About service accounts on page 193. 2. Perform Test Connection to verify connection. For more information, see About Test Connection on page 194. 3. Attempt to check, change, and set password again. For more information, see Checking, changing, or setting an account password on page 156.
Missing or incorrect SSH host key
If a Safeguard for Privileged Passwords asset requires an SSH host key and does not have one, Safeguard for Privileged Passwords will not be able to communicate with the asset. For more information, see Certificate issue on page 556.
To resolve missing SSH host keys To verify that an asset has an SSH host key, select the asset and look under Connection on the General view. If there is no SSH Host Key Fingerprint displayed, you need to add one.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

541

To add an SSH host key 1. Open the asset's Connection tab. 2. Choose any authentication type (except None) and enter required information. NOTE: You must enter the service account password again. 3. Click Test Connection. Test Connection verifies that the appliance can communicate with the asset. 4. Confirm that you accept the SSH host key. NOTE: To bypass the SSH host key verification and automatically accept the key, click the Auto Accept SSH Host Key option. 5. Click OK to save asset.
To resolve incorrect SSH host keys Safeguard for Privileged Passwords uses the following host key algorithms for key exchange:
l DSA l ECDSA l RSA To correct a mismatched SSH host key, run Test Connection.
No cipher supported error
If you receive an error message that says: There is no cipher supported by both: client and server, refer to Cipher support on page 556.
Service account has insufficient privileges
If you are having service account issues, consider the following: l Is the service account properly authorized to access the system? In a common setup, sudo is used to elevate the service account's privileges on the system. l Has the service account been locked out or disabled? l Is the service account configured to allow remote logon?
A service account needs sufficient permissions to edit the passwords of other accounts. For more information, see About service accounts on page 193.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

542

To resolve incorrect or insufficient service account privileges 1. Verify that the service account has sufficient permissions on the asset. 2. Perform Test Connection to verify connection. 3. Attempt to manually check, change, and set password again on the account that failed.
If the asset is running a Windows operating system, a local account password check, change, or set can fail when you are using an asset that is configured with a service account with Administrative privileges, other than the built-in Administrator. Before Safeguard for Privileged Passwords can change local account passwords on Windows systems, using a service account that is a non-built-in administrator, you must change the local security policy to disable the Run all administrators in Admin Approval Mode option. For more information, see Change password fails on page 540.
Cannot connect to remote machine through SSH or RDP
If you are unable to connect to a remote machine either through SSH or RDP, log in to the Safeguard for Privileged Passwords desktop client as an Appliance Administrator and check the Activity Center and logs for additional information. If you are using the embedded sessions module, you may also check:
l Ensure that the Network Interface X1 is configured correctly (Administrative Tools | Settings | Appliance | Networking). If one or more Safeguard Sessions Appliances are joined to Safeguard for Privileged Passwords, X1 is not available in Safeguard for Privileged Passwords.
l Ensure that you have installed the Privileged Sessions module license. (Administrative Tools | Settings | Appliance | Licensing).
Cannot delete account
If you are unable to delete an account, review the considerations below.
Wrong account name:
As an Asset Administrator, you may receive this error if you attempt to delete an account : This entity has access requests which have not yet expired or have to be reviewed. It cannot be deleted now. This error could indicate that Safeguard for Privileged Passwords is trying to change the password on an account that does not exist on the asset. One reason for this error message is that the wrong account name was used when adding the account to Safeguard. So now when someone requests the password for this account,

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

543

Safeguard displays the password that was manually set. However, when the requester attempts to log in to the asset using the bad account and password, it will fail. If the access request policy specified Change password after check-in, the above error message appears when the administrator tries to delete the account from Safeguard for Privileged Passwords. Workaround: To delete the account with the misspelled name, first manually set the password on the account. Once the account password is reset, Safeguard for Privileged Passwords will allow you to delete the account.
Cannot play session message
If you receive a message that says Cannot play session... The specified executable is not a valid application for this OS platform, you are most likely attempting to run the Desktop Player on a 32-bit platform, which is not supported.
Domain user denied access to Safeguard for Privileged Passwords
If you add a directory user who has the User must change password at next logon option enabled in Active Directory, Safeguard for Privileged Passwords prevents that user from logging in. There are two ways to allow the directory user to log in to Safeguard for Privileged Passwords successfully:
l Have the directory user use his domain account to log in to an asset joined to Active Directory. When prompted he can change his password. This fulfills the User must change password at next logon requirement. -OR-
l Have the domain administrator disable the option in Active Directory for the directory user.
LCD status messages
The Safeguard for Privileged Passwords 2000 Appliance has an LCD screen that displays the status of the appliance as it is starting and as it progress through certain operations. As it proceeds through its various stages, it displays the following LCD status messages. First boot setup refers to the initial configuration of Safeguard for Privileged Passwords, which normally happens at the factory when the appliance is deployed and after a factory reset.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

544

l Apply Update xx%: Shows the percentage completed as the appliance progresses through an update operation.
l Factory Reset xx%: Shows the percentage completed as the appliance progresses through a factory reset.
l First boot ... <version>: Displays after the first boot completes while it is waiting for Safeguard for Privileged Passwords to load.
l First Boot Setup xx%: Shows the percentage completed as the appliance is being configured for the first time.
l Preparing for first boot setup: Displays after a factory reset and before the appliance starts configured for the first time.
l Quarantine: Indicates the appliance in a Quarantine state. For more information, see What do I do when an appliance goes into quarantine on page 582.
l Starting core: Indicates that Safeguard for Privileged Passwords is being loaded.
l Starting database: Indicates that the Safeguard for Privileged Passwords database is being loaded.
l Starting reboot: Indicates the appliance is being rebooted.
l Starting services: Indicates that Safeguard for Privileged Passwords services are being loaded.
l Starting shut down: Indicates the appliance is being shut down.
l Starting web: Indicates that the web services are being loaded.
When the appliance is running, the LCD home screen displays: Safeguard for Privileged Passwords <version number>.

Appliance LCD and controls

The front panel of the Safeguard for Privileged Passwords 2000 Appliance contains the following controls for powering on, powering off, and scrolling through the LCD display.

Green check mark button: Use the Green check mark button to start the

appliance. Press the Green check mark button for NO more than one second to

power on the appliance.

CAUTION: Once the Safeguard for Privileged Passwords Appliance is booted, DO NOT press and hold the Green check mark button. Holding this button for four or more seconds will cold reset the power of the appliance and may result in damage.

l Red X button: Use the Red X button to shut down the appliance. Press and hold the Red X button for four seconds until the LCD displays POWER OFF.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

545

CAUTION: Once the Safeguard for Privileged Passwords Appliance is booted, DO NOT press and hold the Red X button for more than 13 seconds. This will hard power off the appliance and may result in damage.
l Down, up, left, and right arrow buttons: When the appliance is running, the LCD home screen displays: Safeguard for Privileged Passwords <version number>. Use the arrow buttons to scroll through the following details:
l Serial: <appliance serial number>
l X0: <appliance IP address>
l X1: <IP address of the sessions module interface>
If one or more Safeguard Sessions Appliances are joined to Safeguard for Privileged Passwords, X1 is not available in Safeguard for Privileged Passwords.
l MGMT: <management IP address>
l MGMT MAC: <media access control address>
l IPMI: <IP address for IPMI>

Table 213: Appliance LCD and controls

Control

Description

Green check mark button

Use the Green check mark button to start the appliance. Press the Green check mark button for NO MORE THAN one second to power on the appliance.

Red X button

Use the Red X button to shut down the appliance. Press and hold the Red X button for four seconds until the LCD displays POWER OFF.

Down, up, left, and right arrow buttons

When the appliance is running, the LCD home screen displays: l Safeguard for Privileged Passwords <version number>
Use the arrow buttons to scroll through the following details: l Serial: <appliance serial number> l X0: <appliance IP address>

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

546

Control

Description
l X1: <IP address of the sessions module interface> If one or more Safeguard Sessions Appliances are joined to Safeguard for Privileged Passwords, X1 is not available in Safeguard for Privileged Passwords.
l MGMT: <management IP address> l MGMT MAC: <media access control address> l IPMI: <IP address for IPMI>

My Mac keychain password was lost
The keychain in Macintosh OS X is the Apple password management system. A keychain can store all your passwords for applications, servers, and web sites, or even sensitive information unrelated to your computer, such as credit card numbers or personal identification numbers (PINs) for bank accounts. If you have added a Mac OS X system to Safeguard for Privileged Passwords, you may receive a message that says, The system was unable to unlock your login keychain. That is because Safeguard for Privileged Passwords automatically updates the account passwords on all managed systems based on the policies your Security Policy Administrator has configured, but it does not update the keychain password.
Password fails for Unix host
Some Unix systems silently truncate passwords to their maximum allowed length. For example, Macintosh OS X only allows a password of 128 characters. If an Asset Administrator creates a profile with an Account Password Rule that sets the password length to 136 characters, when Safeguard for Privileged Passwords changes the password for an account governed by that profile, the asset's operating system truncates the new password to the allowable length and does not return an error; however, the full 136character password is stored in Safeguard for Privileged Passwords. This causes the following issues:
l Check Password for that account will fail. When Safeguard for Privileged Passwords compares the password on the Unix host with the password in Safeguard for Privileged Passwords, they never match because the Unix host truncated the password generated by Safeguard for Privileged Passwords.
l A user will not be able to log in to the Unix host account successfully with the password provided by Safeguard for Privileged Passwords unless they truncate the password to the allowable length imposed by the operating system.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

547

Password is pending a reset
If a user receives a persistent message that states either of the following, the account password is stuck in a pending password change state:
l You cannot checkout the password for this account while another request is pending password reset
l This account has password requests which have not yet expired or have to be reviewed. It cannot be deleted now"
Possible solutions: l Ensure that the service account for the asset associated with this account is working. Then manually change the account password. For more information, see Checking, changing, or setting an account password on page 156. l Or, if the service account for the asset is working properly and the policy governing the account allows emergency access and has enabled multiple users simultaneous access, you can instruct the user to request the password using Emergency Access.
You can allow new access requests whether a prior request is approved or not approved. In other words, no requests will be blocked based on the approval status of a prior request. Setting the Pending reviews do not block access check box only pertains to future requests. For more information, see Reviewer tab on page 274.
Related Topics
Password is pending review
Profile did not run
The password management settings Settings | Access Request | Enable or Disable Services enable the automatic profile check and change schedules in partitions. Ensure the password management settings are enable for profiles to run on schedule:
l Check Password Management Enabled l Change Password Management Enabled For more information, see Enable or Disable Services (Access and management services) on page 301.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

548

Recovery Kiosk (Serial Kiosk)
Safeguard for Privileged Passwords provides a Recovery Kiosk (Serial Kiosk) with the following options.
l Appliance information: Allows you to view basic appliance information. l Power options: These options allow you to remotely restart or shut down the
appliance. l Admin password reset: Allows you to reset the Bootstrap Administrator's password
to its initial value. l Factory reset from the Recovery Kiosk: Allows you to recover from major problems
or to clear the data and configuration settings on the appliance. Factory reset is not available for virtual appliances, like Azure. Virtual appliances are backed up and can be recovered. For more information, see Virtual appliance backup and recovery on page 56.
CAUTION: Care should be taken when performing a factory reset against a physical appliance, because this operation removes all data and audit history, returning it to its original state when it first came from the factory. The appliance must go through configuration again as if it had just come from the factory. For more information, see Setting up Safeguard for Privileged Passwords for the first time on page 58. In addition, performing a factory reset may change the default SSL certificate and default SSH host key.
l Support bundle: Allows you to generate and send a support bundle to a Windows share.
To start the Recovery Kiosk On the terminal or laptop running the Recovery Kiosk, you must configure your serial port settings as follows:
1. Connect a serial cable from a laptop or terminal to the serial port on the back of the appliance marked with |0|0|.
2. On the laptop or terminal, configure the serial port settings as follows: l Speed: 115200 l Data bits: 8 l Parity: None l Stop bit: 1
3. These options display on the Recovery Kiosk screen: l Appliance Information l Power Options

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

549

l Reboot l Shut Down l Admin Password Reset l Factory Reset (Not available for Azure.) l Support Bundle 4. Use the up-arrow and down-arrow to select one of these options. 5. Use the right-arrow to initiate the option. 6. Use the left-arrow to return to the option.
Kiosk keyboard shortcuts
Safeguard for Privileged Passwords provides these keyboard shortcuts. If you make the window too small to accommodate the kiosk elements, Safeguard for Privileged Passwords tells you how to readjust the window size.
l Ctrl + D: Resets the kiosk to its original state. Clears challenges and options.
CAUTION: When resetting the Bootstrap Administrator's password or performing a factory reset, if you reset the kiosk before you receive the response from One Identity Support, you must submit a new challenge.
l Ctrl + R: Re-draws the kiosk to fit a resized window. If you resize the window, press Ctrl + R to reorganize the kiosk elements to fit properly into the newlysized window.
Appliance information
Use the Appliance Information option on the Recovery Kiosk to view basic appliance information and edit the IP addresses. If you are using Azure, configure the SPP VM with a static IP address in Azure. If you need to change the IP address of the Safeguard appliance, or if it changes due to dynamic configuration in Azure, and the appliance is part of a cluster, the appliance will automatically reset to Standalone Read-only mode on the next boot (effectively leaving the cluster). The Administrator can join the appliance back to the cluster.
To view or edit the appliance information 1. From the Recovery Kiosk, select the Appliance Information option. 2. Right-arrow to see: l Appliance State: The appliance's current state. l Uptime: The amount of time (hours and minutes) the appliance has been running.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

550

l MGMT (not used for Azure): The management host's network interface properties, including the MAC address and IPv4 (and optionally IPv6) properties.
l X0: The network interface properties for the primary interface that connects your appliance to the network, including the MAC address and IPv4 (and optionally IPv6) properties.
l X1 (not available of a Safeguard Sessions Applianc is joined): The network interface properties used for the embedded sessions module, including the MAC address and IPv4 (and optionally IPv6) properties.
3. To change the network properties for the primary interface (x0) or session interface (X1), if available, click Edit next to the appropriate heading. Clicking Edit displays the network interface properties which can be modified. If you are using Azure, the IP address cannot be changed.
4. After editing the network interface properties, click Submit. Once the updates are completed, a Network interface update request accepted message is displayed.
Power options
Use the power options in the Recovery Kiosk to remotely restart or shut down the physical appliance or Azure virtual deployment.
l You can use the Reboot option in the Recovery Kiosk to restart the appliance. Reboot from the Recovery Kiosk if you cannot access the Safeguard for Privileged PasswordsWindows desktop client, web client, or API to restart the appliance using the normal procedures. Reboot the Azure virtual deployment.
l You must use the Shut Down option in the Recovery Kiosk to shutdown the physical appliance or Azure virtual deployment.
Rebooting the appliance
Restarting the appliance from the Recovery Kiosk is available. If you cannot access the Safeguard for Privileged Passwords Windows desktop client, web client, or API to restart the appliance using the normal procedures, you can restart the appliance or Azure VM from the Recovery Kiosk.
To reboot the appliance
1. From the Recovery Kiosk, select the Power Options | Reboot option. 2. Press the right arrow. 3. When prompted, select Yes to start the reboot or No to return to the main
option screen.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

551

Shutting down the appliance
Shutting down the appliance from the Recovery Kiosk is available. You must use the Recovery Kiosk to manually shutdown the Safeguard for Privileged Passwords 2000 Appliance. You can also shut down the Azure virtual machine deployment.
To shut down the appliance 1. From the Recovery Kiosk, select the Power Options | Shut Down option. 2. Press the right arrow. 3. When prompted, select Yes to shut down the appliance or No to return to the main option screen.
Admin password reset
If your Bootstrap Administrator's password is locked out when using the hardware appliance or Azure virtual deployment, you can reset it to the initial password.
NOTE: If a user has not logged onto Safeguard for Privileged Passwords for a set number of days, Safeguard for Privileged Passwords disables the user account. This is set using the Disable After setting in Administrative Tools | Settings | Safeguard for Privileged Passwords Access | Login Control.
To reset the Bootstrap Administrator's password 1. From the Recovery Kiosk, select the Admin Password Reset option. 2. Press the right arrow. 3. At id, enter your identification and press the Tab key (or down arrow). 4. At Get Challenge, press the Enter key. Safeguard for Privileged Passwords produces a challenge. 5. Copy and paste the challenge and send it to One Identity Support. 6. When you get the response from One Identity Support, copy and paste the response into the kiosk screen and select Reset Password. l A challenge response is only good for 48 hours. l Do not navigate away from the page or refresh during a challenge response operation. Doing so will invalidate the challenge response.
One Identity Support resets the Bootstrap Administrator's password back to Admin123. NOTE:Best practice: To keep your appliance secure, change the default password for the Bootstrap Administrator's account.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

552

Factory reset from the Recovery Kiosk
There is a Factory Reset selection in the Recovery Kiosk. Factory Reset allows you to reset a Safeguard for Privileged Passwords hardware appliance to recover from major problems or to clear the data and configuration settings on the appliance. Factory reset is not an option for virtual appliances. You will need to redeploy the appliance.
CAUTION: Care should be taken when performing a factory reset against a physical appliance, because this operation removes all data and audit history, returning it to its original state when it first came from the factory. The appliance must go through configuration again as if it had just come from the factory. For more information, see Setting up Safeguard for Privileged Passwords for the first time on page 58. In addition, performing a factory reset may change the default SSL certificate and default SSH host key.
Factory reset on a clustered appliance
Performing a factory reset on a clustered hardware appliance will not automatically remove the appliance from a cluster. The recommended best practice is to unjoin an appliance from the cluster before performing a factory reset on the appliance. After the unjoin and factory reset, the appliance must be configured again. For more information, see Setting up Safeguard for Privileged Passwords for the first time on page 58.
To perform a factory reset from the Recovery Kiosk
1. To perform a hardware factory reset, go to the Recovery Kiosk. For more information, see Recovery Kiosk (Serial Kiosk) on page 549.
2. Select Factory Reset. 3. Press the right arrow. 4. At id, enter your email or name and press the Tab key (or down arrow). 5. At Get Challenge, press the Enter key. Safeguard for Privileged Passwords
produces a challenge. 6. Copy and paste the challenge and send it to One Identity Support.
l A challenge response is only good for 48 hours. l Do not navigate away from the page or refresh during a challenge response
operation. Doing so will invalidate the challenge response. 7. When you get the response from One Identity Support, copy and paste the response
into the kiosk screen and select Factory Reset.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

553

Support bundle
Prior to using the Support Bundle function, set up a Windows share where the support bundle is to be sent.
To generate a support bundle 1. From the Recovery Kiosk, select the Support Bundle option. 2. Press the right arrow. 3. Select the type of support bundle to be generated: l Support Bundle l Quarantine Bundle 4. When prompted, enter the following information: l Address: Enter the address of the Windows share (<IP Address>\<ShareName>) where the support bundle is to be saved. l User: Enter the user name to be used to access the Windows share. l Password: Enter the password associated with the specified user account. NOTE: If you set up the Windows share to allow anonymous access, you will not be prompted to enter a user name or password. 5. Select Copy to Share. When completed, a message appears stating that a support bundle has been sent to the specified share.
Replica not adding
If you receive a persistent message that says, An internal request has timed out... when you attempt to add an appliance to a cluster, ensure that the appliance is at the same version of Safeguard for Privileged Passwords as the primary. All members of a cluster must be the same.
System services did not update or restart after password change
If the system services do not update or restart after an automatic password change, first check your audit logs in the Activity Center.
NOTE: You can also check the Support bundle logs.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

554

If the audit logs do not adequately explain the problem, then check the options on the Change password tab of the profile that governs the service account. For more information, see Creating a profile on page 294. For service accounts that run system services or scheduled system tasks, verify the options on the profile's Change password tab that enable or disable automatic service update, or restart. You must update the Change Password Setting to change these options. For more information, see Change Password on page 421.
Test Connection failures
The most common causes of failure in Safeguard for Privileged Passwords are either connectivity issues between the appliance and the managed system, or problems with service accounts.For more information, see Connectivity failures on page 540. Disabling User Account Control (UAC) Admin Approval Mode on a remote host can also resolve Test Connection failures. For more information, see Change password fails on page 540. The following topics explain some possible reasons that Test Connection could fail.
l Test Connection failures on archive server: Learn how to resolve Test Connection failures for archive servers.
l Certificate issue: Learn how to resolve Test Connection failures for assets that require SSL.
l Cipher support: Learn about Safeguard for Privileged Passwords's cipher support. l Domain controller issue: Learn how Safeguard for Privileged Passwords manages
passwords for accounts on domain controllers. l Networking issue: Learn how to resolve system connectivity issues. l Windows WMI connection: Learn how to enable Safeguard for Privileged Passwords
to manage Windows assets.
Test Connection failures on archive server
There could multiple reasons why you receive an Unexpected copying error... when attempting to run Test Connection on an existing archive server. When you run Test Connection, Safeguard for Privileged Passwords adds a file named Safeguard_Test_Connection.txt to the Storage Path location of the archive server owned by the Account Name you entered when you created the archive server. To run Test Connection on an existing archive server with a new account name, you must first delete the existing Safeguard_Test_Connection.txt file.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

555

Certificate issue
If you are experiencing Test Connection failures for an asset that uses SSL, these are some possible causes:
l The asset's signing authority certificate has not been added to the Trusted Certificates store in Safeguard for Privileged Passwords.
l The signing authority's certificate has expired. l There is a name mismatch between the name given and the name on the
certificate of the asset. For more information, see Missing or incorrect SSH host key on page 541.
Cipher support
Both the Safeguard for Privileged Passwords client and the SSH server must support the same cipher. If you run Test Connection against an asset that uses SSH and there is no cipher supported by both the client and the server, Safeguard for Privileged Passwords displays an error message that says, Connecting to asset XXXXXXXXXXXXXXXXXX failed (There is no cipher supported by both: client and server). This means that during the setup of the asset connection, the Safeguard for Privileged Passwords client and the SSH server did not have matching ciphers for message encryption. In this case, you must modify the SSH server's configuration by adding at least one cipher supported by Safeguard for Privileged Passwords to the list of ciphers. Safeguard for Privileged Passwords supports these ciphers:
l 3des l 3des-ctr l aes128 l aes128-ctr l aes192 l aes192-ctr l aes256 l aes256-ctr l arcfour l arcfour128 l arcfour256 l blowfish l blowfish-ctr l cast128 l cast128-ctr

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

556

l des l idea l idea-ctr l none l serpent128 l serpent128-ctr l serpent192 l serpent192-ctr l serpent256 l serpent256-ctr l twofish128 l twofish128-ctr l twofish192 l twofish192-ctr l twofish256 l twofish256-ctr For example, if using an OpenSSH server with a default list of ciphers, you must add one or more of these ciphers in the OpenSSH's sshd_config file, and then restart the SSH server. For more information about OpenSSH ciphers, see http://www.openbsd.org/cgibin/man.cgi/OpenBSD-current/man5/sshd_config.5?query=sshd_config&sec=5.
Domain controller issue
Safeguard for Privileged Passwords does not manage passwords for accounts on domain controllers; Safeguard for Privileged Passwords manages passwords for accounts on a domain controller through a directory that hosts the domain controller. For more information, see Adding an account on page 147.
Networking issue
If you are having system connectivity issues, here are some things to consider: l Are there security rules on the network (such as firewalls or routers) that might be preventing this traffic? l Is traffic from Safeguard for Privileged Passwords routable to the network address of the managed system? l Are there any problems with cables, hubs, or switches, and so forth?
You could be experiencing network issues like these:

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

557

l Network outage l Router misconfiguration l Unplugged wire l Switch not working If Safeguard for Privileged Passwords suspends event notifications, try logging out and logging back in to re-subscribe to SignalR.
Windows WMI connection
To enable Safeguard for Privileged Passwords to manage Windows assets, you must configure your firewall to allow Windows Management Instrumentation (WMI).
Timeout errors causing operations to fail
If you experience any timeout errors, wait a few minutes and retry the operation. If you are performing clustering operations in the background, for example adding replicas to a cluster, wait for the cluser operations to complete before performing other operations in Safeguard for Privileged Passwords.
TIP: A timeout error can appear as a Request failed. A task was canceled. error message.
User locked out
If a user has not logged on to Safeguard for Privileged Passwords for a set number of days, Safeguard for Privileged Passwords disables the user account.
NOTE: This is set using the Disable After setting in Administrative Tools | Settings | Password Settings | Login Control. For more information, see Login Control on page 431.
Related Topics
Unlocking a user's account

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

558

User not notified
If a user did not receive an email notification, first check to see if you have set everything up in Safeguard for Privileged Passwords correctly for the email notifications to work properly. For more information, see Enabling email notifications on page 393.
Notification lists
Safeguard for Privileged Passwords does not dynamically maintain the email addresses for an escalation notification contact list. If you change a Safeguard for Privileged Passwords user's email address or delete a Safeguard for Privileged Passwords user after creating a policy, you must update the email addresses in escalation notification contact lists manually. For example, when you create a policy, you can indicate who to contact when emergency access has been used. If a user has changed an email address, the notification will not be received by that individual. Furthermore, if a user has been deleted from Safeguard for Privileged Passwords, the user will still receive the notification.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Troubleshooting

559

25
Frequently asked questions
The following topics will help you find answers to some of your questions about managing Safeguard for Privileged Passwords:
How do I access the API How do I audit transaction activity How do I configure external federation authentication How do I manage accounts on unsupported platforms How do I modify the appliance configuration settings How do I prevent Safeguard for Privileged Passwords messages when making RDP connections How do I set up telnet and TN3270/TN5250 session access requests How do I set the appliance system time How do Safeguard for Privileged Passwords database servers use SSL What are the access request states What do I do when an appliance goes into quarantine What is required for Safeguard for Privileged Passwords, embedded sessions module Verifying syslog server configuration When does the rules engine run for dynamic grouping and tagging Why did the password change during an open request
Related Topics
Appliance settings Troubleshooting

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

560

How do I access the API
Safeguard for Privileged Passwords (SPP) is built with an API-first design and uses a modernized API based on a REST architecture which allows other applications and systems. Every function is exposed through the API to enable quick and easy integration regardless of what want to do or which language your applications are written. There are even a few things that can only only be done via the Safeguard SPP API. The Safeguard for Privileged Passwords API tutorial is available on GitHub at: https://github.com/oneidentity/safeguard-api-tutorial.
Access the SPP API
Safeguard for Privileged Passwords has the following API categories:
l Core: Most product functionality is found here. All cluster-wide operations: access request workflow, asset management, policy management, and so on. https://<Appliance IP>/service/core/swagger/
l Appliance: RAppliance-specific operations, such as setting IP address, maintenance, backups, support bundles, appliance management. https://<Appliance IP>/service/appliance/swagger/
l Notification: Anonymous, unauthenticated operations. This service is available even when the appliance isn't fully online. https://<Appliance IP>/service/notification/swagger/
l Event: Specialized endpoint for connecting to SignalR for real-time events. https://<Appliance IP>/event/notification/swagger/
l a2a: Application integration specific operations. Fetching passwords, making access requests on behalf of users, and so on. https://<Appliance IP>/a2a/notification/swagger/
You must use a bearer token to access most resources in the API. When using the Swagger web UI (as referenced in the URLs above), click the Authorize button at the top of each page and log in using the web UI. The Swagger web UI adds the bearer token to each API request automatically. However, if you are manually making the API request or writing your own application/script, perform the following two steps to obtain a bearer token.
1. You must first authenticate using the OAuth 2.0 Resource Owner Password Credentials or Client Credentials grant types. An example of the former is: POST https://<ApplianceIP>/RSTS/oauth2/token Host: <ApplianceIP> Content-Type: application/json Accept: application/json

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

561

{ "grant_type": "password", "username": "<Username>", "password": "<Password>", "scope": "rsts:sts:primaryproviderid:local"
} Where:
l grant_type is required and must be set to password. l username is required and set to the user account you want to log in as. l password is required and set to the password associated with the username. l scope is required and set to one of the available identity provider's scope ID.
The value shown in the example request, rsts:sts:primaryproviderid:local, is the default value available on all Safeguard for Privileged Passwords Appliances. User accounts that you create in Safeguard for Privileged Passwords directly (that is, not an Active Directory or LDAP account) will most likely have this scope value.
NOTE: The list of identity providers is dynamic and their associated scope ID can only be obtained by making a request to: https://<ApplianceIP>/service/core/v2/AuthenticationProviders and parsing the returned JSON for the RstsProviderScope property. If you wish to authenticate using a client certificate, you must use the OAuth 2.0 Client Credentials grant type in which your certificate is included as part of the SSL connection handshake and the Authorization HTTP header is ignored. Set the scope to rsts:sts:primaryproviderid:certificate or any other identity provider that supports client certificate authentication.
POST https://<ApplianceIP>/RSTS/oauth2/token Host: <ApplianceIP> Content-Type: application/json Accept: application/json
{ "grant_type": "client_credentials", "scope": "rsts:sts:primaryproviderid:certificate"
} 2. After successfully authenticating, your response will contain an access_token that
must be exchanged for a user token to access the API. POST https://<ApplianceIP>/service/core/v2/Token/LoginResponse

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

562

Host: <ApplianceIP> Content-Type: application/json Accept: application/json
{ "StsAccessToken": "<access_token from previous response>"
} You should now have an authorization token to be used for all future API requests. The token is to be included in the HTTP Authorization header as a Bearer token like this:
Authorization: Bearer <UserToken value> For example:
GET https://<ApplianceIP>/service/core/v2/Users/-2 Host: <ApplianceIP> Accept: application/json Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1Ni... NOTE: The token will expire in accordance to the Token Lifetime setting that is configured in Safeguard for Privileged Passwords (Settings | Safeguard Access | Login Control) at the time the token was issued.

How do I customize the response using API query parameters

You can use the following API query parameters to customize the response returned from the API.
The following output parameters allow you to define the property names to be included and the property names to be used for sorting.

Table 214: API query filtering: Output

Output Example

Description/Notes

fields GET /Users?fields=FirstName,LastName

List of property names to be included in the output.

orderby Get /AssetAccounts?orderby=-AssetName,Name List of property names to be used to sort the output.
Implies descending order.

The following paging parameters allow you to include an item count, the starting page, and the number of items per page.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

563

Table 215: API query filtering: Paging Paging Example count GET /Assets?count=true
page & GET /DirectoryAccounts?page=3&limit=100 limit

Description/Notes
Indicates, True or False, whether to return a single integer value representing the total number of items that match the given criteria.
page defines which page (starting with 0) of data to return.
limit defines the size of the page data.

The following operators can be used to filter the results.

Table 216: API query filtering: filter parameter

Operator Example

Description/Notes

GET /AssetAccounts?filter=Name eq

'George'

equal to

GET /Users?filter=LastName ne 'Bailey' not equal to

GET /Assets?filter=Id gt 10

greater than

GET /Assets?filter=Id ge 10

greater than or equal to

GET /Assets?filter=Id lt 10

less than

GET /Assets?filter=Id le 10

less than or equal to

and

GET /UserGroups?filter=(Id eq 1) and

both operands return true

(Name eq 'Angels')

GET /UserGroups?filter=(Id eq 1) or (Name at least one operand returns

eq 'Bedford')

true

not

GET /UserGroups?filter=(Id eq 1) and not narrows the search by excluding

(Name eq 'Potters')

the "not" value from the results

contains GET /Users?filter=Description contains 'greedy'

contains the word or phrase

GET /Users?q=bob

q can be used to search across text properties; means "contains" for all relevant properties.

GET /Users?filter=UserName in [ 'bob', property values in a predefined

'sally', 'frank']

set

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

564

When using the filter parameter, you can use parenthesis () to group logical expressions. For example, GET/Users?filter=(FirstName eq 'Jane' and LastName eq 'Smith') and not Disabled When using the filter parameter, use the backward slash character (\) to escape quotes in strings. For example: Get/Users?filter=UserName contains '\''
How do I audit transaction activity
The appliance records all activities performed within Safeguard for Privileged Passwords. Any administrator has access to the audit log information; however, your administrator permission set determines what audit data you can access. For more information, see Administrator permissions on page 507. Safeguard for Privileged Passwords provides several ways to audit transaction activity:
l Password Archive: Where you access a previous password for an account for a specific date. For more information, see Viewing password archive on page 157.
l Check and Change Log: Where you view an account's password validation and reset history. Access the Check and Change Log from Accounts. For more information, see Accounts on page 138.
l History: Where you view the details of each operation that has affected the selected item.Each of the Administrative Tools has a History tab. For more information, see History tab (account) on page 145.
l Activity Center: Where you can search for and review any activity for a specific time frame. For more information, see Activity Center on page 90.
l Workflow: Where you can audit the transactions performed as part of the workflow process from request to approval to review for a specific access request. For more information, see Auditing request workflow on page 98.
l Reports: Where you can view and export entitlement reports that show you which assets and accounts a selected user is authorized to access. For more information, see Reports on page 100.
How do I configure external federation authentication
Safeguard for Privileged Passwords supports the SAML 2.0 Web Browser SSO Profile, allowing you to configure federated authentication with many different Identity Provider STS servers and services, such as Microsoft's AD FS. Through the exchange of the federation metadata, you can create a trust relationship between the two systems. Then, you will create a Safeguard for Privileged Passwords user account to be associated with the federated account.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

565

Safeguard supports both Service Provider (SP) initiated and Identity Provider (IdP) initiated logins. For SP initiated, the user will first browse to Safeguard and choose External Federation as the authentication provider. After entering just their email address, they will be redirected to the external STS to enter their credentials and perform any two-factor authentication that may be required by that STS. After successful authentication, they will be redirected back to Safeguard for Privileged Passwords and logged in. This works in both a web browser and the Safeguard desktop client application. For IdP initiated logins, a user will first go to their IdP STS and authenticate. Typically, the customer will have configured Safeguard as an application within their STS, allowing the user to just click on a link or icon and be redirected to Safeguard, automatically being logged in without having to enter any further credentials. Note, IdP initiated logins only work in the web browser, not the Safeguard desktop client application.
NOTE: Additional two-factor authentication can be assigned to the associated Safeguard for Privileged Passwords user account to force the user to authenticate again after being redirected back from the external STS. To use external federation, you must first download the federation metadata XML for your STS and save it to a file. For example, for Microsoft's AD FS, you can download the federation metadata XML from: https://<adfs server>/FederationMetadata/2007-06/FederationMetadata.xml.
How do I add an external federation provider trust
It is the responsibility of the Appliance Administrator to configure the external federation service providers in Safeguard for Privileged Passwords.
To add an external federation service provider
1. In Settings, select External Integration | Identity and Authentication.
2. Click Add then select External Federation. 3. In the External Federation dialog, supply the following information:
a. Name: Enter a unique display name for the external federation service provider. The name is used for administrative purposes only and will not be seen by end users. Limit: 100 characters
b. Realm: Enter a unique realm value, typically a DNS suffix, like contoso.com, that matches the email addresses of users intended to use this STS for authentication. A case-insensitive comparison will be used on this value when performing Home Realm Discovery. Wildcards are not allowed. Limit: 255 characters

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

566

c. Federation Metadata File: Choose or enter the file path to the STS federation metadata file that you previously downloaded.
d. Download Safeguard for Privileged Passwords Federation Metadata: If you have not done so before, click the link to download a copy of Safeguard for Privileged Passwords's federation metadata XML. You will need this file when creating the corresponding trust relationship on your STS server.
NOTE: The federation metadata XML files typically contain a digital signature and cannot be modified in any way, including white space. If you receive an error regarding a problem with the metadata, ensure that it has not been edited.
How do I create a relying party trust for the STS
The process for creating the relying party trust in your STS (Security Token Service) will differ between applications and services. However, as stated earlier, you can download a copy of Safeguard for Privileged Passwords's federation metadata by clicking the link when you entered the STS information in Safeguard for Privileged Passwords. You can also download the Safeguard for Privileged Passwords federation metadata at any time using one of the following methods:
l Click Settings | External Integration | Identity and Authentication. Click Download Safeguard Federation Metadata.
l Download the file from the following URL:
https://<Safeguard for Privileged Passwords server>/RSTS/Saml2FedMetadata If the STS does not support importing federation metadata, but instead requires you to manually input values, you will typically need an App ID and Login or Redirect URL. Both of these values can be copied from the Safeguard for Privileged Passwords federation metadata XML file you downloaded.
l The App ID for Safeguard for Privileged Passwords will come from the entityID attribute of the <EntityDescriptor> element in the XML file.
l The Login or Redirect URL will come from the Location attribute of the <AssertionConsumerService> element within the <SPSSODescriptor> element. NOTE: Only the HTTP-POST binding is supported for this end point.
You must then configure or ensure that the STS returns the authenticated user's email address as a SAML attribute claim. The email address must appear in either the standard SAML email address claim or name claim:
l http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress l http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
If the emailaddress and name attribute claims are not present in the SAML assertion, the SAML Subject NameID can be used.
NOTE: Any other attributes or claims will be ignored.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

567

The SAML Response or Assertion must be signed, but not encrypted. When the signing certificate used by your STS expires, you must update the metadata in Safeguard for Privileged Passwords by uploading a new copy of your STS's metadata file. Safeguard for Privileged Passwords will not automatically attempt to refresh the metadata.
NOTE: Your STS's metadata can contain more than one signing certificate to allow for a grace period between an expiring certificate and a new one. For further details regarding specific STS servers, see the following knowledge base articles on the One Identity support site:
l Configuring Microsoft's AD FS Relying Party Trust for Safeguard for Privileged Passwords: KB Article 233669
l Configuring Microsoft's Azure AD for Safeguard for Privileged Passwords: KB Article 233671
How do I add an external federation user account
It is the responsibility of either the Authorizer Administrator or the User Administrator to add an associated external federation Safeguard for Privileged Passwords user.
NOTE: You must add external federation service providers to Safeguard for Privileged Passwords before you can add external federation users. NOTE: No user information, such as first name, last name, phone number, email address, is ever imported from the STS claims token. You must enter that information manually when creating the user in Safeguard for Privileged Passwords if you need it.
To add a user
1. Navigate to Administrative Tools | Users. 2. In Users, click Add User from the toolbar. 3. In the User dialog, provide information in each of the tabs:
l Identity tab (add user): Where you define the identity provider and the user's contact information.
l Authentication tab (add user): Where you define the authentication provider, login name and password, if necessary.
l Location tab (add user): Where you set the user's time zone. l Permissions tab (add user): Where you set the user's administrator
permissions.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

568

How do I manage accounts on unsupported platforms
Safeguard for Privileged Passwords makes it possible for you to manage passwords for accounts on unsupported platforms and not addressed by a Custom platforms.
You will use a profile with a manual change password setting. For example, you may have an asset that is not on the network. The manual change password setting allows you to comply with your company policies to change account passwords on a regular schedule without using the Safeguard for Privileged Passwords automatic change password settings. Safeguard for Privileged Passwords notifies you by email, toast notification, or both on a set schedule to change account passwords manually. You can then reset the password yourself, or allow Safeguard for Privileged Passwords to generate a random password according to the password rule selected in the profile.
IMPORTANT: After you change the password in Safeguard for Privileged Passwords you must remember to change the password on the account; Safeguard for Privileged Passwords does not do that automatically for you.
The following summarizes the general workflow for managing accounts on unsupported platforms.
To manage account passwords manually
1. Configure a profile with a manual change password setting and assign asset accounts to it. For more information, see Adding change password settings on page 422.
2. Ensure toast notifications or email notifications are properly configured. For more information, see Settings (desktop client) or Enabling email notifications.
3. When notified to change an account password, choose the Set Password option you prefer:
a. Generate Password - to have Safeguard for Privileged Passwords generate a new random password, that complies with the password rule that is set in the account's profile.
i. Click Generate Password to display the Password Change dialog.
ii. Click Show Password to reveal the new password.
iii. Click Copy to place the value into your copy buffer.
l log in to your device, using the old password, and change it to the password in your copy buffer.
iv. Click Success to change the password in the Safeguard for Privileged Passwords database.
b. Manual Password - to manually set the account password in the Safeguard for Privileged Passwords database.
i. Click Manual Password to display the Set Password dialog.
ii. Enter and save a new password.
OK updates the Safeguard for Privileged Passwords database.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

569

iii. Set the account password on the physical device to synchronize it with Safeguard for Privileged Passwords.
How do I modify the appliance configuration settings
NOTE: This topic assumes you have already performed the initial appliance installation and configuration steps in the Safeguard for Privileged Passwords Appliance Setup Guide provided in the box with your hardware equipment.
(web client) To modify the appliance configuration settings 1. Log in to the Safeguard for Privileged Passwords web client using the Appliance
Administrator account.
2. Click Settings to go to the Settings: Appliance page.
3. Click Networking to configure the appliance. For more information, see Networking on page 318. a. On the Appliance Configuration page, configure the following: l Network (X0): Enter the DNS Server address information for your primary interface. l Sessions (X1): Configure the sessions interface. If one or more Safeguard Sessions Appliances are joined to Safeguard for Privileged Passwords, X1 is not available in Safeguard for Privileged Passwords. b. Click Save.
4. Click Time to enable and view information about the Network Time Protocol (NTP): a. Select Enable NTP. b. Set the primary and secondary NTP servers, if desired. c. The Last Sync Time is displayed. To view or hide details, click Show Last Sync Details or Hide Last Sync Details. For more information, see Time on page 321. d. Click Save.
(desktop client) To modify the appliance configuration settings 1. Log in using the Appliance Administrator account. 2. Navigate to Administrative Tools | Settings | Appliance.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

570

3. Expand the Time pane to enable NTP and set the primary and secondary NTP servers. Click OK. For more information, see Time on page 321.
4. Expand the Appliance Information pane to change the appliance name. 1. To change the appliance's name, click Edit next to the Appliance Name.
5. Expand the Networking pane to add or modify DSN suffixes and to configure the network interface for the embedded sessions module for Safeguard for Privileged Passwords. For more information, see Networking on page 318. a. To change the DNS suffixes for your primary interface, click Edit next to the Network Interface X0 heading. l Enter the DSN suffixes to be used. l Click OK. b. To configure the sessions interface, click Edit next to the Network Interface X1 heading. If one or more Safeguard Sessions Appliances are joined to Safeguard for Privileged Passwords, X1 is not available in Safeguard for Privileged Passwords. l Enter the IP Address, netmask, and gateway information, and the DNS servers and suffixes. l Click OK.
How do I prevent Safeguard for Privileged Passwords messages when making RDP connections
When making an RDP connection, you may encounter two different certificate messages.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

571

l Unsigned RDP file message
This message occurs when Remote Desktop Connection opens the RDP file that is downloaded when you click Play in the Safeguard for Privileged Passwords user interface. We are currently working on a solution that will allow Safeguard for Privileged Passwords to sign this RDP file to avoid this message. l Untrusted server certification message

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

572

This message occurs when the workstation has not trusted the Safeguard for Privileged Passwords RDP Connection Signing Certificate.
NOTE: The IP address of the connecting server is that of the Safeguard appliance. To avoid this message, you must trust the RDP Connection Signing Certificate and certificates in its chain of trust or replace the current certificate with an enterprise certificate and chain of trust that is trusted. For more information on certificate chain of trust for Safeguard for Priviliged Passwords, see Certificate chain of trust on page 573. For more information on replacing the RDP Connection Signing Certificate, see Sessions Certificates on page 353. The join is initiated from Safeguard for Privileged Sessions. For details about the join steps and issue resolution, see the One Identity Safeguard for Privileged Sessions Administration Guide. One Identity recommends that you replace the entire configuration with your own trusted enterprise PKI. This would result in a structure such as:
l Your Root CA l Your Issuing CA l Your RDP Signing Certificate (from Safeguard CSR) l <Sessions module generated certificate>
The Root CA, Issuing CA, and RDP Signing Certificates can be distributed via Group Policy, Active Directory, or other distribution means.
Certificate chain of trust
The default certificate chain of trust configuration that ships with Safeguard for Privileged Passwords is generated from the SafeguardCluster root certificate.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

573

Figure 4: Default certificate chain of trust
When setting up RDP Connection Signing, the certificate chain of trust also includes the certificate issued to Safeguard for Privileged Passwords for RDP, as illustrated below.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

574

Figure 5: Default certificate chain of trust when setting up RDP Connection Signing

NOTES:
l The Safeguard for Privileged Passwords Cluster certificate must be added to the trusted root CA certificate store and the DefaultSessionRdpSigning certificate must be added to the intermediate CA certificate store of the workstations from which a session request is submitted.
l Once configured, RDP sessions from any cluster member will be trusted (thus avoiding the Untrusted server certification message) because the certificate for each Safeguard for Privileged Passwords cluster member is issued the DefaultSessionRdpSigning certificate.
l This also prevents receiving new messages should the IP address of the Safeguard for Privileged Passwords Appliance change.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

575

How do I set up telnet and TN3270/TN5250 session access requests
Safeguard for Privileged Passwords (SPP) supports session access requests with mainframes using software terminal emulation including telnet and TN3270/TN5250 over telnet. Safeguard for Privileged Sessions (SPS) version 6.1 or higher is used for session recording. Actions
l Security officers can record activities of administrators who maintain critical systems running on IBM iSeries and mainframe computers.
l Asset Administrators can: l Customize the TN3270/TN5250 login screen field detection to work for the Safeguard custom login setup. l Mark an asset as supporting telnet sessions and specify if the asset is available.
l Policy Administrators can create an entitlement with an access policy that includes session access using telnet and TN3270/TN5250 sessions over telnet.
l Requesters' log in experience follows the regular client telnet or TN3270/TN5250 interface even when the session is being recorded. Sessions are not launched from Safeguard for Privileged Passwords and all required log in information is available through Safeguard for Privileged Passwords.
Steps for sessions access requests using telnet and TN3270/TN5250 over telnet
IMPORTANT: Assistance with One Identity Professional Services is required for help with configurations and installation including available plug-ins, policy creation, pattern files, shortcuts, and best practices.
SPS set up steps
Complete the following set up steps in Safeguard for Privileged Sessions (SPS). For operation details, see the One Identity Safeguard for Privileged Sessions Administration Guide: One Identity Safeguard for Privileged Sessions Administration Guide.
l Import the necessary plug-in to supply authentication and authorization (AA) and credential store (credstore) information to authenticate with and pull the credentials from SPP. The plug-in file and instructions are available at the Safeguard Custom Platform Home wiki on GitHub.
l Create and assign Pattern Sets that use pattern files specific to the log in experience for each connection. A pattern file describes the log in experience for a

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

576

specific system. The pattern file may include the on-screen location of the user name, password field location, login result, descriptions, states, and other required detail. Because log in experiences vary from mainframe to mainframe, custom pattern files must be created, uploaded, and referenced by the system-related connection policy. Template pattern files and instructions are available at the Safeguard Custom Platform Home wiki on GitHub.
CAUTION: Template pattern files are provided for information only. Customized telnet and TN3270/TN5250 pattern files need to be created. Updates, error checking, and testing are required before using them in production.
l Specify each Authentication Policy and list the authentication methods that can be used in a connection.
l Create and configure each Connection Policy. Multiple connection policies are typically required because of the uniqueness of each system log on experience and related pattern file as well as the fact that inband destinations are not used for TN3270/TN5250 over telnet. For example, telnet can be used for inband destinations. However, inband destinations are not used for TN3270/TN5250 over telnet. Instead, a fixed address including the port and server can be identified which results in the need for a different connection policy for each mainframe. A fixed address in SPS includes the port used; the SPP asset port is not used in the connection but is usually the same.
l Export a configuration file, if desired.
l Configure basic settings for the SSH server, cluster interface, and cluster management.
SPP set up steps
Complete the following set up steps in Safeguard for Privileged Passwords (SPP).
l The Asset Administrator adds the mainframe asset including the Telnet Session Port that is identified on the Administrative Tools | Asset | Management tab. For more information, see Adding an asset on page 185.
l The Policy Administrator sets the Access Type (Telnet) on the Administrative Tools | Entitlements | Access Request Policies tab.
SPP requester steps
In SPP after all configuration is complete, the requester proceeds based on the terminal service application in use.
l For a terminal service application that uses an inband connection string (like telnet), click Copy to copy the Hostname Connection string and check out the password. Then, paste the information in the log in screen.
l If the terminal service application requires more information for log in (for example, TN3270/TN5250 over telnet):

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

577

l Click Show to display values that may include Vault Address (the SPP address), a one-time Token, Username, Asset, and Sessions Module (the SPS address).
l Click Copy by any of the values to copy a single value. Or, you can click Copy at the right of all values to copy the entire the connection string, if that is required by your terminal service application.
l Paste the necessary information into your terminal service application. l Click Check-In to complete the password checkout process. This makes the
session request available to reviewers.
l Click Hide to conceal the information from view. NOTE: The user would copy an entire connection string if, for example, you have a launcher to take the connection string and launch the profile of the terminal service application.
How do I set the appliance system time
NOTE: Changing appliance time can result in unintended consequences with processes running on the appliance. For example, there could be a disruption of password check and change profiles and audit log time stamps could be misleading. TIP:As a best practice, set an NTP server to eliminate possible time-related issues. For more information, see Time on page 321.
To set the time on your appliance l Use the appliance API to change the appliance time (SystemTime). For information about using the API, see How do I access the API.
How do Safeguard for Privileged Passwords database servers use SSL
Some database servers use Secure Socket Layer (SSL) when communicating with Safeguard for Privileged Passwords. Depending on the platform type, version, and configuration, the database server can either use SSL for only encrypting the session or it can use SSL for encrypting and verifying the authenticity of the database server.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

578

ODBC Transport
The following platforms use the ODBC transport. Safeguard for Privileged Passwords installs the appropriate software driver on the appliance to communicate with the platform. The configuration data that Safeguard for Privileged Passwords uses to initialize a connection with the server is in the form of a connection string consisting of a colonseparated list of driver-specific options.
By default, the database servers encrypt the login data, but not the subsequent data passed on the connection. You must configure SSL and enable it on the database server to enable encryption for the session data.

Microsoft SQL Server

MicrosoftSQL Server is always capable of encrypting the connection with SSL. It listens on a single port for both SSL and non-SSL connections.
If you have set the Force Encryption option to yes on the SQL server, then it uses SSL to encrypt the data, regardless of whether the Safeguard for Privileged Passwords client requests it or not.
You can set the Force Encryption option to yes on the SQL server without configuring a server certificate. In this case, the SQL server transparently generates a self-signed certificate to use when a Safeguard for Privileged Passwords client requests encryption. This makes it possible for the SQL server to use SSL only to provide encryption for the session without verifying the server certificate.
NOTE: It is not possible from within a running session to detect whether the SQL server is using SSL for encryption.

Table 217: Microsoft SQL Server SSL support

Safeguard for Privileged
Passwords Client Options

Microsoft SQL Server Configuration

Result

Use SSL Verify Force

Server

Encryption SSL Encryption

Cert

Configured

n/a

The SQL Server does not encrypt the

session.

Yes

n/a

Safeguard for Privileged Passwords requests that the SQL server encrypt the session using a generated selfsigned certificate.

Yes

n/a

Yes

Safeguard for Privileged Passwords

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

579

requests that the SQL server encrypt the session using the server certificate.

Yes

n/a

The SQL server rejects the connection as there is no certificate to verify against.

Yes

n/a

Yes

Safeguard for Privileged Passwords

requests that the SQL server encrypt

the session and verify the server certi-

ficate against the trusted CA certi-

ficates in Safeguard for Privileged

Passwords.

MySQL Server

To support SSL you must compile the MySQL server software with SSL support and correctly configure it with a CA certificate and server certificate. If there is any problem with the certificate, the MySQL server may log an error and start up without SSL support. In this case the MySQL server rejects the request to enable SSL for a session as there is no certificate to verify against and does not encrypt the session. The MySQL server listens on a single port for both types of connections.
The behavior of the MySQL server depends on the server version and configuration. In some versions of MySQL, the server enables SSL by default on all Safeguard for Privileged Passwords client sessions once it is configured.
If the MySQL server defaults to using SSL, or requires SSL for a user, the MySQL server encrypts the session even if the Safeguard for Privileged Passwords client does not request it. However, the Safeguard for Privileged Passwords client cannot request to use SSL just for encryption; it can only request SSL if you have imported the correct CA certificate to Safeguard for Privileged Passwords.
NOTE: It is possible to detect that SSL is in use from within a session by examining the session variables. That is, the Safeguard for Privileged Passwords client can detect if a request to use SSL has not been honored and displays an error.

Table 218: MySQL Server SSL support

Safeguard for Privileged
Passwords Use SSL Encryption
Option

SSL Supported on MySQL
Server

Result

Unencrypted session.

Yes

Determined by the MySQL server. The server

encrypts the session if it defaults to using SSL or

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

580

Safeguard for Privileged
Passwords Use SSL Encryption
Option
Yes
Yes

SSL Supported on MySQL
Server

Result

requires it for this user.

Safeguard for Privileged Passwords client detects

this and reports a failure.

Yes

Safeguard for Privileged Passwords requests that

the MySQL server encrypt the session and verity

the server certificate against the trusted CA certi-

ficate in Safeguard for Privileged Passwords

For more information, see Preparing MySQL servers on page 527.

Sybase ASE Server

To support SSL you must correctly configure the Sybase server with a CA certificate and server certificate. The Sybase server listens on different ports for SSL and non-SSL connections, and rejects a mismatched request from a Safeguard for Privileged Passwords client to a particular port.
The Safeguard for Privileged Passwords client cannot request to use SSL just for encryption; it can only request SSL if you have imported the correct CA certificate to Safeguard for Privileged Passwords.

Table 219: Sybase ASE Server SSL support

Safeguard for Privileged
Passwords Use SSL Encryption
Option

Sybase Server Listening Port Uses
SSL

Result

Unencrypted session.

Yes

The Sybase server rejects the connection attempt.

NOTE: The ODBC driver cannot detect that this is an SSL error and displays a client cannot connect error.

Yes

The Sybase server rejects the session with an SSL

error.

Yes

Safeguard for Privileged Passwords requests that

the Sybase server encrypt the session and verify

the server certificate against the trusted CA certi-

ficates in Safeguard for Privileged Passwords.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

581

For more information, see Preparing Sybase (Adaptive Server Enterprise) servers on page 531.

What are the access request states

Safeguard for Privileged Passwords uses the following access request states, which change as a request steps through the workflow process.

Table 220: Access request states

State

Description

Available

Approved requests that are ready for the requester. That is, for password release requests, the requester can view or copy the password. For session access requests, the requester can launch the session.

Approved

Requests that have been approved, but the checkout time has not arrived.

Denied

Requests denied by the approver.

Expired

Requests for which the checkout duration has elapsed.

Pending

Requests that are waiting for approval.

Revoked

Approved requests retracted by the approver.
NOTE: The approver can revoke a request between the time the requester views it and checks it back in.

What do I do when an appliance goes into quarantine
Safeguard for Privileged Passwords hardware and virtual appliances can end up in a quarantine state if something goes wrong while doing certain activities. The best defense against losing data or compounding problems associated with quarantined appliances is a good and recent backup. For more information, see Backup and Retention settings on page 334. The appliance (at least one appliance in a clustered environment), should be set up to take a scheduled backup regularly, that should be saved to an archive server so that if something happens, you can recover with minimum downtime and loss.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

582

Recovering from a quarantine state
1. Follow these steps to create a quarantine bundle from the Recovery Kiosk. For more information, see Recovery Kiosk (Serial Kiosk) on page 549.
a. Prior to using the Quarantine Bundle function, set up a Windows share where the quarantine bundle is to be sent.
b. From the Recovery Kiosk, select the Support Bundle option, click the right arrow, and select Quarantine Bundle.
c. Enter the following information:
l Address: Enter the address of the Windows share (<IP Address>\<ShareName>) where the support bundle is to be saved.
l If the Windows share is not anonymous, enter the User name and Password.
d. Click Copy to Share.
2. You can now restart the appliance. Often, a quarantine happens because the system was waiting for a response that did not return in time. Restarting the appliance allows it to retry and frequently fixes itself.
a. To restart a quarantined appliance, connect to the Recovery Kiosk for that appliance and restart it from there. Once the appliance has restarted, it will take several minutes for Safeguard for Privileged Passwords to start.
b. If you log into the appliance using the desktop client while Safeguard for Privileged Passwords is starting, you will see a Maintenance mode screen. At the end of the Maintenance mode, you will see a Restart Desktop Client button or the Quarantine warning.
i. If you see the Restart Desktop Client button, the restart successfully recovered the appliance and brought the appliance back in a healthy state.
ii. If the Quarantine warning appears, contact One Identity Technical Support and report the result.
NOTE:Clustered environment: If the quarantined appliance was the primary appliance, use the Failover option to reassign the primary appliance role to a healthy member of the cluster. For more information, see Failing over to a replica by promoting it to be the new primary on page 491.
To remove a quarantined appliance from a cluster
You may want to remove a quarantined appliance from a cluster.
1. First try to unjoin the replica appliance from the cluster. For more information, see Unjoining replicas from a cluster on page 483.
2. If unjoining the appliance fails, reset the cluster to remove the appliance from the cluster. For more information, see Resetting a cluster that has lost consensus on page 497.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

583

Considerations for a factory reset of a hardware appliance
CAUTION: Care should be taken when performing a factory reset against a physical appliance, because this operation removes all data and audit history, returning it to its original state when it first came from the factory. The appliance must go through configuration again as if it had just come from the factory. For more information, see Setting up Safeguard for Privileged Passwords for the first time on page 58. In addition, performing a factory reset may change the default SSL certificate and default SSH host key.
One Identity Technical Support can determine if a factory reset is necessary. If a factory reset is the last option, you will need to Support to complete the operation.
1. To perform a factory reset, connect to the Recovery Kiosk and select the Factory Reset option. For more information, see Factory reset from the Recovery Kiosk on page 553. Once the factory reset is started, you must wait until it finishes (it could take up to 30 minutes to complete). When the factory reset is complete, the kiosk will return an Online indicator.
2. Once the factory reset is complete: a. Re-configure the network interface settings. b. Re-apply any patches you had installed. c. If this is an unclustered appliance, upload and restore the most recent backup to retrieve your data. For more information, see Restore on page 345. d. If the appliance was a member of a cluster, skip the restore step and join the appliance to the cluster as if it were a brand new appliance. For more information, see Enrolling replicas into a cluster on page 482.Safeguard for Privileged Passwords will take care of replicating all the data back to the appliance.
What is required for Safeguard for Privileged Passwords, embedded sessions module
NOTE: The embedded sessions module is not available when using a virtual appliance. Safeguard for Privileged Passwords embedded sessions module allows you to issue privileged access to users for a specific period or session and gives you the ability to record, archive, and replay user sessions so that your company can meet its auditing and compliance requirements. Before using Privileged Sessions, make sure the following settings and configuration are in place:

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

584

l Appliance Administrator: l Ensure the embedded sessions module for Safeguard for Privileged Passwords is licensed (Settings | Appliance | Licensing). For more information, see Licensing on page 312. l Ensure the Network Interface X1 is configured (Settings | Appliance | Networking). For more information, see Networking on page 318. l Ensure the session request service is enabled (Settings | Access Request | Enable or Disable Services). For more information, see Enable or Disable Services (Access and management services) on page 301. l Safeguard for Privileged Passwords ships with default session certificates; however, it is recommended that you replace the default certificate with your own (Settings | Certificates | Session Certificates).For more information, see Sessions Certificates on page 353.
l Security Policy Administrator: Ensure there is an entitlement with an access request policy for both SSH and RDP sessions defined. For more information, see Entitlements on page 258.
l Ensure Remote Desktop is enabled for Windows machines that will use RDP. l Ensure the necessary SSH algorithms are configured for any Unix or Linux machines
that will use SSH. NOTE:Safeguard for Privileged Passwords ships with default SSH algorithms configured for Unix and Linux machines. To add new algorithms, use the API endpoint: https://<Appliance IP>/service/core/swagger/SessionsSSHAlgorithm
Related Topics
About sessions and recordings
Verifying syslog server configuration
Use the Send Test Event link located below the Syslog configuration table on the Syslog pane to verify your syslog server configuration. Navigate to Administrative Tools | Settings | External Integration | Syslog.
To validate your setup
1. When configuring your syslog server, on the Syslog dialog add the test event. 2. Back on the Syslog pane, select the syslog server configuration from the table, then
select Send Test Event. Safeguard for Privileged Passwords logs a test message to the designated syslog server.
NOTE: To log event messages to a syslog server, you must configure Safeguard for

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

585

Privileged Passwords to send alerts. For more information, see Configuring alerts on page 108.
When does the rules engine run for dynamic grouping and tagging
Dynamic account groups are associated with rules engines that run when pertinent objects are created or changed. For example:
l Whenever you add or change an asset account, all applicable rules are reevaluated against that asset account.
l Whenever you change an asset account rule, the rule is reevaluated against all asset accounts within the scope of that rule. In other words, the rule is reevaluated against all asset accounts for grouping and the asset accounts within the designated partitions for tagging.
You can create a dynamic account group without any rules; however, no accounts will be added to this dynamic account group until you have added a rule. In large environments, there is a possibility that the user interface may return before all of the rules have been reevaluated and you may not see the results you were expecting. If this happens, wait a few minutes and Refresh the screen to view the results. Related topic: Adding a dynamic account group
Why did the password change during an open request
There are three ways a password can change while a user has it checked out. 1. An Asset Administrator manually changes the password. For more information, see Checking, changing, or setting an account password on page 156. 2. A profile was scheduled to automatically change the password. For more information, see Change Password on page 421. 3. A policy allows both simultaneous access and requires that the password change when a user checks it in.
If the password changes while a user has it checked out, and the current request is still valid, the user can select either Copy or Show Password again to obtain the new password.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Frequently asked questions

586

Appendix A

Safeguard ports
Ap p e nd ix :

Safeguard for Privileged Passwords requires port availability for various system operations.

Port details

Safeguard network port details are in the following table.

Table 221: Safeguard ports

Use in SPP

Appliance Protocol Description port

MGMT

TCP

HTTPS used for a secure first-time configuration of the appliance. The IP address is a fixed address that cannot be changed. It is available in case the primary interface becomes unavailable.
Typically used: TCP/443 and IP address: 192.168.1.105

Base operation 25

TCP

SMTP: Simple Mail Transfer

Base operation 53

TCP / UDP

DNS (Domain Name Server)

Base operation 123

NTP time synchronization

Base operation 88

UDP

For communication with Active Directory, Safeguard uses port 88 (for example, Kerbos authorization against Active Directory).

Base operation 389 (AD Asset and Account Discovery, password check and change)

TCP

LDAP used for Active Directory Asset

Discovery and Directory Accounts Discovery.

The standard global catalog port, 3268 (LDAP),

must be open on the firewall for every

Windows global catalog server in the

environment and SPP Appliance to

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Safeguard ports

587

Use in SPP
Base operation (password check and change) LDAPS WMI

Appliance Protocol Description port

communicate for directory management tasks (for example, adding a directory account, a directory user account, or a directory user group). LDAP uses port 389 for unencrypted connections. For more information, see the Microsoft publication How the Global Catalog Works.
For basic functionality when changing an OS account password, the following ports are required:

l Windows Active Directory: TCP/389 and TCP/445
l Windows, Windows Desktop: TCP/445

Also see:

l Adding identity and authentication providers
l Preparing Windows systems
l Port 445

445

TCP SMB NetLogon Service (NP-In) is used to perform

password check and changes for Windows

Active Directory and Windows, Windows

Desktop. Also see port 389 and Preparing

Windows systems

636

Supported for non-AD LDAP providers. The

default LDAPS port is 636. Port 636 needs to

be open to use LDAPS for non-AD LDAP

providers.

135

TCP

(49152-

65535

Windows)

The firewall must be configured to allow Windows Management Instrumentation (WMI) for computer name and other lookups. WMI is also required if SPP performs any of the functions listed below on any Windows machine (whether it be a dependent system or a normal target platform):

l Managing service account passwords l Managing scheduled task passwords l Restarting a service l Using Account Discovery on the target

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Safeguard ports

588

Use in SPP

Appliance Protocol Description port

l Recording using embedded sessions

WMI / DCOM from DPA will need access to TCP/135 to initiate communication on the target. The conversation continues on a random negotiated port. On Windows 7 and Windows 2008 (and above) this is in the range: 49152 - 65535.
To limit the ports used by WMI/DCOM, refer to these Microsoft articles:

l How to configure RPC dynamic port allocation to work with firewalls
l Setting Up a Fixed Port for WMI

For Windows Active Directory, if using Account Discovery or Auto Discovery CLDAP ping UDP/389 is also required. See:

l Preparing Windows systems l Networking

WMI

4915265535

See port 135

Archiving

TCP (X0)

The Secure Shell (SSH) Protocol for SFTP/SCP transfers backups and session recordings to the archive server for the SPP embedded sessions module.
See:

l Assets, Management tab (add asset)
l Authenticating an asset, Password (local service account)

Embedded sessions

22 and 3389

TCP (X1)

RDP (3389/TCP) is permitted inbound for PSM RDP sessions (SPP embedded sessions module). Users who will use the embedded session require access to the cluster X1 ports on port 3389 to make an RDP connection to the target system and to port 22 for SSH connections. See: KB article 262371.

SPP/SPS

8649

internal commu-

nications

TCP

Used for the SPP/SPS internal communications

when SPS is joined with SPP.

l SPS to SPP:

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Safeguard ports

589

Use in SPP
Firewall
Firewall and Client and Web browser points

Appliance Protocol Description port

l SPS completes the join by talking to SPP on port 8649.
l SPS authenticates a new session and acquires the password from SPP by talking on port 8649.
l SPS queries SPP for cluster information and the appliance version.
l SPP to SPS:
l SPP queries SPS for cluster information and node roles.
l SPP pushes SSH host keys to SPS when a session is initiated.
l SPP queries SPS for session playback, follow mode, and session termination.

In SPS, the nodes require UDP ports 500 and 4500 and TCP 8649. For the latest detail, see the SPS Administration Guide, Enabling cluster management.

655

TCP /

TINC (655) is open for secure VPN

UDP (X0) communication between appliances in a

clustered high-availability configuration. TINC

perfers UDP and uses TCP if UDP is unreliable.

See KB article 232671.

To enroll an appliance into a cluster, the appliance must communicate over port 655 UDP/TCP and port 443 TCP, and must have IPv4 or IPv6 network addresses (not mixed). See:

l KB article 232289 l KB article 252260 l KB article 232671 l Cluster settings l Enrolling replicas into a cluster

443

TCP

HTTPS over TLS/SSL (443/TCP) permits

(X0)

inbound requests (for client/Web/API access). Used to initially log on to the appliance to join

the cluster member. Users must have access

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Safeguard ports

590

Use in SPP

Appliance Protocol Description port

to the cluster X0 ports on port 443.
To enroll an appliance into a cluster, the appliance must communicate over port 655 UDP/TCP and port 443 TCP, and must have IPv4 or IPv6 network addresses (not mixed). See:

l KB article 232289 l KB article 252260 l KB article 232671 l KB article 229909 (Starling related
endpoint)

The port is used to prepare VMware ESXi host. See:

l Preparing VMware ESXi hosts

Global catalog 3268

The LDAP standard global catalog port for Active Directory. The standard global catalog port, 3268 (LDAP), must be open on the firewall for every Windows global catalog server in the environment and SPP Appliance to communicate for directory management tasks (for example, adding a directory account, a directory user account, or a directory user group). LDAP uses port 389 for unencrypted connections. For more information, see the Microsoft publication How the Global Catalog Works. Also see:

l Adding an account l Adding a directory user group

There are no services listening for this port on a member/server workstation (local configuration).

Kiosk

DB9

SERIAL

To connect to the Safeguard Kiosk. See KB article 233584.

Radius server 1812

Default port number that a Radius server uses to listen for authentication requests. See Adding identity and authentication providers.

SonicWALL SMA 8443

TCP/ UDP For SonicWALL SMA or CMS appliance. See

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Safeguard ports

591

Use in SPP or CMS appliance SQL server
Telnet

Appliance Protocol Description port

information related to authenticating an asset, Password (local service account).

1433

The port on which the SQL server will be listening for connections. See information related to authenticating an asset, Password (local service account).

TCP

Telnet

Platform ports
ACF2 23 ACF2 LDAP 389 AIX 22 AWS 443 Cent OS 22 Cisco Pix 22 Debian 22 IDRAC 22 ESXi - 443 default F5 - 22 default Facebook (deprecated) - 443 Fortinet 22 default Free BSD 22 HP iLO IBM i 23 JunOS 22 MongoDB - https://docs.mongodb.com/manual/reference/default-mongodb-port/ MySQL 3306 Oracle 1521 Oracle Linux 1521 OSX 22 Other port is not supported for the platform Other Managed - port is not supported for the platform Other Linux 22 Pan OS 22

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Safeguard ports

592

PostgreSQL 5432 default RACF 23 RACF LDAP 389 RHEL 22 SAP Hana 39013 default SAP Netweaver 3300 Solaris 22 SoniOS 22 SonicWall SMA 22 SQL 1433 SUSE 22 SyBase 5002 Top Secret 23 Top Secret LDAP 389 Twitter (deprecated) 443 Ubuntu 22 Windows (various depanding on OS type) 135/389/445 and maybe dynamic ports
Archiving
Archiving uses uses SFTP/SCP and CIFS. l SFTP/SCP: 22 TCP (X0). See the Port details table, appliance port 22 for X0. l CIFS: Uses UDP ports 137 and 138 and TCP ports 139 and 445.
Backup
Same as Archiving.
External Authentication
Federation Port 443 Secondary Auth Radius Port 1812 Starling - Port 443
External Integration
SNMP Port 162 UDP SMTP - Port 25 TCP Simple Mail Transfer

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Safeguard ports

593

SysLog 514 UDP
External Integration for Password Workflow
Approval Anywhere - 443 Ticketing ServiceNow 443 Ticketing - Remedy 1433 (communicates to the SQL server directly)
Other
NTP port 123 UDP Directories Ports 389 LDAP and 3268 global catalog

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Safeguard ports

594

Appendix B

SPP 2.7 or later migration guidance
Ap p e nd ix :
Safeguard for Privileged Passwords version 2.7 was simplified to allow for a separation of duties based only on identity management, asset management, access policy configuration, and appliance maintenance. In the migration to version 2.7 or later, greater flexibility is realized through these high-level assignments:
l Directories are migrated to assets. l Accounts include both directory accounts and asset accounts. l Each directory is assigned its own partition in the migration to version 2.7 or later.
The following information details the changes from version 2.6 to version 2.7 or later. The same information is generally true if you are upgrading from version 2.1 forward to version 2.7 or later.
Before you migrate
l Make sure you back up before migrating to version 2.7 or later. l Be sure you have data you want to migrate and perform general clean up. For
example, if you have entities that are not needed, remove them before migrating. l Complete as many outstanding Access Requests as possible. This is especially
important for Active Directory Access Requests because any outstanding Active Directory Access Requests will need to be recreated after the migration since they cannot be resubmitted. l Save all necessary version 2.6 logs. Directory log history prior to the migration to version 2.7 or later is not available after the migration. Details follow.
l Before the migration to version 2.7 or later, Directory Administrators, Asset Administrators, and Auditors can see audit log history for each of the directories, regardless of who created or changed them.
l The migration takes Directories and turns them into directory assets. All associated relationships with directories are also migrated to the new directory assets. The Directory Administrator role is removed and users with Directory Administrator permission are assigned as a partition owners for directories that are migrated to assets.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: SPP 2.7 or later migration guidance

595

l After the migration to version 2.7 or later, the Asset Administrator can see the directory asset whose audit log history starts on the day of the migration. Events prior to migration are not available.
l We recommend two clients:
l A version 2.6 client to connect to older appliances
l A new version 2.7 or later client to get the new features of Directory Assets and Discovery
This recommendation is made because a new client uses v3 endpoints. A version 2.6 appliance doesn't know how to respond to v3 calls. An new client pointed to an old appliance will get an error when trying to connect. You will see this message: The Safeguard desktop application is not compatible with this appliance. Please contact your administrator.
What to expect
The following lists entity changes you will note in the migration to version 2.7. or later.
Directories are migrated to Assets
l Directories are migrated to assets with the appropriate platform assignment.
l Directories are still synced with Safeguard.
l Migrated directory assets reflect any account dependencies with Windows services and task on other assets.
l You can select whether a directory asset manages the forest or a subset of the forest. Multiple assets can be assigned against the same forest.
l Every migrated directory has Managed Forest selected so the administrator can create a directory to manage a domain or part of a domain. As assets, directories can be shared and all domains in a forest can be managed from one instance of a domain. Navigate to Administrative Tools | Asset | Management tab | Managed Forest check box.
l Every migrated directory asset has Available for discovery across all partitions selected so the asset is available for asset and account aiscovery jobs beyond partition boundaries. Any partition that exists is able to use this directory asset. Navigation: Administrative Tools | Asset | Management tab | Available for discovery across all partitions check box.
l Discovery detail grids will identify migrated directory assets with a Partition value of Import.
l Each migrated directory asset is assigned to its own partition and includes the Account Discovery jobss, the check and change schedules, account password rules, password sync groups, and related functions.
l To view the Account Discovery job assigned as the results of migration, navigate to Administrative Tools | Asset. Select the directory asset then Edit. Then navigate to | Account Discovery tab to see the selected Account

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: SPP 2.7 or later migration guidance

596

Discovery job for the partition. If no schdule is selected, this message displays: No Account Discovery Chosen. l Directory tags are migrated into the appropriate partition tag. To copy a tag to a new partition, change the description then copy the tag.
Administrative Tools | Directories removed and Discovery added
When Safeguard for Privileged Sessions version 2.7 is installed, directories, discovery jobs, and other related entities automatically migrate to the appropriate associations. The Administrative Tools | Directories selection is gone, and Administrative Tools | Discovery has been added. Functionality is reorganized and streamlined for better data control.
Discovery
l During migration, existing partition account discovery jobs are separated by platform type, for example, Unix, Windows, or Directory. As a result, you will see discovery jobs with the same name and a different prefix which denotes the platform. For example, you may see: l (Unix) AD-Asset Discovery account discovery job l (Windows) AD-Asset Discovery account discovery job Each discovery job is assigned the appropriate asset and settings that apply to the platform. You can rename or delete jobs, as needed. Navigate to: Administrative Tools | Discovery.
l In version 2.6, you can have several directory account discovery jobs assigned to the same directory. During migration, all the directory account discovery jobs assigned to a directory are put in a single account discovery job with multiple rules, one for each prior job. The job schedule follows the directory sync interval.
l In version 2.7, you can assign a profile to the account or a sync group using the account template in the Account Discovery job rule. For more information, see Adding an Account Discovery rule on page 246.
Account changes
l Accounts include directory accounts and asset accounts. l Directory accounts are migrated into accounts and are assigned to the
appropriate asset. l Accounts identify the dependent assets. l Every migrated account has Available for use across all partitions selected. For
example, if you create an asset service account with this check box selected, the service account could be used from anywhere. Navigate to Administrative Tools | Account | Management tab | Available for use across all partitions check box.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: SPP 2.7 or later migration guidance

597

l You cannot add the same account to multiple partitions from the same domain. l You can select a directory account and view the assets that have dependency on the
directory account. Navigate to Administrative Tools | Accounts | Dependent Assets.
Dynamic account group changes
The rules for dynamic asset groups and dynamic account groups include attributes for directory assets.
NOTE: Dynamic asset groups rule attributes do not include attributes for directory accounts. A directory cannot be the target of an asset group because you can not get an RDP or SSH session to them. Dynamic asset groups are for Policy Administrator control and directories are not included in policies.
Identity and authentication provider migration
A directory identity provider is managed by creating a directory asset which points to the same directory. The directory identity provider can be created and, optionally, put under management or not. During migration from earlier versions of Safeguard for Privileged Passwords, if there are Active Directory users and user groups, SPP determines if Active Directory should be the identity provider or not. To see the result of the migration:
1. Navigate to Administrative Tools | Settings. 2. Select the directory then the General tab. 3. Scroll down to Available Domains for Identity and Authentication to view the
domains selected for the directory. Directory groups require the forest root domain to be visible and available for identity and authentication set on Administrative Tools | Settings | External Integration | Identity and Authentication. For more information, see Available Domains for Identity and Authentication (for Active Directory) on page 400.
After the initial migration to version 2.6, add the identity provider.
Entitlements and access request policies
l Entitlement access request policies are migrated. If the access configuration for the asset-based session asset is a directory and you are using the version 2.6 desktop client, the name of the directory account may be blank since version 2.6 understood only one assignment and version 2.7 or later handles multiple assignments. To verify this, navigate to the Entitlements | Access Request Policy | Access Config tab. For directory accounts, the Asset-Based Session Access is correctly identified as a Directory Account, however, the directory account name is blank.
Management
Directories can be subdivided so administrators can be assigned to manage portions of a directory. For example, Admin A may only manage objects in the Finance organizational

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: SPP 2.7 or later migration guidance

598

unit (OU) of the directory, and Admin B may only manage objects in the Engineering OU of the directory. This is possible via the settings on Assets including the asset Name, Domain Name, and whether to Manage Forest. This way, multiple assets can govern the same domain.
Directory accounts can be service accounts to other assets to run windows services/tasks on assets to keep password changes in sync.
Administrator role changes
l The Directory Administrator role is removed, and users with Directory Administrator permission are assigned as partition owners for directories that are migrated to assets. This role does not include the ability to manage identity providers.
l An Authorizer Administrator can now add an Active Directory forest only for identity to use as an unprivileged service account for connection.
l An Asset Administrator can now:
l Use service accounts to manage Active Directory. The service accounts can have limited permissions within a single domain.
l Use multiple service accounts for managing the same Active Directory domain with different limited permissions within the domain. For example, the administrator can add the domain as a managed asset multiple times with different service accounts.
l Use a service account from Active Directory to manage an asset from a different partition so that the administrator does not have to add that Active Directory to each of the administrator's partitions.
l Set up a dependent system for a service running as an Active Directory account that isn't in the administrator's partition. This avoids having to add the Active Directory asset or the account to the partition.
l Add Active Directory for authentication to Safeguard for Privileged Passwords without managing any of the accounts in Active Directory.
l Set up multiple assets for the same domain.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: SPP 2.7 or later migration guidance

599

Appendix C
SPP and SPS sessions appliance
Ap p e nd ix :
join guidance
CAUTION: The embedded sessions module in Safeguard for Privileged Passwords version 2.7 (and later) will be removed in a future release (to be determined). For uninterrupted service, organizations are advised to join to the more robust Safeguard for Privileged Sessions Appliance for sessions recording and playback. Safeguard for Privileged Passwords version 2.7 introduced the ability to join Safeguard for Privileged Sessions for session recording and auditing. The Asset Administrator can join a Safeguard for Privileged Sessions (SPS) cluster to a Safeguard for Privileged Password (SPP) cluster of one appliance or more for session recording and auditing. The actual join must be between the SPP primary and the SPS cluster master. This means that the Safeguard for Privileged Sessions (SPS) cluster is aware of each node in an SPP cluster and vice-versa. Once joined, all sessions are initiated by the SPP appliance via an access request and managed by the SPS appliance and sessions are recorded via the Sessions Appliance. NOTE: if you have a single node SPS cluster where the Central Management node is also the Search Master, SPP will be unable to launch sessions. There has to be at least one SPS appliance in the cluster that is capable of recording sessions. See the SPS Administration Guide, Managing Safeguard for Privileged Sessions (SPS) clusters.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: SPP and SPS sessions appliance join guidance

600

Session recording, playback, and storage after the join
l Sessions recorded after the join are playable through SPP and are stored on the SPS appliance. An archive server can be set up through SPS.
l Sessions recorded prior to joining the Safeguard Sessions Appliances are not migrated to the SPS appliance. For that reason, it is recommended that the SPP sessions be migrated to an archive server prior to the join.
Functionality in SPS after the join
The following functionality handled in SPP's user interface is available in SPS after the join.
l Session certificate assignment is handled by SPS. The certificate is available for audit by the Auditor.
l After the join, you will set the following configurations in SPS. There is no migration of the SPP settings added via Administrative Tools | Entitlements | Access Request Policies | Session Settings. These include: l Session recording l SSH related command detection and controls (such as SFTP, SCP, and X11 forwarding) l RDP related command detection and controls (such as Windows title detection and allowing the clipboard)
l In SPS, you will: l Set the SSH banner text that is shown to session users when they initiate a privileged session notifying them the session will be recorded. l Identify the SSH host key presented to the user's SSH client when an SSH session is started. l Identify the status of the session module, such as session module health. l Edit the default policy.
Functionality in SPP after the join
l During the join, SPP sets the SPS Connection Policy to safeguard_default for SSH or safeguard_rdp for RDP, as appropriate and may need to be changed. This default is nothing more than SSH or RDP connection policy.
l Other configuration set via the Access Request Policies dialog, are not affected by the join. These include: General, Scope, Requester, Approver, Reviewer, Access Config, Time Restrictions, and Emergency tabs.
l The Activity Center shows all old sessions and new sessions per the configuration. You can play back a session from SPP. However, the session index, which makes the privileged users' activity searchable, is only available from SPS.
l Entitlement reports have not changed.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: SPP and SPS sessions appliance join guidance

601

l On the Dashboard, administrators can still view and manage access requests and accounts failing tasks as usual.
l After the join, Administrative Tools | Settings | Sessions functionality is no longer available and is handled via SPS. This includes session recording management, sessions module, SSH banner, and SSH host key.
Step 1: Prepare for the join
Move all session recording files from Safeguard for Privileged Passwords to an archive server.
1. Move the SPP embedded sessions recordings from local SPP to an archive server.
l If the join has not been started, you can use the SPP user interface to archive existing SPP sessions:
1. Set up the archive server. Navigate to For more information, see Archive servers on page 336.
2. Assign the archive server to the SPP appliances. For more information, see Assigning an archive server to an appliance on page 439. SPP moves the files and deletes the local file storage.
3. Verify the recordings have been archived by comparing the session events in the Activity Center with the actual recording files on the archive server.
4. Test the playback of a recording stored on the archive server. You will need to download it before you can play it. For more information, see Replaying a session on page 133.
l If the join is complete, use the API to archive existing SPP sessions.
a. Use the API PUT Core/v2/SessionArchiveConfigs/{id}. Call this API giving it the ID of the archive server (GET Core/v2/ArchiveServers) and the ID of the appliance (GET Core/SessionArchiveConfigs). Calling the above POST API will assign an archive server to archive session recordings. Within a few minutes, all remaining recordings will be moved to the archive server and removed from the local SPP storage.
b. Test the playback of a recording stored on the archive server. You will need to download it before you can play it. For more information, see Replaying a session on page 133.
2. Ensure the join is performed when open access requests are not pending, if possible.
When the SPS session connection is joined, open access requests are automatically closed. When you double-click the event in the Activity Center, the event details Action is Evicted.
3. Back up your appliances and archive servers. For more information, see Backup and Retention settings on page 334.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: SPP and SPS sessions appliance join guidance

602

Step 2: Join SPS and SPP
The join is initiated from Safeguard for Privileged Sessions. For details about the join steps and issue resolution, see the One Identity Safeguard for Privileged Sessions Administration Guide.
Pay attention to the roles assigned to the SPS nodes. The following caution is offered to avoid losing session playback from SPP.
CAUTION: Do not switch the role of an SPS node from the Search Local role to Search Minion role. If you do, playback of the sessions recorded while in the Search Local role may not be played back from the SPP appliance, and may only be played back via the SPS web user interface. Recordings made with the node in Search Minion role are pushed to the Search Master node and are available for download to SPP. For details about SPS nodes and roles, see the One Identity Safeguard for Privileged Sessions Administration Guide: One Identity Safeguard for Privileged Sessions - Technical Documentation.
Step 3: Perform post join activities in SPP and SPS
Steps to perform in SPP
1. The Appliance Administrator assigns the managed networks for sessions management.
Navigate to Administrative Tools | Settings | Cluster | Managed Networks. For more information, see Managed networks on page 366.
2. The Appliance Administrator can view, delete, or edit join connections, as needed.
Go to Administrative Tools | Settings | Cluster | Session Appliances. For more information, see Session Appliances with SPS join on page 373.
If you soft delete a session connection, then reconnect, the access policies remain available. If you hard delete, the Policy Administrator will need to rejoin and reestablish the SPS Connection Policy via Administrative Tools | Entitlements | Access Request Policies | Session Settings. For more information, see Connection deletion: soft delete versus hard delete.
3. The Policy Administrator identifies the session settings on the entitlements access request policy.
Perform the following steps to ensure each policy's session setting is correctly assigned.
a. Navigate to Administrative Tools | Entitlements, select an entitlement, and open Access Request Policies.
b. Double-click a policy, or select a policy and click Edit Access Policy.
c. On the Session Settings tab, go to the SPS Connection Policy. The host name of the cluster master is displayed first followed by the IP address:

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: SPP and SPS sessions appliance join guidance

603

safeguard_default. d. If needed, select the cluster or appliance to which the policy applies.
For more information, see Session Settings tab on page 1. 4. While on the Access Request Policies dialog, the Policy Administrator checks any
other tab, as needed. The join does not affect the settings on the tabs including the General, Scope, Requester, Approver, Reviewer, Access Config, Time Restrictions, and Emergency tabs.
Steps to perform in SPS Complete any set up in SPS required (such as setting up an archive server, the SSH banner, the SSH host key, as well as SSH-related or RDP-related command detection and controls). For details, see the One Identity Safeguard for Privileged Sessions Administration Guide: One Identity Safeguard for Privileged Sessions - Technical Documentation. :
Standard operating procedure after the initial join
If you add another SPS cluster after the initial join, follow these standard operating procedures:
1. Add join connections. For more information, see Session Appliances with SPS join on page 373.
2. Identify the session settings on the entitlements access request policy (SPS Connection Policy that is the IP address of the cluster master). For more information, see Creating an access request policy on page 268.
3. Assign the managed networks. For more information, see Managed networks on page 366.
Reversing the join
CAUTION: It is not recommended to reverse the join. However, if you were using the embedded session prior to the join, you can return to the embedded sessions module via a factory reset or restoring the backup taken before the join. For more information, see Reversing the SPP to SPS join on page 377.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: SPP and SPS sessions appliance join guidance

604

Appendix D

Regular expressions
Ap p e nd ix :

Regular expressions are used to parse large amounts of data to find matching patterns and validate a predefined pattern. For example, in Safeguard for Privileged Passwords, regular expressions are used for:
l Account Discovery rules (Property Constraints, Name Ranges and Group Ranges). Partial matches are acceptable (unless the regular expression itself is defined to only return exact matches).
l Ticket numbers when an external ticketing system is not used. Matches must be exact.
For details, see these Microsoft resources:
l .NET Regular Expressions l Regular Expression Language - Quick Reference
Best practices for ticketing not tied to external ticket system
These best practices are for adding a regular expression for ticketing not tied to an external ticket system. For more information, see Ticketing systems on page 413. If you use an alternation construct ("|" which is "or"), the longest matching expression is defined first to the least matching expression because Windows.Net regular expression (regex) stops after finding the first match. For example: A{3}[0-9]{5}ZZZ|A{3}[0-9]{5} is advised instead of the reverse order. Sample entry results follow for the A{3}[0-9]{5}ZZZ|A{3}[0-9]{5} expression:

User entry: Match?

AAA12345

Yes. Matched on the second regex

AAA12345Z No. There is no exact match.

AAA12345ZZZ Yes. Matched on the first regex.
If the expression were reversed (A{3}[0-9]{5}|A{3}[0-9]{5}ZZZ) there would be a partial match on the first expression and the entry would be returned as invalid.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Regular expressions

605

You may want to wrap each expression in an alternation construct with the anchors ^ and $ when using alternation constructs. An example follows: ^A{3}[0-9]{5}ZZZ$|^A{3}[0-9]{5}$.
The ? lazy quantifier should be avoided, especially at the end of the expression. For example, if the regex is A{3}[0-9]? and the user enters AAA12345, AAA1 is returned as a matched string which is not an exact match of AAA12345.
If the greedy quantifier (*) is used against AAA12345 then the matched string will be AAA12345 and be an exact match.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Regular expressions

606

Appendix E

Historical changes by release
Ap p e nd ix :

IMPORTANT: The following feature update information is relevant only for the designated release.

What's new in version 2.1.0.5687

Safeguard for Privileged Passwords 2.1 (2.1.0.5687) introduces the following new features and enhancements.

Table 222: Safeguard 2.1: Features and enhancements

Feature/Enhancement Description

Additional platform support

Safeguard for Privileged Passwords now supports the management of assets on the following additional platforms:

l ACF2 - Mainframe r14 and r15 l ACF2 - Mainframe LDAP r14 and r15 l Debian GNU/Linux 9 l ESXi 6.5 l Fedora 26 l Fortinet FortiOS 5.2 and 5.6 l F5 Big-IP 12.1.X and 13.0 l MAC OS X 10.13

Cluster patching

The cluster patching process now allows you to patch all cluster members without having to first unjoin a replica and re-enroll it after it has been updated. During the cluster patch operation, access request workflow is available so authorized users can request password releases and session access.

Federated login

Safeguard for Privileged Passwords supports the SAML 2.0 Web Browser SSO Profile, allowing you to configure federated

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

607

Feature/Enhancement Description

authentication with many different Identity Provider STS servers and services, such as Microsoft's AD FS.

Immediate recording archival

Safeguard for Privileged Passwords provides the ability to immediately archive session recordings from a specific Safeguard for Privileged Passwords Appliance to a specified archive target. When an archive server is configured, session recordings are removed from the Safeguard for Privileged Passwords Appliance and stored on the archive server.

Lights Out Management (BMC)

Multi-request

Authorized Safeguard for Privileged Passwords users can now request multiple password releases or sessions in a single request. In addition, these requests can be saved as a "favorite" access request, providing quick access to the request from the user's Home page.

Safeguard for Privileged Passwords Desktop Player enhancements

The new version of the Safeguard for Privileged Passwords Desktop Player includes the following new features:
l Ability to display user activity as subtiltes when playing back a recorded session. The user activity that can be displayed as subtitles includes windows titles, executed commands, mouse activity, and keystrokes, as they occurred during the recorded session.
l New timeline with user event indicators showing when user activities and screen changes occurred within the recorded session. Clicking an indicator on the timeline takes you to the relevant user event in the recording.
l Ability to export the sessions recording file, including the user event subtitles, as a video file.

Security Policy Administrator dashboard

The new Access Request dashboard allows Security Policy Administrators to review and manage access requests from a single location. From this view, the Security Policy Administrator can revoke a request, follow an active session, or terminate a session.

Restore/Suspend accounts

Safeguard for Privileged Passwords allows you to suspend Safeguard for Privileged Passwords managed accounts when they are not in use to reduce the vulnerability of password attacks on privileged accounts.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

608

Feature/Enhancement Description

NOTE: This new feature applies to Windows platforms (Windows server and Active Directory accounts) and Unix platforms (AIX, HP-UX, Linux, Solaris, and Mac OS X accounts).

TLS 1.2 Only

To remediate security vulnerabilities identified in early versions of the TLS encryption protocol, Appliance Administrators can configure Safeguard for Privileged Passwords to respond only to TLS 1.2 requests. This allows organizations to comply with the security and strong cryptography requirements in PCI-DSS.

X11 Forwarding

When configuring the settings for SSH session access requests, Security Policy Administrators can now enable Allow X11 Forwarding, which forwards a graphical Xserver session from the server to the client.

What's new in version 2.2.0.6958

Safeguard for Privileged Passwords 2.2.0.6958 introduces the following new features and enhancements.

Table 223: Safeguard for Privileged Passwords 2.2: Features and enhancements

Feature/Enhancement Description

Additional platform support

Safeguard for Privileged Passwords now supports the management of assets on the following additional platforms:

l FreeBSD l MongoDB l PostgreSQL l RACF - Mainframe LDAP l SAP HANA

Application to Application Using the Application to Application service, third-party

(A2A) integration

applications can interact with Safeguard for Privileged

Passwords in the following ways:

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

609

Feature/Enhancement Description

l Access request broker: A third-party application can initiate an access request on behalf of an authorized user so that the authorized user can be notified of the available request and log in to Safeguard for Privileged Passwords to retrieve a password or start a session.

Asset Administrator dashboard

The Account Automation tab on the Dashboard allows Asset and Directory administrators to view information regarding accounts that are failing different types of tasks, including:

l Accounts where password check tasks failed. l Accounts where password change tasks failed. l Accounts where SSH key change tasks failed. l Accounts where suspend tasks failed. l Accounts where restore tasks failed.

Dynamic grouping and tagging

Dynamic grouping and tagging helps classify assets allowing Safeguard for Privileged Passwords to assign automatically provisioned systems and accounts to a policy.
Tags allow Asset Administrators to add additional metadata to accounts and assets to enrich the data on the object as it is added to Safeguard for Privileged Passwords. Tags can be dynamically added to assets and accounts based on tagging rules or they can be added manually.
Policy administrators can create rules based on tags or from attribute information that is on the account or asset (for example, name, platform, partition, network address, and so on) to define group membership.

Event subscription

As a Safeguard for Privileged Passwords user, you can now control the email notifications you receive. Using the Manage Email Notifications control in your My Account pane, you can remove the events for which you do not want to receive email notifications.
As a Safeguard for Privileged Passwords administrator, you can use the API to subscribe to the events for which you are interested in receiving notifications.

Audit log archive

Safeguard for Privileged Passwords allows you to define and schedule an audit log management task to rotate audit logs from the Safeguard for Privileged Passwords appliance and archive older audit logs to a designated archive server.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

610

Feature/Enhancement Description

Site awareness and network segmentation

As an Appliance Administrator, you can define managed networks (network segments) for your organization so Safeguard for Privileged Passwords can more effectively manage assets and accounts, and service access requests. Managed network information is used for scheduling tasks, such as password change and account discovery, and for session management in a clustered environment to distribute the task load. That is, by using managed networks the load is distributed in such a way that there is minimal cluster traffic and appliances that are closest to the target asset are used to perform the task.

Attribute search

The attribute search functionality in the user interface allows you to limit an object list based on the object attributes. For example, in the Accounts view, you can now filter the accounts list based on whether the specified attribute contains the search string entered.

Starling Join

The newest versions of One Identity's on-premises products offer a mandatory One Identity Hybrid Subscription, which helps you transition to a hybrid environment on your way to the cloud. The subscription enables you to join Safeguard for Privileged Passwords with the One Identity Starling softwareas-a-service platform. This gives your organization immediate access to a number of cloud-delivered features and services, which expand the capabilities of Safeguard for Privileged Passwords. When new products and features become available to One Identity Starling, the One Identity Hybrid Subscription allows you to use these immediately for Safeguard for Privileged Passwords to add value to your subscription.

Starling Identity Analytics & Risk Intelligence integration

The Starling Identity Analytics & Risk Intelligence service collects and evaluates information from data sources, such as Safeguard for Privileged Passwords, to provide you with valuable insights into your users and entitlements. When integrated with Safeguard for Privileged Passwords, Starling Identity Analytics & Risk Intelligence allows you to identify Safeguard for Privileged Passwords users and entitlements that are classified as high risk and view the rules and details attributing to that classification.

What's new in version 2.3.0.7426
Safeguard for Privileged Passwords 2.3.0.7426 introduces the following new features and enhancements.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

611

Table 224: Safeguard for Privileged Passwords 2.3: Features and enhancements
Feature/Enhancement Description Synchronized passwords As an Asset Administrator, you now have the ability to
synchronize passwords so accounts can use the same password on the same or different assets.
What's new in version 2.4.0.7846
Safeguard for Privileged Passwords 2.4.0.7846 introduces the following new features and enhancements.
Custom platform (770747)
Asset Administrators now have the ability to add a custom platform for use when adding or updating an asset. A custom platform allows Safeguard for Privileged Passwords to connect to and manage password operations on platforms that are not supported by Safeguard for Privileged Passwords out of the box. You can upload a custom platform script file to add support for any system that you want to manage. In this release, only SSH-based custom platforms are supported; other protocols will be added in future releases. To access examples of custom scripts and view commands, visit:
l Scripts: https://github.com/OneIdentity/SafeguardCustomPlatform
l Command wiki: https://github.com/OneIdentity/SafeguardCustomPlatform/wiki/CommandReference
Auditors and Partition Administrators have read only rights to custom platforms. However, Partition Administrators retain the ability to add or remove assets.
Authentication options (765396)
With appropriate administration credentials, you can change the primary and secondary identity and authentication providers for authentication to Safeguard for Privileged Passwords. The feature enables customers to integrate Safeguard for Privileged Passwords with their existing identity and authentication services. For example, a customer can use Radius for primary authentication and rely upon their own company policies for functions like 2FA.
Safeguard Sessions Appliance join (770739)
CAUTION: The SPS/SPP join feature in the Safeguard for Privileged Passwords 2.4 release is intended for proof of concept and preview purposes only. This feature should not be used in production.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

612

The Asset Administrator can now join a Safeguard Sessions Appliance with a standalone primary Safeguard for Privileged Passwords Appliance. Once joined, all sessions are recorded via the Safeguard Sessions Appliance and the embedded sessions module for Safeguard for Privileged Passwords is no longer available. The user initiates the join by connecting to the Safeguard Sessions Appliance over SSH, selecting Join to SPP, and providing the requested information. After the join is complete, the user restarts the desktop client to complete the connection and update settings and entitlement policy details. Sessions recorded prior to joining the Safeguard Sessions Appliances are available to play back from local storage and in accordance with the permissions of the Safeguard for Privileged Passwords Appliance. Sessions that are archived are also available to play back. Once a Safeguard for Privileged Passwords Appliance has been configured to use the Safeguard Sessions Appliance, it can only be reversed by a factory reset of the Safeguard Passwords Appliance or restoring a backup that was taken before the first join of Safeguard for Privileged Sessions (SPS). Either method unjoins the Sessions Appliance and redeploys the Safeguard for Privileged Passwords Appliance sessions module.
What's new in version 2.5.0.8356
Safeguard for Privileged Passwords 2.5.0.8356 introduces the following new features and enhancements.
Directory based user discovery (713614 and 761638)
When adding a new directory based user group, the Authorizer Administrator or the User Administrator now have the option to:
l Configure primary and secondary authentication providers and l Set administrator permissions on the imported or updated Safeguard for Privileged
Passwords users.
In addition, any managed directory accounts that exist in Safeguard for Privileged Passwords at the time of the import process (or during the background synchronization of the directory), can automatically be assigned to a Safeguard user as a linked account. That association will be dependent upon the value of an attribute from the directory (such as "managedObjects" or "directReports" in Active Directory or "seeAlso" in OpenLDAP 2.4).
Offline Workflow (782735)
To ensure password consistency and individual accountability for privileged accounts, when an appliance loses consensus in the cluster access requests are disabled. In the event of an extended network partition, the Appliance Administrator can manually place an appliance in Offline Workflow Mode to run access request workflow on that appliance in isolation from the rest of the cluster. When the network issues are resolved and connectivity is reestablished, the Appliance Administrator can manually resume online operations to

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

613

merge audit logs, drop any in flight access requests, and return the appliance to full participation in the cluster. It is recommended that no changes to cluster membership are made while an appliance is in Offline Workflow Mode. The Appliance Administrator must manually restore the online operations before adding other nodes to ensure the appliance can seamlessly reintegrate with the cluster.
What's new in version 2.6.0.8961
Safeguard for Privileged Passwords 2.6.0.8961 introduces the following new features and enhancements.
Automatic Offline Workflow Mode (794644)
To reduce potential downtime, the Appliance Administrator can configure Offline Workflow Mode to be performed automatically. Offline Workflow Mode allows an appliance that has lost consensus (quorum) to operate in isolation from the cluster to process access requests using cached policy data. To ensure the outage is not a short-lived outage, the default time before the appliance is automatically switched to Offline Workflow Mode is 15 minutes. The time threshold can be changed to 5 minutes or more. If automatic Offline Workflow Mode is enabled, you can enable automatic Resume Online Workflow so the appliance automatically resumes online operations once consensus is restored. The minutes to wait after consensus is restored before automatically resuming online workflow defaults to 15 minutes. The time threshold can be changed to 5 minutes or more. When Offline Workflow Mode settings are configured to run automatically, an Appliance Administrator can override the automatic settings and manually place an appliance in Offline Workflow Mode or manually restore an appliance to online workflow, as needed. The user views status messages that clearly communicate the appliance state and the ability to request passwords. This new feature is available via Settings | Cluster | Offline Workflow.
Export a report as a .csv or .json file (788932)
Administrators and users can export a report to a .csv or .json file to easily view, manipulate, and share data. This functionality includes entitlement reports, Activity Center exports, Activity Center scheduled reports, account automation reports, and access request reports.
Identity provider initiated single sign on flow (788935)
To enable users to have a centralized logon experience, an Appliance Administrator can configure their identity provider to redirect to Safeguard for Privileged Passwords. All

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

614

security requirements, such as two-factor authentication, are enforced. For example, a user can go to a portal, authenticate against their identity provider, and select an application, including Safeguard, based on their organizational role. Safeguard accepts the "unsolicited" SAML 2.0 response assertion and logs in the user without additional authentication. Systems Integrators can offer Safeguard as an application in their single sign-on (SSO) portal. Support personnel can then click the appropriate tool on their dashboard to access Safeguard for Privileged Passwords and Safeguard for Privileged Sessions. This feature only works with SAML 2.0 and the web user interface, not the desktop client.
Policy allows password requests to include all linked accounts (776867)
A Policy Administrator can create a policy that allows a user's password request to include access to assets for all the accounts linked to the user's account. For example, if a company uses personal admin accounts in Active Directory, a single policy can be created to grant password access to each user with a personal admin account. This function is set by selecting the following check box: Entitlements | Access Request Policy | Access Config | Allow password access to linked accounts.
Restore a backup from a previous version (790917)
An Appliance Administrator can restore backups as far back as Safeguard for Privileged Passwords version 2.2.0.6958. Only the data is restored; the running version is not changed. If the administrator attempts to restore a version earlier than 2.2.0.6958, a message like the following displays: Restore failed because the backup version '[version]' is older than the minimum supported version '2.2.0.6958' for restore. You cannot restore a backup from a version newer than the one running on the appliance. The restore will fail and a message like the following displays: Restore failed because backup version [version] is newer then the one currently running [version]. The backup version and the running version display in the Activity Center logs that are generated when Safeguard starts, completes, or fails a restore.
Service discovery (773722)
Overview The Asset Administrator or delegated administrator can configure service discovery jobs to scan Windows assets and discover Windows services and tasks that may require authorization credentials. If the Windows asset is joined to a Windows domain, the authorization credentials can be local on the Windows asset or be Active Directory credentials. Running Service Discovery jobs Service discovery jobs run automatically in the background or may be manually run. Discovered services and tasks association to known Safeguard accounts

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

615

Service discovery jobs associate Windows services and tasks with accounts that are already managed by Safeguard for Privileged Passwords. The accounts put under management display on the Windows Assets | Discovered Services tab. When the account's password is changed by Safeguard, Safeguard updates the password corresponding to the services or tasks on the asset according to the asset's profile change settings.
Service Discovery with Active Directory
A discovered service or task configured to use Active Directory authentication can be automatically linked to the asset with the account managed by Safeguard. Effectively, the asset will have an account dependency on the account.
To automatically link, the Account Discovery job (which runs when Safeguard synchronizes the directory) must have the Automatically Manage Found Accounts check box selected on the Discovery tab. The Assets | General tab designates the directory profile to govern the accounts the discovery job adds to Safeguard.
Unmanaged accounts
The administrators can view Discovery | Discovered Services to identify unmanaged accounts that they may want to manage to require authentication for local users or Active Directory users, if the asset is joined to a domain. For more information, see Adding an account on page 147.
View Service Discovery job status
From the Activity Center, you can select the Activity Category named Service Discovery Activity which shows the Event outcomes: Service Discovery Succeeded, Service Discovery Failed, or Service Discovery Started.
Session player installation (794597)
CAUTION: To play back sessions, the new Desktop Player must be installed for one user or system-wide users after installing Safeguard for Privileged Passwords 2.6 or later.
When Safeguard for Privileged Passwords 2.6 or later is installed, the existing Desktop Player is removed and the latest Desktop Player must be installed.
Once Safeguard for Privileged Passwords is installed, the new player can be accessed by going to the Windows Start menu, Safeguard folder and clicking Download Safeguard Player. The One Identity Safeguard for Privileged Sessions - Download Software web page displays.
To continue the installation for one or system-wide users, follow the Install Safeguard Desktop Player section of the player user guide found here:
1. Click this link: One Identity Safeguard for Privileged Sessions - Technical Documentation.
2. Scroll to User Guide and click One Identity Safeguard for Privileged Sessions [version] Safeguard Desktop Player User Guide.
User experience if the Desktop Player is not installed

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

616

If the Desktop Player is not installed and a user tries to play back a session from the Activity Center, a message like the following will display: No Desktop Player. The Safeguard Desktop Player is not installed. Would you like to install it now? The user will need to click Yes and will be taken to the download page to complete the install. New Desktop Player versions When you have installed a version of the Safeguard Desktop Player application, you will need to uninstall the previous version to upgrade to a newer player version.
Time zone change (780266)
Safeguard for Privileged Passwords sets a default time zone based on the location of the person performing the set up. The time zone is expressed as UTC + or hours:minutes and is used for timed access (for example, access from 9 a.m. to 5 p.m.). It is recommended that the Bootstrap Administrator set the desired time zone on set-up. An Authorizer Administrator can also change the time zone. Time zone changes are made via Settings | Safeguard Access | Time Zone and selecting the Default User Time Zone.
What's new in version 2.7.0.9662
Safeguard for Privileged Passwords 2.7.0.9662 introduces the following new features and enhancements.
Sessions Appliance join (792394)
CAUTION: The embedded sessions module in Safeguard for Privileged Passwords version 2.7 will be removed in a future release (to be determined). For uninterrupted service, organizations are advised to join to the more robust Safeguard for Privileged Sessions Appliance for sessions recording and playback.
Managing sessions via the Safeguard Sessions Appliance is now available for use in production. For this release, the embedded sessions module for Safeguard for Privileged Passwords is still available. The Asset Administrator can join a Safeguard for Privileged Sessions (SPS) cluster to a Safeguard for Privileged Password (SPP) cluster of one appliance or more for session recording and auditing. The actual join must be between the SPP primary and the SPS cluster master. This means that the Safeguard for Privileged Sessions (SPS) cluster is aware of each node in an SPP cluster and vice-versa. Once joined, all sessions are initiated by the SPP appliance via an access request and managed by the SPS appliance and sessions are recorded via the Sessions Appliance. Session recording, playback, and storage

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

617

l Sessions recorded after the join are playable through SPP and are stored on the SPS appliance. An archive server can be set up through SPS.
l Sessions recorded prior to joining the Safeguard Sessions Appliances are not migrated to the SPS appliance. For that reason, it is recommended that the SPP sessions be migrated to an archive server prior to the join.
Safeguard for Privileged Passwords join guidance
Before initiating the join, review the steps and considerations in the join guidance. For more information, see SPP and SPS sessions appliance join guidance on page 600.
Safeguard for Privileged Sessions join steps and troubleshooting
The join is initiated from Safeguard for Privileged Sessions. For details about the join steps and issue resolution, see the One Identity Safeguard for Privileged Sessions Administration Guide at this link: One Identity Safeguard for Privileged Sessions - Technical Documentation.
Separate identity and management for directories for fine grained management (773267)
The following information summarizes the changes at a high level. For more information specific for your initial deployment of Safeguard for Privileged Passwords 2.7, see the Safeguard for Privileged Passwords Administration Guide, SPP 2.7 or later migration guidance.
Overview
Safeguard for Privileged Passwords version 2.7, has been simplified to allow for a separation of duties based only on identity management, asset management, access policy configuration, and appliance maintenance. In the migration to version 2.7, greater flexibility is realized through these high-level assignments:
l Directories are migrated to assets.
l Accounts include both directory accounts and asset accounts.
l Each directory is assigned its own partition in the migration to version 2.7.
The following information details the changes from version 2.6 to version 2.7. The same information is generally true if you are upgrading from version 2.1 forward to version 2.7.
Administrators
l The Directory Administrator role is removed and users with Directory Administrator permission are assigned as partition owners for directories that are migrated to assets. This role does not include the ability to manage identity providers.
l An Authorizer Administrator can now add an Active Directory forest only for identity to use as an unprivileged service account for connection.
l An Asset Administrator can now:
l Use service accounts to manage Active Directory. The service accounts can have limited permissions within a single domain.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

618

l Use multiple service accounts for managing the same Active Directory domain with different limited permissions within the domain. For example, the administrator can add the domain as a managed asset multiple times with different service accounts.
l Use a service account from Active Directory to manage an asset from a different partition so that the administrator does not have to add that Active Directory to each of the administrator's partitions.
l Set up a dependent system for a service running as an Active Directory account that isn't in the administrator's partition. This avoids having to add the Active Directory asset or the account to the partition.
l Add Active Directory for authentication to Safeguard for Privileged Passwords without managing any of the accounts in Active Directory.
l Set up multiple assets for the same domain.
Identity
During the migration to version 2.7, directories are migrated as an asset with the appropriate identity provider and associated users.
Management
Directories can be subdivided so administrators can be assigned to manage portions of a directory. For example, Admin A might only manage objects in the Finance organizational unit (OU) of the directory and Admin B might only manage objects in the Engineering OU of the directory. This is possible via the settings on Assets including the asset Name, Domain Name, and whether to Manage Forest. This way, multiple assets can govern the same domain.
Directory accounts can be service accounts to other assets to run windows services/tasks on assets to keep password changes in sync.
Accounts
l You can select a directory account and view the assets that have a dependency on the account.
l You can sync passwords between a directory account and an asset account.
Assets
l Directories are migrated to assets with the appropriate provider assignment.
l Directories are still synced with Safeguard.
l Migrated directory assets reflect the account dependencies.
l You can select whether a directory asset manages the forest or a subset of the forest. Multiple assets be assigned against the same forest.
l Migrated directory assets are available for access discovery jobs beyond partition boundaries.
l Each migrated directory asset is assigned to its own partition and includes the Account Discovery jobs, the check and change schedules, account password rules, password sync groups, and related functions.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

619

l A directory is a member of an asset partition so that ownership of different parts of the directory can be delegated.
l During import, entities imported from a directory must be unique across all partitions (for example, you cannot import Admin C account into multiple asset partitions).
l When you add an asset, the Account Discovery job for the partition is displayed and can be changed.
Discovery jobs
l Account discovery includes the option for discovered accounts: enable password requests, enable session requests, and make the discovered accounts available for use across all partitions.
l Account discovery can be configured as Unix based, Windows based, or Directory based, each with its own schedule.
Account discovery enhancements (788930)
Asset Administrators and delegated partition owners can create Account Discovery jobs to perform the functions in the following list:
l Set the default password of a discovered account to configure the environment initially and incrementally.
l Add a discovered account to a sync group to configure the environment initially and incrementally.
l Immediately check and change the password of discovered accounts that are set to be automatically managed. This places the account under immediate management rather than waiting for the schedule to execute. NOTE: In Settings | Profile, the partition profile's Change Password Schedule and Check Password Schedule must both be set to a value other than Never.
Activity Center enhancements (799288, 799308, 799307)
From the Activity Center, you have the option to choose All entities (such as users, assets, and accounts) without picking all of them. You can export the report without first previewing the report.
Allow Oracle SYS account as a service account (799993, 800128)
An Asset Administrator responsible for Oracle database servers can use the SYS account with either SYSDBA or SYSOPER system privileges as a service account. The SYS account is automatically created when the administrator installs Oracle and has the necessary privileges. See the Oracle document, About Administrative Accounts and Privileges, for more information. The SYS user is automatically granted the SYSDBA

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

620

privilege on installation and can be SYSOPER. For more details, see the Oracle document, SYSDBA and SYSOPER System Privileges. This is set via setting the Service Name when you add or edit an asset. Navigate to Administrative Tools | Assets | Connection tab.
Asset discovery enhancements (782848)
Asset Administrators are now given: l Expanded connection options when setting up the connection template to discovered assets to automatically manage discovered assets and service accounts. l The ability to set a platform type in the asset discovery rules. l The ability to assign a different profile to service accounts in the asset discovery rules so that the service account is assigned a profile other than default asset profile inherited by other accounts discovered on the asset.
In addition, SSH keys are now auto-accepted for supported platforms.
Custom platform: TN3270 (798892)
An Asset Administrator responsible for an AS400 and mainframe infrastructure (such as ACF2 or RACF) can manage servers customized log in screens and connection strings. A custom platform author can create a customer platform script to check and change passwords against servers where the login screens and connection strings have been customized.
Microsoft SQL Server TCP/IP support (798894, 799577)
An Asset Administrator responsible for Microsoft SQL Server can have Safeguard for Privileged Passwords connect to the databases using TCP/IP rather than named pipes.
Multiple directory account session support with access request policy (792426)
A Policy Administrator can add multiple directory accounts to a single access request policy. For example, you can grant access to a Windows asset via RDP using one of multiple directory accounts. Accounts are added when you create or edit an access request policy via the Administrative Tools | Entitlements | Access Request Policies | Directory Account option.
Radius enhancements (798896)
The User Administrator is offered two new configuration controls on Settings | External Integration | Identity and Authentication when Radius is selected as the provider.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

621

l The User Administrator can choose to mask the Radius secondary authentication response entered by users by selecting the Always Mask User Input check box. If selected, the text box that the user enters their one-time password, or other challenge required by the Radius server, will always be a password style text box in which the user's input is masked and appears as a series of dots, not as clear text. This may be desired when the challenge is not just a one-time password, but also contains the user's PIN. This will prevent any passer-by from seeing the private information. Note, however, that when this setting is enabled, it will also override the Prompt attribute of the Radius server's Access-Challenge response, such that the user's input will always be masked.
l The User Administrator can choose to have the Radius secondary authentication presubmit an Access-Request message to the Radius server in order to initiate a challenge/response cycle before the user sees or enters any information. The PreAuthenticate for Challenge/Response check box is used to indicate whether an Access-Request call containing only the User-Name should be sent to the Radius server prior to the user's authentication attempt. This is done to inform the Radius server of the user's identity so the server can possibly begin the authentication process by starting a challenge/response cycle. This may be required to seed the user's state data. In addition, the Radius server's response may include a login message that is to be displayed, which is specific to that user. Note, if the Radius server is not configured to respond with an Access-Challenge, then this will cause the log in to fail and the user will be unable to proceed.
In addition, the timeout for log in is now configurable to more than 60 seconds.
What's new in version 2.8.0.10133
Safeguard for Privileged Passwords introduces the following new features and enhancements in version 2.8.0.10133.
Virtual appliance and web management console (770749, 781091, 798013, 798014, 798527)
The Appliance Administrator responsible for racking and initial configuration of the appliance can create the virtual appliance, launch the Safeguard web management console, and select one of the following wizards.
l Initial Setup: Used to set up the virtual appliance for the first time including naming, OS licensing, and networking.
l Setup: After the first setup, Safeguard for Privileged Passwords updates and networking changes can be made via the web management console, Setup.
l Support Kiosk: The Support Kiosk is used to diagnose and resolve issues with Safeguard for Privileged Passwords. Any user able to access the kiosk can perform low-risk support operations including appliance restart or shutdown and support

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

622

bundle creation. In order to reset the admin password, the user must obtain a challenge response token from One Identity support.
Security and backups
To maximize security in the absence of a hardened appliance, restrict the access to the Safeguard virtual disks, the web management console, and the MGMT interface to as few users as possible. Recommendations:
l X0 hosts the public API and is network adapter 1 in the virtual machine settings. Connect this to your internal network.
l MGMT hosts the web management console and is network adapter 2 in the virtual machine settings. This interface always has the IP address of 192.168.1.105. Connect this to a private, restricted network accessible to administrators only or disconnect it from the network to restrict unauthenticated actions such as rebooting or shutting down the appliance. The web management console is also available via the VMware console.
Once setup is completed, you can verify which of your NICs is MGMT and X0 by referring to the MAC address information found in Support Kiosk | Appliance Information | Networking for X0 and MGMT.
To protect the security posture of the Safeguard hardware appliance, Safeguard hardware appliances cannot be clustered with Safeguard virtual appliances. Additionally, to ensure the security of the hardware appliance, backups taken from a hardware appliance cannot be restored on virtual appliances and backups taken from a virtual appliance cannot be restored on a hardware appliance.
Application to Application (A2A) enhancement: API visible to certificate user (794148)
When registering a third-party application configured for credential retrieval, the Policy Administrator can make the registration, including the API keys, visible to the certificate user that is configured for the A2A registration. The third-party application can discover the API key and other information needed. The Visible to certificate user check box can be selected when adding an application registration via Administrative Tools | Settings | External Integration | Application to Application.
Custom platform: telnet and HTTP support (799699, 787583)
Custom HTTP, SSH, telnet, and TN3270 transports are available. For more information, see Safeguard for Privileged Passwords Administration Guide,Custom platforms and Creating a custom platform script.
CAUTION: Facebook and Twitter functionality has been deprecated. Refer to the custom platform open source script provided on GitHub. Facebook and Twitter platforms will be remove in a future release.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

623

Sample custom platform scripts and command details are available at the following links available from the Safeguard Custom Platform Home wiki on GitHub:
l Command-Reference: https://github.com/OneIdentity/SafeguardCustomPlatform/wiki/CommandReference
l Writing a custom platform script: https://github.com/OneIdentity/SafeguardCustomPlatform/wiki/WritingACustomPlat formScript
l Example scripts platform scripts are available at this location: https://github.com/OneIdentity/SafeguardCustomPlatform/tree/master/SampleScri pts
CAUTION: Example scripts are provided for information only. Updates, error checking, and testing are required before using them in production. Safeguard for Privileged Passwords checks to ensure the values match the type of the property which include: a string, boolean, integer, or password (which is called secret in the API scripts). Safeguard for Privileged Passwords cannot check the validity or system impact of values entered for custom platforms.
Advanced password complexity rules (780274)
Separate password complexity rules can be set for local users and managed accounts. Password rules can be finely managed.
l Set the allowable password length in a range from 3 to 225 characters. l Set first characters type and last character type. l Allow uppercase letters, lowercase letters, numbers, and/or printable ASCII symbols
along with the minimum amounts of each. l Identify excluded uppercase letters, lowercase letters, numbers, and symbols. l Identify if consecutive letters, numbers, and/or symbols can be repeated
sequentially and, if allowed, set the maximum repetitions allowed.
Passwords are validated against the password rules before they are saved.
Job scheduler enhancements (753203)
An Appliance Administrator can finely tune backup and password check and change job schedules including the ability to ensure changes occur after hours. The administrator can create time windows including start and end times, days of the week, and days in a month by a static day of month or the first through fourth day of the month.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

624

Safeguard for Privileged Sessions (SPS) initiated session (797262)
CAUTION: This functionality supports Safeguard for Privileged Sessions (SPS) version 6.2.0 or later. For information, see the One Identity Safeguard for Privileged Sessions Administration Guide at this link: One Identity Safeguard for Privileged Sessions - Technical Documentation.
The Safeguard for Privileged Passwords (SPP) Asset Administrator can enable an SPS initiated session to get the session credentials from SPP.
l The administrator will navigate to Administrative Tools | Settings | External Integration | Sessions Management and set the Session Module Password Access Enabled toggle on or off. When the toggle is on ( ), SPS has the ability to create an access request and check out a password from SPP on behalf of another user. When the toggle is switched off ( ), this ability is revoked.
CAUTION: On the Session Settings tab, SPS Connection Policy, do not select Sps initiated unless you have SPS version 6.2.0 or later installed. This is used when an access policy is used by SPS to create an SPS initiated access request.
Support for additional ServiceNow ticket types (793493)
System integrators designing privileged account access based on ServiceNow tickets can include ticket types for validation during access request workflow. The following tickets types are supported in addition to INC tickets:
l PRB (problem) tickets l CHG (change) tickets l RITM (request) tickets If the ticket number is found in any of the ServiceNow tables searched (INC, CHG, RITM, or PRB) and the ServiceNow API property for the ticket is "Active", the user can make the access request. Administrators can search by a ticket number in the Activity Center to find the access request.
What's new in version 2.9.0.10658
Safeguard for Privileged Passwords introduces the following new features and enhancements in this version.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

625

Appliance diagnostics package (797266)
Appliance Administrators can execute a trusted, secure appliance diagnostics package to help solve issues with configuration, synchronization, and clustering, as well as other other internal challenges. The appliance diagnostics package is available from the web Support Kiosk, not the Serial Kiosk (Recovery Kiosk). The appliance diagnostics package can be used even when the appliance is in quarantine. To protect against external threats, Safeguard rejects illegitimate appliance diagnostics packages. The manifest file in the appliance diagnostics package lists criteria that may include the minimum Safeguard version, appliance ID, and expiration time-stamp UTC. New product code and database changes are not included in an appliance diagnostics package.
SPP-SPS join enhancements (803185)
Safeguard for Privileged Passwords (SPP) is enhanced to more easily use Safeguard for Privileged Sessions (SPS) for session recording and playback.
Appliance Administrators can identify the SPP SPS join connections by:
l Host Name
l Network Address (identified by the IP address of the session connection)
l Other nodes in the SPS cluster
l Other nodes that belong to each SPS cluster that has been joined to SPP
Navigate to Administrative Tools | Settings | Cluster | Session Appliances for details.
Appliance Administrators can also identify managed networks by the host name and IP address of the cluster master. Navigate to Administrative Tools | Settings | Cluster | Managed Networks and view Sessions Managed By.
Policy Administrators can identify the host name and IP address of the SPS cluster master
from which policies originate. A Warning icon displays if a policy is not functional. Navigate to Administrative Tools | Entitlements | Access Request Policies | Session Settings tab and view the SPS Connection Policy.
Users and administrators receive timely notification if an access request will not result in a launchable session request. The notifications identify details such as:
l User are informed if SPP could not contact SPS and are given the option to try again so the request can be redirected to another managed host in the SPS cluster.
l Policy Administrators can identify the SPS connection policies by the host name and IP address of the SPS cluster master from which the policies originate.
l User are informed if the SPS configuration is locked and are given the option to try again later. This condition is typically because the SPS administrator is making configuration changes to the SPS appliance at the same time that a new access request is being created or a session is being launched.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

626

Telnet and TN3270/TN5250 session access request support (782501)
Safeguard for Privileged Passwords (SPP) supports session access requests with mainframes using software terminal emulation including telnet and TN3270/TN5250 over telnet. Safeguard for Privileged Sessions (SPS) version 6.1 or higher is used for session recording.
Actions
l Security officers can record activities of administrators who maintain critical systems running on IBM iSeries and mainframe computers.
l Asset Administrators can:
l Customize the TN3270/TN5250 login screen field detection to work for the Safeguard custom login setup.
l Mark an asset as supporting telnet sessions and specify if the asset is available.
l Policy Administrators can create an entitlement with an access policy that includes session access using telnet and TN3270/TN5250 sessions over telnet.
l Requesters' log in experience follows the regular client telnet or TN3270/TN5250 interface even when the session is being recorded. Sessions are not launched from Safeguard for Privileged Passwords and all required log in information is available through Safeguard for Privileged Passwords.
High level steps
IMPORTANT: Engagement with One Identity Professional Services is required for assistance with configurations and installation including available plug-ins, policy creation, pattern files, shortcuts, and best practices.
In Safeguard for Privileged Sessions (SPS), the following steps are required. For operation details, see the One Identity Safeguard for Privileged Sessions Administration Guide at this link: One Identity Safeguard for Privileged Sessions Administration Guide.
l Until supplied by SPS, import the plug-in to supply authentication and authorization (AA) information to authenticate with and pull the credentials from SPP.
l Create and assign Pattern Sets which use pattern files specific to the log in experience for each system connection, which vary from mainframe to mainframe.
l Specify each Authentication Policy.
l Configure each Connection Policy. Multiple connection policies are typically required because of the uniqueness of each system and pattern file.
l Perform related activities based on your installation.
In Safeguard for Privileged Sessions (SPS):
l The Asset Administrator adds the mainframe asset including the Telnet Session Port that is identified on the Administrative Tools | Asset | Management tab. For more information, see Adding an asset on page 185.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

627

l The Policy Administrator sets the Access Type (Telnet) on the Administrative Tools | Entitlements | Access Request Policies tab.
l When configuration is complete, the requester proceeds to use the terminal service application in use. The requester will copy the required information based on the telnet or TN3270/TN5250 over telnet connection requirements.
For more information, see How do I set up telnet and TN3270/TN5250 session access requests on page 576.
Additional log in step and two-factor authentication with FIDO2 (79072)
IMPORTANT: All users will experience an additional step to log in to Safeguard for Privileged Passwords. After clicking Connect, the user sees a message like: You'll now be redirected to your web browser to complete the login process. You can select: Don't show this message again. Then, click OK. The browser window can be closed. On the user login screen, the user entered the User Name and Password as usual. A new secondary authentication type, FIDO2, is now supported and can be assigned to any Safeguard for Privileged Passwords user, providing they have at least one compatible FIDO2 authenticator security key. After being configured by a User Administrator, a Safeguard for Privileged Passwords user will be prompted to register their FIDO2 authenticator security key at next login. For more information, see Requiring secondary authentication log in on page 457. Users are then responsible for managing their own FIDO2 authenticator keys, including registering additional keys for backup purposes, viewing, renaming, or deleting unused keys. For more information, see User information and log out (desktop client) on page 82. Authenticator support Any FIDO/FIDO2 authenticator that supports the WebAuthn standard can be used for twofactor authentication, this includes some older U2F authenticator security keys. Safeguard for Privileged Passwords does not use or require any authenticator attestation data. User verification, such as PIN or biometric is also not used.
Virtual appliance using Hyper-V (801564)
The Appliance Administrator can use Hyper-V as the virtual target environment deployed by importing the Safeguard for Privileged Passwords Hyper-V zip file with the virtual machine settings.
VMware ESXi: Backup and restore required
vSphere Hypervisor (ESXi) is enhanced in Safeguard for Privileged Passwords (SPP) 2.9. For SPP 2.9 only, you are required to take a backup of your 2.8.x system and restore it on your SPP 2.9 system. Future versions will not require this action.
CAUTION: Failure to backup of your 2.8.x system and restore it on your SPP 2.9 system will result in loss of configuration and functionality.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

628

What's new in version 2.10.0.10980
Safeguard for Privileged Passwords introduces the following new features and enhancements in this version.
A2A service supports events for multiple accounts (804349)
Using the A2A service, an administrator can use a single signalR connection to monitor password change events for multiple accounts across multiple A2A registrations. A signalR connection failure message is returned if any of the following occur:
l The accounts sent in the authorization header is larger than 8K. l One or more of the API keys sent failed validation. l One or more of the API keys sent failed to match the user certificate used for
authentication. This may occur across multiple A2A registrations.
Active Directory account discovery dynamic tags and dynamic groups (798532)
An Asset Administrator can: l Dynamically tag an account from Active Directory. l Add an account to a dynamic account group based on membership in an Active Directory group. l Add an account to a dynamic account group based on if the account is in a particular organizational unit (OU) in Active Directory.
The options to select Include objects from sub containers is available when adding an account discovery rule from Administrative Tools | Discovery | Account Discovery | Account Discovery Rule dialog. For more information, see Adding an Account Discovery rule on page 246.
Configure Web Client Inactivity Timeout (803424, 782603)
The Appliance Administrator can configure the Web Client Inactivity Timeout which is the time that has elapsed since the user made a request to the server. The minimum value is 5 minutes and the maximum value is 2880 minutes (2 days). When the timeout period is met, a message displays and the user can continue or log out. If there is no response, the user is automatically logged out. The default is 15 minutes. To configure the value, navigate to Administrative Tools | Settings | Safeguard Access | Login Control and set Web Client Inactivity Timeout.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

629

"Other Managed" platform type (805372)
To ensure the automation environment is compliant, a System Integrator can use a generated password that is securely stored and periodically rotated. To ensure compliance in an ultra secure environment, an Asset Administrator can manage an asset that Safeguard for Privileged Passwords cannot connect to (for example, when there is a one-way firewall). In the Add Asset dialog under the Management tab, select the Product setting Other Managed. When selected, Safeguard for Privileged Passwords stores the password and can automatically check and change it per the profile configuration. There is no active connection or service account. The passwords are rotated internally and an event notifications is sent when the rotation is complete. Another component or piece of automation can change the password or make use of the password in the configuration files. For example, a listener can pick up the change event via the Safeguard for Privileged Passwords Application to Application (A2A) service and perform actions, as required.
What's new in version 2.11.0.11444
Safeguard for Privileged Passwords introduces the following new features and enhancements in this version.
Access requests proceed regardless of the review state of an earlier request (TFS 805354/DevOps 191598)
Policy Administrators can choose to allow subsequent access requests to proceed even if the required review on a previous access request is incomplete. This prevents blocking a new session request when the prior request requires a review and the review is not done. Navigate to Administrative Tools | Entitlements | Access Request Policies | (create or edit a policy) | Reviewer tab. For more information, see Reviewer tab on page 274.
Audit history for passwords and sessions (TFS 805354/DevOps 191549)
In preparation for a future release of Safeguard for Privileged Sessions, a toggle has been added to allow the Safeguard for Privileged Passwords Appliance Administrator to push audit data to SPS. Navigate to Administrative Tools | Settings | Appliance | Enable or Disable Services. For more information, see Enable or Disable Services on page 310.
Azure to run in cloud (191524)
Safeguard for Privileged Passwords (SPP) can be run in the cloud using Azure. A version of Safeguard for Privileged Passwords is available in the Azure Marketplace.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

630

Generic ticket system without ticket system validation (TFS 794519/Dev Ops 191534)
Policy Administrators can require requesters to reference a ticket number in their password or session access request. Tickets do not have to be validated against an external ticketing system but, optionally, may be validated against the regular expression of a generic ticketing system. The ticket number is used in the decision to approve the request and serves as a reference visible in the Activity Center. Navigate to Administrative Tools | Settings | External Integration | Ticket Systems. In Type, select Other. For more information, see Ticketing systems on page 413.
Support dynamic grouping for assets based on Active Directory groups (TFS 806225/ DevOps 191499)
Implementers can create tags / asset groups based on any Active Directory group of which the asset is a member unrelated to discovery. For account or asset groups, use the rule editor controls on:
l Account Rules tab of the Dynamic Account Group dialog l Asset Rules tab of the Dynamic Asset Group dialog To add a dynamic tag for an asset or asset account, use the New button on the Tags pane in the Settings | Asset Management settings page.
Web client (TFS 795288/DevOps 200361)
The Safeguard for Privileged Passwords web client provides a web-based user interface that can be used instead of the desktop client for the request workflow and some administration functions. Requesters use the web client to:
l Search for and request password access, session access, or both. l Concurrently request access to multiple passwords and sessions. l Create and use a favorite to quickly access the common access requests. Reviewers use the web client to review requests. Approvers use the web client to: l See the access requests awaiting approval. l See which access requests require immediate attention. l View the details of each access request. l Approve or deny an access request. l Select multiple access requests to approve or deny at the same time. l Return to an approved, active access request and revoke the request.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

631

Administrators can also use the web client to:
l Configure time, network, and license. l Shutdown or reboot the appliance
For more information, see Using the web client on page 69.
Windows SSH platform (TFS 792427/DevOps 191511)
Safeguard for Privileged Passwords can utilize SSH to connect to the target Windows asset and run commands to manage standard platform tasks. Using SSH only requires opening a single well known SSH port. OpenSSH is the recommended connectivity tool; however, other SSH servers may also work. Windows SSH assets support both SSH password and SSH session access requests. From Administrative Tools | Assets | Management tab, you can select the Product as Windows SSH and the Version. Best practices When configuring the SSH service on the asset, it is recommended to use automatic (versus manual) startup. You can also set the default shell to PowerShell. You can control this by going to HKLM\SOFTWARE\OpenSSH and creating a new string value called "DefaultShell and setting it to C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Appendix: Historical changes by release

632

Glossary
A
access request Rule-based password request and/or session request for an account. Access can be automatically approved or require one or more approvals. Email or toast notifications can be set.
access request broker With the Application to Application service, a third-party application can create an access request on behalf of another user.
access request policy Settings that restrict system access. Used to manage access (for example, to a password release request policy or session request policy). Defines the scope (assets, asset groups, accounts, or account groups), the access type (password, SSH, RDP, or telnet), and the rules for password checkout (duration and number of approvals). Entitlements are sets of access request policies.
access request policy time restrictions Enforce when a user can access the account passwords. If there are entitlement and policy time restrictions, the overlapping period is valid.
account May be a directory account or service account associated with an asset. An account can only be associated with one asset. Accounts are added to policies for management (for example, to a password release request policy or session request policy). An account may be associated with an entitlement, account group, or both. Also see user.
account dependency SPP maintains the passwords for dependent accounts on all the systems that use them (for example, one or more Windows servers use a directory account, such as an Active Directory account, to run services or tasks).
Account Discovery job Job with rule-based settings to discover all accounts assigned to the assets in a selected partition, are made available globally, or only the accounts that match the rules criteria. You can automatically manage the found accounts and automatically discover and configure dependent systems. Or, you can manually add the discovered accounts.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

633

account group A set of accounts that can be added to the scope of an access request policy, which in turn can be associated with an entitlement. See dynamic account group.
AD (Active Directory) Microsoft AD consists of services running on a Windows Server to manage permissions and access to networked resources. AD stores data as objects.
AD FS (Active Directory Federated Services) A software component developed by Microsoft that runs on a Windows Server operating systems to provide users with single sign-on access to systems and applications located across organizational boundaries.
appliance The SPP appliance is hardware with pre-installed software to for easy installation. The appliance is hardened to ensure security at the hardware, operating system, and software levels.
Appliance Administrator Responsible for configuring and maintaining the SPP appliance.
Application to Application (A2) An SPP service where third-party applications can retrieve a credential from SPP to 1) perform automated functions or 2) allow a user to log in to SPP to retrieve a password or start a session.
Approval Anywhere SPP feature where an approver can approve (or deny) access requests through their mobile device.
archive servers External physical servers where you store backup files.
asset A computer, server, network device, directory, or application managed by Safeguard for Privileged Passwords. You can log in to an asset with more than one account, but an account (user, group, or service) can only be associated with one asset. All assets must be governed by a partition profile. Assets may be subdivided into subsets for management. For example, a directory asset can manage a subset of the forest.
Asset Administrator Manages all partitions, assets, and accounts.
Asset Discovery job Job with rule-based settings to discover and add assets that are not in SPP. A job can be run against a directory or network (IP range).
asset group A set of assets that can be added to the scope of an access request policy, which in turn is associated with an entitlement. See dynamic asset group.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

634

asset tag rules Can be set to dynamically add tags to assets and asset accounts so the assets and asset accounts can be identified and added to dynamic groups.
audit log management Tasks defined and scheduled to purge audit logs from the SPP Appliance and archive older audit logs to a designated archive server.
audit log signing certificate Used to sign the audit log files saved to an archive server. Proves that the audit logs were created by and came from a particular SPP cluster.
Auditor Administrator Role with read-only access to all features to review all access request activity.
authentication Authentication is the process of validating an identity provided to a system. For example, a system checks the user's login name and password. In SPP, a user's identity provider and authentication provider can be the same or different.
authentication provider In SPP, any mechanism that a user enters credentials into to prove they are acting on behalf of a specific user or system, but does not necessarily contain any personal information of the user. An authentication provider can be the same as the identity provider (such as Active Directory). See identity provider.
Authorizer Administrator Creates and maintains users, directory groups, directory users, password rules, and passwords. Unlocks and enables or disables local and directory user accounts. Typically unlocks administrator accounts.
auto-login Automatic login that never exposes the account credentials to the user.
B
backup and retention settings Used to manage SPP backups and archive servers. SPP encrypts and signs the data before the data is made available for downloading to an off-appliance storage.
Bootstrap Administrator A built-in account to use to start up the appliance for the first time. The account is used to create other administrators. The Bootstrap Administrator default password should be changed. All actions are audited.
C
CA (certificate authority) The authority that issues SSL certificates that are publicly trusted by web browsers. Anyone can issue SSL certificates but the certificates are not automatically trusted

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

635

by web browsers.
certificate (SSL certificate) A small file installed on a secure server that digitally binds a cryptographic key to a computer, device, individual, or organization. A certificate is used to establish trust for communication. Certificates contain information identifying the owner of the certificate, the public key, the expiration date of the certificate, the name of the CA that signed the certificate, and some other data.
certificate settings Used to manage the certificates that are used to secure SPP. Some SPP certificates are default and need to be replaced and others are user-supplied certificates.
certificate store A special key database file that Digital Certificate Manager (DCM) uses to store digital certificates. In SPP, the certificate store is owned by the cluster. SSL certificates in the store can be added to any appliance in the clustered environment.
change password For user and service accounts, the rules and process to reset and synchronize the user or service account password with the SPP database. For directory accounts, SPP synchronizes the directory account password provided by an external identity provider, such as Active Directory. Also see check password and set password.
check password For user and service accounts, the rules and process to verify the account password is in sync with the SPP database. If the password verification fails, you can change the password. Check passwords is associated with a partition. For directory accounts, the rules and process to verify the directory account passwords (such as Active Directory) and synchronize with SPP. Also see change password and set password.
CIDR (Classless Inter-Domain Routing) Allows flexible allocation of Internet Protocol (IP) addresses. A CIDR network address under IPv4 looks like: 192.20.250.00/18. The network address is 192.20.250.00 and the 18 indicates that the first 18 bits are the network part of the address that leaves the last 14 bits for specific host addresses.
clone of VM A copy of an existing virtual machine (the parent) that is a separate virtual machine which may share virtual disks with the parent virtual machine.
cloud platform account SPP can manage cloud platform accounts such as Amazon Web Services (AWS).
cluster A set of computers that work together where each replica (node) can perform the same task to enable high availability and load distribution.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

636

consensus (quorum) A cluster has consensus (quorum) when the majority of the members (primary or replica appliances) are online and able to communicate.
credential retrieval With the SPP (Application to Application service), a third-party application can retrieve credentials from SPP outside the normal workflow.
CSR (certificate signing request) A CSR is submitted to a certificate authority (CA) to obtain a digitally signed certificate.
CSS (cascading style sheet) A .css file that describes how HTML elements display on screen, paper, or other media. See HTML5.
csv A file format used with programs that store data in tables, such as Microsoft Excel. CSV stands for Comma-Separated Values.
custom platform Platform added to SPP via uploading a custom platform script. The script may be selected when adding or updating an asset. Custom platforms are global across all partitions.
D
DCM (Digital Certificate Manager) Used to manage digital certificates on a network and use Secure Sockets Layer (SSL) to enable secure communications for applications.
default gateway The access point or IP router that sends information to a computer in another network when no other route specification matches the destination IP address of a packet.
default SSL certificate SPP provides a default self-signed SSL certificate for HTTPS assigned to the appliance. This certificate is not a trusted certificate and should be replaced.
delegated owner One or more users that the Asset Administrator selected to manage the assets and accounts in a partition.
deny An active access request can be either denied or approved. An approved active access request can be revoked.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

637

directory A structure to catalog files and, possibly, other directories. In SPP, the structure and objects from a directory service, such as Active Directory or OpenLDAP, can be imported and synchronized.
directory account An account from an external identity store, such as Microsoft Active Directory, used to authenticate to a managed system (asset).
DNS (Domain Name System) System to translate human readable information (such as a domain name, web site, or other internet-based resource) to the addressing protocols (IP address).
DNS server (domain name server) Contains a database of public IP addresses and their associated hostnames and translates the common names to IP addresses.
domain name The name of a network (for example, oneidentity.com).
dynamic account group Account group made up of systematically identified accounts that meet asset account rules, directory account rules, or both. The rules engine runs when you add or change an asset account or an asset account rule.
dynamic asset group Asset group made up of systematically identified assets that meet identified rules.
dynamic disk Fault-tolerant volumes that may span multiple disks; flexible volume management with database tracking and replica storage of the dynamic disk database.
E
entitlement A set of access request policies that restrict system access (including rules and schedules), typically by job role. Entitlements are used to authorize users or user groups for accounts in the scope of the access request policies. Entitlements can be associated with one or more profiles.
entitlement time restrictions Controls identifying when an entitlement is in effect (user's time zone). If there are both entitlement and policy time restrictions, the overlapping period is valid.
explicit association (explicit assignment) You can explicitly add an asset to a profile. This overrides the implicit inheritance from the partition so the asset's profile is no longer determined by the partition. You can explicitly assign an account to a profile the account's profile is no longer determined the asset.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

638

F
factory reset Operation to recover from major problems or clear appliance data and configuration settings. All data and audit history are removed.
federation metadata The data format for communicating configuration information between an identity (claims) provider and a relying party. The data format is defined in Security Assertion Markup Language (SAML) 2.0, and it is extended in WS-Federation.
federation provider Service provider that mediates between two or more trust domains so users can access applications and services using the same digital identity.
FIDO2 (Fast ID Online) A set of security specifications for strong authentication. FIDO2 supports multifactored authentication, public key cryptography, biometric authentication, and other personally identifying information (PII).
forest Network logical division that may contain one or more trees and in turn domains made up of objects (computers, users, devices) sharing the same database. The first domain in the forest is called the forest root domain.
FQDN (fully qualified domain name) A domain name that specifies its exact location in the tree hierarchy of the Domain Name System (DNS). For example, given a device with a local hostname myhost and a parent domain name example.com, the fully qualified domain name is myhost.example.com.
G
gateway A device that connects two or more parts of the network. For example, the device may connect your local intranet and the external network (the internet). Gateways act as entrances to other networks.
GMT (Greenwich Meridian Time) GMT is never out of sync with UTC (Coordinated Universal Time) by more than nine tenths of a second so UTC and GMT are virtually equivalent in common usage.
H
HA (high availability) A system that is resilient and likely to operate continuously without failure for a long period of time.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

639

Help Desk Administrator Sets passwords for non-administrative user accounts and unlocks user accounts. The Authorizer Administrator typically unlocks administrator accounts.
host A computer connected to the network. A host may offer resources, services, and applications to users or nodes on the network. May have virtualization software (such as ESX or ESXi) to run virtual machines (VMs).
hostname A label assigned a device connected to a network and that is used to identify the device.
HTML5 Hypertext Markup Language version 5 is the code that describes web pages and includes HTML for structure, Cascading Style Sheets (CSS) for presentation, and JavaScript (processing).
I
identification Identification happens when a user claims to be a specific system user. For example, a user's login name and password are used to establish identity. In SPP, a user's identity provider and authentication provider can be the same or different.
identity provider In SPP, the source from which the user's personal information comes from and is synchronized with. See authentication provider.
implicit association (implicit assignment) When an asset is added, it is added to the default partition and default profile (implicit association/assignment). Accounts inherit the parent asset's profile. This can be overridden by explicitly assigning an asset to a profile; the asset's associated accounts are also assigned to the new profile.
import Accounts, assets, or users in a Comma Separated Values (.csv) file can be added to SPP's database. Objects must pass validity tests. Default values may be added during the import.
IP address (Internet Protocol address) Unique internet number assigned to each device communicating across the internet. The IP address provides location and identification. See DNS.
IPv6 (Internet Protocol version 6) The most recent version of the Internet Protocol (IP). See IP address.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

640

J
JavaScript A computer programming language commonly used for processing on the web. See HTML5.
json A language-independent data format. Code for parsing and generating JSON data is readily available in many programming languages. JSON stands for "JavaScript Object Notation".
K
key pair A private key and its related public key. The private key is known only to the owner, while the public key can be freely distributed. Information encrypted with the private key can only be decrypted using the public key.
KMS (Key Management Service) Used to activate systems in the organization's network so that individual computers do not have to connect to Microsoft for product activation.
KMS Server (Microsoft Key Management Server) A Microsoft Volume Activation 2.0 solution service used to activate volume licensed Microsoft products.
L
LDAP (Lightweight Directory Access Protocol) An application protocol for querying and modifying data using directory services running over TCP/IP.
lights out management (via BMC/baseboard management controller) Feature to manage the SPP power state and serial using BMC. This feature is used to power on an appliance remotely or to interact with the Recovery Kiosk.
M
MAC (Media Access Control) address An identifier assigned to a network adapter or any device with built-in networking capability (such as a printer). A MAC address is burned into the device at the factory (versus an IP address that is assigned later). Also called a hardware address or physical address.
Mac keychain The Apple password management system in Macintosh OS X.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

641

managed networks Named lists of network segments serviced by specific SPP Appliances in a clustered environment. Used to distribute the task load by scheduling tasks (for example, password change or asset discovery).
MSI MSI is an installer package file format used to launch Windows-based software installations.
N
netmask For IPV4, a 32-bit mask used to divide an IP address into subnets and specify the network's available hosts.
network interface and proxy server Network interface X0 is the primary interface. Proxy server X0 is for relaying web traffic if the devices don't connect to the web.
NS lookup (named service lookup) Network utility program to obtain information about internet servers. It finds name server information for domains by querying the domain name server (DNS).
NTP (Network Time Protocol) Protocol to synchronize computer clock times in a network.
O
Offline Workflow Mode Appliance state when the appliance no longer has consensus (quorum) and has been enabled to process access requests using cached policy data. The appliance operates in isolation from the remainder of the cluster.
Operations Administrator Monitors the status of the appliance and can reboot the appliance. This role can be a script or external monitoring system.
OU (Organizational Unit) A subdivision within an Active Directory into which you can place users, groups, computers, and or any other organizational units (for example, functional or business hierarchy.
OVA (Open Virtualization Appliance) An OVA file contains a compressed version of a virtual machine (VM) to be installed. When you open an OVA file, the VM is extracted and imported into the virtualization software installed on your computer.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

642

P
partition A group of assets (and the assets' associated accounts) governed by a partition profile and used for delegate asset management. An asset can only be in one partition at a time. All accounts associated with that asset are automatically added to the partition but can be reassigned.
partition profile The schedules and rules that are required to govern a partition's assets and the assets' accounts. You can set a default partition profile to assign to assets and assets' accounts. You can manually assign a partition profile to an asset or account.
password rules The requirements for user password authentication, such as uppercase and lowercase letters, numerics, and special characters. Password rules set in SPP apply to local users not users from external providers such as Active Directory.
password sync groups Used to control password validation and reset across all associated accounts.
ping A command that sends a message from a host to another host over a network to test connectivity and packet loss.
port A number from 1 to 65,535 for the destination application of the transmitted data. For example, SSH commonly uses port 22 and web servers (HTTP) commonly use port 443.
primary appliance One appliance in a cluster where vital data stored on the primary is also stored on replica appliances.
primary authentication The first authenticating factor for a remote user when two-factor authentication (2FA) is enabled.
priority precedence In authorizing password check-out, SPP first considers the entitlement priority then considers the priorities of access request policies in the entitlement.
profile See partition profile and directory profile.
PuTTY A free and versatile terminal tool for remote access to another computer.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

643

R
RBAC (role-based access control) The role-based access control model restricts system access to authorized users based on roles. SPP supports this model.
RDP (Remote Desktop Protocol) A Microsoft proprietary protocol that provides graphical user interface to connect to another computer over a network connection.
regular expression A string that describes or matches a set of strings.
relying party A service or application, like Safeguard, that receives and accepts a SAML assertion issued by a SAML authority.
REST Architecture that allows other applications and systems to integrate with diverse systems and applications. SPP's API is based on a REST architecture.
revoke An approved active access request can be revoked.(An active access request can be either denied or approved.)
root SSL certificate (trusted certificate) A certificate issued by a trusted certificate authority (CA) at the top of the trust chain and used to issue intermediate SSL certificates to ensure the security of the system.
S
SAML (Security Assertion Markup Language) An open standard for sharing security information about identity, authentication and authorization across systems. SAML is implemented with the XML standard for sharing data. SAML provides a framework for implementing single sign-on and other federated identity systems.
scope An access request policies assets, asset groups, accounts, or account groups assignments.
Secure Shell (SSH) A security protocol for logging in to a remote server.
security key A small physical device that is inserted into a USB drive. Typically, you will enter your password then insert the security key as a required second form of authentication. You can use one security key with more than one account. You can

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

644

have multiple security keys registered on an account. Activating the registration of a security key varies with the key (for example, press a button or tap). Security keys must be U2F or WebAuthn capable.
Security Policy Administrator Creates account groups, asset groups, and user groups. Creates entitlements and adds users or user groups to entitlements. Configures access request policies.
service account Used by an application or service to interact with the operating system or configuration.
service account domain name The name of the domain where the service account resides. SPP uses DNS-SRV to resolve domain names to actual domain controllers.
Service Discovery job Scans Windows assets and automatically discovers Windows services and tasks. If the directory accounts are managed by SPP, the service or task is automatically associated with the managed account. Administrators can identify unmanaged accounts to potentially manage.
sessions SPP issues privileged access to users for specific periods, called sessions.
set password Rules and process to manually set or randomly generate the user or service account passwords in the SPP database. The process does not change the account password on the asset. For directory accounts, SPP synchronizes the directory account password provided by an external identity provider, such as Active Directory. Also see check password and change password.
SID (Security IDentifier) An alphanumeric name used to identify user, group, and computer accounts in Windows. SIDs are created an account is first created in Windows and no two SIDs on a computer are ever the same.
SMTP server (Simple Mail Transfer Protocol server) Protocol server that handles email delivery process (for example, smtp.gmail.com).
snapshot of VM The state of a computer system at a point in time. Snapshots are not enough to restore a virtual machine and do not replace backukps.
SNMP (Simple Network Management Protocol) An industry standard protocol for network management. SNMP alerts are sent to a central SNMP server.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

645

SPA One Identity Safeguard for Privileged Analytics solution to monitor behavior and identify threats.
split brain A split brain situation occurs when for some reason (for example, the loss of connection between the nodes) both nodes of a cluster become active as the primary. New data (for example, audit trails) may be created on both nodes without being replicated to the other node. Thus, it is likely in this situation that two diverging sets of data are created that cannot be easily merged.
SPP One Identity Safeguard for Privileged Passwords solution to secure privileged credentials.
SPS One Identity Safeguard for Privileged Sessions solution to control, monitor, and record privileged sessions.
SSH (Secure Shell) key An access credential in the SSH protocol. The function is similar to a user name and passwords, but SSH keys are primarily used for automated processes and for implementing single sign-on to an SSH server by system administrators and power users.
SSH authorized key The public key from an SSH identity key pair.
SSH banner Contains security warning information or general information.
SSH host key Used for authentication. Host keys are pairs. Public host keys are stored on or distributed to SSH clients. Private keys are stored on SSH servers.
SSH identity key An SSH key pair used for SSH 'publickey' authentication. The private key is required to prove identity and log in wherever the key is authorized.
SSH key An access credential in the SSH protocol. Functionally similar to a user name and password, but primarily used for automated processes and single sign-on by system administrators and power users.
SSH settings Parameters of the connection on the protocol level, including timeout value and greeting message of the connection, as well as the encryption algorithms used.
SSL Secure Sockets Layer (SSL) is a cryptographic protocol that provides secure communications on the internet.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

646

SSL certificate store Contains uploaded or enrolled SSL certificates owned by a cluster. Any SSL certificate in the store can be assigned to any appliance in the clustered environment.
SSO (single sign-on) User logs in with a single ID and password per session to gain access to multiple services within a single organization.
STS (Security Token Service) A third-party servce responsible for issuing, validating, renewing, and cancelling security tokens. The tokens are used to identify the holder of the token to services that adhere to the WS-Trust standard.
support bundle System and configuration information sent to One Identity Support to analyze and diagnose issues.
syslog Protocol to produce and send log and event information from Unix/Linux and Windows systems and devices over UDP port 514 to a centralized syslog server.
T
tags Can be assigned manually (static) or dynamically set through tagging rules (identified by a lightning bolt icon). Tags are helpful in searches. Dynamic tags are updated when the rules engine runs when you add or change an asset account or an asset account rule.
TCP/IP (Transmission Control Protocol/Internet Protocol) A set of networking protocols that allows two or more computers to communicate.
telnet A terminal emulation protocol that enables a user to connect to a remote host or device using a telnet client.
thumbprint A unique hash value that identifies the certificate.
ticketing feature SPP can be integrated with a company's external ticket system, such as ServiceNow or Remedy.
TLS (Transport Layer Security) TLS and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols that provide secure communications on the internet. The application can encrypt the communication between the clients and the server using TLS to prevent unauthorized access to sensitive log messages.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

647

toast notifications A small, auto-expiring alert that displays when the desktop client application is not the active foreground application.
traceroute A command that shows all routing steps (the path of a message) between two hosts.
traffic shaping (packet shaping) Manipulates and prioritizes network traffic to reduce the impact of heavy use cases from effecting other use cases.
two-factor authentication (2FA) A user is required to provide two different authentication factors to verify themself. Provides a higher level of security than one factor and protects the user's credentials and the resources accessed.
U
UNC (Universal Naming Convention) path Used to access network resources and contains two or more of the following components: \\<servername>. <share>.<filename>
user A person who can log in to SPP. A user can be local or can be a directory user from an external identity store such as Microsoft Active Directory. A user may be associated with user groups, partitions, entitlements, and linked accounts. A user may or may not have administrator permissions.
User Administrator Creates (or imports) users. Sets passwords, unlocks accounts, and enables or disables non-administrator user accounts. Adds directory groups to directories, including directory users. Grants Help Desk Administrator permissions. The Authorizer Administrator typically unlocks administrator accounts.
user group A set of local users or directory users that can be added to an entitlement to use the entitlement's access request policies restricting system access.
UTC (Coordinated Universal Time) UTC is never out of sync with GMT (Greenwich Meridian Time) by more than ninetenths of a second, so UTC and GMT are virtually equivalent in common usage.
V
virtual machine (VM) A software computer that runs an operating system and applications and acts as an isolated computing environment. One host computer may have multiple virtual machines.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

648

W
web console A web-based application that allows you to execute shell commands on a server directly from a browser (web-based SSH).
WMI (Windows Management Instrumentation) The infrastructure for accessing management data in an enterprise environment. You can write WMI scripts or applications to automate administrative tasks on remote computers. WMI also supplies management data to other parts of the operating system and products.
workflow engine Directs workflow and may include time restrictions, reviewers, approvers, emergency access, and policy expiration. May integrate with a ticketing system and have reason codes.

Safeguard for Privileged Passwords 2.11.1 Administration Guide Glossary

649

About us
About us
One Identity solutions eliminate the complexities and time-consuming processes often required to govern identities, manage privileged accounts and control access. Our solutions enhance business agility while addressing your IAM challenges with on-premises, cloud and hybrid environments.
Contacting us
For sales and other inquiries, such as licensing, support, and renewals, visit https://www.oneidentity.com/company/contact-us.aspx.
Technical support resources
Technical support is available to One Identity customers with a valid maintenance contract and customers who have trial versions. You can access the Support Portal at https://support.oneidentity.com/. The Support Portal provides self-help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. The Support Portal enables you to:
l Submit and manage a Service Request. l View Knowledge Base articles. l Sign up for product notifications. l Download software and technical documentation. l View how-to videos at www.YouTube.com/OneIdentity. l Engage in community discussions. l Chat with support engineers online. l View services to assist you with your product.

Safeguard for Privileged Passwords 2.11.1 Administration Guide About us

650

Index
I ndex

3
3270 session access request setup 576
5
5250 session access request setup 576
A
access API 561 Access Config tab 276 access historical information 565 Access Key, about 202 access request broker 379 Access Request Policies tab
account 141 account group 161 asset 180 asset group 217 entitlement 261 access request policy access settings 276 add account 169 approver settings 272 assign accounts and assets 270 emergency access 279 requester settings 271 reviewer settings 274 session access settings 277 time restrictions 279

Access Request Policy dialog Access Config tab 276 Approver tab 272 Emergency tab 279 General tab 269 Requester tab 271 Reviewer tab 274 Scope tab 270 Session Settings tab 277 Time Restrictions tab 279
Access Request settings 301 Enable or Disable Services 301 Reasons 303
access request states 582 access request workflow 107 access requests
enable for service account 194 enable or disable services 301 view details 89 Access Requests dashboard about 88 view details 89 account about 138 Access Request Policies tab 141 Account Groups tab 142 add 147, 168 add cloud platform account 148 add dependent account to a Windows
server 209 add to access request policy 142-143

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

651

add to account group 142, 144, 151, 160, 168, 181
add to profile 296 associate with asset 178, 207 associated asset 140 change password 152 Check and Change Log tab 144 check and set password 156 General tab 139 History tab 145 manually add tag 150 modify 152 remove 152 select account group 151 unlock 466 account dependencies about 208 add to Windows servers 209 Account Dependencies tab asset 180 account discovery add setting 227, 241, 244, 325 delete job 250 delete setting 227, 241, 325 details 241 discover accounts 241 discover service accounts 241 edit job 250 how to setup 243 modify setting 227, 241 run setting 227 view setting 227 account discovery job about 240

account discovery rule add 246
account group about 159 Access Request Policies tab 161 Accounts tab 160 add 151, 164 add a dymanic group 165 add account 151, 168 add to policy 169 General tab 160 History tab 162 History tab membership operation 146, 163, 264, 291, 450, 471 modify 169 remove 170
Account Groups tab account 142
account password change 157 check 157 set 157
account password rules about 417 add 417, 419 add to profile 295 copy 418 delete 418 modify 418
Accounts tab account group 160 asset 178
ACF - Mainframe systems prepare for Safeguard 520
activate read-only appliance 492

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

652

Activity Center about 90 apply search criteria 91 audit request workflow 98 delete saved search 97 delete scheduled report 97 edit saved search 97 edit scheduled report 97 generate report 93 query builder 91 save search criteria 92 schedule report 95
activity events filtering report results 99 view details 97
add account 138, 147 account dependency to Windows severs 209 account discovery rule 246 account discovery setting 227, 241, 244 account group 151, 159 account groups 164 account password rules 419 account to access request policy 169 account to asset 207 accounts to account groups 168 application registration 382 asset 172, 185 asset group 215, 220 asset or account to partition profile 298 asset to asset group 210 asset to partition 293 audit log signing certificate 351

cloud platform account 148 custom platform 325 directory group 474 dynamic account group 165 dynamic asset group 220 dynamic asset or asset account
tag 328 entitlement 258, 265 external federation provider
trust 566 external federation user account 568 license 312 managed network 369 partition 285, 292 password reset schedule 422 password sync group 429 password validation schedule
accounts 426 sessions certificate 355 trusted certificate 360 user 444, 451, 568 user group 467, 473 user group to entitlement 281 user group to role 477 user to entitlement 281 user to role 459 user to user group 476 admin password reset 50 Administrative Tools 103 administrator permissions 507 administrator permissions Appliance administrator 507 Asset administrator 509 Auditor administrator 511 Authorizer administrator 512

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

653

Help Desk administrator 514 Operations administrator 514 Security Policy administrator 515 User administrator 517 Amazon Web Services platforms prepare for Safeguard 521 API access 561 customize response 563 EventSubscribers 393 query filtering 563 API key regenerate for Application to Applic-
ation service 384 appliance
activate 492 add license 312 appliance name, set 309 Appliance settings 304 assign SSL certificate 359 backup and restore cluster 495 diagnose cluster 492 diagnostics package 50-51, 306 factory reset 311, 498 information 49-50 LCD controls 545 LDD status messages 544 Lights Out Management (BMC) 313 modify network suffixes 319 monitor cluster health 363 networking settings 318 patch cluster members 493 remove from cluster 483 reset cluster 497 restart 310, 544, 551

shut down 309, 552 specifications 32 states 502 time 321 unjoin from cluster 483 update license 312 view information about 307 virtual appliance setup 45 Appliance administrator permissions 507 appliance configuration about 377 NTP server 322 appliance diagnostic package 50-51, 306 Appliance Diagnostics settings 50-51, 306 Appliance Information restart appliance 310 settings 307 shut down appliance 309 Appliance settings 304 application registration add 382 delete 384 Application to Application about 379 add registration 382 delete registration 384 regenerate API key 384 setting up 381 settings 378 Application to Application service check status 379 disable service 311 enable 379 enable service 311

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

654

make request to 385 apply search criteria to a activity audit
log 91 Approval Anywhere
configure 389 approve password release request 116,
127 desktop client 116 approve session access request 128 Approver tab 272 archive backup file 347 archive servers 336 configure 337 configure for session recordings 438 delete configuration 336 modify configuration 336 asset about 171 Access Request Policies tab 180 Account Dependencies tab 180 Accounts tab 178 add 185 add dynamic tag 328 add to asset group 216, 223 add to partition 298 add to partition profile 296 add to partitions 293 associate account with 178, 207, 211 authentication types 192 copy tag to another partition 333 delete tag 332 Discovered Services tab 182 General tab 174 hide asset marked "ignore" 139, 172 History tab 183 import 172

link to profile 205-206 modify 210 modify connection timeout 210 modify tag 333 product (operating system)
not modifiable 188 remove 211 show hidden 139, 172 view tag assignments 334 asset account add dynamic tag 328 copy tag to another partition 333 delete tag 332 modify tag 333 view tag assignments 334 Asset administrator permissions 509 asset authentication type access key 194, 202 none 199, 203 password 200 Asset dialog Connection tab 192 General tab 186 Management tab 187 asset discovery about 226 add new job 228
General tab 229 Information tab 230 Rules tab 231
Asset Profile 237 Condition 232 Connection 234 Schedule tab 237 Summary tab 238

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

655

delete job 239 directory scan 230 edit job 238 network scan 230 asset group about 215 Access Request Policies tab 217 add 220 add account to 223 add asset to 210 add dynamic group 220 Assets tab 216 General tab 216 History tab 218 History tab membership
operation 184, 218 modify 224 remove 224 view 215 Asset Management settings 324 Assets tab asset group 216 assign accounts and assets to access
request policy 270 assign user to partition 459 Audit Log Management settings 339 Audit Log Signing certificate 349 audit log signing certificates
add 351 create CSR 351 audit request workflow 98 Auditor administrator permissions 511 authentication options 612 Authentication tab 453 Authorizer administrator
permissions 512

Azure 54 backup and recovery 49, 56 change setup 54 deployment steps 54 IP settings 54 security 54
B
backup about 335 archive 342 archive backup file 347 clustered appliance 495 configure archive server 337 create 342-343 delete 342 download 342, 345 information 341 restore 342, 345 run now 342 schedule 343 upload 342, 345
Backup and Retention settings 334 Archive Servers 336 Audit Log Management 339 Safeguard Backup and Restore 341 Safeguard Backup Retention 347
backup retention setting enable 347
Best Practice Add service accounts to profiles set to never change passwords 194 Add User Groups as approvers or reviewers rather than individuals 273, 275

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

656

After changing a user's administrative permissions, close the user's connections to the appliance 461
Disable directory users instead of deleting 462
Keep a minimum number of backups on the appliance 341
Perform backups more frequently than the Maximum Password Age setting 343
Setup an NTP server to eliminate system time issues. 578
bootstrap admin password reset 552
C
Cannot 543 certificate settings 348 Certificate Signing Request 352
create for audit logs 351 create for sessions 356 SSL certificate 359 certificate support for telnet 521, 525,
529, 534 certificates
about 348 Audit Log Signing 349 chain of trust 573 CSRs 352 how to prevent messages when
making RDP connections 571 install audiot log signing
certificates 351 install sessions certificates 355 RDP Connection Signing
Certificate 349, 353 Session Recording Signing

Certificate 349, 353 Timestamping Authority
Certificate 349, 353 challenge response process 50 change password 152 change password management
disable 303 enable 303 change password setting about 421 add to profile 295 copy 422 delete 422 modify 422 Check and Change Log tab account 144 check asset connectivity about 204 check password management disable 302 enable 302 check password setting about 425 add to profile 294 copy 425 delete 425 modify 425 Cisco devices prepare for Safeguard 521 cloud Azure 53-54 backup and recovery 49, 56 change setup 54 using 53 using Azure 54

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

657

cloud platform account add to Safeguard 148
cluster about 479 appliance details 362-363 backup and restore 495 configurations 479 consensus 480 diagnose 492 failover to replica 491 health check 480 monitor health 362-363 patch 493 primary appliance 479 primary appliance failure 481 promote replica to primary 491 remove quarantined appliance 583 remove replica appliance 483 replica appliance 479 reset 481, 497 settings 361 troubleshooting tips 501 unjoin and activate 481 unjoin replica appliance 483 unlock 501
Cluster Management settings 362 cluster member
about cluster patching 494 Activate 485 Check Health 485 Diagnose 485 Failover 485 patch 493 Unjoin 485 Cluster monitoring page 361

cluster patching failure scenarios 494 service guarantees 494
Cluster settings Cluster Management 362 Managed Networks 366
cluster view pane 362 Cluster view pane 363 configure alerts 108 configure assets for Safeguard 519 configure Privileged Sessions 584 Connection tab 192 contact information
change personal information 82 continued access workflow 613 converting timestamps 102 copy
account password rule 418 asset or asset account tag to another
partition 333 change password setting 422 check password setting 425 SNMP subscription 407 syslog server configuration 412 create relying party trust in IdP-STS 567 Creating custom platform script 325 credential retrieval 379 custom platform 612 about 324 download script 325 view 325 custom platform script create 325

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

658

D
delete account 138 account discovery setting 227, 241 account group 159 account password rule 418 application registration 384 archive server configuation 336 asset 172 asset group 215, 224 asset or asset account tag 332 change password setting 422 check password setting 425 custom platform 325 entitlement 259, 283 external federation service provider configuration 395 managed network 370 partition 285 password sync group 429 saved search 97 scheduled activity audit log report 97 sessions management 376 SNMP subscription 407 Syslog server configuration 412 ticketing system 415 user 444 user group 467
dependent accounts about 208
dependent system updates 209 desktop client
application settings 80 install 76

start 78 system requirements 35 uninstall 79 diagnostic tests about 314 clustered appliance 492 nslookup 315 ping 314 show routes 317 Telnet 316 trace route 316 directories that can be searched 37 directory add directory group 474 directory based user discovery 613 directory scan for assets 230 disable change password management 303 check password management 302 password requests 302 session module password access
enabled 303 session requests 302 toast notifications 108 disaster recovery about 479 diagnose cluster members 485 maintain cluster members 485 troubleshooting tips 501 discover accounts 241 service accounts 241 discovered services 182, 254 Discovered Services tab partition 182

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

659

discovery about 225 account 240, 250 account and service 243 asset 226, 228, 238-239 run now 182 asset discovery job workflow 228
Domain Name System (DNS) set 570
download custom platform 325
download Safeguard federation metadata 396
dymanic account group add 165
Dynamic Account Group dialog Asset Account Rules tab 166 General tab 165 Summary tab 168
dynamic asset group add 220
Dynamic Asset Group dialog Asset Rules tab 221 General tab 221 Summary tab 223
dynamic tag add to assets or asset accounts 328
E
edit saved search 97 edit scheduled activity audit log
report 97 email
administrative permissions determine what emails are sent 109

configure notifications 393 configure Safeguard to receive notific-
ations 108 configure SMTP server 391 default events sent 109 modify templates 393 template macros 394 emergency access about 262, 280 Emergency tab 279 enable change password management 303 check password management 302 password requests 302 session module password access
enabled 303 session requests 302 toast notifications 81, 108 Enable or Disable Services settings 301,
311 enroll cluster member 482 entitlement
about 258 Access Request Policies tab 261 add 265 add policy 283 add user 260, 281, 283 add user group 281, 470, 477 change priority 267 delete 283 expired 262 General tab 259 History tab 263 invalid 258, 262 membership 280, 459 modify 283

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

660

modify time restrictions 283 Policies tab 261 priority 266 time restrictions 268 Users tab 260 Entitlement dialog General tab 265 Time Restrictions tab 267 entitlement report filtering report results 99 Entitlements tab user 447 user group 469 export action bar option 94, 100 External federation add external federation provider
trust 566 add external federation user
account 568 configure 565 create relying party trust in IdP-
STS 567 external federation service provider
delete configuration 376, 395 modify configuration 376, 395 External Integration settings 377 Application to Application 378 Approval Anywhere 389 Email 391 External Federation 565 SNMP 407 Starling 408 Syslog 411-412 Ticketing 414

F
F5 Big-IP devices
prepare for Safeguard 524
Facebook Hosts
prepare for Safeguard 523
factory reset 311, 498, 553
FAQ
How do access the API 561
How do I audit transaction activity 565
How do I configure external federation authentication 565
How do I customize the response using API query parameters 563
How do I manage account passwords manually 569
How do I prevent Safeguard prompt when making RDP connections 571
How do I require users to log in using secondary authentication 457
How do I require users to log in using two-factor authentication 455
How do I set the appliance system time 578
How do I set up telnet, 3270, and 5250 session access requests 576
How do Safeguard database servers use SSL 578
What are the access request states 582
What do I do when an appliance goes into quarantine 582
What is required for One Identity Safeguard for Privileged Sessions 584

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

661

When does rules engine run for dynamic grouping and tagging 586
Why did the password change during an open request 586
favorites create 84 remove 85 set color 85
federation metadata 565 download 396 download Safeguard federation metadata 566 manually input values 567
FIDO key 74, 82, 405 filtering report results 99 follow mode, session play back 134 forced access request 613 Forntinet FortiOS devices
prepare for Safeguard 523
G
General tab account 139 account group 160 asset 174 asset group 216 entitlement 259 partition 287 user 444 user groups 468
generate activity audit log report 93 quarantine bundle 583 support bundle 554
global access request settings 301

glossary 633
H
Help Desk administrator permissions 514
hide ignored assets 139, 172 History tab
account 145 account group 162 asset 183 asset group 218 entitlement 263 partition 291 user group 471 Home page about 86 navigation pane 85 widgets 86 HP iLO Management Processors prepare for Safeguard 525 HP iLO servers prepare for Safeguard 524 Hyper-V backup and recovery 49, 56
I
IBM i (AS/400) systems prepare for Safeguard 525
identity provider initiated single sign on flow 614
IdP-STS 565 create relying party trust 567
iDRAC devices prepare for Safeguard 522

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

662

import about 152, 211, 462 accounts 139 assets 172 create import file 155 CSV Template Assistant 155 file format 155 how to import objects 152, 211, 462 users 444
install audit log signing certificate 351 desktop client 76 patch 323 sessions certificate 355 SSL certificate 358 update file 323
integrate with Safeguard external ticket system 414
J
join Safeguard for Priviliged Passwords to Safeguard Sessions Appliance 612
join to Starling 408 JunOS servers
prepare for Safeguard 526
L
launch RDP session 130 Safeguard Desktop Player 133 SSH client 129
LCD controls 545 status messages 544

license add 312 settings 312 update 312
licensing 42 Lights Out Management (BMC)
settings 313 Linked Accounts tab
users 448 live session
follow 134 terminate 134 Location tab 455 login control configure 431 Login Notification setting 416
M
manage accounts passwords manually 569
managed network add 369 delete 370 modify configuration settings 369 resolve IP address 370
Managed Networks settings 366
Management tab 187 member
add to entitlement 280, 459 add to user group 446, 459, 476 Message of the Day setting 416 Messaging settings 416 MIBSNMP configure subscriptions 407

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

663

Microsoft SQL Servers prepare for Safeguard 532 SSL support 579
minimum required permissions for Windows assets 536
modify account discovery setting 227, 241 account group membership 169 account information 152 account password rule 418 archive server configuration 336 asset group information 224 asset or asset account tag 333 change password setting 422 check password setting 425 email template 393 external federation service provider configuration 395 managed network 369 network suffixes 319 password sync group 429 sessions management 376 SNMP subscription 407 syslog server configuration 412 ticketing system 415 user password rules 434
MongoDB prepare for Safeguard 526
MySQL servers prepare for Safeguard 527 SSL support 580
N
network diagnostic tools 304 Network Interface X0 properties 318

Network Interface X1 properties 319 network scan for assets 230 Network Time Protocol (NTP)
enable 322, 570 networking settings 318 new features and resolved issues 605,
607 nslookup 315
O
object ID 104 ODBC Transport 579 Offline Workflow mode 480, 489
enable 490 resume operations 490 Operations administrator
permissions 514 Oracle databases
prepare for Safeguard 527 Other (or Other Linux) operating system
about 187
P
Palo Alto Networks prepare for Safeguard 528
partition about 21, 285 add 292 add asset 293 add assets 298 assign asset 205 change description 298 default profile 297 delegate management of 293, 298, 447

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

664

delete assets from 205 General tab 287 History tab 291 modify 298 Profile tab 290 reassign asset 294 reassign asset accounts 294 remove 299 Scope tab 288-289 set default 296, 299 partition profiles add assets or accounts 298 Partitions about 285 Partitions tab user 446 password change 82 change password manually 422 check and set 156 partition profile 186 policy, add to role 268 policy, modify 282 request, how to prevent 147, 207,
249 reset 465 viewing Password Archive 157 Password Archive viewing 157 password check and change did not
run 548 password Check and Change Log
view 145 password management services 301 password release
check-in 114-115

checkout 114-115 password release request 111
cancel pending request 114-115 desktop client approval 116 desktop client check-in 114 desktop client checkout 114 disable 302 enable 302 remove request 114-115 resubmit request 114-115, 125, 127 review 117 web client approval 116, 127 web client check-in 113 web client checkout 113 workflow 110 password sync group add 429 add to partition profile 296 change sync group password 429 delete 429 modify 429-430 priority 428, 430 password validation schedule add 426 patch cluster members 493 permissions about 507 Appliance administrator 507 Asset administrator 509 Auditor administrator 511 Authorizer administrator 512 delegated partition owner 459 Help Desk administrator 514 Operations administrator 514 Security Policy administrator 515

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

665

User administrator 517 Permissions tab 456 photo
change 82 ping 314 platforms that can be managed 37 play back recorded session 133 Policies tab
account 141 account group 161 asset 180 entitlement 261 policy about 268 add accounts to scope 161, 217 add to role 261, 268 change priority 267 copy 282 edit 282 expired 258, 262 invalid 262 priority 270 reason codes 303 remove 281 time restrictions 268 view details 282 ports 587, 595, 600 PostgreSQL prepare for Safeguard 528 power options 50 prepare asset for management 519 ACF - Mainframe systems 520 Amazon Web Services platforms 521 Cisco devices 521 Dell iDRAC devices 522

ESXi Hosts 522 F5 Big-IP devices 524 Facebook Hosts 523 Fortient FortiOS devices 523 HP iLO Management Processors 525 HP iLO servers 524 IBM i (AS/400) systems 525 JunOS - Juniper Networks
servers 526 MongoDB 526 MySQL servers 527 Oracle databases 527 PAN-OS Networks 528 PostgreSQL 528 RACF - Mainframe systems 529 SAP HANA 529 SAP Netweaver Application
Servers 530 SonicOS devices 531 SonicWALL SMA or CMS
appliances 532 SQL Server 532 Sybase (Adaptive Server Enterprise)
servers 531 Topic Secret - Mainframe
systems 534 Unix-based systems 534 Windows systems 535, 538 prevent Safeguard prompts when making
RDP connections 571 priority
about 266 change entitlement priority 267 change policy priority 267 entitlement 266 policy 270

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

666

Privilege Elevation Command 195, 197, 200
Privileged Sessions required configuration 584
product licensing 42 profile
about 21-22, 286 add asset or account to partition
profile 298 add to partition 290 assign to asset 206 explicit association 286 implicit association 286 reset default profile 286 Profile settings 417 Account Password Rules 417 Change Password 421 Check Password 425 profile, partition about 290 add 294 add accounts 296 add assets 296 add password sync group 296 modify 296, 299 set as default 297 Profiles tab partition 290 Proxy Server X0 properties 319
Q
quarantine bundle 583 quarantined appliance 582

R
RACF - Mainframe systems prepare for Safeguard 529
RDP connection prompts 571 RDP Connection Signing certificate 349,
353 RDP session
launch 130 read-only appliance
activate 492 reason codes 303 recover a quarantined appliance 582 recovery kiosk 549
appliance information 550 factory reset 553 generate quarantine bundle 583 generate support bundle 554 reboot appliance 551 reset bootstrap admin password 552 shutdown appliance 552 regnerate API key 384 remove asset group 224 quarantined appliance from a
cluster 583 trusted certificate 361 replay recorded session 133 replica failover to replica 491 promote to primary 491 remove 483 unjoin 483 Reports about 100

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

667

run entitlement report 101 request password release 111 request workflow
audit 98 dialog 133 password release requests 110 Requester tab 271 reset bootstrap admin password 552 reset cluster 497 reset to default certificate 356 resolve IP address in managed
networks 370 restart appliance 310, 551 restore
backup file 345 clustered appliance 495 reversing the join sessions management 377 review password release request 117 session access request 132 session release request 132 Reviewer tab 274 role-based access control 507 role-based email notifications 109 run account discovery setting 227 run asset discovery job 182 run entitlement report 101 run in the system tray 81
S
Safeguard features 27 set up 58

Safeguard Access settings 431 Login Control 431 Time Zone 437 User Password Rules 434
SAP HANA prepare for Safeguard 529
SAP Netweaver Application Servers prepare for Safeguard 530
save search criteria 92 schedule
activity audit log report 95 asset discovery 237 auto account password reset 422 auto account password
validation 426 backup, how to 343 scope add assets or accounts to
partition 293 Scope tab
partition 288-289 search box 63
using 63-64 secondary authentication
about 457 enable 455 login 78 Secret Key, about 203 Security Policy administrator permis-
sions 515 separation of duties 58 server
archive, configure 337 service account 138
about 193 set as managed account 193

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

668

service discovery 615 how to setup 243
session access request 120 approve 128 check-in session 123, 125 launch RDP session 130 launch session 123, 125 launch SSH client 129 review 132 revoke 128
session module password access enabled disable 303 enable 303
session recording about 118 follow mode 134 play back 133
Session Recording Signing Certificate 349, 353
session release checkout 124, 126
session release request cancel pending request 125, 127 remove request 125, 127 review 132
session request workflow 118 session requests
disable 302 enable 302 Session Settings tab 277 sessions about 118 about certificates 349, 353 Sessions Appliance join 612

sessions certificates about 349, 353 add 355 create CSR 356 reset to default certificate 356
sessions management about 373 reversing the join 377
Sessions Module settings 440 Sessions settings 438
Session Recording Storage Management 438
Sessions Module 440 SSH Banner 442 SSH Host Key 442 set account password reset schedule 422 set account password validation
schedule 426 set appliance name 309 set appliance system time 578 set password
generate 157, 569 manual 157 set telnet, 3270, and 5250 session access
requests 576 settings
Access Request 301 Account Discovery 240 Account Password Rules 417 Appliance 304 Appliance Diagnostics 50, 306 Appliance Information 304, 307 Application to Application 378 Approval Anywhere 389 Archive Servers 336 Asset Management 324

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

669

Audit Log Signing Certificate 349 Autit Log Management 339 Backup and Retention 334 backup settings 343 Certificate Signing Request 352 Certificates 348 Change Password 421 Change Password Management
Enabled 303 Check Password 425 Check Password Management
Enabled 302 Cluster 361 Cluster Management 362 custom platforms 324 desktop client application settings 80 Diagnostics 314 Email 391 Enable Backup Retention 347 Enable or Disable Services 301, 311 External Federation 565 External Integration 377 Factory Reset 311 Licensing 312 Lights Out Management (BMC) 313 Login Control 431 Login Notification 416 Managed Networks 366 Message of the Day 416 Messaging 416 Networking 318 Password Requests Enabled 302 Profile 417 Reasons 303 run in the system tray 81 Safeguard Access 431

Safeguard Backup and Restore 341 Safeguard Retention 347 Session Module Password Access
Enabled 303 Session Recording Storage Manage-
ment 438 Sessions 438 Sessions Certificates 349, 353 sessions management 373 Sessions Module 440 SNMP 407 SSH Banner 442 SSH Host Key 442 SSL Certificates 357 Starling 408 Support Bundle 321 Syslog 411-412 Tags 327 Ticketing 414 Time 321 Time Zone 437 Trusted Certificates 360 User Password Rules 434 setup Safeguard 58 setup Starling account 409 show ignored assets 139, 172 show routes 317 shut down appliance 309 shutdown appliance 552 sign up for Starling One Identity Hybrid
service trial account 409 SNMP
copy subscription 407 delete subscription 407 modify subscription 407

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

670

SonicOS devices prepare for Safeguard 531
SonicWALL SMA or CMS appliances prepare for Safeguard 532
sort entity lists 66 sorting report results 99 SSH Banner 442 SSH Host Key
add 542 algorithms for key exchange 542 sessions 442 SSH Host Key Fingerprint About 176 SSH key download 214 import 196 SSH session launch SSH client 129 SSL certificates about 357 assign to appliance 359 create certificate signing request 359 install 358 SSL support about 578 Microsoft SQL servers 579 MySQL servers 580 Sybase ASE servers 581 Starling join 408 Starling One Identity Hybrid service setup account 409 start desktop client 78 support bundle 321, 554 supported platforms 37

Sybase ASE servers prepare for Safeguard 531 SSL support 581
syslog 411 configure 412 copy server configuration 412 delete server configuration 412 modify server configuration 412
system requirements 34 desktop client 35 web client 36 web management console 37
T
tags copy asset or asset account tag to another partition 333 delete asset or asset account tag 332 manage asset and asset account tags 327 manually adding a tag to an account 150 modify asset or asset account tag 333 view asset and asset account tag assignments 334 when does rules enginer run 586
tasks stop 137 viewing 136
telnet certificate support 521, 525, 529, 534 session access request setup 576
Telnet 316 terminate session play back 134

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

671

Test Connection about 194 disable UAC to resolve connectivity failures 540 resolve failures 555
ticketing system delete 415 integrate with Safeguard 414 modify settings 415
time current appliance time 321
time restrictions 268 Time Restrictions tab
Access Request Policy dialog 279 Entitlement dialog 267 time zone configure 437 timeout errors causing operations to
fail 558 timestamp
conversion 102 Timestamping Authority Certificate 349,
353 TLS 1.2 setting 307 toast notifications 108
about 81 toolbar
Adminitrative Tools views 105 main screen 80 Toolbox about 136 Topic Secret - Mainframe systems prepare for Safeguard 534 trace route 316

troubleshooting
account is stuck in a pending password change state 548
appliance information 550
appliance status 544
cannot add replica to cluster 554
cannot connect to remote machine through SSH or RDP 543
Check Password fails on Unix host 418, 547
Check, Change, or Set failures 540
cluster 501
diagnostic tests 314
domain controller issues 557
error message
An internal request has timed out 554
Anti Cross Site Request Forgery token error 540
cannot play session 544
no cipher supported 542
No SSH host key was provided 540
system was unable to unlock your login keychain 547
There is no cipher supported by both client and server 556
factory reset 553
How do I access the recovery kiosk 549
How do I dowload MIB Definitions 407
How do I enable Network Time Protocol (NTP) 322
How do I generate a support bundle 554
How do I make a Safeguard SSL Webserver Certificate 358

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

672

How do I move assets from one partition to another 205
How do I obtain a new password during an open request 586
How do I reassign assets from one partition to another 294
How do I reboot the appliance 551
How do I reset the bootstrap admin password 552
How do I set a directory account's time zone 474
How do I shut down the appliance 552
How do I test an asset's connectivity 204
incorrect or insufficient service account privileges 542
incorrect service account credentials 541
incorrect SSH host keys 541
login credentials fail on Unix host 418, 547
networking issues 557
password fails for Unix host 547
Safeguard is not working on Windows-based systems 558
Test Connection fails for admin account on Windows machine not in domain 540
Test Connection failures 540, 555
Test Connection failures on archive servers 555
Test Connection failures on assets that require SSL 556
timeout errors causing operations to fail 558
What do I do if the system services do not restart 554
Why are directory users in wrong time zone 456

Why are my email template marcros blank 394
Why can't I checkout an account 548 Why can't my AD user log in 544 Why did Test Connection fail 540,
556-558 Why did the password change
fail 152, 194, 540, 543 Why didn't a user receive email
notifications 393 Why didn't the automatic password
check and change run on schedule 548 Why doesn't Safeguard automatically Check and Change SSH Keys 194 Why don't others see the changes I made 105 Why is the bootstrap account locked out of Safeguard 558 Why is the user account locked out of Safeguard 558 Why isn't the password available for checkout 194, 548 Why wasn't the Approver (or reviewer) notified 559 troubleshooting tools 304 trusted certificates about 360 add 360 remove 361
U
uninstall desktop client 79 Unix-based systems
prepare for Safeguard 534 unjoin
cluster member 484

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

673

unlock account 466 unlock locked cluster 501 update license file 312 update Safeguard appliance 323 updates
install 323 user
about 443 add 444, 451, 568 add from Users selection dialog 281 add to entitlement 281, 448, 461 add to group 478 add to user group 446, 459, 476 administrator permissions 456 authentication settings 453 change password 82 change personal contact
information 82 change photo 82 change time zone 461 delete 444 enable or disable 461 Entitlements tab 447 export history 450 General tab 444 grant partition ownership 461 import 444 Linked Accounts tab 448 modify 461 Partitions tab 446 remove 462 reset password 465 User Groups tab 446 view history 450, 461 User administrator permissions 517

User dialog Authentication tab 453 Permissions tab 456
user group about 467 add 459, 473 add from User Groups selection dialog 281 add member 446, 459, 468, 476 add to entitlement 281, 477 add to role 478 add user 446, 459, 468, 476, 478 change description 477 delete 467 Entitlements tab 469 General tab 468 History tab 471 modify 477 remove 478 Users tab 468
User Groups tab user 446
user password rule about 434 configure 434
Users tab entitlement 260 user group 468
V
view access request details 89 account discovery setting 227, 241 activity event details 97

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

674

asset and asset account tag assignments 334
Check and Change Log 145 custom platform 325 virtual appliance 44 backup and recovery 49, 56 set up 45 virtual kiosk support kiosk 49 VMware backukp and recovery 49, 56 VMware ESXi Hosts prepare for Safeguard 522
W
web client 69 about 80 approvals 71 change password 73 favorites 72 FIDO2 keys 74 log out 74 my requests 70 reviews 71 settings 73 system requirements 36 version 73 Windows client 73
web management console 44 system requirements 37
widgets approvals widget, controls 116, 128 requests widget, controls 125 reviews widget, controls 117, 132

Windows systems minimum required permissions 536 prepare for Safeguard 535, 538

Safeguard for Privileged Passwords 2.11.1 Administration Guide Index

675

madbuild