Privileged Account Manager integrates with the Advanced Authentication application to secure and control the access to privileged endpoints using the Multi-factor authentication methods. With the increasing number of security vulnerabilities and compromised identities, it becomes difficult to ensure security and control over all privileged credential access, and activity. To overcome this issue, you can use two-factor or Multi-factor authentication.
NOTE:Advanced Authentication with Access Control is supported only for LDAP users.
Privileged Account Manager can integrate with Advanced Authentication application to provide the following benefits:
Advanced data security: Privileged Account Manager uses some of the Advanced Authentication methods to secure user privileged access. It prompts users for another authentication before providing privileged access to them. Hence, even when users log in with their primary password they are prompted for second-factor authentication password to get privileged access.
Multi-domain support: Privileged Account Manager uses Advanced Authentication server to authenticate users from different domains. You can define policies to control access of users from different domains.
With the integration of Advanced Authentication application, Privileged Account Manager can authenticate users on various domains including the default domain. You need not import users from various domains to Privileged Account Manager.
Multi factor authentication is one of the steps to the Zero Trust model.
In this chapter we have used some terminologies which are specific to Advanced Authentication. This section helps in providing brief information on the terminologies. For detailed information about Advanced Authentication, you can refer the Advanced Authentication server guide from the Advanced Authentication documentation page.
The following table describes the Advanced Authentication terminologies that are used in this chapter:
|
Term |
Usage in Advanced Authentication |
Usage in Privileged Account Manager |
|---|---|---|
|
Repository |
Used for storing user information. This information can be retrieved from any LDAP directory such as eDirectory, and Active Directory. |
You must create Advanced Authentication repositories for each domain that is used in Privileged Account Manager. If there is an account created in Privileged Account Manager’s Settings > LDAP Server configuration, the repository name must be the same as the domain name mentioned in the Credential Vault. For more information, see Section 4.1, Configuring LDAP Server Settings. NOTE:If you require secondary authentication imposed for local users of Privileged Account Manager, add those local users to the Local repository of Advanced Authentication server before configuring secondary authentication details. |
|
Methods |
Used for defining the type of authentication.It displays the list of available methods for authentication. You can modify the setting for each method as per your requirement. |
Only the supported methods can be used for secondary authentication. |
|
Chain |
Used for defining the combination of authentication methods. The users must authenticate themselves with all the authentication methods that are specified in a chain. For example, if you create a chain which is a combination of Email OTP and SMS, the user is prompted to enter the One-Time Password that is sent to his registered email address. If the OTP is correct, the system sends SMS with a One-Time-Password to the registered mobile number. |
The chains must be a combination of only the supported methods. If there is a combination of supported and unsupported methods, the user authentication is unsuccessful. |
|
Endpoint |
Used for identifying a device or server that contains a database. |
Privileged Account Manager uses a single endpoint for primary and backup servers. NOTE:Privileged Account Manager facilitates adding the endpoint to the Advanced Authentication server. This endpoint must be available to create an event. |
|
Event |
Used for configuring the chains and user categories that can be used for any endpoint. |
There should be a separate event for Privileged Account Manager. Only the chains that have a combination of supported methods must be added to this event. You must add the endpoint that you create through Privileged Account Manager to the Endpoint allowed commands of Advanced Authentication server. |
To integrate Advanced Authentication, you must install NetIQ Advanced Authentication 6.0 or later on a separate server.
The Advanced Authentication Server must be active and available.
The users who are added locally to the Framework User Manager must be added to the Local repository of Advanced Authentication server.
To use Advanced Authentication application you must perform the following in the same order:
In Advanced Authentication server, create required number of repositories for local and LDAP users.
These repositories should be the domains used in Privileged Account Manager.
Modify the supported methods as per requirement.
Create chains. Ensure that the chain includes only the supported methods and the default chains are not deleted.
Create an event.
In Privileged Account Manager specify the Advanced Authentication server details to register Privileged Account Manager server.
This creates new endpoint in Advanced Authentication server.
In Advanced Authentication server, select the Privileged Account Manager endpoint in Events.
All Privileged Account Manager users and Administrators must access the Advanced Authentication URL and enroll the methods before using Privileged Account Manager.
Only the methods that are enrolled will be available for secondary authentication.
You must configure the Advanced Authentication server to make the secondary authentication features available for Privileged Account Manager.
To configure the Advanced Authentication server for Privileged Account Manager, perform the following:
Add required number of repositories in Advanced Authentication server.
You must create a repository for the Local Framework users and add the same usernames as it is specified in Framework User Manager.
The repository name must match the domain name that you specify in Settings > LDAP Servers of Privileged Account Manager console.
In Advanced Authentication server click Method and configure the required methods that are supported in Privileged Account Manager.
Only the supported methods in Privileged Account Manager must be configured and used.
In Advanced Authentication server, click Chains to create the chains that includes those methods that are supported in Privileged Account Manager.
NOTE:
Ensure that you do not delete the default chains from the list of chains.
Ensure that you configure the Chain with LDAP Password method.
In Advanced Authentication server, click Event to create a custom event for Privileged Account Manager.
Include the required chains from the Available to the Used list.
In the Privileged Account Manager server, create an endpoint through Privileged Account Manager.
The endpoint gets created from Privileged Account Manager server. For information about creating endpoint through Privileged Account Manager refer Section 4.2.6, Configuring Advanced Authentication Server Settings
In Advanced Authentication server, edit the event for Privileged Account Manager and add the same endpoint in Endpoints Whitelist.
Email OTP
SMS
Smartphone
TOTP
HOTP
Voice
Fingerprint
Smart card
RFID card
RADIUS
For details about these methods, see the Advanced Authentication server guide on the Advanced Authentication documentation page.
You must specify the details of the Advanced Authentication server in Privileged Account Manager to use the supported advanced authentication methods.
To configure the Advanced Authentication server details, perform the following:
Click Settings > External Services from the home page of the Privileged Account Manager Console., and then click NetIQ Advanced Authentication.
In the right pane, specify the Advanced Authentication Configuration details:
Hostname/IP Address and Port Number: Specify the IP address or the DNS name of the Advanced Authentication Server.
Name: Specify a unique endpoint name.
This endpoint gets created in Advanced Authentication server with the same name that is specified in this field.
If you require to delete the endpoint, you must delete it from the Advanced Authentication server.
Description: Specify the description for the endpoint.
Default Domain: Specify any one of the Advanced Authentication repository names that must be used as the default domain to authenticate the user in that domain.
When a user does not provide the domain name during login and if that user is not a local user in Privileged Account Manager, then this default domain is used for authenticating the user in Advanced Authentication server.
NOTE:You must specify only the name that is already existing as repository in the Advanced Authentication server.
Event: Specify the same event name that is mentioned in the Advanced Authentication server for Privileged Account Manager.
Primary Login Method: Specify one of the following primary login methods:
LDAP Password: This is the default option selected. Use this option for all other certified Section 4.2.5, Supported Authentication Methods.
RADIUS: Use RADIUS option only if Advanced Authentication server forwards the authentication request to a third-party RADIUS server.
NOTE:If you select RADIUS, do not enable the Secondary Authentication Required option under Account Settings.
Retrieve Authorization Attributes from LDAP Server: By default this option is enabled. Ensure that the domain name configured in Advanced Authentication matches with the domain name of LDAP Server configured in Privileged Account Manager. Move the slider to the left if you do not want to retrieve the authorization attributes from the LDAP server.
Before enabling secondary authentication, you must ensure that you have performed all the configuration steps in the same order as mentioned in Section 4.2.3, Checklist to Follow Before Enabling Secondary Authentication. If Advanced authentication server is not configured, there will be issues when users try to login or try to get privileged access for an endpoint.
You can enable advanced authentication feature for authenticating users who access the following:
Administration console
Host servers such as Windows, SSH.
Applications or database by retrieving Passwords or shared keys from the user console
You can allow a framework user group or all privileged users to have privileged access without prompting for secondary authentication. To allow this access, Privileged Account Manager provides the Bypass Secondary Authentication option.
This option is helpful for framework users in the following scenario:
In case of some emergency, Privileged Account Manager administrators can log in to Privileged Account Manager Administration console without being asked for secondary authentication. This can happen only if the administrator is in a user group that has the option enabled. To enable this option for a user group refer, Section 4.2.7, Enabling Advanced Authentication for Privileged Access. The users who may require to be a part of the same group are:
Identity Manager users using the driver for Privileged Account Manager
Any other users who perform Privileged Account Manager administrative activities through automation.
This option is also available as a global setting where you can bypass secondary authentication on the parent policy. This is helpful so that in case of emergency such as when Advanced Authentication server is down, you can enforce bypassing secondary authentication for all the policies. To enforce this global policy perform the following procedure:
On the home page of the administration console, click Settings > Server Settings > Authentication.
In the details pane, move the Secondary Authentication Required slider to the right.
You can enable Advanced Authentication for the Privileged Account Manager to allow access only to the users who pass the secondary authentication.
To enable Advanced Authentication, Privileged Account Manager administrator must perform the following:
On the home page of the Privileged Account Manage console, click Settings > Server Settings > Authentication.
In the right pane, move the Secondary Authentication Required slider to the right.
To use this, ensure that Netiq Advanced Authentication is enabled.
This setting ensures that the users are prompted for secondary authentication to log into the Administration Console.
Inactivity Session Timeout: Set the time in minutes to timeout the session when in inactive state.