Configuration > Security settings

Configuration > Security settings

Authorizations

Definition

Soffid console provides a granular access control system. That granular control system allows the administrator user to assign granular permissions to roles. Be in mind that some permissions may inherit some other permissions.

You cannot assign permissions directly to users. Instead, permissions are assigned to roles and roles are assign to users, either directly or through grant inheritance.

The roles may be created into Soffid application system, but could also be included in any other application system.

Permissions are grouped into permission scopes. Most scopes are Soffid object types, but there are one special scope named Soffid, that applies to Soffid console web pages.

Addons can create their own authorizations that automatically will appear at this screen. When a new addon has been installed and applied, the first thing to do use to be assign permissions for this new addon. In fact, administrators won't be able to manage the addon unless the log out and log in to get the newly created permissions.

The permissions given to roles and the roles given to users are cached by Soffid. In order to reapply permissions, the user should close its session and log-in again

image.png

image.png

    Standard attributes

    Table attributes

    Authorization attributes

    Actions

    Table actions

    Download CSV file Allows you to download a CSV file with the authorization data.
    Import

    Allows you to upload a CSV file with the authorization data to add or to update the granular control system. If they exist, the values of the CSV file will prevail.

    First, you need to pick up a CSV file, that CSV has to contain a specific configuration. Then you need to check the contents. And finally, you need to select the mappings for each column of the CSV file to import the data correctly and to click the Import button.

    Authorization actions

    Add new

    Allows you to add a new role to the authorization.

    First, you need to search a role writing the role name on the field, and Soffid will show the values related. Second, you can select one or more roles and accept.

    And finally, you need to apply changes to save the roles added. If you cancel that action, no role will be assigned.
    Delete

    Allows you to delete one or more roles from an authorization.

    To delete one role, you need to click the subtraction symbol (-), located at the end of the row, of the role which you want to delete and then apply changes.

    To delete more than one role, you can select the roles which you want to delete and there click the subtraction symbol (-) and then apply changes.

    It is mandatory apply changes to save the roles deleted.

    Soffid will ask you for confirmation to perform that action, you could confirm or cancel the operation.
    Undo Allows you to quit without applying any changes.
    Apply changes Allows you to update the changes made on the authorization.

    Select role actions

    Undo

    		 Allows you to quit without applying any changes.
    Apply now Allows you to add the role or roles to the authorization.

    Examples

    End user for identity self service.

    A Soffid role is created for this functionality.

    image.png

    This role is assigned to the authorisations we require.

    image.png

    The role is assigned to a user.

    image.png

    The user will only be able to access the pages and actions permitted by their authorisations.

    image.png

     

     

    Authentication

    Definition

    This page gathers different types of settings that may affect user authentication in the Soffid Console.

    Soffid could use different kinds of external authentication sources. These mechanisms could be selectively enabled or disabled.

    Screen overview

    image.png

    image.png

    image.png

    Related objects

    Standard attributes

    Global status

    Once you check the Enforce TLS connections to Soffid Console option, there are no easy way to come back. You should use this option only en Production environments.

    💻 Image

    image.png

    💻 Image

    image.png

    💻 Image

    image.png

    Username and password

    This authentication is applies only to agents that have checked "Trust password" in the agent. For more information about agents please visit the Agents page.

    If the password entered by the user does not match with the Soffid account (if the attribute "Enabled" is checked), the Soffid core will issue a "ValidatePassword" task for each trusted target system (with checked "Trust password"). If any of the trusted target systems accepts the password, it will be hashed and stored in Soffid tables and login will be accepted.

    Be aware that this password change in Soffid will affect all systems that share the same password domain (defined in the password policies).

    External SAML identity provider 

    It should be noted this feature does not depend on the federation addon. That is a feature included by default in the Soffid smart engine to allow you to include in the authentication flow a mechanism to use a third-party SAML system.

    Soffid's own identity provider can also be used.

    Finally, download the Soffid Console and load it into your SAML Identity Provider federation.

    If SAML Identity Provider is enabled, as well as username and password, the user will have the chance to select the preferred authentication method. Otherwise, if only SAML is enabled, the user will be automatically redirected to SAML Identity Provider.

    💻 Image

    image.png

    💻 Office 365 as External SAML identity provider

    Introduction

    Steps to configure Office 365 as External SAML identity provider.

    Step-by-Step

    1. Open a https://portal.azure.com

    2. Open Microsoft Entra ID and then select Enterprise applications option

    image.png

    image.png

     

    3. Select All applications and click New Application

    image.png

    4. Select Create your own application

    image.png

    5. Type the name of your app and select the "Integrate any other application you don't find in the gallery (Non-gallery)" option

    image.png

    6. Click on Set up single sign on

    image.png

    7. Click the SAML option

    image.png

    8. Enter the Basic SAML Configuration and Save:

    image.png

    image.png

    9. Configure Attributes & Claims and change the attributes and claims to send the mailnickname as the user identifier (nameid)

    image.png


    image.png

    10. Copy the App Federation Metadata Url

    image.png

    11. Configure the External SAML identity Provider in the Soffid Console Authentication page

    image.png

    12. Optional, enable any user to login

    image.png

    API webservice authentication

    Soffid allows you to configure the way to verify the identity of a user or system accesing to the Soffid Web Service, to ensure that only authorized entities can interact with the service.

    This webservice is included in the addon SCIM, it must be installed previously.

    Bear in mind that the Identity Provider needs to have enabled the OpenID profile.

    Also, the Identity Provider cert must be in the Console cacerts.

    Enable LinOTP integration

    Soffid allows you to use an external OTP, LinOTP in this case. If you decide to use LinOTP, Soffid could be configured to request the user to authenticate using a second factor authentication to perform certain actions. In another case, you can use the Soffid OTP.

    If you want to configure the Soffid OTP you could visit Two factor authentication (2FA) chapter.

    Second Factor Authentication configuration

    💻 Example

    Request only the OTP for these pages:

    image.png

    💻 Example

    Request OTP for all pages except those containing menu.zul or otp.zul:

    image.png


    💻 Example

    image.png

    In both configurations, if OTP is required by the user, a popup requesting the token value is raised to write the OTP value.

    Actions

    Expand all Displays all the attributes of the different blocks.
    Collapse all Hide all attributes of the different blocks.
    "Types of views" Change the view type: Classic view, Modern view, Compact design.
    Download metada Allows you to download an XML file with metadata to load it into your SAML Identity Provider federation when you use an External SAML identity provider
    Confirm changes Allows you to save the changes made in the Authentication setup.

    Password policies

    Definition

    On this page, you can configure the password policies that will be applied when assigning a new password, always depending on the password domain selected by that system and the type of user selected.

    Therefore, the two main components of this page are password management and password policies.

    Password domain

    Is a logical way of grouping managed systems that are sharing the same password for each account.

    If the administrator chooses to have the same password for every system, only one password domain should exist. If the administrator chooses to assign a different password for each system, then a password domain should be created for each managed system.

    Password policies

    Password policies allow you to define custom rules that passwords must comply with to enhance system security.

    For each password domain, Soffid allows you to create different password policies related to user type. It is only possible to define a single password policy for one password domain and one user type. 

    There are two kinds of password policies.

    A password policy will also define how often the password needs to be changed and how many days are allowed to change it.

    Regarding password complexity, you can specify the minimum and the maximum number of lowercase letters, uppercase letters, numbers, and symbols, as well as password length.

    The administrator users can define a regular expression that must match each password. This can be used, for instance, to ensure that the first password is not numeric.

    It is allowed to create a list of forbidden words that cannot be used as passwords.

    image.png

    image.png

    image.png

    image.png

    Standard attributes

    Password domain attributes

    Password policies attributes

    Actions

    Table actions

    Add new Allows you to create a new password domain. To add a new password domain it will be mandatory to fill in the required fields
    Add password policy Allows you to create a new password policy on a specific password domain. Below the father password domain, you can find the button [+] to perform that action. To add a new password policy it will be mandatory to fill in the required fields.

    Password domain detail actions

    Apply changes (dick button) Allows you to save a new password domain or to update the password domain changes. To save the data it will be mandatory to fill in the required fields.
    Delete

    Allows you to delete a password domain. To delete a password domain you can click on the "three points" icon and then click the delete button.

    Soffid will ask you for confirmation to perform that action, you could confirm or cancel the operation.
    Undo Allows you to quit without applying any changes.

    Password policies detail actions

    Apply changes (dick button) Allows you to create a new password policy or to update password policy changes. To save the data it will be mandatory to fill in the required fields.
    Delete

    Allows you to delete a password policy. To delete a password policy you can click on the "three points" icon and then click the delete button.

    Soffid will ask you for confirmation to perform that action, you could confirm or cancel the operation.
    Undo Allows you to quit without applying any changes.

    Others

    Examples

    Password validation script example:

    codi3 = user.userName.substring(0, 3);
codi3 = codi3.toLowerCase();
if (passwordT != null)
	if(codi3.equals(passwordT.substring(0,3)))
  		return false;
return true;

    Configure PAM session servers

    Definition

    Soffid provides the functionality that allows you to configure the Jump servers.

    To configure that functionality is mandatory to install PAM following the instructions of the PAM installation page.

    A Jump server is the control point that forces users to log into that system first, then, they could traverse to other servers without having to log in again. The purpose of a jump server is to be the only gateway for access to your infrastructure reducing the size of any potential attack surface.

    For correct configuration, you must first create a PAM server group and then publish the store service and any available jump servers within it.

    Screen overview

    image.png

    image.png

    Standard attributes

    Table attributes

    Details atributes

    Actions

    Table actions

    Add new

    Allows you to add a new configuration PAM server group.

    You must fill in all the attributes to save a new configuration. 

    Detail actions

    Apply changes (disk button)

    Allows you to create a new configuration PAM or to update an existing one.

    You must fill in all the attributes to save a new configuration.

    Delete PAM server group

    Allows you to delete the PAM server group.

    To perform that action, Soffid will ask you for confirmation, you could confirm or cancel the operation.

    Undo

    Allows you to quit without applying any changes made.

    Apply changes

    Allows you to create a new configuration PAM or to update an existing one. To save the data it will be mandatory to fill in the required fields.

    PAM policies

    Definition

    Privileged Access Management (PAM) policies are a set of guidelines and controls that dictate how privileged access is granted, managed, and audited within an organization.

    Soffid allows you to define policies, those policies can be made up of several rules. For each rule, you could select the action to perform when Soffid detects that rule is accomplished.

    To use those policies you need to define how policies will be used by each folder in the password vault. For more information, you can visit the Password Vault page. 

    Screen overview

    image.png

    image.png

    Standard attributes

    Table attributes

    Policy attributes

    When you save the standard attributes of a PAM policy and edit the policy again, the rule list will be shown. Here you can customize the policy depending on the existing rules.

    Rules attributes

    Show a list of the PAM rules defined. You can check/uncheck the available options. You can choose zero, one, or several:

    💻 Image

    image.png

    Actions

    Table actions

    "Query search"

    Allows you to query PAM policies through different search systems, Quick, Basic and Advanced.

    Add new

    Allows you to create a new PAM policy.

    To add a new PAM policy it will be mandatory to fill in the required fields.

    Delete PAM policy

    Allows you to remove one or more PAM policies by selecting one or more records and next clicking this button.

    To perform that action, Soffid will ask you for confirmation, you could confirm or cancel the operation.

    Download CSV file

    Allows you to download a CSV file with the PAM policies information.

    Import

    Allows you to upload a CSV file with the PAM policies list to add or update PAM policies to Soffid.

    First, you need to pick up a CSV file, that CSV has to contain a specific configuration. Then you need to check the content to be loaded, it is allowed to choose if you want or not to load a specific attribute. Finally, you need to select the mappings for each column of the CSV file to import the data correctly and click the Import button.

    View

    Allows you to show and hide columns in the table.

    You can also set the order in which the columns will be displayed.

    Policy actions

    Apply changes (dick button)

    Allows you to create a new configuration PAM policy or to update an existing one.

    To save the data it will be mandatory to fill in the required fields.

    Delete

    Allows you to delete a PAM policy. To delete a PAM policy you can click on the "three points" icon and then click the delete button.

    To perform that action, Soffid will ask you for confirmation, you could confirm or cancel the operation.

    Undo

    Allows you to quit without applying any changes made.

    Apply changes

    Allows you to create a new configuration PAM policy or to update an existing one.

    To save the data it will be mandatory to fill in the required fields.

    Once the change has been applied, you will return to the main screen.

    PAM rules

    Definition

    Soffid allows you to define rules to detect commands executed on a server. When a user launches a command defined on a rule, Soffid will detect it.

    To use those rules you need to define the PAM policies. For more information, you can visit the PAM policies page.

    Screen overview

    image.png

    Screen example

    image.png

    Keyboard example

    image.png

    Keyboard example

    image.png

    Standard attributes

    Table attributes & rule attributes

    Actions

    Table actions

    "Query search"

    Allows you to query PAM rules through different search systems, Quick, Basic and Advanced.

    Add new

    Allows you to create a new PAM rule. You can choose that option on the hamburger menu or click the add button (+).

    To add a new PAM rule it will be mandatory to fill in the required fields.

    Delete PAM rule

    Allows you to remove one or more PAM rules by selecting one or more records and next clicking this button.

    To perform that action, Soffid will ask you for confirmation, you could confirm or cancel the operation.

    Download CSV file

    Allows you to download a CSV file with the PAM rules information.

    Import

    Allows you to upload a CSV file with the PAM rules list to add or update PAM rules to Soffid.

    First, you need to pick up a CSV file, that CSV has to contain a specific configuration. Then you need to check the content to be loaded, it is allowed to choose if you want or not to load a specific attribute. And finally, you need to select the mappings for each column of the CSV file to import the data correctly and click the Import button.

    View

    Allows you to show and hide columns in the table.

    You can also set the order in which the columns will be displayed.

    Rule actions

    Apply changes (disk button)

    Allows you to create a new configuration PAM rule or to update an existing one.

    To save the data it will be mandatory to fill in the required fields.

    Delete

    Allows you to delete a PAM rule. To delete a PAM rule you can click on the "three points" icon and then click the delete button. To perform that action, Soffid will ask you for confirmation, you could confirm or cancel the operation.

    Undo

    Allows you to quit without applying any changes made.

    Apply changes

    Allows you to create a new configuration PAM rule or to update an existing one.

    To save the data it will be mandatory to fill in the required fields.

    Once the change has been applied, you will return to the main screen.

    Issue policies

    Definition

    Soffid has defined automatic events by default. For each of these events, it is possible to define the tasks to be performed and configure them.

    Once the necessary issues have been configured, there are other screens for viewing and managing them.

    Issue types

    Below is a list of the issue types available in Soffid.

    Issue Type Description
    account-created

    This issue is created when the Sync Server detects when a new account is created. This may occur after the Reconciliation process has been executed.
    breached-account-password

    This issue is created when a password change for an account has been rejected because the password has been detected as breached. Be aware you must have enabled the "Network intelligence" feature with a valid token.
    breached-email

    This issue is created when the "Network intelligence verify domains" process is launched and it is detected that a user's email has been breached. An issue is created for each system in which that email is found. Be aware that to enable the process, you must have enabled the "Network intelligence" feature with a valid token.
    breached-password

    This issue is created when a password change for a user has been rejected because the password has been detected as breached. Be aware you must have enabled the "Network intelligence" feature with a valid token.
    disconnected-system This issue is created when the Sync Server detects that some target system is offline. 
    discovered-host

    This issue is created when the Sync Server detects a new host in the network. This only occurs after the Network Discovery process has been executed.
    discovered-system

    This issue is created when the Sync Server detects a new system in a host. This only occurs after the Network Discovery process has been executed.
    duplicated-user

    This issue is created the system detects that there are duplicate users, or when the task is generated manually from the user management.
    enabled-account-on-disabled-user This issue is created when an enabled account is detected on a disabled user. This may occur after the reconciliation process has been executed.
    expired-breached-password
    		 During login, when everything has gone well, the system also checks whether a password has been compromised.
    This is checked asynchronously, allowing the user to log in to Soffid without affecting performance.
    If the password has been compromised, the password and account are marked as expired and an issue is created.
    The next time the user logs in, they will be asked to create a new password.
    failed-job

    This issue is created when the system detects job failures. This may occur by running any scheduled task.
    global-failed-login This issue is created when the number of session start failures exceeds the threshold of 0.8.
    integration-errors This issue is created when the Sync Server detects an integration error between Soffid and an end system. You can check the task in the Monitoring & Reporting.  
    locked-account

    This issue is created when an account has been blocked for exceeding the maximum number of login attempts. You can configure the property Lock after failures in the Password policies settings. Even if it is temporarily locked, the incident will be generated.
    login-different-country

    This issue is created when Soffid detects a new login from a different country. It only works with the Identity Provider and it is necessary to have the geolocation database updated.
    login-from-new-device

    This issue is created when Soffid detects a new login from a new device. It only works with the Identity Provider.
    login-not-recognized This issue is created when Soffid detects a login not recognized (disabled user or user does not exist) in the Soffid Console or in Soffid as an Identity Provider.
    otp-failures This issue is created when an OTP is blocked for exceeding the number of attempts. Currently blocked with 10 unsuccessful attempts.
    pam-violation This issue is created when any of the rules of the PAM are violated. You can define the PAM rules and the PAM policies. Be in mind, that you must check the "Open issue" option in the PAM policies you wish to control.
    password-changed

    This issue is created when a Password change is detected. These changes come from the end system (Active Directory or Soffid OpenLDAP) and Soffid has been notified. The issue is not created if it is the operator or a script that changes the password in Soffid.
    permissions-granted

    This issue is created when it is detected that permissions have been given to a user on the end system. This may occur after the reconciliation process has been executed.
    risk-increase This issue is created when it is detected the risk level of a user is increased. You can configure the risks in the Segregation of Duties option.
    robot-login This issue is created when it is detected is detected that someone who has not passed the CAPTCHA is trying to log in to the Identity Provider.
    security-exception This issue is created when unauthorized access to the console via WebService or admin console occurs.

    Screen overview

    image.png

    image.png

    Standard attributes

    Note that it will be necessary to restart the Sync Server when changing the action of an issue.

    Actions

    Table actions

    "Query search" Allows you to query issue types through different search systems, Quick, Basic and Advanced.
    Download CSV file Allows you to download a CSV file with the issue policies data.

    Issue actions

    Apply changes (dick button)

    Allows you save a issue policy.

    To save the data it will be mandatory to fill in the required fields.
    Download CSV file Allows you to download a CSV file with the issue policies data.
    Expand all Displays all the attributes of the different blocks.
    Collapse all Hide all attributes of the different blocks.
    "Types of views" Change the view type: Classic view, Modern view, Compact design.
    Add new

    Allows you to add a new action to the issue policy. You can choose the action from the action list. Depending on the selected action, you must fill in different information.

    Once the information will be filled in, you need to close the window and Apply the changes.
    Delete

    Allows you to delete one or more actions from the actions list.
    Undo Allows you to quit without applying any changes.
    Apply changes Allows you to update the changes made to the issue policy.

    Digital certificates (addon federation)

    Definition

    Soffid includes Digital certificate functionality as a security enhancement. You could add new Digital certificates, internal or external.

    If you select the external certificate, you could add a valid certificate to Soffid; If you select the internal certificate, Soffidl will generate a valid certificate.

    Screen overview

    image.png

    image.png

    Related objects

    Standard attributes

    Internal

    Image

    image.png

    image.png

    External

    Image

    image.png

    image.png

    Actions

    Table actions

    Add new

    Allows you to add a new certificate.

    To add a new certificate it will be mandatory to fill in the required fields. 
    Delete

    Allows you to remove one or more certificates by selecting one or more records and next clicking this button.

    To perform that action, Soffid will ask you for confirmation, you could confirm or cancel the operation.
    Download CSV file

    Allows you to download a CSV file with the digital certificates data.

    New token

    Undo

    Allows you to quit without applying any changes.

    Next

    Allows you to browse the wizard to create a new certificate.

    Back

    Go to theprevious step.

    Apply changes

    Allows you to save the data of a new certificate or to update the data of a specific certificate. To save the data it will be mandatory to fill in the required fields

    OTP settings (addon otp)

    Definition

    The OTP settings allow the administrator users to configure the available OTP options. Soffid provides six different OTP implementations.

    This page is available if you have previously installed the Soffid OTP add-on.

    Configure these options as a second authentication factor in the Soffid identity provider. Remember that this functionality is found in the federation add-on.

    Screen overview

    image.png

    image.png

    image.png

    Related objects

    Standard attributes

    Email

    To send an email, you must register a mail server. To this purpose, Soffid has a set of parameters that you can find on the Soffid parameters page.

    SMS

    https://www.xxxxxxx.com/cgi-bin/sms/http2sms.cgi?account=sms-bg490971-1&password=XXXXXXt&login=user&from=SOFFID&to=${PHONE}&message=This is your access PIN: ${PIN}&noStop&contentType=application/json&class=0
    "status":100

    The URL and POST data to be sent, the administrator can use some tags that will be replaced by some target user attributes:

    Soffid does not offer any SMS services, this service must be provided by the customer.

    Voice (alternative to SMS)

    Text to be present in the HTTP response: Soffid will check the response from your SMS Provider contains this text
    "status":100

    The POST data to be sent, the administrator can use some tags that will be replaced by some target user attributes:

    Soffid does not offer any voice service, this service must be provided by the customer.

    Time based HMAC Token

    An additional application is required to load the OTP generation settings. You may use any of the following: Google Authenticator, Microsoft Authenticator, FreeOTP Authenticator.

    Event based HMAC Token

    An additional application is required to load the OTP generation settings. You may use any of the following: Google Authenticator, Microsoft Authenticator, FreeOTP Authenticator. 

    Security PIN

    Actions

    Expand all Displays all the attributes of the different blocks.
    Collapse all Hide all attributes of the different blocks.
    "Types of views" Change the view type: Classic view, Modern view, Compact design.
    Confirm changes

    Allows you to save the updates and quit the page.

    Password recovery configuration (addon recovery)

    Description

    Soffid provides you the functionality that allows to the users recover their passwords.

    To do this, the administrator user, or a user with the proper roles/authorizations, must first config the password recovery settings.

    This setting can be used in the Console login and in the Federation login if enabled in the Identity Provider.

    There are several sending method configuration options, use the one that best suits your organization.

    Screen Overview

    image.png

    Standard attributes

    Password recovery questions tab

    Enabled methods

    Recovery questions

    Recovery email

    Tip: Use the ${variable} syntax to customize SMS and e-mails. Use ${PIN} for the secret pin, or ${attributeName} for any user attributes like ${fullName}.

    Recovery SMS

    Tip: Use the ${variable} syntax to customize SMS and e-mails. Use ${PIN} for the secret pin, or ${attributeName} for any user attributes like ${fullName}.

    Default questions tab

    This Default questions tab is where you enter the questions that the end user will have to answer in order to recover their password.

    image.png

    Table:

    Actions:

    Add new

    Add a new row to the table to allow the administrator to write the question.

    Delete

    After selecting one or more questions, the "Delete" will be displayed and you could delete the question/s.

    For more information on how to activate and configure the question and answer feature, please review the page How to configure questions?

    Actions

    Password recovery questions tab

    Confirm changes

    Allows you to save the data of password recovery configuration. To save the data it will be mandatory to fill in the required fields.

    Default questions tab

    Add new

    Allows you to add a new question to the questions list

    Others

    Login in console

    First, activate one of the available methods, in this case email.

    Sedond, when you log in to the console, you will see the option ‘Recover password’.

    Image

    image.png

    image.png


    Login in federation

    First, enable "Allow user to recover password" in the "Advanced authentication" section.

    Second, when you log in to the federation, after entering the user, you will see the option "Forgot your password?".

    Image

    image.png

    image.png