IBM Security Privileged Identity Manager Version 1.0

Table 2. Data reference for shared access (continued)Data ReferenceDescriptionShared access classesFor Directory Server schema, shared access module hasseveral types object classes, such as credentialcomponent, credential, credential pool, credential lease,and shared access policy.Auditing schemaYou can use auditing schema to track shared accesspolicy management, credential lease management,credential pool management, and credentialmanagement.For more information:v See “Roadmap for configuring shared access for a managed resource” in the IBMSecurity Privileged Identity Manager Deployment Overview Guidev Shared access documentationIn the IBM Security Identity Manager product documentation, see the“Administration” section to find links to the documentation for administeringshared access.v IBM Security Identity Manager product documentationTo find information about a task in either Table 1 on page 1 or Table 2 on page 1,go to this product documentation. On the home page, locate the productdocumentation search window, and enter the administration task name or datareference name, as listed in the table. For example, to administer shared accesspolicies, enter Managing shared access policies.Privileged Administrator viewIn IBM Security Identity Manager, the shared access feature includes a defaultgroup and a default view for privileged Administrators. The default view showsthe administrative tasks that can be accessed by users who have the groupmembership.The scope of activities for members of the Privileged Administrator group includethe following activities:v Manage a service, including the user accounts and requests for that servicev Manage and load privileged accounts from the managed service into thecredential vaultA privileged Administrator can manage and delegate the activities that are shownin administration console view for the Privileged Administrator group. ThePrivileged Administrator group can also view nearly all tasks on the self serviceconsole.For more information:v Shared access documentationIn the IBM Security Identity Manager documentation, see the section “Features”for links to topics on privileged Administratorsv IBM Security Identity Manager product documentationTo find more information about privileged Administrators, search for Scope ofthe Privileged Administrator group.2IBM Security Privileged Identity Manager: Administrator Guide

Privileged user viewIn IBM Security Identity Manager, the shared access feature includes a defaultgroup and a default view for privileged users. The default view shows the tasksthat can be accessed by users who have the group membership.The scope of activities for members of the Privileged User group includes thefollowing activities:v Manage their own profilev Change their passwordv Check in and check out shared accounts from the credential vaultThe Privileged User group has no default view on the administration console, andno default access control items.For more information:v Shared access documentationIn the IBM Security Identity Manager documentation, see the section “Features”for links to topics on privileged users.v IBM Security Identity Manager product documentationTo find more information about privileged users, go to this productdocumentation. On the home page, locate the product documentation searchwindow, and enter Scope of the Privileged User group.Manual checkout and check-in of shared credentialsUse the IBM Security Identity Manager self-service user interface console to accessshared credentials.Some IBM Security Privileged Identity Manager deployments do not requireautomated access to shared credentials. These deployments use only the IBMSecurity Identity Manager component. In these deployments, users who havesufficient privileges, such as membership in the Privileged Users group, canmanually access shared credentials.v For initial access to the self service user interface console, see the topic “Initiallogin and password information” in the IBM Security Identity Manager ProductOverview Guide in the IBM Security Identity Manager documentation.v When you log in to the self-service interface, go to the My Shared Accesssection of the entry panel. You can select wizards to assist you with thefollowing tasks:– Checking out a credentialCheck out the credential of your authorized shared accesses.– Checking in a credentialCheck in the credential that you checked out previously.– Viewing a passwordView the password for the credentials.v From anywhere in the self-service user interface, you can start the Help systemto view help topics. In the Shared access section of the Help system, see:– “Checking out a credential or credential pool”– “Viewing the password for a shared credential”– “Checking in credentials”Chapter 1. Shared access administration3

For more information:v Shared access documentationIn the IBM Security Identity Manager documentation, see the section “Userscenarios for shared access” to view links to topics on user access.v IBM Security Identity Manager product documentationTo find more information about manual access to shared credentials, go to thisproduct documentation. On the home page, locate the product documentationsearch window, and enter Checking out a credential or credential pool.Administrative console host names, ports and URLsConfiguration and administration tasks for IBM Security Privileged IdentityManager require you to log on to administrative consoles.Host names and portsThe following table contains the different variable host names and port numbersthat are used throughout the guide:Table 3. Description of variables for host names and port numbersVariableDescription was hostname Name of the host where the WebSphere Application Server is installed. dmgr hostname Name of the host where the WebSphereApplication Server Network Deployment Manageris installed. ihs hostname Name of the host where the IBM HTTP Server isinstalled. loadbalancer hostname Name of the host where the load balancer isinstalled. ims hostname Name of the host where the IMS Server isinstalled. ihs ssl port IBM HTTP Server SSL port number. admin ssl port Administrative console secure port number. isim hostname Name of the host where the IBM Security IdentityManager Server is installed. recorder hostname Name of the host where the Privileged SessionRecorder Server is installed.URLsTable 4. Common administrative consoles for IBM Security Privileged Identity ManagerConsolesFormatIBM Security Accessv If you are using a load balancer:Manager for Enterprisehttps://Single Sign-On loadbalancer hostname : ihs ssl port /AccessAdminadminv If you are not using a load balancer:https:// ims hostname : ihs ssl port /adminv If the web server is configured properly:https://ims hostname /admin4IBM Security Privileged Identity Manager: Administrator GuideExample URLv https://imsserver:9443/adminv https://imsserver/admin

Table 4. Common administrative consoles for IBM Security Privileged IdentityManager (continued)ConsolesFormatExample URLIBM Security Accessv If you are using WebSphere ApplicationManager for EnterpriseServer stand-alone:Single Sign-On IMShttps:// was hostname : admin ssl port /Configuration Utilitywebconfhttps://localhost:9043/webconfv If you are using WebSphere ApplicationServer Network Deployment:https:// dmgr hostname : admin ssl port /webconfIBM Security IdentityManageradministrative consolehttps:// isim hostname /itim/consolehttps://isimserver/itim/consoleIBM Security IdentityManager self-serviceconsolehttps:// isim hostname /itim/selfhttps://isimserver/itim/selfIBM Privileged Session v If you are using a load balancer:Recorder consolehttps:// loadbalancer hostname : ihs ssl port /recorder/uiv https://recorderserver:9443/recorder/uiv https://recorderserver/recorder/uiv https://recorderserverihs/recorder/uiv If you are not using a load balancer:v https://loadbalancerhost/recorder/uihttps:// recorder hostname : ihs ssl port /recorder/uiv If the web server is configured properly:https:// recorder hostname /recorder/uiIBM Privileged Session v https:// recorder hostname : ihs ssl port /Recorder Serverrecorder/collector(Collector)v https:// recorder hostname /recorder/collectorv https://recorderserver/recorder/collectorChapter 1. Shared access administration5

6IBM Security Privileged Identity Manager: Administrator Guide

Chapter 2. Session recording administrationAs an Administrator, you must have a comprehensive set of procedures andreference information for managing the resources for session recording.Session recording overviewYou can record privileged identity sessions for auditing, security forensics, andcompliance.The IBM Privileged Session Recorder is a virtual surveillance camera that capturesuser activity during an active session on a workstation. Captured recordings arestored in a centralized database. You can search for recordings and play backrecordings from a web-based corderDaemonCollectorDatabaseWebSphere ApplicationServerPlayerWebSphere ApplicationServerFigure 1. Session recording components.The IBM Privileged Session Recorder captures user activity on Windowsapplications. The software includes session recording enabled AccessProfiles. Thefollowing applications are supported and have bundled AccessProfiles:v Terminal consoles or SSH sessions with PuTTY or IBM PersonalCommunications.v Remote desktop sessions with Microsoft Remote Desktop connection, orVMware vSphere.For other applications, you can add session recording by configuring customAccessProfiles.Screen recordings consist of multiple screen captures. Screen captures of the activeapplication window are captured. Depending on the application type, therecording includes metadata for the keys that are pressed, the window controlsthat are clicked, and the window title.Each recording is identified by a Recording ID. A recording can include moresession metadata. The following items are examples of session metadata:User IDThe IBM Security Access Manager for Enterprise Single Sign-On user whosigned on to a system.Local user IDThe Windows user who logged on a client computer. Copyright IBM Corp. 20137

Application User IDThe privileged account.Local hostHost name of the client computer.Service HostThe system that is accessed using the privileged account.Application nameThe program on the end user computer where the privileged account isused.Process nameThe executable file name of the application.Start TimeThe date and time of day when the recording started on the clientworkstation.End TimeThe date and time of day when the recording ended on the clientworkstation.Session recorder configurationYou can start, stop, pause, or resume recording sessions by adding the PrivilegedSession Recorder widgets to an AccessProfile. You can also customize additonalsession recording options by configuring policies.Recording policiesYou can use AccessAdmin to customize recording settings. You can customizesettings such as server location, recording quality, and keys to exclude.Use AccessAdmin to configure the privileged identity management policies.For example, you can customize some of the following options:v Enable or disable session recording. (pid recorder enabled)v Specify the Privileged Session Recorder Server URL. (pid recorder server)v Capture recording in full color or in grayscale for smaller recordings.(pid recorder image capture option)v Enable or disable key logging. (pid recorder keyboard capture option)v Specify the action to take on the client computer when the Privileged SessionRecorder Server is not available. (pid collector comm fail action)For more information about the policies for session recording, search for Policiesfor privileged identity management in the IBM Security Access Manager forEnterprise Single Sign-On product documentation.AccessProfilesAdd the bundled Privileged Session Recorder widgets to custom AccessProfiles toenable session recording.For example, to customize recording for a Microsoft Remote Desktop Connectionclient application, be sure to add the Recorder widget to the Remote DesktopConnection AccessProfile.8IBM Security Privileged Identity Manager: Administrator Guide

The controls for initializing, starting, stopping, pausing, or resuming a recordingdepend on how the AccessProfile is designed with the available Privileged SessionRecorder widgets.For more information about customizing AccessProfiles, see Chapter 3, “ModifyingAccessProfiles,” on page 17.Adding security auditorsYou can use the configuration utility to add members of security auditors to theISPIMRecorderAuditors group to access the Privileged Session Recorder console.Before you beginInstall and configure the Privileged Session Recorder Server. For more information,see the IBM Security Privileged Identity Manager Deployment Overview Guide.About this taskMembers of the ISPIMRecorderAuditors group have privileges to view sessionrecordings on the Privileged Session Recorder console.The configuration tool already creates one auditor. To add more auditors, followthis procedure.Procedure1. Start the configuration tool. You can start the configuration tool from thefollowing location recorder install home /configtool/IBMCM.exe.2. When the configuration tool is displayed, click Configure Privileged SessionRecorder Server.3. Click Guided Configuration.4. Skip the steps in the configuration tool until the Configure Security Settingspage is displayed.5. In the Configure Security Settings page, specify the the user information youwant to add to the ISPIMRecorderAuditors group. Privileged Session Recorder.The user credentials you specify are used to log on to the Privileged SessionRecorder console.You can choose to create a user or specify an existing account. If you choose touse an existing account, the account must exist on WebSphere ApplicationServer.6. Click Finish.Accessing recordingsYou can access session recordings to play back, investigate, or audit the recordedusage of privileged identities.Logging on to the IBM Privileged Session Recorder consoleTo log on to the Privileged Session Recorder console, the user must be a memberof ISPIMRecorderAuditors group.Before you beginv Deploy and configure Privileged Session Recorder Server. See the IBM SecurityPrivileged Identity Manager Deployment Overview Guide.Chapter 2. Session recording administration9

About this taskTo grant more users access to the IBM Privileged Session Recorder console, youcan add security auditors. For more information, see “Adding security auditors”on page 9.Procedure1. Log on to the IBM Privileged Session Recorder console at https:// recorder hostname /recorder/ui. For example: https://recorderserver/recorder/ui2. Enter your ISPIMRecorderAuditors member credentials.The Privileged Session Recorder management console is displayed.Searching for recordingsYou can locate recordings by keywords, filtering, or by sorting. You can also searchrecordings for custom metadata. You can also save frequent searches for fasteraccess the next time you log on.Procedure1. Log on to the Privileged Session Recorder console.2. Use the search and filter controls to locate the recording you want.3. Play back the recording.Global searchGlobal search provides you with the ability to search all the session recordings forspecific keywords that are embedded in the metadata.For example, you can use the search function accomplish the following tasks:v Find recordings where a specific command was typed.v Find recordings that include a specific application or process.v Find recordings for a specific User ID, Application User ID, or Local User ID.Note: Global search does not support searching by date and time. To filter thesearch results by date and time, use the filter box that is above the recording listtable.Advanced searchTo retrieve recordings over a specific time range, use the Advanced Search.Filters and search criteriaUse the provided filters to refine the results of your search results. For example,you can filter the search by process name, time range, or by combining differentkeywords. To learn about the available session recording attributes that you cansearch for, see “Session recording overview” on page 7.Searching for recordings within a time spanTo retrieve recording over a time span, use the following search filters:Start time range (s1-s2)Where s1 is the beginning, and s2 is the end of the range for start time.10IBM Security Privileged Identity Manager: Administrator Guide

End time range (e1-e2)Where e1 is the beginning, and s2 is the end of the range for end time.Table 5. Examples of how to search with the Start time range and End time range inAdvanced Search.To search forSpecify the following valuesRecordings that start between 1 July 2013 to10 July 2013.Start time range (1 July 2013 - 10 July 2013)Recordings that end between on 1 July 2013to 10 July 2013.End time range (1 July 2013 - 10 July 2013)Recordings between 1 July 2013 to 10 July2013.Start time range (none - 10 July 2013)End time range (1 July 2013 - none)For Search type, select Match all criteria.Saving search queriesIf you repeat searches with specific criteria frequently, you can save your searchqueries for faster result retrieval.Procedure1. In the IBM Privileged Session Recorder console, use the Advanced search fieldsto refine and combine different search critieria.2. Click Saved searches.3. Specif

v A list of publications in the "IBM Security Privileged Identity Manager library." v Links to "Online publications." v A link to the "IBM Terminology website" on page x. IBM Security Privileged Identity Manager library The following documents are available online in the IBM Security Privileged Identity Manager library: