®

One Identity Safeguard
Authentication Services
The next generation of Active Directory bridge technology

Introduction
One Identity Safeguard Authentication Services
by Quest provides enterprisewide access,authentication and authorization for UNIX, Linuxand Mac OS X systems by using an organization’s
existing Active Directory (AD) infrastructure.
Safeguard Authentication Services’ patented
technology allows non-Windows resources tobecome part of the AD trusted realm, and extends
AD’s security, compliance and authentication
capabilities to UNIX, Linux and Mac OS X.

Benefits

Safeguard Authentication Services is theundisputed leader in the Active Directory bridge
market with nearly 1,500 customers and morethan 5 million deployed licenses. Only Safeguard
Authentication Services provides the functionality,flexibility and scope of integration to meet theneeds of the most complex and demanding
heterogeneous global organizations.

• Provides centralized authenticationand single sign-on

Tools for managing your AD bridge
Safeguard Authentication Services has robust andflexible UNIX utilities, as well as flexible deploymentoptions. It contains a powerful set of tools forcreating and managing your AD bridge, including:• Product configuration and licensing• Guidance to help with initial setup
and integrating systems with AD• Eliminates complexity byallowing UNIX, Linux and Mac OS
X systems to participate as “fullcitizens” in Active Directory• Consolidates the administration ofAD-enabled systems and AD Bridge• Delivers strong authentication aspart of the AD bridge solution• Facilitates the migration of all
systems and users to a single Active
Directory-based infrastructure• Simplifies security and compliance• A broad range of migration anddeployment options• NIS migration tools with pre-migrationassessment and preparation• Group Policy and local UNIX users
and groups management tools• Simplified and compliant auditing and reporting• Strong authentication for non-Windows systems

Safeguard Authentication Services

Kerberos/LDAPGroup Policy

User

Authentication
Local user & group

Administrator

Authentication
Optional second factor authentication• Password policy• Access control• Directory/identity
Consolidation• Integration with IAM
frameworks• NIS migrations• Audit/compliance

Safeguard Authentication
Services natively implements
Kerberos, LDAP and single
sign-on for UNIX, Linuxand Mac OS X systems inthe same way they are
implemented in Windows.

Management console
for Unix

Authentication
Mac Group
Policy Console

Audit
SSOSAP

SSO

OtherApps• Unix users in AD• Unix groups in AD• Unix computers in AD• Unix, Linux, Mac,Group policy objects• Pre-migration reporting• Optimized reports• Birds-eye view of local
Unix accounts• And more…

Migration

Strong Authentication

Ideally, most heterogeneous organizations want toconsolidate into one secure and robust directory
for all of their systems. Safeguard Authentication
Services can help you quickly achieve that goal bystreamlining the process of integrating UNIX, Linuxand Mac OS X systems and users to the AD domain.
It also facilitates a fast and accurate migration frommultiple authentication mechanisms, identities anddirectories into a single AD-based infrastructure.
Capabilities include:

Safeguard Authentication Services includes
licenses for powerful AD-based, one-time password(OTP), strong authentication across all supported
UNIX, Linux and Mac OS X platforms. In addition,
Safeguard Authentication Services extends
Windows-based smart cards to UNIX and Linux andsupports third-party OTP solutions.

• Mapped User Mode provides an elegant
alternative to a full migration. It allows themigration to proceed at its own pace while
quickly resolving the most pressing compliancerequirements. Mapped User Mode enables
organizations to achieve immediate compliancewith no impact on the Active Directory schema.

Audit, alerting and change tracking• UNIX Personality Management createsalternate UNIX “personalities” to define
profiles in AD for different systems, using
standard schema attributes based on
the default AD schema definition.

Only Safeguard Authentication Services gathers
the vital data demanded by auditors. Safeguard
Authentication Services enables you to audit, alertand provide a detailed change history of UNIXcentric information managed by Active Directory.

Compliance
Safeguard Authentication Services uses the same
industry standards as AD to provide a compliant
alternative to multiple identity stores and points ofauthentication, as well as noncompliant directories,
such as NIS. It also quickly and easily gathers thecritical information demanded by auditors, andseamlessly facilitates strong authentication for
non-Windows systems.

• Ownership Alignment Tool simplifies thetime-consuming final step of resolving
user-ID conflicts at the end of a migration.
• It provides a flexible tool set for aligning theownership of conflicting files; this allows you toquickly realign user namespace conflicts before,
during or after your primary migration to AD.
• Full RFC 2307 NIS Map Support provides
full support for users migrating their NIS
infrastructure into Active Directory’s RFC

2®

2307 NIS maps, enabling them to completely
retire their existing NIS infrastructure. RFC2307 is supported with advanced NIS map
import wizards, NIS map editors for Windows,
and full RFC 2307 support in the Safeguard
Authentication Services NIS proxy.
• UNIX Account Import Wizard imports users
and groups to personalities from sources
such as NIS, local files or remote shells. It alsoenables you to choose sophisticated matching
criteria (for linking to account principal)
from pop-ups. This greatly simplifies thetedious work of migrating users into AD.

Enterprise Group Policy
Safeguard Authentication Services provides aneasily implemented, infinitely scalable, and natively
integrated extension of the Windows Rights
Management Service Group Policy to UNIX, Linuxand Mac OS systems. Through this framework, you
can leverage the existing Group Policy extensions
built into the product, or develop your own basedon the simple ADM template methodology, or the
more capable client-side extensions.

Safeguard Authentication Services
includes generic scripting, filecopying and customization, as
well as a collection of powerfulprepackaged Group Policies andflexible policy management.
In addition, the product leverages existing
Windows security policies, making AD entirely
authoritative for UNIX, Linux and Mac OS X accesscontrol. Safeguard Authentication Services includes
a powerful Group Policy interface for Mac OS X
systems that provides control over the entire rangeof Mac policy and preferences, including support
for third-party applications through Preference
Manifest integration.

Safeguard Authentication
Services also audits and tracks
changes to Group Policy Objects.

“Overall, the installation of One
Identity software products has
reduced downtime and saved thebank around 100 staff-days ofwork each year.
Alexander Nesterenko,
Deputy Head of the IT Support Department

Active Directory for UNIX,
Linux and Mac OS X”Safeguard Authentication Services seamlesslyextends an existing AD infrastructure to the rest ofthe enterprise. Safeguard Authentication Services
natively integrates UNIX, Linux and Mac OS X
systems to allow them to act as full citizens within
AD and benefit from AD’s security and complianceadvantages. Key capabilities include:• Extends AD password policy toUNIX, Linux and Mac OS X
• Supports the most complex AD environments
including multiple domains, crossforest trusts, and nested groups• Leverages AD’s AES 128 strong encryption(128-bit keys) for UNIX, Linux andMac OS X to enhance security• Synchronizes UNIX system clocks with AD• Supports the RFC 2307 schema definition• Supports custom schema configuration
as well as implementation options for
pre-R2 schemas without extension.

Centralized authenticationand single sign-on
Safeguard Authentication Services natively
implements Kerberos and LDAP on UNIX, Linuxand Mac OS X systems in the same way they are
implemented in Windows. In addition, it provides
single sign-on SAP, a powerful application
programming interface (API) that allows you to add
single sign-on to internally developed applications
and guidance for creating single sign-on to anumber of popular applications (such as DB2,PuTTY, Samba and Apache).

3®

Centralized access control
Safeguard Authentication Services enables you toconfigure access rules using several options:• Local, file-based access lists that determine
what users can access on the UNIX andLinux machines (down to the level of theindividual services). These can then be
centrally managed through Group Policy.
• UNIX Personality Management helps control
access by defining the user namespace
for a given set of computer hosts.
• Windows security policies and theUser Workstation features can provide
granular, per-user access control toUNIX computer objects in AD.

Simplified identity management
Safeguard Authentication Services enables
you to simplify identity management based onyour existing AD investment. Using Safeguard
Authentication Services, AD-based identity
management solutions— including thosefor provisioning, password management,strong authentication, privileged accountmanagement, and auditing and reporting—fromand other vendors can be naturally extended to
non-Windows systems.

Extensive cross-platform support Safeguard
Authentication Services provides centralizedauthentication support for the widest range ofUNIX, Linux and Mac OS X platforms including
Solaris, IBM AIX, HP-UX, SuSE, RedHat, Fedora,
VMware, and others. For a complete list of
supported platforms refer to oneidentity.com/
Safeguard-Authentication-Services

About One Identity
One Identity delivers unified identity security
solutions that help customers strengthen theiroverall cybersecurity posture and protect thepeople, applications and data essential to business.
Our Unified Identity Security Platform brings
together best-in-class Identity Governance andAdministration (IGA), Access Management (AM),Privileged Access Management (PAM) and Active
Directory Management (AD Mgmt) capabilities toenable organizations to shift from a fragmented toa holistic approach to identity security. One Identity
is trusted and proven on a global scale – managing
more than 500 million identities for more than
11,000 organizations worldwide.
For more information, visit www.oneidentity.com.

Safeguard Authentication
Services can also work with anexisting IAM framework to reduce
the number of systems that
require custom integration andindividually managed connectors.

© 2023 One Identity LLC ALL RIGHTS RESERVED. One Identity, and the One Identity logo are trademarks and registered trademarks of One Identity LLC in the U.S.A. and other countries. For a complete list of One Identity trademarks,
please visit our website at www.oneidentity.com/legal. All other trademarks, servicemarks, registered trademarks, andregistered servicemarks are the property of their respective owners. Datasheet-Safeguard-Auth-Services-PG-83749®