Chat now with support
Chat with Support

KACE Systems Management Appliance 14.1 Common Documents - Administration Guide

About the KACE Systems Management Appliance Getting started
Configuring the appliance
Requirements and specifications Power-on the appliance and log in to the Administrator Console Access the Command Line Console Tracking configuration changes Configuring System-level and Admin-level General Settings Configure appliance date and time settings Managing user notifications Enable Two-Factor Authentication for all users Verifying port settings, NTP service, and website access Configuring network and security settings Configuring session timeout and auto-refresh settings Configuring locale settings Configuring the default theme Configure data sharing preferences About DIACAP compliance requirements Configuring Mobile Device Access Enable fast switching for organizations and linked appliances Linking Quest KACE appliances Configuring history settings Configuring Content Security Policy
Setting up and using labels to manage groups of items Configuring user accounts, LDAP authentication, and SSO Deploying the KACE Agent to managed devices Using Replication Shares Managing credentials Configuring assets
About the Asset Management component Using the Asset Management Dashboard About managing assets Adding and customizing Asset Types and maintaining asset information Managing Software assets Managing physical and logical assets Maintaining and using manual asset information Managing locations Managing contracts Managing licenses Managing purchase records
Setting up License Compliance Managing License Compliance Setting up Service Desk Configure the Cache Lifetime for Service Desk widgets Creating and managing organizations Importing and exporting appliance resources
Managing inventory
Using the Inventory Dashboard Using Device Discovery Managing device inventory
About managing devices Features available for each device management method About inventory information Tracking changes to inventory settings Managing inventory information Finding and managing devices Registering KACE Agent with the appliance Provisioning the KACE Agent Manually deploying the KACE Agent Using Agentless management Adding devices manually in the Administrator Console or by using the API Forcing inventory updates About Remote Control Managing MIA devices Obtaining Dell warranty information
Managing applications on the Software page Managing Software Catalog inventory
About the Software Catalog Viewing Software Catalog information Adding applications to the Software Catalog Managing License assets for Software Catalog applications Associate Managed Installations with Cataloged Software Using software metering Using Application Control Update or reinstall the Software Catalog
Managing process, startup program, and service inventory Writing custom inventory rules
Deploying packages to managed devices
Distributing software and using Wake-on-LAN Broadcasting alerts to managed devices Running scripts on managed devices Using Task Chains
Patching devices and maintaining security
Using the Security Dashboard About patch management Subscribing to and downloading patches Creating and managing patch schedules Managing patch inventory Managing Windows Feature Updates Managing Dell devices and updates Managing Linux package upgrades Manage quarantined file attachments
Using reports and scheduling notifications Monitoring devices
Getting started with monitoring Working with monitoring profiles Managing monitoring for devices Working with alerts
Using the Service Desk
Configuring Service Desk Using the Service Desk Dashboard Managing Service Desk tickets, processes, and reports
Overview of Service Desk ticket lifecycle Creating tickets from the Administrator Console and User Console Creating and managing tickets by email Viewing tickets and managing comments, work, and attachments Merging tickets Using the ticket escalation process Using Service Desk processes Using Ticket Rules Run Service Desk reports Archiving, restoring, and deleting tickets Managing ticket deletion
Managing Service Desk ticket queues About User Downloads and Knowledge Base articles Customizing Service Desk ticket settings Configuring SMTP email servers
Maintenance and troubleshooting
Maintaining the appliance Troubleshooting the appliance
Appendixes Glossary About us Legal notices

Use Active Directory single sign on to access the Administrator Console or User Console

Configuring browser settings for single sign on

Configure Microsoft Edge browser settings
Configure Firefox browser settings
Use Active Directory single sign on to access the Administrator Console or User Console

To use Active Directory single sign on with Microsoft Edge™ and Firefox® browsers, users must configure their browser settings to use the appropriate authentication. The Chrome™ browser does not require any special configuration.

Configure Microsoft Edge browser settings

To use Active Directory single sign on with the Microsoft Edge, you must configure the Windows security settings.

1.
In the Windows Control Panel, click Internet OptionsTools > Internet Options > Security.
2.
In the Internet Properties dialog box that appears, on the Security tab, select the appropriate security policy:
◦
If the appliance is available on the Internet select Trusted Sites.
◦
If the appliance is not available on the Internet, select local intranet.
3.
Click Custom level, then scroll to the bottom of the list.
4.
Select Automatic logon with current username and password. If this option is not selected, Microsoft Edge cannot automatically log in to the Administrator Console or User Console even if single sign on is enabled on the appliance.
Configure Firefox browser settings

To use Active Directory single sign on with Firefox, you must configure the browser's authentication settings.

1.
In the Firefox browser, type about:config in the address bar.
2.
In the Search field type the following network.negotiate-auth.trusted-uris.
3.
In the search results, double-click the name of the preference.
4.
In the string value box, enter the URL of the appliance. For example, http://kace_sma.example.com, then click OK.
Use Active Directory single sign on to access the Administrator Console or User Console

When Active Directory single sign on is enabled on the appliance, users who are logged in to the domain can access the Administrator Console or User Console without entering their credentials on the appliance login page.

Single sign on must be enabled through Active Directory. See Enable single sign on.
1.
Log in to the domain.
2.
In a web browser, type the hostname of the appliance in the browser address field. To identify the host name, see Change appliance network settings.
* 
TIP: If you enter the appliance IP address, you are directed to the appliance login page instead of being signed on automatically.
The Administrator Console or User Console appears, depending on user account privileges.

Unjoin the domain and disable Active Directory single sign on

Unjoin the domain and disable Active Directory single sign on

You can remove the appliance from the Active Directory domain. Removing the appliance from the domain automatically disables single sign on as well.

1.
Go to the appliance Control Panel:
◦
If the Organization component is not enabled on the appliance, log in to the appliance Administrator Console, https://appliance_hostname/admin, then select Settings > Control Panel.
◦
If the Organization component is enabled on the appliance, log in to the appliance System Administration Console, https://appliance_hostname/system, or select System in the drop-down list in the top-right corner of the page, then select Settings > Control Panel.
2.
Click Security Settings to display the Security Settings page.
3.
In the Single Sign On tab, click Unjoin Domain.
* 
NOTE: Users who are currently logged in to the User Console or Administrator Console remain logged in until their session ends. The next time they attempt to access the User Console or Administrator Console, however, they are required to enter their credentials.

Configure SAML for single sign on

Configure SAML for single sign on

Example: Using Microsoft Active Directory in Azure as a SAML Identity Provider

You can configure the appliance to authenticate users without providing their credentials on the Welcome page using a third-party authentication tool.

Security Assertion Markup Language (SAML) is an XML-based protocol that uses security tokens between identity and service providers. The security tokens contain assertion elements that provide information about the user's identity.

When SAML is enabled and configured on the appliance, and the user logs in using this single sign-on method, the appliance sends an authorization request to your Identity Provider (IdP). The identity provider then confirms the user's identity and sends an authentication response to the appliance. Next, the appliance logs the user in to the Administrator Console (or User Console) and establishes the user session. When a SAML user logs out of the appliance, they are logged out of their IdP account. If you want to continue to be logged into your IdP account after using the appliance, simply close the Administrator Console browser window without signing out. If a SAML user's session times out, and they are still logged into their IdP account, the appliance automatically starts a new session for that user.

If you have multiple organizations, you can configure SAML in each organization that uses this method of authentication, and keep the local login method for other organizations.

1.
Ensure that your IdP has valid identity information for logging you in to the appliance.
2.
Log in to the appliance Administrator Console, https://appliance_hostname/admin. Or, if the Show organization menu in admin header option is enabled in the appliance General Settings, select an organization in the drop-down list in the top-right corner of the page next to the login information.
3.
Go the SAML Settings page:
a.
On the left navigation bar, click Settings, then click SAML Configuration > Configure Single Sign On with SAML.
b.
On the SAML Settings page, under Security Assertion Markup Language (SAML), select the Enable SAML Service Provider check box.
4.
If you want to allow users to only use SAML to access this appliance, select Require SAML login.
This option causes all local logins to the appliance to be disabled, with the exception of the local admin user and the KACE Support account (available only with an active Support tether).
5.
In the Remote Identity Provider (IdP) Settings section, specify your IdP metadata to authenticate users by completing one of the following steps.
◦
Recommended. If your IdP provides an URL to the XML page containing the IdP metadata (suggested option), click Get Metadata From IdP. In the IdP Metadata URL field that appears, type that URL, and click Import IdP Metadata.
◦
To use your IdP metadata XML file, click Enter XML Metadata, and in the IdP Metadata XML field that appears, copy and paste the contents of the XML file. Then click Import IdP Metadata. The appliance parses the provided XML content and populates the settings required to establish a connection with the IdP.
The Remote Identity Provider (IdP) Settings section refreshes, showing the details of your IdP configuration. The listed options specify the appliance page redirects during SAML authentication. For more information, visit https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=security.
* 
NOTE: To review this information anytime during your SAML configuration, click View Metadata in this section.
6.
In the IdP Attribute Mappings tab, select the option that you want to use to grant the SAML user access to the appliance.
◦
Use Local User Table: Relies on the user list stored locally on the appliance.
◦
Use LDAP Lookup: Imports user information from an external LDAP server. For more information, see Using an LDAP server for user authentication.
◦
Use SAML: Uses the values specified on this page to map to the fields used by your IdP to the appliance user records, such as name, email address, and so on. For example, if the IdP uses LDAP to authenticate users, you can set UID and Login to objectGUID and cn, respectively. For more information, see your IdP documentation.
7.
If you selected Use SAML, indicate if you want to create a new user on the appliance for authenticated SAML users that do not have accounts on the appliance. To do that, select Create new SMA user if authenticated SAML user does not exist on SMA.
8.
If you selected Use SAML, specify the roles that you want to grant to the SAML-authenticated user. Under Role Mapping, specify the conditions that you want to check when granting the roles.
For example, you can grant the Administrator role to the members of an LDAP group whose name contains a specific text string (such as admin), set the Administrator role as follows:
Administrator memberOf Contains admin
The roles are listed in the order of priority. You can change the role priority by dragging and dropping them, as needed. If there are multiple matches, the appliance grants the role with the highest priority to the SAML user.
Role mapping is optional. If no matches are found, the appliance assigns the default role. To specify the default role, click Default Role for Unmatched Users, and choose a role from the available options, as applicable: Administrator, No Access, Read Only Administrator, or User Console Only.
9.
Optional. To view the appliance-specific SAML settings on the appliance, in the Local Service Provider (SP) Settings section, click View Metadata, and review the options that appear.
These fields contain default values and in most cases you do not need to make any changes.
10.
Click Save.
11.
Test your SAML configuration.
a.
Log out of the appliance.
b.
Ensure you are logged in to your IdP account.
c.
Open the Administrator Console or User Console Welcome page.
d.
Without specifying your user credentials, click Login.
* 
TIP: When SAML is enabled on the appliance, click Local Sign On, and specify your user credentials.
The Administrator Console or User Console page appears.

Example: Using Microsoft Active Directory in Azure as a SAML Identity Provider

Example: Using Microsoft Active Directory in Azure as a SAML Identity Provider

When you use Active Directory in Azure as a SAML Identity Provider (IdP), some additional steps are required. This topic describes the process of configuring SAML with Active Directory as an IdP.

1.
Ensure that your IdP has valid identity information for logging you in to the appliance.
2.
Complete the following steps:
a.
Enable SSL for the appliance. This step is required because Microsoft Azure can successfully communicate only with SSL clients. For instructions, see Configure security settings for the appliance.
b.
Log in to https://portal.azure.com and select Azure Active Directory.
c.
Under App Registrations, create a new registration, leaving the Redirect URI settings cleared.
d.
In the newly created App Registration, on the Endpoints page, copy the contents of the Federation metadata document field.
3.
Log in to the appliance Administrator Console, https://appliance_hostname/admin. Or, if the Show organization menu in admin header option is enabled in the appliance General Settings, select an organization in the drop-down list in the top-right corner of the page next to the login information.
4.
Go the SAML Settings page:
a.
On the left navigation bar, click Settings, then click SAML Configuration > Configure Single Sign On with SAML.
b.
On the SAML Settings page, under Security Assertion Markup Language (SAML), select the Enable SAML Service Provider check box.
5.
In the Remote Identity Provider (IdP) Settings section, specify your IdP metadata to authenticate users by completing the following steps.
a.
Click Get Metadata From IdP.
b.
In the IdP Metadata URL field that appears, enter the contents from the Federation metadata document field that you recorded in 2.d, and click Import IdP Metadata.
The Remote Identity Provider (IdP) Settings section refreshes, showing the details of your IdP configuration. The listed options specify the appliance page redirects during SAML authentication. For more information, visit https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=security.
* 
NOTE: To review this information anytime during your SAML configuration, click View Metadata in this section.
6.
In the Security Assertion Markup Language (SAML) tab, ensure the IdP Does Not Support Passive Authentication check box is selected.
7.
In the IdP Attribute Mappings tab, select the option that you want to use to grant the SAML user access to the appliance.
◦
Use Local User Table: Relies on the user list stored locally on the appliance.
◦
Use LDAP Lookup: Imports user information from an external LDAP server. For more information, see Using an LDAP server for user authentication.
◦
Select Use SAML, and set the following options:
◦
UID: http://schemas.microsoft.com/identity/claims/objectidentifier
◦
Login: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
◦
Name: http://schemas.microsoft.com/identity/claims/displayname
◦
Primary Email: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
8.
If you selected the Use SAML option, under Role Mapping, specify the following condition for the role that you want to grant to SAML-authenticated users (for example, the Administrator role):
http://schemas.microsoft.com/ws/2008/06/identity/claims/groups equals <Object ID>
Where <Object ID> is the object ID of the group.
9.
Optional. To view the appliance-specific SAML settings on the appliance, in the Local Service Provider (SP) Settings section, click View Metadata, and review the options that appear.
These fields contain default values and in most cases you do not need to make any changes.
10.
Complete the following steps:
a.
In the Local Service Provider (SP) Settings section, click View Metadata
b.
In the Microsoft Azure Portal, locate the newly created App Registration.
c.
On the App Registration page, click Add a Redirect URI.
d.
In the Redirect URIs section, select Web and set it to the SP Assertion Consumer Service (url) value from the SAML Settings page, under Local Service Provider (SP) Settings.
e.
In the Advanced settings, set the Logout URL field to the SP SLO Endpoint (url) value from the Local Service Provider (SP) Settings section.
f.
In Azure, click Expose an API, and click Set next to Application ID URI. Set this field to the SP Entity Identifier (uri) value from the Local Service Provider (SP) Settings section.
g.
In Azure, click Manifest, and in the editor that appears on the right, add or update the "groupMembershipClaims" attribute and set its value to "SecurityGroup" or "All".
For example: "groupMembershipClaims": "SecurityGroup",
11.
Click Save.
12.
Test your SAML configuration.
a.
Log out of the appliance.
b.
Ensure you are logged in to your IdP account.
c.
Open the Administrator Console or User Console Welcome page.
d.
Without specifying your user credentials, click Login.
* 
TIP: When SAML is enabled on the appliance, click Local Sign On, and specify your user credentials.
The Administrator Console or User Console page appears.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating