Setting Up Use My Account

You can set up Use My Account (UMA) so you can access enrolled Linux/UNIX computers without an additional login step. UMA provides single sign-on to Linux computers for users who are logged in to the Verify Privileged Identity Platform.

This section describes several different ways to set up Use My Account for Linux/UNIX computers.

Using IBM Security OpenSSH

To automatically set up UMA for *nix systems, run the agent_setup.sh script during the agent installation.

Using OS Stock Version of OpenSSH

The agent_setup.sh script automatically sets up UMA during the agent installation process.

Using Automatic Script for UMA

  1. Navigate to where you downloaded the agent from the IBM Security Marketplace.

  2. Run the following script with root permissions:

    ./uma_setup.sh --install-cakey-file delinea_<tenantname>_date.pub -v

Example: 

./uma_setup.sh --install-cakey-file delinea_jwtraining-us_20240125_124856.pub –v



Using Manual Steps

  1. Navigate to and open the folder where you downloaded the agent from the IBM Security Marketplace.

    The agent is a .pub file in the following format:

    delinea_{tenant-name}_{download-date}.pub

  2. Copy the .pub file to the ssh directory.

    Example: 

    cp delinea_{tenant-name}_{download-date}.pub /etc/ssh/users_ca.pub

    cp delinea_fishing_20231213_041058.pub /etc/ssh/users_ca.pub

  3. Make a backup copy of the sshd_config file:

    cp /etc/ssh/sshd_config /etc/ssh/sshd_config_121323bk

  4. Edit the sshd_config file with the following lines:

    • Example command: vi /etc/ssh/sshd_config

    • AuthorizedPrincipalsCommand /usr/bin/adquery user -P %u

    • AuthorizedPrincipalsCommandUser root

    • TrustedUserCAKeys /etc/ssh/users_ca.pub


  5. Restart OpenSSH Service.

    Example:

    systemctl restart sshd.service


Test Use My Account

When the Privilege Control Agent is used, UMA is only for *nix systems with the agent installed that is joined to the domain and zone.

  1. Log in to the Platform as a user with permission to log in to the Linux system. The permission is granted through an Endpoint Login policy.

    On the Privilege Control Agent, only AD users are supported.

  2. From the left navigation, select Inventory.

  3. Find the server with the agent installed.

    To access a server where the Privilege Control Agent is installed, the agent must be joined to the domain and zone.

  4. Hover your cursor over the row with the target computer, and click the launch icon.


  5. Select Launch with My Account.