BeyondTrust Privileged Identity Supported Platforms and Systems

Authentication to Amazon uses an Amazon account configured with an API certificate for validation.

The API certificate (including alternate name and password) is used for AWS management.

When establishing an SSH session, authentication to AS400 hosts can occur using a certificate or password.

Users can originate from a local directory or from a central directory.

Telnet can support password authentication only.

While all scenarios are supported, each requires different considerations and planning, especially when using certificates. It is important to understand your system's authentication requirements.

When establishing an SSH session, authentication to a Cisco device can occur using a certificate or password.

Users can originate from a local directory or from a central directory.

While all scenarios are supported, each requires different considerations and planning, especially when using certificates. It is important to understand your system's authentication requirements.

Authentication to a DB2 database can be performed using any non-managed account. To make the connection, you must know the default database name.

Authentication to a WebSphere instance must use a local WebSphere account.

Authentication to an IPMI device can occur using local credentials. The password for the management account must be known to Privileged Identity in order to begin management.

To authenticate to an LDAP directory, you need the following information:

• Target server: The target server to query.
• Base LDAP path: The base LDAP path from which to begin the query.
• Authentication type/ Log In Name and Format: Be mindful of how the login username and password must be formatted (simple vs. not simple) as well as what authentication type is required (explicit, Integrated, etc.).
• Port and Protocols

When establishing an SSH session, authentication to Linux/Unix hosts can occur using a certificate or password.

Users can originate from a local directory or from a central directory.

While all scenarios are supported, each requires different considerations and planning, especially when using certificates. It is important to understand your system's authentication requirements.

McAfee ePO password changes occur by directly manipulating information in the Orion table or the ePO database, which runs on a Microsoft SQL Server. Access to this database must be available to Privileged Identity.

Authentication to a Microsoft SQL Server can be performed using an explicit SQL account (e.g. sa) or a trusted account from the local Windows host or joined directory. When working with a SQL Server from a trusted domain, the account running the console or the scheduling service must be granted the appropriate permissions to the target SQL Server. Or, the SQL Server must permit access with a proper explicit SQL Server account.

If attempting to manage a SQL instance on an untrusted host, you are able to use an explicit SQL Server account only.

Authentication to Microsoft Azure AD uses an Azure AD account supplied as an email address. The following information is also required:

• Client ID
• Tenant ID
• Subscription ID
• Management Certificate and Certificate Password (Optional): Used for discovering systems in the Azure instance

Authentication to a MySQL database can be performed only when using an explicit account. Directory accounts are not supported for management of MySQL databases.

MySQL uses a scheme to identify the source of the login account. MySQL instances must be configured with an account allowing access from Privileged Identity host servers.

To make a connection, you must know the default database name.

Authentication to an Oracle database can be performed only when using an explicit account. Directory accounts are not supported for management of Oracle databases.

Authentication to WebLogic instances must use a local WebLogic account.

When establishing an SSH session, authentication to an OS390 host can occur using a certificate or password.

When establishing an SSH session, authentication to an SSH host can occur using a certificate or password.

Authentication to a PostgreSQL database can be performed only when using an explicit account. Directory accounts are not supported for management of PostgreSQL databases.

PostgreSQL authentication does not allow remote connections from anywhere out-of-the-box, and rules must be established to allow communications from specific hosts or networks.

For the connection to be made, you must know the default database name.

Authentication to Rackspace requires using an explicit username and password.

Authentication to Salesforce uses an account supplied as an email address.

An application must be configured in Salesforce to allow connectivity. The Consumer Key and Consumer Secret are required.

Authentication to an SAP instance can occur with a local SAP account or a trusted account from another directory.

If using a gateway, note the following:

• HTTP or non-HTTP
• URL path to the server
• The NetWeaver add-on must be installed on the gateway host.

If a gateway is not used, note the following:

• System Number
• Client
• Destination
• Table Name (a default table name is USERLIST and column index is 0.)

Authentication to SoftLayer uses an explicit username and password.

.Authentication to a Microsoft SQL Server can be performed using an explicit SQL account (e.g. sa) or a trusted account from the local Windows host or joined directory. When working with a SQL Server from a trusted domain, the account running the console or the scheduling service must be granted the appropriate permissions to the target SQL Server. Or, the SQL Server must permit access with a proper explicit SQL Server account.If attempting to manage a SQL instance on an untrusted host, you are able to use an explicit SQL Server account only.

Authentication to VMware ESX uses an explicit username and password.

When changing a local account password, the change can occur by an administrative account or by the target account changing its own password. When performing an administrative password change, a password reset is actually being performed. When an account is used to change its own password, a change, not a reset, is being performed.

When changing a domain account,this change can occur by an administrative account, or by the target account changing its own password, or by a delegated reset.For an account to manage different domain account passwords, the rights required vary based on the domain account.

Authentication to a Xerox Phaser Printer occurs over SNMP via the administrator account. This account can be renamed, which means you must be aware of the current name of this account.