SailPoint IdentityIQ

SailPoint IdentityIQ is an identity and access management (IAM) solution that delivers automated access certifications, policy management, access request and provisioning, password management, and identity intelligence.

Types of Assets Fetched

This adapter fetches the following types of assets:

• Users
• Roles
• Accounts/Tenants

Data Retrieved through the Adapter

Users - fields such as: Username, Department, Title, Country

Roles - fields such as: Name, Display Name, Role Type, Active

Accounts/Tenants - fields such as: Name, Display Name, Application Name, Owner Display Name

Before You Begin

Required Ports

• TCP port 443 (HTTPS)

Authentication Methods

This adapter supports two authentication methods:

APIs

Axonius uses the IdentityIQ SCIM REST API (8.3). The following endpoints are called:

• GET /identityiq/scim/v2/Users - Fetch identity users
• GET /identityiq/scim/v2/Accounts - Fetch accounts
• GET /identityiq/scim/v2/Applications - Fetch applications
• GET /identityiq/scim/v2/Roles - Fetch roles
• GET /identityiq/scim/v2/Entitlements - Fetch entitlements
• POST /identityiq/oauth2/token - Obtain OAuth 2.0 bearer token (OAuth 2.0 authentication only)

Required Permissions

The following capabilities must be assigned to the service account in SailPoint IdentityIQ:

• SCIMExecutor — Grants access to all SCIM REST API endpoints. Includes the ReadScimUser right by default.
• WebServicesExecutor — Required alongside SCIMExecutor to enable REST API access.

No write permissions are required. These capabilities grant read-only access.

Accessing the SCIM API — SailPoint Developer Community
IdentityIQ SCIM REST API — SailPoint Developer Community

Supported From Version

Supported from Axonius version 4.5

Setting Up SailPoint IdentityIQ to Work with Axonius

Connecting the Adapter in Axonius

1. Navigate to the Adapter Catalog, search for SailPoint IdentityIQ, and select the adapter.
2. Click Add Connection.
3. Provide the following parameters.

Connecting the Adapter in Axonius

1. Navigate to the Adapter Catalog, search for SailPoint IdentityIQ, and select the adapter.
2. Click Add Connection.
3. Provide the following parameters.

Required Parameters

1. Host Name or IP Address - The hostname or IP address of the SailPoint IdentityIQ server. You must include https:// or http:// at the beginning of the Host Name or IP Address

2. Auth Method - Select Authentication method either Basic Authentication (default) or OAuth 2.0.

   • Basic Authentication:
     • Username and Password - The credentials for a user account that has the permissions to fetch assets.
   • OAuth 2.0:
     • Client ID and Client Secret - Parameters for SailPoint IdentityIQ OAuth2 authentication.

Optional Parameters

1. Port - The port for the SailPoint IdentityIQ instance.

2. Filter - A filter to use. Note that the filter only works for the Users asset type.

3. Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

4. HTTPS Proxy - Connect the adapter to a proxy instead of directly connecting it to the domain.

5. HTTPS Proxy User Name - The user name to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.

6. HTTPS Proxy Password - The password to use when connecting to the server using the HTTPS Proxy.

7. API Gateway Connection - Enable this to use API gateway parameters for authentication. After enabling this option, under API Gateway Type, choose Layer7 and fill in the parameters that are displayed (in addition to the SailPoint IdentityIQ host name or IP address). Read more about Layer7 API Gateway Parameters.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

1. Fetch user entitlements - Select this option to fetch user entitlements.
2. Fetch user roles - Select this option to fetch user roles.
3. Fields to exclude from fetch - Enter a comma-separated list of fields to exclude from the fetch. When you select "Fetch SailPoint Accounts as Users." The adapter fetches SailPoint accounts and ingests them as Axonius users and then removes the fields from the account data before ingestion.
4. Fields to include exclusively from the fetch - Enter a comma-separated list of fields to include from the fetch. Only the specified fields are included in the fetch; all others are excluded. IMPORTANT: The 'id' field MUST be included — users without it will be skipped and not ingested. It is also recommended to include 'userName' to strengthen the identifier. When you select "Fetch SailPoint Accounts as Users." The adapter fetches SailPoint accounts and ingests them as Axonius users and then only these fields are included in the account data.
5. Custom attributes to fetch - Enter a comma-separated list of extra fields to fetch.
6. Users per request (default: 1000) - Enter a number of users to receive in each request from the server, in order to reduce strain on the server.
7. Exclude disabled users - Select this option to not fetch users whose “active“ status is false or non-existent.
8. Async batch chunk size (default: 50) - Specify the size of the chunk size per async request batch. This can be helpful when the SailPoint IdentityIQ server crashes due to loads.
9. Fetch users seen in the last X days - Fetch only users that have been seen within the given number of days.
10. Save entitlements raw data - Select this option to save the raw data for the entitlements field in JSON format.
11. Fetch Sailpoint Applications as Accounts - Select this option to fetch SailPoint Applications as Accounts.
12. Fetch Sailpoint Accounts as Users - Select this option to fetch SailPoint Accounts as Users.
13. Fetch Roles as Assets - Select this option to fetch SailPoint Roles as Roles.
14. Fetch Entitlements as Roles - Select this option to fetch SailPoint Entitlements as Roles.