Sailpoint IdentityIQ Console is the command line utility for interfacing with IdentityIQ.
It is a powerful tool that allows the user to view objects, execute workflows, import and export data, and much more.
In the following presentation, we have discussed how to launch the IIQ console, usage, and syntax of the frequently used console commands.
The following demonstration presents the usage of frequently used console commands along with some examples.
Privileged accounts on a system possess higher authorizations and control. These accounts pose a higher risk if they are compromised. Privileged Identity Management solutions aim to address this by providing security and control over these accounts. CyberArk is a major provider that offers privileged account security and is backed by a patented vaulting technology. CyberArk enables organizations to secure, provision, manage, control and monitor activities associated with privileged accounts.
The following presentation describes privileged account security and the architecture of a CyberArk implementation. The various components of the CyberArk architecture and their functionalities are also discussed.
CyberArk’s PAS solution uses the Password Vault Web Access System which provides the method by which users request passwords and high-level administrators approve the requests. Access to this system should be as secure as possible. Integrating with a multi-factor authentication system like Duo would make the login process more secure by authenticating the user based on LDAP password as well as the response received by the Duo Authentication Proxy using Duo Push setup on the user’s mobile device.
In the current demo, an LDAP user with the name “testuser” is created on the Active Directory Domain Controller as well as the DUO instance.
Once the accounts have been created, the DUO Authentication Proxy is setup and is configured as the primary LDAP host for authentication.
The Duo Authentication Proxy is a service that runs either on Windows or Linux. It is configured by using the file authproxy.cfg
The details of the Duo instance and the details of the LDAP server which is being used for primary authentication are configured in authproxy.cfg
The firewall must allow outbound traffic to the Duo instance using HTTPS.
Only on successful primary and secondary authentication, access to the PVWA is granted.
As part of Active Directory Application Configuration in IdentityIQ 7.2, “Test Connection” failing with below error message.
In IdentityIQ 7.2, the Active Directory connector supports multiple Active Directory (AD) forests through one application definition.
While defining the Active Directory application through the IdentityIQ user interface in version 7.2, we do not have the option to mention the server details in Domain configuration settings.
Even though we do not specify any server details, the default configuration tries to connect to “localhost“, similar to the default port configuration which is “389“.
We see the below error message when we click on the “Test Connection”
2018-09-04 05:05:12,551 ERROR http-nio-8080-exec-6 sailpoint.web.ApplicationObjectBean:2701 – Connector failed.sailpoint.connector.ConnectorException: Failed to connect to – dc=enhcorp,dc=com : Failed to connect to server:ldap
dc=enhcorp,dc=com localhost:389
Modify the Application xml file to include the DC servers details.
Below is the example modification.
From
<entry key=”domainSettings”>
<value>
<List>
<Map>
<entry key=”authorizationType” value=”simple”/>
<entry key=”domainDN” value=”DC=enhcorp,DC=com”/>
<entry key=”password” value=”1:iIopEeOL5KrLoSjYKvh/Ww==”/>
<entry key=”port” value=”389″/>
<entry key=”servers”/>
<entry key=”useSSL”>
<value>
<Boolean></Boolean>
</value>
</entry>
<entry key=”user” value=”ENHCORP\Administrator”/>
</Map>
</List>
</value>
</entry>
To
<entry key=”domainSettings”>
<value>
<List>
<Map>
<entry key=”authorizationType” value=”simple”/>
<entry key=”domainDN” value=”DC=enhcorp,DC=com”/>
<entry key=”password” value=”1:iIopEeOL5KrLoSjYKvh/Ww==”/>
<entry key=”port” value=”389″/>
<entry key=”servers”>
<value>
<List>
<String>172.16.153.185</String>
</List>
</value>
<entry key=”useSSL”>
<value>
<Boolean></Boolean>
</value>
</entry>
<entry key=”user” value=”ENHCORP\Administrator”/>
</Map>
</List>
</value>
</entry>
Active Directory Provisioning along with Exchange attributes failing with below error message.
Errors returned from IQService. Connecting to remote server win-g303o4860qk.enhcorp.com failed with the following error message: The username or password is incorrect. For more information, see the about_Remote_Troubleshooting Help topic.
+ New-PSSession -ConnectionURI “$connectionUri” -ConfigurationName Microsoft.Excha …
Active Directory-Direct connector reads Exchange Server attributes by connecting to the Active Directory.
But, for provisioning any Exchange attributes, connector needs access to remote Powershell via IQService.
Windows Remote Management (WinRM) is a feature of Windows that allows
administrators to remotely run management scripts. WinRM Service should be running and that
should also be set up for Remote Management using the Enable-PSRemoting -force.
Enable PowerShell remoting in the domain using below cmdlet in Exchange Management Shell.
>Enable-PSRemoting -Force