Tag: Identity IQ

Identity IQ is the flagship product of Sailpoint in the space of Identity Governance

https://www.sailpoint.com/products/identityiq/

SailPoint’s IdentityIQ Integration with Okta

Posted on by Mahesh Bitla in Identity Governance, Okta, Sailpoint, Technology

In the world of Identity Management, securing and monitoring the access for the external users like partners, contractors and customers who have access to organizational resources have always been a challenge for many organizations. To mitigate and help the organizations to secure their resources two big Identity management products partnered together in February 2018. Okta and SailPoint announced a strategic partnership to provide an end-to-end identity for the enterprise – helping organizations balance providing simple, secure user access while meeting complex compliance and security requirements.

Benefits of the Combined Solutions

• Effectively manage user identities’ authentication, application assignments, while ensuring all governance and compliance requirements are met.

• Authenticate user access with single sign-on and multi-factor authentication.

• Ensure that for sensitive applications, only the right user has access, authorization policies are enforced, and the process is documented, timestamped and compliant.

• Automate provisioning throughout the user lifecycle by simplifying processes for creating, modifying and revoking access.

• Automate provisioning of applications adherent to corporate policies.

• Trigger provisioning workflows from authoritative sources, such as Active Directory or HR systems, to ensure consistency and increase efficiency.

Below presentation demonstrates Okta, IdentityIQ, SSO Concepts, Importance of SailPoint’s IdentityIQ integration to achieve SSO. The presentation is followed by a demo.

Okta and SailPoint IIQ Integration

Demo of SailPoint’s IIQ and Okta Integration.

 

Sailpoint IdentityIQ – Perform Maintenance Task

Posted on by Vishal Kuruganti in Identity Governance, Sailpoint, Technology

The Perform Maintenance Task in Sailpoint’s IdentityIQ plays a crucial role in ensuring that background maintenance activities are carried out periodically.

The following presentation is an attempt to deep dive into :

  • XML object structure of the Perform Maintenance Task
  • Native Java-based Sailpoint  objects associated with the Perform Maintenance Task
  • Understanding the flow of execution of the Perform Maintenance Task

 

Please leave your comments below

Sailpoint IdentityIQ Integration with Oracle E-Business Suite

Posted on by Narasingarao Nagireddi in Identity Governance, Oracle, Sailpoint, Technology

Oracle E-Business Suite is the most comprehensive suite of integrated, global business applications that enable organizations to make better decisions, reduce costs, and increase performance. All large enterprises use ERP systems for managing and optimizing enterprise-wide business processes. ERP systems like Oracle E-Business Suite are mission-critical which processes a huge amount of business-critical data.

Oracle EBS includes the company’s enterprise resource planning (ERP) product as well as Oracle Human Resources Management System (HRMS), Oracle Financials, Oracle Order Management and customer relationship management (CRM) applications. Each application is licensed separately enabling organizations to select the combination best suited for their business processes.

The Sailpoint Oracle E-Business connector is designed to aggregate user and entitlement data from the Oracle E-Business Suite, and provision user accounts.The Oracle EBS connector only targets APPS schema tables according to Oracle standards.

Sailpoint Connector for EBS User Management Aggregates and provisions EBS user accounts along with their role and responsibility assignments. It helps EBS customers to achieve compliant user administration by enforcing the Segregation of Duties (SoD) policies in real-time during role and responsibility grants.

In this presentation, we are going to see how the Sailpoint IdentityIQ is an innovative identity Governance solution that reduces the cost and complexity of both complying with regulations and delivering access to Oracle E-Business Suite users.

 

 

 

The Following Demo presents the use case of  Birth Right Provisioning and Implementing Security in Oracle E-Business Suite using Role Based Access Control.

 

Reassignment of Employee mailbox to manager via Sailpoint’s Identity IQ

Posted on by Chaitanya Malladi in Identity Governance, Sailpoint, Technology

Email is the most powerful tool for enterprise level communication as it provides accountability and reliability in communication. To an organization, the emails that are received by the employees are a valuable resource. When an employee resigns or is terminated from the company, the organization might still need access to his/her mailbox. This is especially significant in sales, support and administration activities as it can impact the organization either directly or indirectly. This scenario can be addressed by allowing an authority within the organization to access the de-provisioned mailbox and is an important challenge within identity and access management. The risks and compliance guidelines associated with this approach are also factors that need to be considered.

Sailpoint’s IdentityIQ is shipped with a connector for Active Directory. This connector supports management of users, groups and mailboxes on Exchange server. However, for modifying the mailbox permissions, native rules need to be configured in order to execute the corresponding PowerShell scripts.

The following presentation introduces a scenario where handling mailbox permissions would be required. After an overview of native rules, the implementation of this use case is also discussed.

The following demo focuses on granting Exchange mailbox permissions via IdentityIQ and verifying that the changes are reflected on the mail server.

XML Tags in Sailpoint

Posted on by Chaitanya Malladi in Sailpoint, Technology

XML Objects:

Every object in Sailpoint is stored as an XML file. The existing XML objects can be explored from the “Debug Pages”. XML files are useful while adding new objects. This can be done using “Import from XML” under Global Settings. Any object like rules, certifications, system configurations, email templates, etc. can be created using XML.

XML Object Tags:

Each of the objects is represented by its respective XML tag and has its own structure. For example, rules are referred with the <Rule> tag, tasks with <TaskDefinition> tag, email templates with <EmailTemplate> tag.

An XML file with only one object begins and ends with a tag corresponding to that object type. However, it is a better practice to always wrap the objects with the <sailpoint> tags as this offers more flexibility. This approach also enables to import multiple objects defined in the same XML file.

For example, two XML files can be combined into a single file:

 

Usage of combined XML objects:

Taking the approach of using a single XML file is extremely useful for deploy-ready and stable objects. Doing this in general will reduce the modularity which raises few concerns:

  1. If an issue arises with importing one of the objects, it will halt the process of import and rest of the features would be left out
  2. As part of the development process, it would be inconvenient to import all the objects repeatedly while only one or few of them are updated.

Due to these reasons, it is better to combine tested and stable XML objects instead of objects that are still in development.

The usage of this approach can be observed in the “init.xml” file that comes with Sailpoint. This file contains all of the objects required for the basic features of the product, packaged into a single XML file.

Service Now Queue User Administration via SailPoint Identity IQ

Posted on by Neetika Malhotra in Identity Governance, Sailpoint, Technology

The SailPoint ServiceNow Connector manages ServiceNow accounts, groups, and roles. It supports provisioning and aggregation for ServiceNow accounts and groups.

ServiceNow Connector supports configuration of multiple applications of different ServiceNow versions on same IdentityIQ. ServiceNow Rest API supports Basic and OAuth2 methods of authentication.

Under IT Service Management, Its Queue management and administration is based on roles and services assigned to a user.

SailPoint Service Catalog Integration: The integration between SailPoint and ServiceNow allows users of both systems to easily navigate from ServiceNow into IdentityIQ.

In the following presentation, ServiceNow Queue Administration using Sailpoint IdentityIQ is explained and overview of SailPoint Service Catalog Integration using MID Server.

This following demo is based on ServiceNow Queue User Administration using Sailpoint IdentityIQ with all the approval modes (serial, parallel, serialpoll, parallelpoll and any).

Sailpoint IdentityIQ’s Transient workflows and their advantages

Posted on by Sandilya Krovvidi in Identity Governance, Sailpoint, Technology

Quicklinks are usually used for faster access of specific functionalities. Often a “no delays” workflow where the start and end of the workflow happen within one single launch of quicklink shall be launched by quicklinks. Usually these kind of workflows involve custom Sailpoint forms which would not be useful once the user stops using this quick link by navigating to some other page.

Conventional workflow launches are serialized by storing the workflow cases as XML objects. This leads to many work items and workflow cases which are incomplete and hang around the Identity IQ over long run. This might lead to performance issues and unwanted data accumulated inside IIQ.

This problem could easily be solved using the transient workflows. The main feature of transient workflows is that they don’t get serialized.

Without the workflow getting serialized, we have specific advantages.

  1. Workflow cases which are inactive specific to this workflow shall not be generated.
  2. Work items that are generated do not get serialized and as a result we don’t have any unwanted work items related to this workflow in user’s inbox.

This would result in cleaner environment where we don’t have unnecessary data.

Extra perk with logging:

Workflow variables in Sailpoint are serialized in non-transient workflows. This means that we can store only the objects that Sailpoint has capability to store as XML object. Log4J loggers are very useful objects which are disqualified as workflow variables because of this restriction.

As the transient workflows do not try to serialize the objects referred by the variables, Logger objects can also be stored in the workflow variables.

This provides us the flexibility to maintain a workflow level logger variable to use your custom logging. Rather than instantiating the custom loggers whenever we require them, we can simply use the workflow variable whenever required.

Sailpoint Implementation: Referring Rule Libraries in Validation Scripts

Posted on by Sandilya Krovvidi in Identity Governance, Sailpoint

Validation scripts are amongst the most common features while working with Sailpoint Identity IQ’s workflow forms. When we have common validation logic for multiple fields, it is always good to maintain this piece of logic in a separate rule library and call it from the validation script whenever required. This encourages modularity of the code and decreases code redundancy.

 

The way in which the name space of a validation script of a form in the workflow behaves is quite different from the rest of the workflow. Initial declaration of referenced libraries does well for referring the code in other parts of the workflow. But this does not work with validation scripts.

 

The following syntax should be used when we are using the rule referencing in validation scripts –

<ValidationScript>

<Includes>

<Reference class=”sailpoint.object.Rule” name=”Rule-Library-Name”/>

</Includes>

<Source>

// your code that calls some useful function in the rule library

</Source>

</ValidationScript>

 

 

Resolved : Manage Account Request Problem in SailPoint IIQ

Posted on by Neetika Malhotra in Cyber Security, Identity Governance, Sailpoint, Technology

Environment:

SailPoint Version : 7.0, 7.1

Problem Statement:

Unable to request a new account for existing identity from Manage Accounts in SailPoint IIQ.

Problem : Account Request Option is not available

 

Solution :

Firstly we need to check the Lifecycle Manager Configurations, navigate to Lifecycle Manager and in Configure tab Search for Manage Accounts options :

Applications that support account only requests : Select all applications check box or specified application according to your requirement.

Solution part 1- Select all applications

 

Allow Manage Accounts Additional Account Requests : Enable
Allow Manage Existing Accounts : Enable
Allow Account Only Requests : Enable

–> If you are using higher version of SailPoint 6.4 then you will face problem in finding these 3 options to enable them.

Solution 1 :

For that you need to edit init-lcm.xml and import it again in iiq console. (This will effect pre-existing workflows and LCM Configuration. So, to avoid that follow Solution 2).

Follow these steps and pictures shown below for editing init-lcm.xml (Solution 1)

 Step 1: init-lcm.xml is present in ~identityIQ/WEB-INF/config/init-lcm.xml location. Make a copy of it and place it in a safe folder.

 

Now open init.xml and search for Manage Accounts under QuickLink tag.

In init.xml search Manage Account

 

Carefully observe 3 entries under Manage Accounts tag.

Original_init-lcm.xml of SailPoint 7.1 version

 

Step 2: Make few changes by enabling this options manually from false to true 3 times in Quicklink Manage Accounts tag as shown in the picture below.

<entry key=”allowManageAccountsAdditionalAccountRequests” value=”false” />
<entry key=”allowManageExistingAccounts” value=”true” />
<entry key=”allowAccountOnlyRequests” value=”false” />

After editing : <entry key=”allowManageAccountsAdditionalAccountRequests” value=”true” />
<entry key=”allowManageExistingAccounts” value=”true” />
<entry key=”allowAccountOnlyRequests” value=”true” />

 

After Editing Manage Accounts Configuration

 

Step 3: Now save it and import it in iiq console. By using command import init-lcm.xml. After importing observe following changes.

Step 4: Request Account option is available (Issue Resolved). Choose the application for account request. Submit the form.

 

Request Option Available Now 7.1

> Just for Reference in SailPoint 7.0  it will look like this as shown in the picture below.

Request Option Available in SailPoint 7.0

 

 

Step 5: Confirm Account Action . Click Confirm at the end of the page.

Confirm Account Request

 

Solution 2 :

You can get same results by configuring through Debug Pages.

Step 1: Go to Debug Page > Select object QuickLink from dropdown list. Choose Manage Accounts.

Step 2: Follow same Step 2 in Solution 1.

Step 3: Request Account option is available (Issue Resolved).

 

Sailpoint IdentityIQ Pass through Authentication via Active Directory

Posted on by Ganesh Kandekar in Identity Governance, Sailpoint, Technology

When working with the Cloud, organizations of any scale wish to have common credentials across on-premise applications and the cloud applications. It’s the best user experience as well as the best IT management experience. The overhead of facilitating this can be quite a large endeavor.

Sailpoint’s IIQ provides Pass-through authentication using which a Login into IdentityIQ can be done via an enterprise directory credentials or via SSO credentials.

With pass-through authentication in Sailpoint IdentityIQ, password validation takes place through Application Configured in IdenitytIQ. What this means is a simple, but effective SSO solution for the end user. The below presentation gives a quick overview of concepts of Pass Through Authentication and how it is implemented in Sailpoint IdentityIQ.

The presentation is followed by different use cases demonstrated.