How to Configure SailPoint IdentityNow Integration

Overview

IdentityNow is a Software as a Service (SaaS) identity governance solution from SailPoint. This guide covers the steps required to configure OAuth Service Account in either Password Safe or Password Safe Cloud for SailPoint IdentityNow.

For more information, please see IdentityNow for BeyondTrust Password Safe at https://community.sailpoint.com/t5/Connector-Directory/IdentityNow-for-BeyondTrust-Password-Safe/ta-p/211776.

Steps for the service account creation also applies to SailPoint IdentityIQ, but the focus of this guide is IdentityNow.

Step-by-Step Installation and Configuration

Configure the BeyondTrust Source Type in IdentityNow

BeyondTrust provides an Access Data Source supported by default with IdentityNow. Once IdentityNow has visibility into a data source, it can manage information at the source location.

Users must have the appropriate credentials to log in to IdentityNow.

Configure a Source Type for BeyondTrust

Configure a Source Type

  1. In the IdentityNow Console, go to Admin > Connections > Sources.
  2. Click the New button in the top right corner.
  3. Under Source Type select BeyondTrust Password Safe - Cloud.
  4. Include a Source Name, Description, Source Owner, and Connection Type.
  5. Click Continue.

 

Assign a Virtual Appliance Cluster

  1. On the next screen, under Base Configuration, select a Virtual Appliance Cluster.
  2. Click Save.

 

Update Connection Settings

Update Connection Settings

  1. In the IdentityNow Console, go to Admin > Connections > Sources. Select the test source.
  2. On the next screen, click the Edit Configuration button in the top right corner.
  3. On the next screen, select Connection Settings on the left hand side.
  4. For a production environment, select the API Token option. For a test environment, select the OAuth 2.0 option.
  5. Fill out the rest of the form as required with information saved earlier in the How to Configure SailPoint IdentityNow Integration section.
  6. Click Save.

 

Test Connection

  1. Once connection settings have been saved, test the connection:
    1. Select Review and Test on the right hand side of the screen.
    2. Click Test Connection on the upper left hand side of the screen.

 

Aggregate Accounts and Entitlements

Aggregate Accounts and Entitlements

  1. In the IdentityNow Console, go to Admin > Connections > Sources. Select the test source.
  2. On the next screen, select the Import Data tab.
  3. Select Account Aggregation and enter the necessary information.
  4. Click Save.
  5. Select Entitlement Aggregation and enter the necessary information.
  6. Click Save.

 

Smart Group Permissions

Within Password Safe, permissions are granted via groups. A smart group is a filtered list of managed accounts. All managed accounts are granted the read only permission.

Assign Password Safe Role as Requestor

  1. In the Password Safe Console, go to Configuration > Role Based Access > User Management > Groups. Select the group and then click on the corresponding ellipsis to right of the group.
  2. Select View Group Details.
  3. Select Smart Groups under Group Details.
  4. Select a managed account and then Assign Permissions.
  5. Assign permissions as read only.
  6. Select the managed account again and then click on the corresponding ellipsis to right of the account.
  7. Select Edit Password Safe Roles.
  8. Assign role as Requestor.
  9. Select Access Policy for Requestor from the drop down.
  10. Click Save Roles.

 

View User Entitlements

To view user entitlements and Password Safe groups assigned to the user:

View Password Safe Groups Assigned to User

  1. In the IdentityNow Console, go to Admin > Connections > Sources. Select the test source.
  2. Select Accounts.
  3. Select the user.
  4. Select Accounts.
  5. Select the Source Name.
  6. Scroll to the bottom of the screen to view entitlements.

 

Entitlement Details and Permissions

  1. To view Entitlement Details and Permissions, expand the appropriate user group.
  2. Select either the Details tab or Permissions tab to view information. Here you can find the target (Smart Group/Rule All Managed Accounts), Smart Group Permissions (Read or Write), and the Password Safe Role (Requestor).

 

Create Profile

BeyondTrust source types come with a preconfigured Create Profile.

BeyondTrust Pre-configured Profile

  1. In the IdentityNow Console, go to Admin > Connections > Sources. Select the test source.
  2. Select Accounts.
  3. Select Create Profile.

 

Correlation

BeyondTrust source types come with a preconfigured Correlation.

BeyondTrust Pre-configured Correlation

  1. In the IdentityNow Console, go to Admin > Connections > Sources. Select the test source.
  2. Select Import Data.
  3. Select Correlation.

 

Schema

BeyondTrust source types come with a preconfigured Schema.

BeyondTrust Pre-configured Schema

  1. In the IdentityNow Console, go to Admin > Connections > Sources. Select the test source.
  2. Select Import Data.
  3. Select Correlation.

 

Once the BeyondTrust source is in place, you have access to IdentityNow business processes including Access Request, Access Certification, automated provisioning for Joiner, Mover, Leaver, Search and Analytics, and more.

Password Safe Applications

It is possible to create Access Profiles that consume Password Safe Groups and then assign the Access Profiles to Roles or Applications.

For more information on assigning Access Profiles to Roles or Applications, please visit SaaS Product Documentation / IdentityNow at https://documentation.sailpoint.com.

 

Example Application with Access Profile for Password Safe Group