How to Configure SailPoint IdentityNow Integration

Overview

IdentityNow is a Software as a Service (SaaS) identity governance solution from SailPoint. This guide covers the steps required to configure OAuth Service Account in either Password Safe or Password Safe Cloud for SailPoint IdentityNow.

For more information, please see IdentityNow for BeyondTrust Password Safe at https://community.sailpoint.com/t5/Connector-Directory/IdentityNow-for-BeyondTrust-Password-Safe/ta-p/211776.

Steps for the service account creation also applies to SailPoint IdentityIQ, but the focus of this guide is IdentityNow.

Step-by-Step Installation and Configuration

Creating an IdentityNow service account in BeyondInsight requires the following:

• Create a user group
• Enable features and Smart Groups for the user group
• Create a user account and add it to the user group
• Log in to BeyondInsight as the new service account user to generate OAuth credentials.

The below sections detail the steps to take to accomplish the above.

Create a New Group for the Service Account

To create a local group in BeyondInsight, follow the below steps:

1. Navigate to Configuration > Role Based Access > User Management.

2. From the Groups tab, click + Create New Group.

 

3. Select Create a New Group.
4. Enter a Group Name and Description for the group.
5. Click Create Group.
6. Follow the steps in the below sections to enable features and Smart Group for your newly created group.

 

In addition to creating groups locally, you can import Active Directory, Entra ID, and LDAP groups into BeyondInsight.

Enable Features for the Group

To enable features for a group in BeyondInsight, assign permissions to the features as follows:

1. Go to Configuration > Role Based Access > User Management.
2. From the Groups tab, find the group and click on the corresponding ellipsis to right of the group.
3. Select View Group Details from the list.
4. Click Features located under Group Details.
5. Select All Features from the Show dropdown above the grid to display a list of features in the grid.

6. Select the Management Console Access feature and click Assign Permissions > Assign Permissions Read Only above the grid. This permission is required so the service account can log in to BeyondInsight and obtain the service accounts’ unique OAuth credentials.
7. Select the following features and click Assign Permissions > Assign Permissions Full Control above the grid.
   • Options - Connectors: This feature is required to allow the creation of OAuth credentials by the member account. In production, this permission could be removed after connection is established, but is needed again to cycle client_secret and refresh_token.
   • Password Safe Account Management: This feature is required to read or write managed accounts through the public API.
   • Password Safe Role Management: This feature is required to allow visibility into account Smart Groups, which are assigned via user groups in BeyondInsight.
   • Smart Rule Management - Managed Account: This feature is required to manage Smart Rules for managed accounts.
   • User Accounts Management: This feature is required for the service account to manage user groups and user accounts.

 

Enable Smart Groups for the Group

To enable Smart Groups for a group in BeyondInsight, assign permissions to the Smart Groups as follows:

1. Go to Configuration > Role Based Access > User Management.
2. From the Groups tab, find the group and click on the corresponding ellipsis to right of the group.
3. Select View Group Details from the list.
4. Click Smart Groups located under Group Details.
5. Select All Smart Groups from the Show dropdown above the grid to display a list of Smart Groups in the grid.

6. Select the All Managed Accounts Smart Group and click Assign Permissions > Assign Permissions Read Only above the grid.

Managed Account Smart Groups with a category of Managed Accounts are visible via the SCIM API. Managed Account Smart Groups with a category of Platforms are not visible. However, you can recreate the same Smart Group with a category of Managed Accounts.

 

Create a New User and Assign to Group

Once the group is created and assigned the appropriate features and Smart Groups permissions, you can create a new account in BeyondInsight for the service account and add it to the group.

Permissions are assigned only to the group, not to the account.

1. Go to Configuration > Role Based Access > User Management.
2. From the Users tab, click Create New User.
3. Select Create a New User.

 

4. Provide Identification, Credentials, Contact Information, User Status, and Authentication Options as needed.
5. Click Create User.

6. You are taken to the details page for the user account where Groups is automatically selected. Select All Groups from the Show dropdown above the Groups grid to list all available user groups.
7. Locate the group you created above for the service account, select it, and then click Assign Group above the grid.

In addition to creating user accounts locally, you can import AD, Entra ID, and LDAP accounts and add them to either local or imported groups.

 

Generate OAuth Credentials

Once the user account is created and assigned to a group, you must log in as the new user to generate OAuth credentials.

1. Go to Configuration > General > Connectors.
2. Under Connectors, select the SCIM connector. Once selected, the SCIM connector information displays.

Do not select the SailPoint connector. This was available in previous versions of BeyondInsight, but it is an older integration and is not based on SCIM.

3. Each logged-in account in BeyondInsight has a unique client ID. The Client ID is located within the SCIM connector information. Highlight the ID, right-click, and save locally as client_id to a text file.
4. Click Recycle Client Secret.
5. Click Recycle on the Recycle Secret Access Key pop-up. This generates a unique access key.
6. Highlight the Client Secret access key, right-click, and save as client_secret to a text file.
7. Click Generate Refresh Token if you want to use this method of authentication. Use the account login password when prompted.

 

The refresh token is used in the production environment. Client credentials (client ID and client secret) are used in a lab or test environment. Every Password Safe user with full control permissions to the Options – Connectors feature can obtain a Client ID and Client Secret via the connector.

Only one SCIM connector can be created by Password Safe per instance.

Configure the BeyondTrust Source Type in IdentityNow

BeyondTrust provides an Access Data Source supported by default with IdentityNow. Once IdentityNow has visibility into a data source, it can manage information at the source location.

Users must have the appropriate credentials to log in to IdentityNow.

Configure a Source Type for BeyondTrust

1. In the IdentityNow console, go to Admin > Connections > Sources.
2. Click the New button in the top right corner.
3. Under Source Type select BeyondTrust Password Safe - Cloud.
4. Include a Source Name, Description, Source Owner, and Connection Type.
5. Click Continue.

 

6. On the next screen, under Base Configuration, select a Virtual Appliance Cluster.
7. Click Save.

 

Update Connection Settings

1. In the IdentityNow console, go to Admin > Connections > Sources. Select the test source.
2. On the next screen, click the Edit Configuration button in the top right corner.
3. On the next screen, select Connection Settings on the left hand side.
4. For a production environment, select the API Token option. For a test environment, select the OAuth 2.0 option.
5. Fill out the rest of the form as required with information saved earlier in the Generate OAuth Credentials section.
6. Click Save.

 

7. Once connection settings have been saved, test the connection:
   1. Select Review and Test on the right hand side of the screen.
   2. Click Test Connection on the upper left hand side of the screen.

 

Aggregate Accounts and Entitlements

1. In the IdentityNow console, go to Admin > Connections > Sources. Select the test source.
2. On the next screen, select the Import Data tab.
3. Select Account Aggregation and enter the necessary information.
4. Click Save.
5. Select Entitlement Aggregation and enter the necessary information.
6. Click Save.

 

Smart Group Permissions

Within Password Safe, permissions are granted via groups. A Smart Group is a filtered list of managed accounts. All managed accounts are granted the read only permission.

1. In the Password Safe console, go to Configuration > Role Based Access > User Management > Groups. Select the group and then click on the corresponding ellipsis to right of the group.
2. Select View Group Details.
3. Select Smart Groups under Group Details.
4. Select a managed account and then Assign Permissions.
5. Assign permissions as read only.
6. Select the managed account again and then click on the corresponding ellipsis to right of the account.
7. Select Edit Password Safe Roles.
8. Assign role as Requestor.
9. Select Access Policy for Requestor from the drop down.
10. Click Save Roles.

 

View User Entitlements

To view user entitlements and Password Safe groups assigned to the user:

1. In the IdentityNow console, go to Admin > Connections > Sources. Select the test source.
2. Select Accounts.
3. Select the user.
4. Select Accounts.
5. Select the Source Name.
6. Scroll to the bottom of the screen to view entitlements.

 

7. To view Entitlement Details and Permissions, expand the appropriate user group.
8. Select either the Details tab or Permissions tab to view information. Here you can find the target (Smart Group/Rule All Managed Accounts), Smart Group Permissions (Read or Write), and the Password Safe Role (Requestor).

 

Create Profile

BeyondTrust source types come with a preconfigured Create Profile.

1. In the IdentityNow console, go to Admin > Connections > Sources. Select the test source.
2. Select Accounts.
3. Select Create Profile.

 

Correlation

BeyondTrust source types come with a preconfigured Correlation.

1. In the IdentityNow console, go to Admin > Connections > Sources. Select the test source.
2. Select Import Data.
3. Select Correlation.

 

Schema

BeyondTrust source types come with a preconfigured Schema.

1. In the IdentityNow console, go to Admin > Connections > Sources. Select the test source.
2. Select Import Data.
3. Select Correlation.

 

Once the BeyondTrust source is in place, you have access to IdentityNow business processes including Access Request, Access Certification, automated provisioning for Joiner, Mover, Leaver, Search and Analytics, and more.

It is possible to create Access Profiles that consume Password Safe Groups and then assign the Access Profiles to Roles or Applications.

For more information on assigning Access Profiles to Roles or Applications, please visit SaaS Product Documentation / IdentityNow at https://documentation.sailpoint.com.