Additional Configuration Parameters

This section contains information on additional parameters you can configure to modify connector behavior that are not available in the UI. Configure these parameters in the source configuration using the Identity Security Cloud REST API. This page contains the following sections:

Note
For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

  • Additional Configuration Parameters

  • Additional binary/Sid/Guid Attributes

  • Caching Ports

Additional Configuration Parameters

The following attributes can be added in the source configuration using the REST API:

To roll back a created account when one or more requested attributes for that account fail during provisioning operations, set this attribute to true as follows:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/rollbackCreatedAccountOnError",
    "value": true
  }
]

By default, the msDS-SupportedEncryptionTypes attribute for gMSA accounts is returned as a text representation (for example, AES128,AES256). This can cause mismatches during provisioning verification, as the provisioned value is typically numeric (for example, 24).

When gmsaMsDSSupportedEncryptionTypesInNumeric is set to true in the source configuration using the REST API, the connector returns the attribute in its numeric format, matching the behavior of regular service accounts:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/gmsaMsDSSupportedEncryptionTypesInNumeric",
    "value": true
  }
]

When set to true, native postscript errors are returned as warnings instead of errors for all update operations. The value for reportPostScriptFailuresAsWarnings must be passed as a string. This ensures that attributes are successfully provisioned to Active Directory and reflect in Identity Security Cloud.

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/reportPostScriptFailuresAsWarnings",
    "value": "true"
  }
]

The default behavior of unlocking the account on change password can be turned off by setting the unlockOnChangePassword attribute to false. The value for unlockOnChangePassword must be passed as a string. Default: true

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/unlockOnChangePassword",
    "value": "true"
  }
]

Set it to true to enable attribute request level results. The value for setAttributeLevelResult must be passed as a string. Default: false

Enabling this parameter marginally increases the time taken to process the request.

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/setAttributeLevelResult",
    "value": "true"
  }
]

Count of maximum retry attempts for Active Directory aggregation in case of failures with retry-able errors. The value for aggregationMaxRetries must be passed as a string. Default: 5

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/aggregationMaxRetries",
    "value": "5"
  }
]

Delay in seconds between each retry attempt of aggregation. The value for aggregationRetryThreshold must be passed as a string. Default: 10 seconds

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/aggregationRetryThreshold",
    "value": "10"
  }
]

Microsoft Lync/Skype for Business Server to be managed by the connector.

Add the manageLync attribute in the source configuration using the REST API:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/manageLync",
    "value": true
  }
]

List of attributes used to search for a user during Pass Through Authentication.

Configure the authSearchAttributes attribute in the source configuration using the REST API:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/authSearchAttributes",
    "value": ["sAMAccountName", "msDS-PrincipalName", "mail"]
  }
]

Defines the number of cache elements to store in memory (RAM). The value for memoryStoreSizeInElements must be passed as a string. To store all elements in memory and nothing on disk, specify the value as -2:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/memoryStoreSizeInElements",
    "value": "-2"
  }
]

Default: false

To disable auto detection of group membership pre-loading for forests, set the value to true. The value for disableComputePreloading must be passed as a boolean:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/disableComputePreloading",
    "value": true
  }
]

During full aggregation, dirsync cookies are fetched per domain using concurrent threads. To fetch cookies sequentially on a single thread, set the value to true. The value for useSingleThreadedCookieSearch must be passed as a boolean:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/useSingleThreadedCookieSearch",
    "value": true
  }
]

CN is used as the default display name for contact objects in Identity Security Cloud. To use another schema attribute, define the attribute name as the value of this parameter:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/displayAttributeForContacts",
    "value": "firstName"
  }
]

Default: false

To disable aggregating foreign memberships of any user, set the value to true. The value for disableFspAggregation must be passed as a boolean:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/disableFspAggregation",
    "value": true
  }
]

For an Active Directory managed system not to generate further references (crossRef objects) in response to the search query, add the following entry in the source configuration using the REST API:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/ldapExtendedControls",
    "value": ["1.2.840.113556.1.4.1339"]
  }
]

Active Directory connector search does not rely on referrals to fetch information from the managed system. To aggregate comprehensive data, Domain Settings configuration must be up to date with required information.

Default: false

If set to true during account delta aggregation, the connector does not call Active Directory to check whether the deleted object was in scope of the source. The value for skipDeletedObjScopeCheckInDelta must be passed as a string.

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/skipDeletedObjScopeCheckInDelta",
    "value": "true"
  }
]

If the deleted object is present in the Identity Security Cloud database, it is deleted from the database. If the deleted object is not in the Identity Security Cloud database, no further action is performed.

Default: false

If set to true during account delta aggregation, the connector does not call Active Directory to check if the objectType of a member is added or removed from a group. The value for skipObjTypeCheckForMembersInDelta must be passed as a string:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/skipObjTypeCheckForMembersInDelta",
    "value": "true"
  }
]

If the object is present in the Identity Security Cloud database, membership is updated.

Default: false

If set to true, the DNS server is not used to find the Domain Controller for any given domain in serverless configuration. The value for skipBindUsingDNS must be passed as a string:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/skipBindUsingDNS",
    "value": "true"
  }
]

The connector always calls IQService to find the domain controller.

Default: false

If set to true, the connector does not call Active Directory to get additional attributes of the changed object intercepted during delta aggregation:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/skipGetObjInMembershipDelta",
    "value": "true"
  }
]

The connector fetches these additional attributes if the user has entitlement changes along with attribute changes, or if the user has add, remove, or both entitlement changes.

When skipGetObjInMembershipDelta is set to true, the resource object sent to Identity Security Cloud contains only the attributes intercepted during delta aggregation.

Default: false

By default, pass-through authentication (PTA) searches for users in the entire domain defined (when multiple searchDNs are configured), which can delay PTA.

To limit PTA to configured search DNs only, set the following entry to true in the source configuration using the REST API (applies to pass-through authentication only). The value for searchInContainers must be passed as a boolean:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/searchInContainers",
    "value": true
  }
]

To disable hostname verification during LDAP communication over TLS, configure the following attribute in the source configuration using the REST API. The value for disableLDAPHostnameVerification must be passed as a boolean:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/disableLDAPHostnameVerification",
    "value": true
  }
]

Default: false

If set to true, the connector does not consider the iterate search filter configured for a single search DN to authenticate the user in pass-through authentication (PTA). The value for skipIterateSearchFilterInPTA must be passed as a boolean:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/skipIterateSearchFilterInPTA",
    "value": true
  }
]

If the searchInContainers flag is set to true, it takes precedence over skipIterateSearchFilterInPTA.

Default: false

By default, when buildPartialROOnAuthentication is set to false, the connector builds a full resource object, which can take time and cause login delay.

When buildPartialROOnAuthentication is set to true in the source configuration using the REST API, the connector builds a partial resource object and sets identity, display, and other attributes used in correlation such as samAccountName, improving login performance. The value for buildPartialROOnAuthentication must be passed as a boolean:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/buildPartialROOnAuthentication",
    "value": true
  }
]

(Applicable only for User Delta Aggregation) Define this attribute in domain settings to override the iterate filter defined in Search Scope for Users.

(Applicable only for Delta Aggregation) This attribute skips the iterate search filter when set to true while performing DirSync delta aggregation.

Additional binary/Sid/Guid Attributes

To display additional binary/SID/GUID attributes, use the following entries:

To display attribute values in binary format, which is also the default display format:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/attrsDisplayInBinaryFormat",
    "value": ["Attribute name1", "Attribute name2"]
  }
]

To display attribute values in SID format:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/attrsDisplayInSIDFormat",
    "value": ["Attribute name1", "Attribute name2"]
  }
]

To display attribute values in GUID format:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/attrsDisplayInGUIDFormat",
    "value": ["Attribute name1", "Attribute name2"]
  }
]

Caching Ports

Port numbers for the caching mechanism to replicate cached data across different task servers.

Note
SailPoint recommends that the ports are open and not in use by another application.

To enable cache, set the value to true:

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/enableCache",
    "value": true
  }
]

The default value is 40001.

The default value is 40002.

Maximum time in minutes to wait for membership cache replication on task server. Default: 10 minutes

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/cacheReplicationTimeout",
    "value": 20
  }
]

Maximum time in milliseconds to wait for client sockets to send messages to a remote listener. Default: 2000 milliseconds.

Copy 
[
  {
    "op": "add",
    "path": "/connectorAttributes/cacheSocketTimeoutMillis",
    "value": 5000
  }
]