Skip to content

Integrating SailPoint with BeyondTrust Password Safe (On-Premise)

Integration

This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

The SailPoint and Privileged Account Management source for BeyondTrust Password Safe (On-Premise) provides a standardized approach to managing accounts in SailPoint.

This document is designed to give specific information about the requirements and field definitions needed to get a working instance of a BeyondTrust Password Safe (On-Premise) source.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

This page briefly lists the features supported by the BeyondTrust Password Safe (On-Premise) connector. It also lists supported use cases that the connector can assist with.

Note

Before you can use any item marked with an asterisk (*), SailPoint must activate the feature for your site. For more information on opening a support ticket, refer to Working With Services.

Account Management

  • Aggregation (local and external users)

    Note

    Local users are users which reside locally in the PAM system. External users are users synced from a managed system outside of the PAM system.

  • Aggregate a single account

  • Create account through provisioning (local users only)
  • Enable and disable accounts through provisioning
  • Add and remove entitlement(s)
  • Delete accounts

Entitlement Management (groups)

  • Group aggregation
  • Aggregate a single group
  • Aggregate Container permissions as Direct permissions

Supported Use Cases

The following use cases are facilitated by the BeyondTrust Password Safe (On-Premise) connector.

Read Operation

  • Fetch local and external users from the PAM system.
  • Fetch local groups from the PAM system.
  • View Safes/Containers and view how their permissions are assigned to groups.

Provisioning

  • Create local users on the PAM system.
  • Add or remove internal and external users from local groups. This indirectly assigns and revokes Safes and their associated permissions.
  • Enable or disable internal and external users residing on the PAM system.

For more information on features, refer to Source Features.

Prerequisites

  • For a successful connection FQDN of the Machine on which BeyondTrust Password Safe (On-Premise) Solution is installed must be defined, instead of the IP address.
  • For VA-based Deep Governance connectors, the source and credential provider virtual appliances must be in the same cluster.
  • VA-based Deep Governance connectors, SaaS-based Discovery connectors, and Quick Compliance connectors now support the use of credential providers.
  • Copy the Certificate of the Beyond Trust instance to the Certificates folder in the VA located at /home/sailpoint.
  • Have hostname mapping for the Host on the VA.
  • Restart the CCG.

Supported Managed Systems

The BeyondTrust On-Premise source supports the following managed systems:

  • BeyondInsight version 21.3.0.1710; Patch Version 21.3.0.1746
  • BeyondInsight version 24.2.0
  • BeyondInsight version 24.3.0

Administrator Permissions

For the permissions and access details, refer to the BeyondTrust BeyondInsight Guides.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.