# SailPoint Databricks Connector Documentation

> Databricks Connector Documentation

# Documentation

# Connecting SailPoint and Databricks

To connect SailPoint with Databricks, perform the following tasks:

## Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

> [!IMPORTANT]
>
> By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration.

**To configure a new source:**

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Sources**.
3. Select **Create New**.
4. Search for the connector by entering the name in the search box, and then select **Configure**.
5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
8. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
9. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
10. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.
2. In the **Source Owner** dropdown list, select the identity that owns this source.

   - To find a source owner, begin entering their name.
3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
4. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information.
5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
6. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system.
   - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.
7. Select **Save**.

## Connection Settings

This section contains the information that the source uses to connect to and authenticate with the Databricks managed system. After you select **Connection Settings** the following page is displayed.

The source supports the following authentication types:

- Databricks M2M
- Microsoft Entra

### Configuring the Account Host

Complete these steps for every authentication type.

> [!NOTE]
>
> **Screenshot: Use Vanity Account URL Off**
>
> [![Connection Settings with Use Vanity Account URL turned off](<https://documentation.sailpoint.com/connectors/databricks/saas/help/img/connection_settings_vanity_off.png>)](<https://documentation.sailpoint.com/connectors/databricks/saas/help/img/connection_settings_vanity_off.png>)

> [!NOTE]
>
> **Screenshot: Use Vanity Account URL On**
>
> [![Connection Settings with Use Vanity Account URL turned on and the Vanity Account URL field displayed](<https://documentation.sailpoint.com/connectors/databricks/saas/help/img/connection_settings_vanity_on.png>)](<https://documentation.sailpoint.com/connectors/databricks/saas/help/img/connection_settings_vanity_on.png>)

1. Select the **Cloud Type** for your Databricks cloud provider. The source uses the standard account host for that cloud unless you select **Use Vanity Account URL**.
2. (Optional) Select **Use Vanity Account URL** if the Databricks account uses a custom domain. Authentication still uses the standard account host for the selected **Cloud Type**.
3. If you selected **Use Vanity Account URL**, enter the HTTPS URL for the custom domain in **Vanity Account URL**, such as `https://company.azuredatabricks.net`. Do not include a path or a trailing slash.

   > **Important**
   >
   > The source uses the vanity account URL for account and workspace API calls only. Allow network access to both the custom domain and the standard Databricks account host for the selected **Cloud Type**.

### Configuring Databricks M2M or Microsoft Entra Authentication

1. Select **Databricks M2M** or **Microsoft Entra** as the **Authentication Type**.
2. Select a **Grant Type** for OAuth authentication. The default value is **Client Credentials**.
3. If you use Microsoft Entra authentication, enter the **Tenant ID** for your Microsoft Entra ID (Azure AD) tenant.
4. Enter the **Client ID** for the Service Principal. The Service Principal must have permissions to manage users, groups, and workspaces.
5. Enter the **Client Secret** for the Service Principal.
6. Enter the **Account ID** of your Databricks account. You can find this in your account console URL or account settings. For more information, refer to [Prerequisites](<https://documentation.sailpoint.com/connectors/databricks/saas/help/index.html#prerequisites>).
7. Enter the **Metastore ID** to govern all workspaces within the Unity Catalog metastore.
8. Select **Save**.

## Workspace Settings

Configure workspace filtering to control which workspaces are included in aggregation and provisioning flows. If filtering is disabled, all workspaces attached to the metastore will be included.

> [!NOTE]
>
> **Screenshot**
>
> [![Workspace Settings](<https://documentation.sailpoint.com/connectors/databricks/saas/help/img/Workspace_Settings.png>)](<https://documentation.sailpoint.com/connectors/databricks/saas/help/img/Workspace_Settings.png>)

1. Enable **Filter Workspaces** to filter workspaces by ID.
2. Select a **Workspace Filter Type** to include or exclude the specified workspaces.
3. Enter the **Workspace IDs** to include or exclude. Press Enter after each ID to add it to the list.
4. Select **Save**.

## Aggregation Settings

> [!NOTE]
>
> **Screenshot**
>
> [![Data Object Privileges](<https://documentation.sailpoint.com/connectors/databricks/saas/help/img/Data_Object_Privileges.png>)](<https://documentation.sailpoint.com/connectors/databricks/saas/help/img/Data_Object_Privileges.png>)

Enable to aggregate Unity Catalog **Data Object Privileges**. When enabled, select the specific object types to include:

- **Catalog**: Aggregate privileges for catalog-level objects.
- **Schema**: Aggregate privileges for schema-level objects.
- **Table**: Aggregate privileges for table-level objects.
- **Volume**: Aggregate privileges for volume-level objects.
- **Function**: Aggregate privileges for function-level objects.

> [!IMPORTANT]
>
> - In the **Edit Account and Entitlement Schema**, select **Include permissions in aggregations** before you proceed with aggregation.
> - If the specified workspace is unreachable, Unity Catalog privileges will not be included during aggregation. If you do not provide a workspace ID, the connector will randomly select a workspace ID during aggregation.

### Default Workspace

> [!NOTE]
>
> **Screenshot**
>
> [![Default Workspace](<https://documentation.sailpoint.com/connectors/databricks/saas/help/img/Default_Workspace.png>)](<https://documentation.sailpoint.com/connectors/databricks/saas/help/img/Default_Workspace.png>)

Provide the specific default workspace ID for fetching Unity Catalog level privileges within the current Metastore. The connector uses the corresponding workspace host or Fully Qualified Domain Name to perform the fetch operations.

### Workspace Bound Data Object Privileges

Select **Workspace Bound Data Object Privileges** to aggregate data object privileges that are bound to workspaces.

### Data Object Owner

Select **Include Data Object Owner in Privilege** to aggregate ownership information for Unity Catalog securable objects. When enabled, the source fetches the owner for each data object.

### Additional Settings

> [!NOTE]
>
> **Screenshot**
>
> [![Page Size](<https://documentation.sailpoint.com/connectors/databricks/saas/help/img/page_size.png>)](<https://documentation.sailpoint.com/connectors/databricks/saas/help/img/page_size.png>)

In the **Page Size** field, enter the number of records to aggregate in a single page when iterating over large datasets. The value can range from 1 to 100. The default is 100.

## Agent Governance Settings

Select **Enable Databricks Agents** to include Databricks Agents in aggregation. Select **Save** to apply changes.

> [!IMPORTANT]
>
> Agent aggregation is only supported for workspace based agent.

> [!NOTE]
>
> **Screenshot**
>
> [![Agent Governance Settings](<https://documentation.sailpoint.com/connectors/databricks/saas/help/img/Agent_Governance_Settings.png>)](<https://documentation.sailpoint.com/connectors/databricks/saas/help/img/Agent_Governance_Settings.png>)

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Data Access Security

## Identity Collectors

Databricks source can synchronize identity data into Data Access Security through Identity Collectors. An Identity Collector synchronizes identity data such as accounts and attributes from the source into DAS. DAS uses this data when you create DAS applications for identity forensics and permission analysis.

> [!IMPORTANT]
>
> You need a license to access Identity Collectors. Contact your SailPoint Customer Success Manager (CSM) to request access and for more information.

## Prerequisites

Before you configure Identity Collectors, ensure the following requirements are met:

- Your tenant has a Data Access Security license.
- Data Access Security Identity Collectors is enabled for your tenant.
- You completed Source Setup for the Databricks source.

> [!NOTE]
>
> **Screenshot**
>
> [![Identity Collectors on the Data Access Security page](<https://documentation.sailpoint.com/connectors/databricks/saas/help/img/data_access_security.png>)](<https://documentation.sailpoint.com/connectors/databricks/saas/help/img/data_access_security.png>)

## Creating an Identity Collector

To create an Identity Collector:

1. Select **Create Identity Collector**.
2. Enter a unique **Name** for the Identity Collector.
3. Select **Save**. This links the Identity Collector to your source and sets Databricks as a collector type.

   > **Note**
   >
   > You can also manage Identity Collectors that you create here under **Data Access Security \> Admin \> Identity Collectors**. For more information on managing Identity Collectors in the Data Access Security, refer to [Create an Identity Collector](<https://documentation.sailpoint.com/das/help/acct_entitlement_aggregation/create_idc.html>).

## Editing or Deleting an Identity Collector

To edit an Identity Collector:

1. Select the Identity Collector you want to edit.
2. Select **Edit**.
3. Update the **Name**.
4. Select **Save**.

To delete an Identity Collector:

1. Select the Identity Collector you want to delete.
2. Select **Delete**.
3. Confirm the deletion.

# Dataset Management

Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history.

> [!NOTE]
>
> Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>) for more information.

For more information, refer to [Managing Datasets and Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html>) for datasets, resources, owner correlation, and aggregation.

## Datasets

A *dataset* is a named group of one or more related resources that the source aggregates together.

When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources.

> [!NOTE]
>
> Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them.

### Dataset Aggregation

Configure aggregation on the **Dataset Aggregations** tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to [Configuring Dataset Aggregations](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

## Resources

A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model.

In the UI, each resource appears under **Dataset Management** \> **Resources** with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation.

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

### Owner Correlation

Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to [Configuring Owner Correlation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-owner-correlation>).

## Supported Datasets

Go to **Dataset Management \> Datasets** on your Databricks source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation.

> [!NOTE]
>
> Configure aggregation for each dataset separately. For more information, refer to [Dataset Aggregation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

| Dataset name | Associated resources | Dataset ID |
| --- | --- | --- |
| **Databricks Mosaic AI Agents** | Databricks Mosaic AI Agent | `databricks:mosaic` |

For schema attribute definitions, refer to [Databricks Mosaic AI Agent Attributes](<#databricks-mosaic-ai-agent-attributes>).

Before you aggregate Mosaic AI agents, enable agent collection on the **Dataset Aggregations** tab for the dataset in **Dataset Management** \> **Datasets**. For more information, refer to [Dataset Aggregation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

## Supported Resources

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

> [!NOTE]
>
> When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources.

Under **Dataset Management** \> **Resources**, the Databricks source lists each object type that is aggregated. Select a resource to review its schema on the **Schema** tab.

| Resource name | Resource type | Resource ID |
| --- | --- | --- |
| **[Databricks Mosaic AI Agent](<#databricks-mosaic-ai-agent-attributes>)** | Agent | `databricks:mosaic-agent` |

## Databricks Mosaic AI Agent Attributes

Schema attributes for the **Databricks Mosaic AI Agent** resource (`databricks:mosaic-agent`).

| Attribute name | Description | Type | Entitlement | Multi-Valued |
| --- | --- | --- | --- | --- |
| ACLAssignments | Principal ACL assignments as a stringified JSON array of {principalType, principal, permissionLevel}; populated only when ACL aggregation is enabled | string | No | No |
| agentIdentifier | Composite resource identity: agentName@workspaceId | string | No | No |
| aiGateway | AI gateway settings as stringified JSON (usage\_tracking\_config, inference\_table\_config) | string | No | No |
| config | Entire serving endpoint config as a stringified JSON object, verbatim (includes served\_entities and served\_models) | string | No | No |
| creationTimestamp | Creation time as ISO-8601 UTC (converted from Unix epoch millis) | string | No | No |
| creator | Email or identifier of the user who created the agent | string | No | No |
| creatorDisplayName | Display name of the creator | string | No | No |
| creatorKind | Kind of creator (for example User or ServicePrincipal) | string | No | No |
| description | Description of the agent | string | No | No |
| id | Unique identifier of the serving endpoint (agent) | string | No | No |
| lastUpdatedTimestamp | Last-updated time as ISO-8601 UTC (converted from Unix epoch millis) | string | No | No |
| name | Name of the agent (serving endpoint) | string | No | No |
| permissionLevel | Caller's permission level on the agent (CAN\_MANAGE \| CAN\_QUERY \| CAN\_VIEW) | string | No | No |
| spBusinessApplication | Business application identifier for Mosaic AI agents; fixed value databricks\_mosaic\_ai\_agents | string | No | No |
| spDescription | Agent description; mirrors the description attribute value | string | No | No |
| spStatus | Normalized agent status derived from state. Aggregation: ready READY -\> Active; otherwise Inactive (any NOT\_READY, or missing/unreadable state). Enable Agent only: ready NOT\_READY + config\_update IN\_PROGRESS without system\_update\_failure is reported Active (warm-up), reconciled by the next aggregation | string | No | No |
| state | Operational state as a stringified JSON (ready, config\_update, suspend, system\_update\_failure) | string | No | No |
| tags | Endpoint tags as a stringified JSON array of key/value objects | string | No | No |
| task | Task type (for example agent/v1/responses) | string | No | No |
| workspaceId | ID of the Databricks workspace containing this agent | string | No | No |
| workspaceName | Name of the Databricks workspace containing this agent | string | No | No |

# Diagnosing Connection Issues

## Timeout Errors and Settings

Timeout errors might occur when SailPoint is waiting for a response from the connector-runtime. These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down.

This document is designed to give specific information that can be used to resolve these errors.

Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error.

To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the connector-runtime using the SailPoint REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

### aggregateTimeout

**Description:** This parameter is set for the aggregation timeout, measured in seconds.

**Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds.

For example:

If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/aggregateTimeout",
        "value": 600
    }
]
```

### healthCheckTimeout

**Description:** This parameter is set for the test connection and health check timeout.

**Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again.

For example:

If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/healthCheckTimeout",
        "value": 45
    }
]
```

### provisioningTimeout

**Description:** This parameter is set for provisioning timeout.

**Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds.

For example:

If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/provisioningTimeout",
        "value": 360
    }
]
```

### timeout

**Description:** This parameter is set for pass-through authentication timeout.

**Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again.

For example:

If your current time value is 15 seconds, update the `timeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/timeout",
        "value": 30
    }
]
```

### apiTimeout

**Description:** This parameter is set for API time tracking; customers can check it using an external tool.

**Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again.

For example:

If your current time value is 60 seconds, update the `apiTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/apiTimeout",
        "value": "75"
    }
]
```

## Enable Connector Logging

This topic provides the steps needed to enable logging on SailPoint using REST APIs.

> [!NOTE]
>
> This topic only applies to VA-based integrations.

> [!NOTE]
>
> The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector.

This process is broken up into four steps:

1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging.
2. Get the logging configuration for the existing VA cluster.
3. Update the VA cluster to enable logging levels.
4. Observe logging changes to the logging levels.

### Identify the Virtual Appliance Cluster

Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>).

1. Make the following call to the REST API to return a list of available VA clusters:

   GET /v3/managed-clusters

   The REST API returns a response that looks similar to the following:

   ```json
   [
       {
           "id": "2c9180866166b5b0016167c32ef31a66",
           "name": "Development Cluster",
           "description": "Development Cluster",
           "clientType": "CCG",
           "ccgVersion": "373_535_70.2.0",
           "pinnedConfig": true,
           "logConfiguration": null
       },
       {
           "id": "2c9180846a93ce60016ab29f039944de",
           "name": "Cloud Cluster",
           "description": "Cloud Cluster",
           "clientType": "CCG",
           "ccgVersion": "373_535_70.2.0",
           "pinnedConfig": true,
           "logConfiguration": {
               "clientId": null,
               "durationMinutes": 60,
               "expiration": "2020-12-15T19:13:36.079Z",
               "rootLevel": "DEBUG",
               "logLevels": {
                   "sailpoint.connector.ADLDAPConnector": "DEBUG"
               }
           }
       }
   ]
   ```

   > **Note**
   >
   > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster.
2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute.

### Get the Logging Configuration

Get your selected VA's cluster logging configuration and identify the values you need to update.

1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier.

   GET /v3/managed-clusters/{id}/log-config

   - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response.
   - If the VA has an existing logging configuration, it returns something similar to the following:

     ```json
     {
         "clientId": null,
         "durationMinutes": 60,
         "expiration": "2020-12-15T19:13:36.079Z",
         "rootLevel": "DEBUG",
         "logLevels": {
             "sailpoint.connector.ADLDAPConnector": "DEBUG"
         }
     }
     ```

     You'll need to configure the following information in the response:

     - `durationMinutes` is the number of minutes logging should remain enabled.
     - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>).
     - `logLevels` is a map object with logging classes as keys and logging levels as values.

       - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes.
       - For a list of available values, refer to [Logging Levels](<#logging-levels>).

### Update Logging Configuration

Update the VA cluster configuration returned by the REST API to update the logging settings as needed.

1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier.

   PUT /v3/managed-clusters/{id}/log-config
2. Submit your configuration changes to the REST API in a JSON body.

   - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one.
   - If the VA returned a configuration, you can edit it to include the changes.

   The JSON body should be as follows:

   ```json
   {
       "durationMinutes": 60,
       "rootLevel": "DEBUG",
       "logLevels": {
           "sailpoint.connector.ADLDAPConnector": "DEBUG"
       }
   }
   ```

   Consider the following as you edit the JSON:

   - `durationMinutes` is the number of minutes logging should remain enabled.
   - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>).
   - `logLevels` is a map object with logging classes as keys and logging levels as values.

     - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes.
     - For a list of available values, refer to [Logging Levels](<#logging-levels>).

   If the update was successful, the REST API should return a response similar to the following:

   ```json
   {
       "clientId": null,
       "durationMinutes": 60,
       "expiration": "2020-12-15T19:13:36.079Z",
       "rootLevel": "DEBUG",
       "logLevels": {
           "sailpoint.connector.ADLDAPConnector": "DEBUG"
       }
   }
   ```

### Observe Logging Changes

Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**.

### References

The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file.

#### Logging Levels

| Logging Level | Description |
| --- | --- |
| ERROR | Designates error events that might still allow the connector to continue. |
| WARN | Designates potentially harmful situations. |
| INFO | Designates information messages that highlight process at a coarse-grain level. |
| DEBUG | Very verbose. Fine grain logging levels used for development and debugging. |
| TRACE | Most verbose. Finer grain logging levels than debugging. |

#### Logging Classes

| Connector | Logging Class |
| --- | --- |
| Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector |
| AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector |
| Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT |
| Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector |
| Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector |
| Microsoft Entra ID | sailpoint.connector.AzureADConnector |
| Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter |
| Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter |
| Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT |
| Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter |
| Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter |
| GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter |
| Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter |
| IBM i | openconnector.connector.IBMiConnector |
| Lotus Domino | sailpoint.connector.LotusDomino |
| JDBC | sailpoint.connector.JDBCConnector |
| Sun One LDAP | sailpoint.connector.LDAPConnector |
| Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector |
| Microsoft Office365 | sailpoint.connector.Office365Connector |
| Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 |
| Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT |
| Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector |
| Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector |
| Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter |
| Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector |
| Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector |
| Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector |
| PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter |
| PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector |
| RemedyForce | sailpoint.connector.ForceConnector |
| RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter |
| Salesforce | sailpoint.connector.ForceConnector |
| SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector |
| SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector |
| SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT |
| SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector |
| SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter |
| SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter |
| ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter |
| ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter |
| Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter |
| Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter |
| Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter |
| SuccessFactors | sailpoint.connector.SuccessFactorsConnector |
| Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector |
| Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter |
| Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter |
| Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter |
| Web Services | sailpoint.connector.WebServices |
| XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter |
| Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter |
| Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter |

# Integrating SailPoint with Databricks

This guide provides instructions for integrating SailPoint with Databricks to centralize identity aggregation, access governance, and automated lifecycle management. Using a service principal with OAuth 2.0 authentication, the SailPoint source interfaces directly with Databricks Account and Workspace APIs. This integration supports comprehensive identity management across both account and workspace levels for a single metastore.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Key Capabilities

The integration provides the following capabilities:

- **Identity Aggregation**: Import users, service principals, groups, and membership data.
- **Access Governance**: Manage workspace access and automate entitlement assignments.
- **Lifecycle Management**: Streamline the provisioning and deprovisioning of identities.
- **Compliance**: Automate governance workflows to ensure audit readiness.

> [!NOTE]
>
> Managing multiple metastores requires the configuration of separate application instances within SailPoint.

## Supported Features

The SailPoint Databricks source supports the following features:

### Authentication and Account Host

- Databricks custom (vanity) account URLs for account and workspace API routing.

> [!NOTE]
>
> The standard Databricks account hosts and the existing Databricks M2M and Microsoft Entra authentication types remain supported and are unchanged by default.

### Account Aggregation

The source aggregates the following objects:

#### Account Objects

- Users
- Service principals

### Entitlement Aggregation

The source aggregates the following entitlements:

#### Groups

- Databricks groups as groups

#### Workspace Access

- Workspace Permission as `workspaceEntitlements`

#### Account Roles

- Connected Account Roles as `accountLevelRoles`

### Group Aggregation

- Aggregation of Databricks groups with connected permissions aggregated.
- Aggregation of roles (account level).
- Aggregation of all workspace access along with permissions.
- Connected permissions are also aggregated.

> [!NOTE]
>
> "Group Aggregation" is Databricks-specific terminology.

### Provisioning Support

User Provisioning

| Operation | Supported |
| --- | --- |
| Create user | Yes |
| Update user | Yes |
| Disable user | Yes |
| Enable user | Yes |
| Delete user | Yes |
| Add/Remove Entitlement | Yes |

### Non-Human Identity Discovery

- Aggregate Databricks Mosaic AI agents

Refer to Dataset Management for more information.

Refer to [Discovering Potential Non-Human Accounts](<https://documentation.sailpoint.com/saas/help/agentic_fabric/nhi/non_human_accounts.html#discovering-potential-non-human-accounts>) for more information.

## Agent Management

The Databricks source supports governance of Mosaic AI Agents (serving endpoints) at the workspace level through Dataset 2.0.

| Feature | Description |
| --- | --- |
| Aggregation of workspace-level agents | Discovers and aggregates Mosaic AI agents (serving endpoints) from configured Databricks workspaces. Agents are collected via Dataset 2.0 (`databricks:mosaic`) and exposed as resources of type `std:agent` (`databricks:mosaic-agent`). Aggregated attributes include agent ID, name, creator, timestamps, workspace details, configuration, and operational state. |
| Activate/Deactivate agent | Supports lifecycle management of workspace-level agents through Activate Agent and Deactivate Agent provisioning actions. |

### Agent Status Mapping

During aggregation, the source normalizes the Databricks agent state object into `spStatus` (**Active** or **Inactive**) using the fields below.

| spStatus | Ready |
| --- | --- |
| Active | READY |
| Inactive | NOT\_READY |

> [!NOTE]
>
> When an agent is activated, Databricks takes approximately 2-3 minutes to fully start it. The activate (start) API returns a `success (200)` response immediately, but at that point the agent is still starting up and reports `ready = NOT_READY` with `config_update = IN_PROGRESS`. For the activate-agent use case only, the connector treats this transitional state as **Active**, since the agent is on its way to becoming ready.

## Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

| Privilege Level | Description |
| --- | --- |
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |

> [!NOTE]
>
> To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to [Managing Privilege Classification](<https://documentation.sailpoint.com/saas/help/loading_entitlements/privilege_classification.html>).

## Prerequisites

Before configuring the source, ensure the following requirements are met:

- Databricks account is active
- Identity federation is enabled
- At least one workspace exists
- OAuth authentication is allowed
- You are a Databricks Account Admin
- Network allows outbound HTTPS to Databricks
- Firewall allows OAuth token exchange
- Network allows access to the custom domain and to the standard Databricks account host, if you use a vanity account URL

## Configuring the Databricks Connector

Complete the following steps in Databricks before connecting:

### Creating a Service Principal

- Sign in to the Databricks Account Console as an Account Admin.
- Create Service Principal:

  1. Go to **User Management**.
  2. Select **Service Principals**.
  3. Click **Add Service Principal**.
  4. Enter a name (for example, `SailPoint-source`).
  5. Select **Create**.

### Assigning Required Roles

1. Select the service principal.
2. Open **Roles**.
3. Select **Assign** and select **Account admin**.
4. Save.

### Generating OAuth Credentials

1. Open the service principal in the Account Console.
2. Go to **Secrets/Credentials**.
3. Select Generate Secret.
4. Choose expiration.
5. Copy the following:

   - Client ID
   - Client Secret

### Retrieving Your Account ID

To retrieve your account ID:

1. Go to the [account console](<https://accounts.cloud.databricks.com/>).
2. Select the down arrow next to your username in the upper right corner.
3. In the drop-down menu, view and copy your **Account ID**.

   > **Note**
   >
   > You must be in the account console to retrieve the account ID. The ID will not display inside a workspace.

For more information, refer [Databricks Account Settings Documentation](<https://docs.databricks.com/aws/en/admin/account-settings/>).

### Retrieving Your Metastore ID

For more information on retrieving your metastore ID, refer [Find Your Metastore ID](<https://kb.databricks.com/unity-catalog/find-your-metastore-id>).

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

## Required Permissions

The source requires a dedicated Databricks service principal with administrative privileges.

> [!NOTE]
>
> The service account must have admin permissions on all workspaces you want to manage in the source environment.

### Minimum Required Roles

| Role | Scope |
| --- | --- |
| Account Admin | Account |

## Generate Client ID and Client Secret for Azure Authentication

### Register the Application in Azure Portal

The client ID is the unique identifier for your registered application. To register the application:

1. Sign in to the [Azure Portal](<https://portal.azure.com/#home>).
2. Search for and select **Microsoft Entra ID** (formerly Azure Active Directory).
3. In the left sidebar, select **App registrations \> + New registration**.
4. Enter a name for your application (for example, `Databricks-Automation`), and then select Register.
5. On the **Overview** page, copy the **Application (client) ID**. This is your client ID.

### Generate the Client Secret

The client secret is the password your application uses to authenticate. To generate the client secret:

1. In your registered app’s menu, select **Certificates &amp; secrets**.
2. Select **\+ New client secret**.
3. Enter a description, choose an expiration period, and then select **Add**.
4. Immediately copy the **Value** (not the Secret ID).

> [!IMPORTANT]
>
> The client secret value is displayed only once and cannot be retrieved later. Store it securely.

### Add the Service Principal to Databricks

After you generate credentials, you must authorize this identity in your Databricks workspace. To add the service principal:

1. Sign in to your Azure Databricks workspace.
2. Select your username in the upper right corner, and then select **Settings**.
3. Go to **Identity and access \> Service principals \> Manage**.
4. Select **Add service principal \> Add new**.
5. Paste the **Application (client) ID** that you copied from the Azure Portal, and then enter a display name.
6. Select **Add**.

# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The Databricks connector uses the following default correlation and object configurations.

## Default Correlation Configuration

Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements.

You can customize the correlation configuration. Refer to [Assigning Source Accounts to Identities](<https://documentation.sailpoint.com/saas/help/accounts/correlation.html>) for more information.

When you first create the Databricks source, the default correlation mapping is:

| Account Attribute | Operation | Identity Attribute |
| --- | --- | --- |
| workEmail | Equals | Work Email |
| displayName | Equals | Display Name |

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| id | Account |

### Default Account Attributes

The Databricks connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attributes | Description |
| --- | --- |
| id | Unique identifier for the user or service principal |
| userName | User's unique login name (email address) |
| displayName | Display name of the user or service principal |
| givenName | User's first name |
| familyName | User's family name |
| workEmail | User's work email address |
| active | Status of the User or Service Principal |
| externalId | External identifier for the user or service principal (from identity provider) |
| applicationId | Application ID of the Service Principal |
| type | Identity type: USER or SERVICE\_PRINCIPAL |
| identityScope | Identity scope: account or federated |
| federatedWorkspaces | Comma-separated list of workspaces the identity is federated to |
| totalGroupMembershipCount | Total count of group memberships |
| isAccountAdmin | Whether the identity is an account admin |
| directWorkspacePermissions | Direct workspace permissions in format Workspace@Role |
| groups | Direct groups the user belongs to |
| accountLevelRoles | Account level roles assigned to the group |
| workspaceEntitlements | Workspace entitlements in format entitlement@workspace |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Group Attributes

The Databricks connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

### Group Schema

| Attributes | Description |
| --- | --- |
| id | Unique identifier for the group |
| displayName | Group display name |
| type | Type of the group |
| identityScope | Identity scope (account/federated/legacy) |
| externalId | External identifier for the group |
| federatedWorkspaces | List of workspaces into which group is federated |
| totalGroupMembershipCount | Total count of group membership |
| isAccountAdmin | Whether the group is an account admin |
| directWorkspacePermissions | Direct workspace permissions in format workspace@permission |
| parentGroups | Represents the parent groups that this group is a member of |
| accountLevelRoles | Account level roles assigned to the group |
| workspaceEntitlements | Workspace entitlements linked to this group (format: entitlement@workspace) |

### Account Role Schema

| Attributes | Description |
| --- | --- |
| name | Account-level role name |

### Workspace

| Attributes | Description |
| --- | --- |
| workspacePermission | The unique identifier for the workspace with associated privilege |
| workspacePermissionIdentifier | The unique identifier for the workspace id associated privilege |
| workspaceId | The unique numerical ID for the workspace |
| workspaceName | Name of the workspace |
| workspaceStatus | Lifecycle state of the workspace |
| workspaceStatusMessage | Detailed status or error message for the workspace |

## Machine Identity Schema

Machine Identity attributes define the multiple types of machine identities that can be assigned to the managed system's user accounts.

| Attributes | Description |
| --- | --- |
| creationTimestamp | Date when the agent was created |
| creator | Email or identifier of the user who created the agent |
| creatorDisplayName | Display name of the creator |
| creatorKind | Kind of creator (for example, User) |
| description | Description of the agent |
| id | Unique identifier of the serving endpoint (agent) |
| lastUpdatedTimestamp | Date when the agent was last updated |
| name | Name of the agent (serving endpoint) |
| routeOptimized | Boolean representing if route optimization has been enabled for the endpoint |
| task | Task type (for example, agent/v1/responses) |
| workspaceId | ID of the Databricks workspace containing this agent |
| workspaceName | Name of the Databricks workspace containing this agent |

# Enable Connector Logging

This topic provides the steps needed to enable logging on SailPoint using REST APIs.

> [!NOTE]
>
> This topic only applies to VA-based integrations.

> [!NOTE]
>
> The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector.

This process is broken up into four steps:

1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging.
2. Get the logging configuration for the existing VA cluster.
3. Update the VA cluster to enable logging levels.
4. Observe logging changes to the logging levels.

### Identify the Virtual Appliance Cluster

Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>).

1. Make the following call to the REST API to return a list of available VA clusters:

   GET /v3/managed-clusters

   The REST API returns a response that looks similar to the following:

   ```json
   [
       {
           "id": "2c9180866166b5b0016167c32ef31a66",
           "name": "Development Cluster",
           "description": "Development Cluster",
           "clientType": "CCG",
           "ccgVersion": "373_535_70.2.0",
           "pinnedConfig": true,
           "logConfiguration": null
       },
       {
           "id": "2c9180846a93ce60016ab29f039944de",
           "name": "Cloud Cluster",
           "description": "Cloud Cluster",
           "clientType": "CCG",
           "ccgVersion": "373_535_70.2.0",
           "pinnedConfig": true,
           "logConfiguration": {
               "clientId": null,
               "durationMinutes": 60,
               "expiration": "2020-12-15T19:13:36.079Z",
               "rootLevel": "DEBUG",
               "logLevels": {
                   "sailpoint.connector.ADLDAPConnector": "DEBUG"
               }
           }
       }
   ]
   ```

   > **Note**
   >
   > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster.
2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute.

### Get the Logging Configuration

Get your selected VA's cluster logging configuration and identify the values you need to update.

1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier.

   GET /v3/managed-clusters/{id}/log-config

   - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response.
   - If the VA has an existing logging configuration, it returns something similar to the following:

     ```json
     {
         "clientId": null,
         "durationMinutes": 60,
         "expiration": "2020-12-15T19:13:36.079Z",
         "rootLevel": "DEBUG",
         "logLevels": {
             "sailpoint.connector.ADLDAPConnector": "DEBUG"
         }
     }
     ```

     You'll need to configure the following information in the response:

     - `durationMinutes` is the number of minutes logging should remain enabled.
     - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>).
     - `logLevels` is a map object with logging classes as keys and logging levels as values.

       - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes.
       - For a list of available values, refer to [Logging Levels](<#logging-levels>).

### Update Logging Configuration

Update the VA cluster configuration returned by the REST API to update the logging settings as needed.

1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier.

   PUT /v3/managed-clusters/{id}/log-config
2. Submit your configuration changes to the REST API in a JSON body.

   - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one.
   - If the VA returned a configuration, you can edit it to include the changes.

   The JSON body should be as follows:

   ```json
   {
       "durationMinutes": 60,
       "rootLevel": "DEBUG",
       "logLevels": {
           "sailpoint.connector.ADLDAPConnector": "DEBUG"
       }
   }
   ```

   Consider the following as you edit the JSON:

   - `durationMinutes` is the number of minutes logging should remain enabled.
   - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>).
   - `logLevels` is a map object with logging classes as keys and logging levels as values.

     - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes.
     - For a list of available values, refer to [Logging Levels](<#logging-levels>).

   If the update was successful, the REST API should return a response similar to the following:

   ```json
   {
       "clientId": null,
       "durationMinutes": 60,
       "expiration": "2020-12-15T19:13:36.079Z",
       "rootLevel": "DEBUG",
       "logLevels": {
           "sailpoint.connector.ADLDAPConnector": "DEBUG"
       }
   }
   ```

### Observe Logging Changes

Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**.

### References

The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file.

#### Logging Levels

| Logging Level | Description |
| --- | --- |
| ERROR | Designates error events that might still allow the connector to continue. |
| WARN | Designates potentially harmful situations. |
| INFO | Designates information messages that highlight process at a coarse-grain level. |
| DEBUG | Very verbose. Fine grain logging levels used for development and debugging. |
| TRACE | Most verbose. Finer grain logging levels than debugging. |

#### Logging Classes

| Connector | Logging Class |
| --- | --- |
| Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector |
| AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector |
| Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT |
| Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector |
| Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector |
| Microsoft Entra ID | sailpoint.connector.AzureADConnector |
| Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter |
| Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter |
| Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT |
| Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter |
| Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter |
| GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter |
| Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter |
| IBM i | openconnector.connector.IBMiConnector |
| Lotus Domino | sailpoint.connector.LotusDomino |
| JDBC | sailpoint.connector.JDBCConnector |
| Sun One LDAP | sailpoint.connector.LDAPConnector |
| Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector |
| Microsoft Office365 | sailpoint.connector.Office365Connector |
| Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 |
| Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT |
| Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector |
| Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector |
| Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter |
| Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector |
| Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector |
| Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector |
| PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter |
| PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector |
| RemedyForce | sailpoint.connector.ForceConnector |
| RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter |
| Salesforce | sailpoint.connector.ForceConnector |
| SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector |
| SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector |
| SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT |
| SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector |
| SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter |
| SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter |
| ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter |
| ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter |
| Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter |
| Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter |
| Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter |
| SuccessFactors | sailpoint.connector.SuccessFactorsConnector |
| Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector |
| Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter |
| Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter |
| Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter |
| Web Services | sailpoint.connector.WebServices |
| XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter |
| Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter |
| Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter |

# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](<https://documentation.sailpoint.com/saas/help/sources/managing_additional_settings.html>).

## Data discrepancy in Full and Single account aggregation

**Issue**: Some fields, such as workspace entitlements, may not be retrieved in single account aggregation but are retrieved in full aggregation.

**Resolution**: Verify that the service account has the required permissions for the workspace. The service account may lack the necessary permissions to access the workspace.

## Connection fails when a vanity account URL is configured

**Issue**: The test connection or aggregation fails after you select Use Vanity Account URL.

**Resolution**: Verify that Vanity Account URL is an HTTPS URL with no path and no trailing slash. Because authentication uses the standard Databricks account host for the selected Cloud Type, verify that your network allows access to both the custom domain and that standard host.

# Timeout Errors and Settings

Timeout errors might occur when SailPoint is waiting for a response from the connector-runtime. These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down.

This document is designed to give specific information that can be used to resolve these errors.

Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error.

To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the connector-runtime using the SailPoint REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

### aggregateTimeout

**Description:** This parameter is set for the aggregation timeout, measured in seconds.

**Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds.

For example:

If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/aggregateTimeout",
        "value": 600
    }
]
```

### healthCheckTimeout

**Description:** This parameter is set for the test connection and health check timeout.

**Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again.

For example:

If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/healthCheckTimeout",
        "value": 45
    }
]
```

### provisioningTimeout

**Description:** This parameter is set for provisioning timeout.

**Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds.

For example:

If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/provisioningTimeout",
        "value": 360
    }
]
```

### timeout

**Description:** This parameter is set for pass-through authentication timeout.

**Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again.

For example:

If your current time value is 15 seconds, update the `timeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/timeout",
        "value": 30
    }
]
```

### apiTimeout

**Description:** This parameter is set for API time tracking; customers can check it using an external tool.

**Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again.

For example:

If your current time value is 60 seconds, update the `apiTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/apiTimeout",
        "value": "75"
    }
]
```