Connecting SailPoint and Delimited File

To connect SailPoint with Delimited File, perform the following tasks:

Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

1. Sign in to SailPoint.
2. Go to Admin > Connections > Sources.
3. Select Create New.
4. Search for the connector by entering the name in the search box, and then select Configure.

5. Enter the following information:

   • Source Name - Enter a name for the new source.
   • Description - Enter a description for the new source to help distinguish it from similar sources.

   • Source Owner - Begin typing the name of an owner. Matches appear after you type two or more letters.

     Note

     You must add a source owner at the same time as you add a Name, Description, and Source Type while creating the source.

   • Platform Type - Select VA Based.

     • VA Based - A direct connection fetches data from the Virtual Appliance Cluster you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the Virtual Appliance Reference Guide.

   • Governance Group (Optional) - Select an optional governance group from the dropdown list.

   • Select Authoritative Source if the source will be used as the account source for an identity profile. For more information, refer to Creating Identity Profiles.

6. Select Continue to create the new source with your selections.

Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.

2. In the Source Owner dropdown list, select the identity that owns this source.

   • To find a source owner, begin entering their name.

3. In the Virtual Appliance Cluster dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to SailPoint Virtual Appliances.

4. (Optional) If enabled for your organization, select the Use a Credential Provider checkbox to manage the source's authentication using a credential provider.

   Note

   To add a credential provider, go to Admin > Connections > Credential Providers. For more information about credential providers, refer to Credential Providers.

5. Configure the authentication to allow SailPoint to connect to the source. Refer to Connection Settings for more information.

6. (Optional) In the Governance Group for Source Management dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to Associating Governance Groups with a Source.

7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   • Enable Provisioning - Set the toggle to Enabled to allow the source to create, update, and deactivate accounts in the connected source system.

   • Disable Provisioning - Set the toggle to Disabled to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.

8. Select Save.

Connection Settings

This section contains the information that this connector uses to connect and interact with the application. Each application type requires different information to create and maintain a connection. The fields displayed in Connection Settings depend on your File Transport and Authentication Type selections. The following file transport methods are available:

• SFTP
• FTPS
• SCP
• AWS S3
• SMB

SFTP

1. In File Transport, select SFTP to access the file.
2. Enter the Host name where the file is located.
3. Enter the Port number to use to establish a connection.

4. For Authentication Type, select Basic or Public Key.

   Basic

   Screenshot

   

   1. Select Basic as the authentication type.
   2. Enter the Username to use during the file transfer.
   3. Enter the Password for the user to use during the file transfer.

   Public Key

   Screenshot

   

   1. Select Public Key as the authentication type.
   2. Enter the Username to use during the file transfer.
   3. Enter the SSH Private Key content to use to establish a connection. Paste the full private key in PEM or OpenSSH format. Do not enter a file path.
   4. (Optional) Enter the SSH Private Key Passphrase for the private key.

5. Select Save.

FTPS

1. In File Transport, select FTPS to access the file.
2. Enter the Host name where the file is located.
3. Enter the Port number to use to establish a connection.

4. For Authentication Type, select Basic or Client Certificate.

   Basic

   Screenshot

   

   1. Select Basic as the authentication type.
   2. Enter the Username to use during the file transfer.
   3. Enter the Password for the user to use during the file transfer.

   Client Certificate

   Screenshot

   

   1. Select Client Certificate as the authentication type.
   2. Enter the Username to use during the file transfer.
   3. Enter the Password for the user to use during the file transfer.
   4. Enter the FTPS Client Certificate (PKCS12 Base64) content to use to establish a connection. Paste the Base64-encoded content of your PKCS12 (.p12) client certificate file.
   5. (Optional) Enter the FTPS Client Certificate Passphrase for the client certificate.

   Note

   The connector uses a hybrid model: the client certificate authenticates the TLS layer, and Username and Password authenticate the FTP protocol layer. Both are always required.

5. Select Save.

SCP

1. In File Transport, select SCP to access the file.
2. Enter the Host name where the file is located.
3. Enter the Port number to use to establish a connection.
4. Enter the Username to use during the file transfer.
5. Enter the Password for the user to use during the file transfer.
6. Select Save.

AWS S3

Before configuring AWS S3, ensure you have completed the S3 File Transport prerequisites, including the required IAM permissions on the target bucket and objects. For more information, refer to Prerequisites.

1. In File Transport, select AWS S3 to access the file.
2. Enter the S3 Bucket name where the file is located.
3. Enter the S3 Region name where the bucket is located.

4. For Authentication Type, select IAM User or IAM Role.

   IAM User

   Screenshot

   

   1. Select IAM User as the authentication type.
   2. Enter the Access Key ID to use during the file transfer.
   3. Enter the Secret Access Key to use during the file transfer.

   IAM Role

   Screenshot

   

   With IAM Role, the connector assumes a role through AWS STS. For the requirements and the AWS setup procedures, refer to Prerequisites.

   1. Select IAM Role as the authentication type.
   2. Enter the Role Name of the IAM role to assume, for example S3ReaderRole. Enter the name only, not the full ARN. The connector builds the ARN. A path-qualified name such as sailpoint/S3ReaderRole is accepted.
   3. (Optional) Enter the Account ID, the 12-digit AWS account ID where the role exists. Leave this field blank when the role is in the same account as the virtual appliance - the connector detects that account automatically. This field is required only for cross-account access.
   4. (Optional) Enter the External ID. Provide it only if the target role's trust policy requires an external ID. The value must match the policy's sts:ExternalId condition exactly.
   5. (Optional) Enter the Role Session Name. This identifies the session in AWS CloudTrail and can be used in sts:RoleSessionName policy conditions. When blank, the connector generates a name from the source ID so each source is separately identifiable.
   6. (Optional) Enter the Role Session Duration (seconds), which is how long each assumed session lasts, between 3600 and 43200. Defaults to 3600. The value cannot exceed the target role's Maximum session duration. Credentials refresh automatically before expiry, so this does not limit how long an aggregation can run.

5. Select Save.

SMB

SMB reads the file from a Windows File Server share or a Samba share. Before configuring SMB, ensure you have completed the SMB File Transport prerequisites, including the Kerberos and virtual appliance requirements. For more information, refer to Prerequisites.

1. In File Transport, select SMB to access the file.
2. Enter the fully qualified Host name of the SMB server, for example fileserver.example.com. Do not enter an IP address.
3. Enter the Port number to use to establish a connection. Default: 445
4. Enter the Share Name to read from, for example Data. Enter the share name only, without the server name or leading backslashes.
5. Enter the Kerberos Realm that issues tickets for the service account, for example EXAMPLE.COM. For Active Directory, this is the DNS domain in uppercase.
6. Enter the Username of the service account to use during the file transfer. Enter either the account name, which the connector combines with the Kerberos Realm, or a full principal such as svc_aggregation@EXAMPLE.COM. Use the full principal when the account belongs to a different realm than the share.
7. Enter the Password for the service account.
8. (Optional) Enter the Kerberos Configuration Directory on the virtual appliance that contains the Kerberos configuration file, krb5.conf or krb5.config. Enter the directory only, not the filename. If you leave this field blank, the connector searches /opt/sailpoint/ccg/lib/custom and /home/sailpoint/ccg, then the default Java location.
9. Complete the file settings, including the file name, delimiter, and schema. For more information, refer to File Settings.
10. Select Test Connection.

A successful Test Connection confirms that the service account authenticated with Kerberos, that the share was reached, and that the account file was opened. Aggregation still requires that the file contain account rows after the header. If Test Connection succeeds and aggregation reports that there is no valid data in the file, compare the file size on the share with the file size on the file server.

Parsing Settings

Configure the parsing technique the connector uses to parse the data file: Delimited or Regular Expression.

• Delimited - When Parsing Type is set to Delimited, select the edit button for the schema in File Settings to enter the character to use as a delimiter.
• Regular Expression - When Parsing Type is set to Regular Expression, select the edit button for the schema in File Settings to enter the regular expression using regular expression groups to break the data into tokens.

File Settings

For each schema type, specify the attributes to use during aggregation.

Account Schema File Settings

Complete the following tasks to configure the file path, parsing, merging, and filtering settings for the Account schema:

File

Use the File Path attribute to specify the path to the export file that the Delimited File source uses for the Account Schema.

Enter the path and name of the data file that should be parsed.

Parsing

Use the following parsing attributes for the Account Schema:

• Delimiter
  • Applicable when Parsing Type is set to Delimited.
  • Enter the character to use as a delimiter.
  • If the delimiter is a Unicode character, use the \u format. For example, \u0009 is used for the tab character.
• Regular Expression
  • Applicable when Parsing Type is set to Regular Expression.
  • Enter the regular expression using regular expression groups to break the data into tokens.
• Columns - Enter the names of the columns to use when parsing the file.
  • If you are using the Regular Expression parsing type, this field is required.
  • If you are using the Delimited parsing type, configure this field only if there is no header defined or you want to rename the columns used in the buildMap rule.

Filtering

Use the following filtering attributes for the Account schema:

• Number of Lines to Skip - Enter the Number of Lines to Skip in the data file before parsing the data. For example, when the value is set to 1, the connector skips the first line of data from the input file along with the header line.

  Note

  The first line of the input file consists of column headers. For the Regular Expression parsing type, the connector skips the header section during aggregation if the value is set to 1.

• Filter Empty - Select this checkbox to filter out any objects that parse but have no attributes.

• Comment Character - Enter a comment character in the Comment Character field. Records that start with the comment character are skipped by the source. The default value is #.

• Filter String - Enter a string that represents a filter object in the Filter String field. Any object that matches this filter is excluded from the dataset and is not returned. For example, the following filter excludes all objects from the Marketing department:

  department == "Marketing"
  

Merging

Use the following merging attributes for the Account Schema of the Delimited File source:

• Data sorted by the indexColumn(s) - Select this checkbox if the data is sorted by the index columns. If the data is not sorted, an in-memory representation of the data is built and used.
• Ignore case while merging - Select this checkbox to ignore case during the merge. The Data sorted by the indexColumn(s) option must be selected.

Group Schema File Settings

Complete the following tasks to configure the file path, parsing, merging, and filtering settings for the Account schema:

File

Use the File Path attribute to specify the path to the export file that the Delimited File source uses for the Account Schema.

Enter the path and name of the data file that should be parsed.

Parsing

Use the following parsing attributes for the Account Schema:

• Delimiter
  • Applicable when Parsing Type is set to Delimited.
  • Enter the character to use as a delimiter.
  • If the delimiter is a Unicode character, use the \u format. For example, \u0009 is used for the tab character.
• Regular Expression
  • Applicable when Parsing Type is set to Regular Expression.
  • Enter the regular expression using regular expression groups to break the data into tokens.
• Columns - Enter the names of the columns to use when parsing the file.
  • If you are using the Regular Expression parsing type, this field is required.
  • If you are using the Delimited parsing type, configure this field only if there is no header defined or you want to rename the columns used in the buildMap rule.

PATCH https://{orgName}.api.identitynow.com/v3/sources/:id

[
    {
        "op": "add",
        "path": "/connectorAttributes/group.delimiter",
        "value": <delimiter_character>
    }
]

Filtering

Use the following filtering attributes for the Group schema:

• Number of Lines to Skip - Enter the Number of Lines to Skip in the data file before parsing the data. For example, when the value is set to 1, the connector skips the first line of data from the input file along with the header line.

  Note

  The first line of the input file consists of column headers. For the Regular Expression parsing type, the connector skips the header section during aggregation if the value is set to 1.

• Filter Empty - Select this checkbox to filter out any objects that parse but have no attributes.

• Comment Character - Enter a comment character in the Comment Character field. Records that start with the comment character are skipped by the source. The default value is #.

• Filter String - Enter a string that represents a filter object in the Filter String field. Any object that matches this filter is excluded from the dataset and is not returned. For example, the following filter excludes all objects from the Marketing department:

  department == "Manufacturing"
  

Merging

Use the following merging attributes for the Account Schema of the Delimited File source:

• Data sorted by the indexColumn(s) - Select this checkbox if the data is sorted by the index columns. If the data is not sorted, an in-memory representation of the data is built and used.
• Ignore case while merging - Select this checkbox to ignore case during the merge. The Data sorted by the indexColumn(s) option must be selected.

Encryption Settings

Provide the encryption configuration for the file, including options for PGP decryption attributes to ensure successful processing.

• PGP Encrypted File - Enable this if the file is encrypted with PGP. The file is automatically decrypted during the aggregation process.
• PGP Private Key - Applicable when PGP Encrypted File is selected. Enter the PGP private key used to decrypt the file's data.
• PGP Private Key Password - Applicable when PGP Encrypted File is selected. Enter the password for the PGP private key used to decrypt the file's data.

Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to Review and Test.

2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.

3. Select Test Connection.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.