# Connecting SailPoint and Delimited File To connect SailPoint with Delimited File, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. Enter the following information: - **Source Name** - Enter a name for the new source. - **Description** - Enter a description for the new source to help distinguish it from similar sources. - **Source Owner** - Begin typing the name of an owner. Matches appear after you type two or more letters. > **Note** > > You must add a source owner at the same time as you add a Name, Description, and Source Type while creating the source. - **Platform Type** - Select **VA Based**. - **VA Based** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Governance Group (Optional)** - Select an optional governance group from the dropdown list. - Select **Authoritative Source** if the source will be used as the account source for an identity profile. For more information, refer to [Creating Identity Profiles](). 6. Select **Continue** to create the new source with your selections. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Select **Save**. ## Connection Settings This section contains the information that this connector uses to connect and interact with the application. Each application type requires different information to create and maintain a connection. The fields displayed in Connection Settings depend on your **File Transport** and **Authentication Type** selections. The following file transport methods are available: - SFTP - FTPS - SCP - AWS S3 - SMB ### SFTP 1. In **File Transport**, select **SFTP** to access the file. 2. Enter the **Host** name where the file is located. 3. Enter the **Port** number to use to establish a connection. 4. For **Authentication Type**, select **Basic** or **Public Key**. **Basic** > **Screenshot** > > [![SFTP connection settings with Basic authentication]()]() 1. Select **Basic** as the authentication type. 2. Enter the **Username** to use during the file transfer. 3. Enter the **Password** for the user to use during the file transfer. **Public Key** > **Screenshot** > > [![SFTP connection settings with Public Key authentication]()]() 1. Select **Public Key** as the authentication type. 2. Enter the **Username** to use during the file transfer. 3. Enter the **SSH Private Key** content to use to establish a connection. Paste the full private key in PEM or OpenSSH format. Do not enter a file path. 4. (Optional) Enter the **SSH Private Key Passphrase** for the private key. 5. Select **Save**. ### FTPS 1. In **File Transport**, select **FTPS** to access the file. 2. Enter the **Host** name where the file is located. 3. Enter the **Port** number to use to establish a connection. 4. For **Authentication Type**, select **Basic** or **Client Certificate**. **Basic** > **Screenshot** > > [![FTPS connection settings with Basic authentication]()]() 1. Select **Basic** as the authentication type. 2. Enter the **Username** to use during the file transfer. 3. Enter the **Password** for the user to use during the file transfer. **Client Certificate** > **Screenshot** > > [![FTPS connection settings with Client Certificate authentication]()]() 1. Select **Client Certificate** as the authentication type. 2. Enter the **Username** to use during the file transfer. 3. Enter the **Password** for the user to use during the file transfer. 4. Enter the **FTPS Client Certificate (PKCS12 Base64)** content to use to establish a connection. Paste the Base64-encoded content of your PKCS12 (`.p12`) client certificate file. 5. (Optional) Enter the **FTPS Client Certificate Passphrase** for the client certificate. > **Note** > > The connector uses a hybrid model: the client certificate authenticates the TLS layer, and **Username** and **Password** authenticate the FTP protocol layer. Both are always required. 5. Select **Save**. ### SCP > [!NOTE] > > **Screenshot** > > [![SCP connection settings]()]() 1. In **File Transport**, select **SCP** to access the file. 2. Enter the **Host** name where the file is located. 3. Enter the **Port** number to use to establish a connection. 4. Enter the **Username** to use during the file transfer. 5. Enter the **Password** for the user to use during the file transfer. 6. Select **Save**. ### AWS S3 Before configuring AWS S3, ensure you have completed the S3 File Transport prerequisites, including the required IAM permissions on the target bucket and objects. For more information, refer to [Prerequisites](). 1. In **File Transport**, select **AWS S3** to access the file. 2. Enter the **S3 Bucket** name where the file is located. 3. Enter the **S3 Region** name where the bucket is located. 4. For **Authentication Type**, select **IAM User** or **IAM Role**. **IAM User** > **Screenshot** > > [![AWS S3 connection settings with IAM User authentication]()]() 1. Select **IAM User** as the authentication type. 2. Enter the **Access Key ID** to use during the file transfer. 3. Enter the **Secret Access Key** to use during the file transfer. **IAM Role** > **Screenshot** > > [![AWS S3 connection settings with IAM Role authentication]()]() With **IAM Role**, the connector assumes a role through AWS STS. For the requirements and the AWS setup procedures, refer to [Prerequisites](). 1. Select **IAM Role** as the authentication type. 2. Enter the **Role Name** of the IAM role to assume, for example `S3ReaderRole`. Enter the name only, not the full ARN. The connector builds the ARN. A path-qualified name such as `sailpoint/S3ReaderRole` is accepted. 3. (Optional) Enter the **Account ID**, the 12-digit AWS account ID where the role exists. Leave this field blank when the role is in the same account as the virtual appliance - the connector detects that account automatically. This field is required only for cross-account access. 4. (Optional) Enter the **External ID**. Provide it only if the target role's trust policy requires an external ID. The value must match the policy's `sts:ExternalId` condition exactly. 5. (Optional) Enter the **Role Session Name**. This identifies the session in AWS CloudTrail and can be used in `sts:RoleSessionName` policy conditions. When blank, the connector generates a name from the source ID so each source is separately identifiable. 6. (Optional) Enter the **Role Session Duration (seconds)**, which is how long each assumed session lasts, between 3600 and 43200. Defaults to 3600. The value cannot exceed the target role's **Maximum session duration**. Credentials refresh automatically before expiry, so this does not limit how long an aggregation can run. 5. Select **Save**. ### SMB SMB reads the file from a Windows File Server share or a Samba share. Before configuring SMB, ensure you have completed the SMB File Transport prerequisites, including the Kerberos and virtual appliance requirements. For more information, refer to [Prerequisites](). > [!NOTE] > > **Screenshot** > > [![SMB connection settings]()]() 1. In **File Transport**, select **SMB** to access the file. 2. Enter the fully qualified **Host** name of the SMB server, for example `fileserver.example.com`. Do not enter an IP address. 3. Enter the **Port** number to use to establish a connection. *Default: 445* 4. Enter the **Share Name** to read from, for example `Data`. Enter the share name only, without the server name or leading backslashes. 5. Enter the **Kerberos Realm** that issues tickets for the service account, for example `EXAMPLE.COM`. For Active Directory, this is the DNS domain in uppercase. 6. Enter the **Username** of the service account to use during the file transfer. Enter either the account name, which the connector combines with the **Kerberos Realm**, or a full principal such as `svc_aggregation@EXAMPLE.COM`. Use the full principal when the account belongs to a different realm than the share. 7. Enter the **Password** for the service account. 8. (Optional) Enter the **Kerberos Configuration Directory** on the virtual appliance that contains the Kerberos configuration file, `krb5.conf` or `krb5.config`. Enter the directory only, not the filename. If you leave this field blank, the connector searches `/opt/sailpoint/ccg/lib/custom` and `/home/sailpoint/ccg`, then the default Java location. 9. Complete the file settings, including the file name, delimiter, and schema. For more information, refer to [File Settings](<#file-settings>). 10. Select **Test Connection**. > [!NOTE] > > SMB uses Kerberos authentication. A Windows server in a workgroup cannot be used because it has no key distribution center (KDC). A successful **Test Connection** confirms that the service account authenticated with Kerberos, that the share was reached, and that the account file was opened. Aggregation still requires that the file contain account rows after the header. If **Test Connection** succeeds and aggregation reports that there is no valid data in the file, compare the file size on the share with the file size on the file server. ## Parsing Settings Configure the parsing technique the connector uses to parse the data file: **Delimited** or **Regular Expression**. > [!NOTE] > > **Screenshot** > > [![Parsing Settings]()]() - **Delimited** - When **Parsing Type** is set to **Delimited**, select the edit button for the schema in **File Settings** to enter the character to use as a delimiter. - **Regular Expression** - When **Parsing Type** is set to **Regular Expression**, select the edit button for the schema in **File Settings** to enter the regular expression using regular expression groups to break the data into tokens. ## File Settings For each schema type, specify the attributes to use during aggregation. ### Account Schema File Settings Complete the following tasks to configure the file path, parsing, merging, and filtering settings for the Account schema: #### File Use the **File Path** attribute to specify the path to the export file that the Delimited File source uses for the Account Schema. > [!NOTE] > > **Screenshot** > > [![File Path]()]() Enter the path and name of the data file that should be parsed. #### Parsing Use the following parsing attributes for the Account Schema: > [!NOTE] > > **Screenshot** > > [![Parsing]()]() - **Delimiter** - Applicable when **Parsing Type** is set to **Delimited**. - Enter the character to use as a delimiter. - If the delimiter is a Unicode character, use the `\u` format. For example, `\u0009` is used for the tab character. - **Regular Expression** - Applicable when **Parsing Type** is set to **Regular Expression**. - Enter the regular expression using regular expression groups to break the data into tokens. - **Columns** - Enter the names of the columns to use when parsing the file. - If you are using the **Regular Expression** parsing type, this field is required. - If you are using the **Delimited** parsing type, configure this field only if there is no header defined or you want to rename the columns used in the buildMap rule. #### Filtering Use the following filtering attributes for the Account schema: > [!NOTE] > > **Screenshot** > > [![Filtering]()]() - **Number of Lines to Skip** - Enter the **Number of Lines to Skip** in the data file before parsing the data. For example, when the value is set to `1`, the connector skips the first line of data from the input file along with the header line. > **Note** > > The first line of the input file consists of column headers. For the **Regular Expression** parsing type, the connector skips the header section during aggregation if the value is set to `1`. - **Filter Empty** - Select this checkbox to filter out any objects that parse but have no attributes. - **Comment Character** - Enter a comment character in the **Comment Character** field. Records that start with the comment character are skipped by the source. The default value is `#`. - **Filter String** - Enter a string that represents a filter object in the **Filter String** field. Any object that matches this filter is excluded from the dataset and is not returned. For example, the following filter excludes all objects from the Marketing department: ```text department == "Marketing" ``` #### Merging Use the following merging attributes for the Account Schema of the Delimited File source: > [!NOTE] > > **Screenshot** > > [![Merging]()]() - **Data sorted by the indexColumn(s)** - Select this checkbox if the data is sorted by the index columns. If the data is not sorted, an in-memory representation of the data is built and used. - **Ignore case while merging** - Select this checkbox to ignore case during the merge. The **Data sorted by the indexColumn(s)** option must be selected. ### Group Schema File Settings Complete the following tasks to configure the file path, parsing, merging, and filtering settings for the Account schema: #### File Use the **File Path** attribute to specify the path to the export file that the Delimited File source uses for the Account Schema. > [!NOTE] > > **Screenshot** > > [![File Path]()]() Enter the path and name of the data file that should be parsed. #### Parsing Use the following parsing attributes for the Account Schema: > [!NOTE] > > **Screenshot** > > [![Parsing]()]() - **Delimiter** - Applicable when **Parsing Type** is set to **Delimited**. - Enter the character to use as a delimiter. - If the delimiter is a Unicode character, use the `\u` format. For example, `\u0009` is used for the tab character. - **Regular Expression** - Applicable when **Parsing Type** is set to **Regular Expression**. - Enter the regular expression using regular expression groups to break the data into tokens. - **Columns** - Enter the names of the columns to use when parsing the file. - If you are using the **Regular Expression** parsing type, this field is required. - If you are using the **Delimited** parsing type, configure this field only if there is no header defined or you want to rename the columns used in the buildMap rule. > [!NOTE] > > The delimiter character the connector should use to parse group data is defined separately by the `group.delimiter` parameter. Set the `group.delimiter` parameter value using the SailPoint REST API as shown in the following `PATCH` example. The default value is a comma (`,`). > > ```text > PATCH https://{orgName}.api.identitynow.com/v3/sources/:id > ``` > > ```json > [ > { > "op": "add", > "path": "/connectorAttributes/group.delimiter", > "value": > } > ] > ``` > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. #### Filtering Use the following filtering attributes for the Group schema: > [!NOTE] > > **Screenshot** > > [![Filtering]()]() - **Number of Lines to Skip** - Enter the **Number of Lines to Skip** in the data file before parsing the data. For example, when the value is set to `1`, the connector skips the first line of data from the input file along with the header line. > **Note** > > The first line of the input file consists of column headers. For the **Regular Expression** parsing type, the connector skips the header section during aggregation if the value is set to `1`. - **Filter Empty** - Select this checkbox to filter out any objects that parse but have no attributes. - **Comment Character** - Enter a comment character in the **Comment Character** field. Records that start with the comment character are skipped by the source. The default value is `#`. - **Filter String** - Enter a string that represents a filter object in the **Filter String** field. Any object that matches this filter is excluded from the dataset and is not returned. For example, the following filter excludes all objects from the Marketing department: ```text department == "Manufacturing" ``` #### Merging Use the following merging attributes for the Account Schema of the Delimited File source: > [!NOTE] > > **Screenshot** > > [![Merging]()]() - **Data sorted by the indexColumn(s)** - Select this checkbox if the data is sorted by the index columns. If the data is not sorted, an in-memory representation of the data is built and used. - **Ignore case while merging** - Select this checkbox to ignore case during the merge. The **Data sorted by the indexColumn(s)** option must be selected. ## Encryption Settings Provide the encryption configuration for the file, including options for PGP decryption attributes to ensure successful processing. > [!NOTE] > > **Screenshot** > > [![Encryption Settings]()]() - **PGP Encrypted File** - Enable this if the file is encrypted with PGP. The file is automatically decrypted during the aggregation process. - **PGP Private Key** - Applicable when PGP Encrypted File is selected. Enter the PGP private key used to decrypt the file's data. - **PGP Private Key Password** - Applicable when PGP Encrypted File is selected. Enter the password for the PGP private key used to decrypt the file's data. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**.