# SailPoint Delimited File Connector Documentation > Delimited File Connector Documentation # Documentation # Connecting SailPoint and Delimited File To connect SailPoint with Delimited File, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. Enter the following information: - **Source Name** - Enter a name for the new source. - **Description** - Enter a description for the new source to help distinguish it from similar sources. - **Source Owner** - Begin typing the name of an owner. Matches appear after you type two or more letters. > **Note** > > You must add a source owner at the same time as you add a Name, Description, and Source Type while creating the source. - **Platform Type** - Select **VA Based**. - **VA Based** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Governance Group (Optional)** - Select an optional governance group from the dropdown list. - Select **Authoritative Source** if the source will be used as the account source for an identity profile. For more information, refer to [Creating Identity Profiles](). 6. Select **Continue** to create the new source with your selections. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Select **Save**. ## Connection Settings This section contains the information that this connector uses to connect and interact with the application. Each application type requires different information to create and maintain a connection. The fields displayed in Connection Settings depend on your **File Transport** and **Authentication Type** selections. The following file transport methods are available: - SFTP - FTPS - SCP - AWS S3 - SMB ### SFTP 1. In **File Transport**, select **SFTP** to access the file. 2. Enter the **Host** name where the file is located. 3. Enter the **Port** number to use to establish a connection. 4. For **Authentication Type**, select **Basic** or **Public Key**. **Basic** > **Screenshot** > > [![SFTP connection settings with Basic authentication]()]() 1. Select **Basic** as the authentication type. 2. Enter the **Username** to use during the file transfer. 3. Enter the **Password** for the user to use during the file transfer. **Public Key** > **Screenshot** > > [![SFTP connection settings with Public Key authentication]()]() 1. Select **Public Key** as the authentication type. 2. Enter the **Username** to use during the file transfer. 3. Enter the **SSH Private Key** content to use to establish a connection. Paste the full private key in PEM or OpenSSH format. Do not enter a file path. 4. (Optional) Enter the **SSH Private Key Passphrase** for the private key. 5. Select **Save**. ### FTPS 1. In **File Transport**, select **FTPS** to access the file. 2. Enter the **Host** name where the file is located. 3. Enter the **Port** number to use to establish a connection. 4. For **Authentication Type**, select **Basic** or **Client Certificate**. **Basic** > **Screenshot** > > [![FTPS connection settings with Basic authentication]()]() 1. Select **Basic** as the authentication type. 2. Enter the **Username** to use during the file transfer. 3. Enter the **Password** for the user to use during the file transfer. **Client Certificate** > **Screenshot** > > [![FTPS connection settings with Client Certificate authentication]()]() 1. Select **Client Certificate** as the authentication type. 2. Enter the **Username** to use during the file transfer. 3. Enter the **Password** for the user to use during the file transfer. 4. Enter the **FTPS Client Certificate (PKCS12 Base64)** content to use to establish a connection. Paste the Base64-encoded content of your PKCS12 (`.p12`) client certificate file. 5. (Optional) Enter the **FTPS Client Certificate Passphrase** for the client certificate. > **Note** > > The connector uses a hybrid model: the client certificate authenticates the TLS layer, and **Username** and **Password** authenticate the FTP protocol layer. Both are always required. 5. Select **Save**. ### SCP > [!NOTE] > > **Screenshot** > > [![SCP connection settings]()]() 1. In **File Transport**, select **SCP** to access the file. 2. Enter the **Host** name where the file is located. 3. Enter the **Port** number to use to establish a connection. 4. Enter the **Username** to use during the file transfer. 5. Enter the **Password** for the user to use during the file transfer. 6. Select **Save**. ### AWS S3 Before configuring AWS S3, ensure you have completed the S3 File Transport prerequisites, including the required IAM permissions on the target bucket and objects. For more information, refer to [Prerequisites](). 1. In **File Transport**, select **AWS S3** to access the file. 2. Enter the **S3 Bucket** name where the file is located. 3. Enter the **S3 Region** name where the bucket is located. 4. For **Authentication Type**, select **IAM User** or **IAM Role**. **IAM User** > **Screenshot** > > [![AWS S3 connection settings with IAM User authentication]()]() 1. Select **IAM User** as the authentication type. 2. Enter the **Access Key ID** to use during the file transfer. 3. Enter the **Secret Access Key** to use during the file transfer. **IAM Role** > **Screenshot** > > [![AWS S3 connection settings with IAM Role authentication]()]() With **IAM Role**, the connector assumes a role through AWS STS. For the requirements and the AWS setup procedures, refer to [Prerequisites](). 1. Select **IAM Role** as the authentication type. 2. Enter the **Role Name** of the IAM role to assume, for example `S3ReaderRole`. Enter the name only, not the full ARN. The connector builds the ARN. A path-qualified name such as `sailpoint/S3ReaderRole` is accepted. 3. (Optional) Enter the **Account ID**, the 12-digit AWS account ID where the role exists. Leave this field blank when the role is in the same account as the virtual appliance - the connector detects that account automatically. This field is required only for cross-account access. 4. (Optional) Enter the **External ID**. Provide it only if the target role's trust policy requires an external ID. The value must match the policy's `sts:ExternalId` condition exactly. 5. (Optional) Enter the **Role Session Name**. This identifies the session in AWS CloudTrail and can be used in `sts:RoleSessionName` policy conditions. When blank, the connector generates a name from the source ID so each source is separately identifiable. 6. (Optional) Enter the **Role Session Duration (seconds)**, which is how long each assumed session lasts, between 3600 and 43200. Defaults to 3600. The value cannot exceed the target role's **Maximum session duration**. Credentials refresh automatically before expiry, so this does not limit how long an aggregation can run. 5. Select **Save**. ### SMB SMB reads the file from a Windows File Server share or a Samba share. Before configuring SMB, ensure you have completed the SMB File Transport prerequisites, including the Kerberos and virtual appliance requirements. For more information, refer to [Prerequisites](). > [!NOTE] > > **Screenshot** > > [![SMB connection settings]()]() 1. In **File Transport**, select **SMB** to access the file. 2. Enter the fully qualified **Host** name of the SMB server, for example `fileserver.example.com`. Do not enter an IP address. 3. Enter the **Port** number to use to establish a connection. *Default: 445* 4. Enter the **Share Name** to read from, for example `Data`. Enter the share name only, without the server name or leading backslashes. 5. Enter the **Kerberos Realm** that issues tickets for the service account, for example `EXAMPLE.COM`. For Active Directory, this is the DNS domain in uppercase. 6. Enter the **Username** of the service account to use during the file transfer. Enter either the account name, which the connector combines with the **Kerberos Realm**, or a full principal such as `svc_aggregation@EXAMPLE.COM`. Use the full principal when the account belongs to a different realm than the share. 7. Enter the **Password** for the service account. 8. (Optional) Enter the **Kerberos Configuration Directory** on the virtual appliance that contains the Kerberos configuration file, `krb5.conf` or `krb5.config`. Enter the directory only, not the filename. If you leave this field blank, the connector searches `/opt/sailpoint/ccg/lib/custom` and `/home/sailpoint/ccg`, then the default Java location. 9. Complete the file settings, including the file name, delimiter, and schema. For more information, refer to [File Settings](<#file-settings>). 10. Select **Test Connection**. > [!NOTE] > > SMB uses Kerberos authentication. A Windows server in a workgroup cannot be used because it has no key distribution center (KDC). A successful **Test Connection** confirms that the service account authenticated with Kerberos, that the share was reached, and that the account file was opened. Aggregation still requires that the file contain account rows after the header. If **Test Connection** succeeds and aggregation reports that there is no valid data in the file, compare the file size on the share with the file size on the file server. ## Parsing Settings Configure the parsing technique the connector uses to parse the data file: **Delimited** or **Regular Expression**. > [!NOTE] > > **Screenshot** > > [![Parsing Settings]()]() - **Delimited** - When **Parsing Type** is set to **Delimited**, select the edit button for the schema in **File Settings** to enter the character to use as a delimiter. - **Regular Expression** - When **Parsing Type** is set to **Regular Expression**, select the edit button for the schema in **File Settings** to enter the regular expression using regular expression groups to break the data into tokens. ## File Settings For each schema type, specify the attributes to use during aggregation. ### Account Schema File Settings Complete the following tasks to configure the file path, parsing, merging, and filtering settings for the Account schema: #### File Use the **File Path** attribute to specify the path to the export file that the Delimited File source uses for the Account Schema. > [!NOTE] > > **Screenshot** > > [![File Path]()]() Enter the path and name of the data file that should be parsed. #### Parsing Use the following parsing attributes for the Account Schema: > [!NOTE] > > **Screenshot** > > [![Parsing]()]() - **Delimiter** - Applicable when **Parsing Type** is set to **Delimited**. - Enter the character to use as a delimiter. - If the delimiter is a Unicode character, use the `\u` format. For example, `\u0009` is used for the tab character. - **Regular Expression** - Applicable when **Parsing Type** is set to **Regular Expression**. - Enter the regular expression using regular expression groups to break the data into tokens. - **Columns** - Enter the names of the columns to use when parsing the file. - If you are using the **Regular Expression** parsing type, this field is required. - If you are using the **Delimited** parsing type, configure this field only if there is no header defined or you want to rename the columns used in the buildMap rule. #### Filtering Use the following filtering attributes for the Account schema: > [!NOTE] > > **Screenshot** > > [![Filtering]()]() - **Number of Lines to Skip** - Enter the **Number of Lines to Skip** in the data file before parsing the data. For example, when the value is set to `1`, the connector skips the first line of data from the input file along with the header line. > **Note** > > The first line of the input file consists of column headers. For the **Regular Expression** parsing type, the connector skips the header section during aggregation if the value is set to `1`. - **Filter Empty** - Select this checkbox to filter out any objects that parse but have no attributes. - **Comment Character** - Enter a comment character in the **Comment Character** field. Records that start with the comment character are skipped by the source. The default value is `#`. - **Filter String** - Enter a string that represents a filter object in the **Filter String** field. Any object that matches this filter is excluded from the dataset and is not returned. For example, the following filter excludes all objects from the Marketing department: ```text department == "Marketing" ``` #### Merging Use the following merging attributes for the Account Schema of the Delimited File source: > [!NOTE] > > **Screenshot** > > [![Merging]()]() - **Data sorted by the indexColumn(s)** - Select this checkbox if the data is sorted by the index columns. If the data is not sorted, an in-memory representation of the data is built and used. - **Ignore case while merging** - Select this checkbox to ignore case during the merge. The **Data sorted by the indexColumn(s)** option must be selected. ### Group Schema File Settings Complete the following tasks to configure the file path, parsing, merging, and filtering settings for the Account schema: #### File Use the **File Path** attribute to specify the path to the export file that the Delimited File source uses for the Account Schema. > [!NOTE] > > **Screenshot** > > [![File Path]()]() Enter the path and name of the data file that should be parsed. #### Parsing Use the following parsing attributes for the Account Schema: > [!NOTE] > > **Screenshot** > > [![Parsing]()]() - **Delimiter** - Applicable when **Parsing Type** is set to **Delimited**. - Enter the character to use as a delimiter. - If the delimiter is a Unicode character, use the `\u` format. For example, `\u0009` is used for the tab character. - **Regular Expression** - Applicable when **Parsing Type** is set to **Regular Expression**. - Enter the regular expression using regular expression groups to break the data into tokens. - **Columns** - Enter the names of the columns to use when parsing the file. - If you are using the **Regular Expression** parsing type, this field is required. - If you are using the **Delimited** parsing type, configure this field only if there is no header defined or you want to rename the columns used in the buildMap rule. > [!NOTE] > > The delimiter character the connector should use to parse group data is defined separately by the `group.delimiter` parameter. Set the `group.delimiter` parameter value using the SailPoint REST API as shown in the following `PATCH` example. The default value is a comma (`,`). > > ```text > PATCH https://{orgName}.api.identitynow.com/v3/sources/:id > ``` > > ```json > [ > { > "op": "add", > "path": "/connectorAttributes/group.delimiter", > "value": > } > ] > ``` > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. #### Filtering Use the following filtering attributes for the Group schema: > [!NOTE] > > **Screenshot** > > [![Filtering]()]() - **Number of Lines to Skip** - Enter the **Number of Lines to Skip** in the data file before parsing the data. For example, when the value is set to `1`, the connector skips the first line of data from the input file along with the header line. > **Note** > > The first line of the input file consists of column headers. For the **Regular Expression** parsing type, the connector skips the header section during aggregation if the value is set to `1`. - **Filter Empty** - Select this checkbox to filter out any objects that parse but have no attributes. - **Comment Character** - Enter a comment character in the **Comment Character** field. Records that start with the comment character are skipped by the source. The default value is `#`. - **Filter String** - Enter a string that represents a filter object in the **Filter String** field. Any object that matches this filter is excluded from the dataset and is not returned. For example, the following filter excludes all objects from the Marketing department: ```text department == "Manufacturing" ``` #### Merging Use the following merging attributes for the Account Schema of the Delimited File source: > [!NOTE] > > **Screenshot** > > [![Merging]()]() - **Data sorted by the indexColumn(s)** - Select this checkbox if the data is sorted by the index columns. If the data is not sorted, an in-memory representation of the data is built and used. - **Ignore case while merging** - Select this checkbox to ignore case during the merge. The **Data sorted by the indexColumn(s)** option must be selected. ## Encryption Settings Provide the encryption configuration for the file, including options for PGP decryption attributes to ensure successful processing. > [!NOTE] > > **Screenshot** > > [![Encryption Settings]()]() - **PGP Encrypted File** - Enable this if the file is encrypted with PGP. The file is automatically decrypted during the aggregation process. - **PGP Private Key** - Applicable when PGP Encrypted File is selected. Enter the PGP private key used to decrypt the file's data. - **PGP Private Key Password** - Applicable when PGP Encrypted File is selected. Enter the password for the PGP private key used to decrypt the file's data. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. # Integrating SailPoint with Delimited File An integration of SailPoint with a Delimited File source creates a connector that reads account data from a file. The Delimited File connector is designed to work with any system to fetch data. It supports customizable account schemas based on your specific requirements and can retrieve both accounts and groups. Additionally, it is capable of handling multi-valued attributes. Compared to the Generic Flat File connector, the Delimited File connector offers more control options in the SailPoint configuration pages, giving you more flexibility with the source file. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The Delimited File connector supports the following features: - Custom account schema - Load accounts - Load entitlements For more information on features, refer to [Source Features](). ## Prerequisites - A delimited file is required to use this source. - The first line of the file must be column headers. ### S3 File Transport Prerequisites In **File Transport**, you can use AWS S3 mode to access the file. Selecting **AWS S3** shows **Authentication Type**, with two choices: **IAM User** and **IAM Role**. The IAM user or the assumed IAM role must have the following permissions on the target bucket and objects: | Permission | Purpose | | --- | --- | | List (list bucket, list objects) | List bucket and list/iterate objects in the bucket | | Get (get object, get bucket location) | Read object contents and get bucket metadata (for example, region) | Without these permissions, the connector receives a 403 Forbidden error from S3. AWS returns 403 for both invalid credentials and insufficient permissions. Ensure your credentials are valid and have the required access. #### Required S3 Permissions The IAM principal, either the IAM user or the assumed IAM role, must have at least the following S3 actions: | S3 Action | Resource | Use | | --- | --- | --- | | s3:ListBucket | Bucket ARN | List bucket and list objects | | s3:GetBucketLocation | Bucket ARN | Determine bucket region (used by the SDK) | | s3:GetObject | Bucket and object ARNs | Read object contents | #### IAM Role Authentication With **IAM Role**, a source can read from S3 without storing a long-lived access key and secret. The virtual appliance assumes an IAM role through AWS STS, using its EC2 instance profile as the base identity. IAM Role authentication requires all of the following. IAM User authentication is unaffected. - The virtual appliance runs on an **AWS EC2 instance**. This method is unavailable for virtual appliances deployed elsewhere (VMware, Hyper-V, Azure, on-premises). - An **IAM instance profile is attached** to that EC2 instance. - If the instance uses **IMDSv2**, its `http-put-response-hop-limit` is set to **2 or higher**. The default of 1 prevents the connector's container from reaching the instance metadata service. - The instance profile role is permitted to call `sts:AssumeRole` on the target role. - The target role's trust policy allows the instance profile role. > [!NOTE] > > **Same-Account Access** > > Use when the S3 bucket is in the same AWS account as the virtual appliance. > > 1. Create an IAM role in that account, for example `S3ReaderRole`, with a permissions policy granting `s3:GetObject` on `arn:aws:s3:::/*`. Granting `s3:ListBucket` on `arn:aws:s3:::` as well is optional and produces clearer errors when a connection test fails. > 2. Set the role's trust policy to allow the virtual appliance's instance profile role: > > ```json > { > "Version": "2012-10-17", > "Statement": [{ > "Effect": "Allow", > "Principal": { "AWS": "arn:aws:iam:::role/" }, > "Action": "sts:AssumeRole" > }] > } > ``` > 3. Attach a policy to the virtual appliance's instance profile role allowing `sts:AssumeRole` on `arn:aws:iam:::role/S3ReaderRole`. > 4. In the source's Connection Settings, set **File Transport** to **AWS S3**, **Authentication Type** to **IAM Role**, and **Role Name** to `S3ReaderRole`. Leave **Account ID** blank. > 5. Select **Test Connection**. > > > **Note** > > > > Do not enter the virtual appliance's own instance profile role as the **Role Name**. A role cannot assume itself unless its trust policy explicitly names itself, and the connection test fails with an access-denied error. > [!NOTE] > > **Cross-Account Access** > > Use when the bucket is in a different AWS account (Account B) from the virtual appliance (Account A). > > 1. In **Account B**, create the role with the same S3 permissions as above. > 2. In **Account B**, set its trust policy to allow Account A's instance profile role, adding the external ID condition if you use one: > > ```json > { > "Version": "2012-10-17", > "Statement": [{ > "Effect": "Allow", > "Principal": { "AWS": "arn:aws:iam:::role/" }, > "Action": "sts:AssumeRole", > "Condition": { "StringEquals": { "sts:ExternalId": "" } } > }] > } > ``` > 3. In **Account A**, allow the instance profile role to call `sts:AssumeRole` on the Account B role ARN. > 4. In the source, set **Role Name** to the Account B role, **Account ID** to Account B's 12-digit ID, and **External ID** if the trust policy requires one. #### IAM Role Behavior - **Credential refresh** - Sessions are renewed automatically before they expire, so aggregations longer than the session duration are unaffected. - **CloudTrail** - Each aggregation appears in your CloudTrail under the session name, so bucket access is attributable to a specific source. - **GovCloud and China regions** - The role ARN partition is derived from the configured S3 region, so `us-gov-*` and `cn-*` regions are supported without extra configuration. ### SMB File Transport Prerequisites In **File Transport**, you can use SMB mode to read the file from a Windows File Server share or a Samba share. The same source fields apply to both. SMB authenticates with Kerberos only, so a Windows server in a workgroup cannot be used - it has no key distribution center (KDC) and no domain service principal. Complete the following requirements before you configure the source. Most connection failures are caused by one of these requirements being missed, and several of them cannot be diagnosed from SailPoint alone. #### File Share - The share must support SMB2 or SMB3. SMB1 is not supported. - The share must be a disk share. An administrative or printer share such as `IPC$` cannot be used. - The share must accept Kerberos authentication. If the server accepts only NTLM, the connection fails. The connector does not fall back to NTLM. - The account file must already exist on the share, at the path configured in the source's file settings. The connector reads the share, not a local path on the file server. > [!NOTE] > > **Windows File Server** > > Complete these requirements when the share is on Windows Server. > > - The server must be a domain member or a domain controller. Joining or promoting the server to the domain is what enables Kerberos. Installing the Active Directory Domain Services role is not enough while the computer is still in a workgroup. > - Install the File Server role (`FS-FileServer`) if it is not already present, then create the folder and share it as a disk share. > - Create an Active Directory user as the service account, and enable the AES128 and AES256 Kerberos encryption types on the account. The password must not be expired and must not require a change at next sign-in. > - Grant the service account Read permission on both the share ACL and the NTFS ACL of the folder and the file. > - Confirm that a service principal of the form `cifs/` exists. On a domain-joined Windows host, Active Directory registers `HOST/` on the computer account and treats it as an alias for `cifs/`, so an additional service principal is usually not required. Verify with `setspn -Q cifs/`. > - On the domain controller, the Kdc service must be running. That service is Kerberos on Windows - there is no separate Kerberos Server role. > - Verify the share from a domain-joined Windows client with `dir \\\`. > [!NOTE] > > **Samba File Server** > > Complete these requirements when the share is on Linux. > > - The host must be an Active Directory member or a Samba Active Directory domain controller. Standalone Samba with local users authenticates with NTLM and cannot be used. > - The share must accept Kerberos. Verify from a Kerberos-capable client with `smbclient /// --use-kerberos=required`. The `smbclient` utility is not present on a virtual appliance. #### Kerberos Realm and Service Account - A service account must exist in the Kerberos realm, with read permission on the share and on the account file. - The service account password must not be expired. - The KDC must resolve a service principal of the form `cifs/` for the host of the share. On Active Directory and Samba Active Directory, the host's `HOST/` service principal usually satisfies this because the KDC treats it as an alias for `cifs/`. Verify with `kvno cifs/` from a machine that holds a ticket for the realm. - The clocks on the virtual appliance and the KDC must be within the realm's tolerance of each other, which is five minutes by default. Kerberos rejects authentication outside that window. #### Virtual Appliance - The virtual appliance must reach the file share on TCP port 445. - The virtual appliance must reach the realm's KDC on port 88, over both TCP and UDP. For a Windows member file server, port 445 is the file server and port 88 is the domain controller, which are often different hosts. - A Kerberos configuration file mapping the realm to its KDC must be placed on the virtual appliance. The connector checks for `krb5.conf` first, then falls back to `krb5.config`. - The connector locates the file through the **Kerberos Configuration Directory** field in the source's Connection Settings. Enter the directory that contains the file, not the path of the file itself, for example `/opt/sailpoint/ccg/lib/custom`. A trailing `/` is optional. The file must be readable by the `sailpoint` user. - If you leave **Kerberos Configuration Directory** blank, the connector searches `/opt/sailpoint/ccg/lib/custom` and `/home/sailpoint/ccg` in that order, then the default Java location. - Restart the Cloud Connection Gateway (CCG) service after you place the Kerberos configuration file on the virtual appliance for the first time. The following is a minimal Kerberos configuration file. For a Windows File Server, `kdc` is the fully qualified name of an Active Directory domain controller that serves the realm, and the realm is the DNS domain in uppercase. ```text [libdefaults] default_realm = EXAMPLE.COM udp_preference_limit = 1 [realms] EXAMPLE.COM = { kdc = kdc.example.com } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM ``` > [!CAUTION] > > `udp_preference_limit = 1` is required. A Kerberos service ticket for a Windows or Samba file share carries a privilege attribute certificate (PAC) that is usually too large for a UDP datagram, and the connector cannot process the KDC's request to retry over TCP. This setting makes Kerberos use TCP from the start. Omitting it is the most common cause of a failed SMB connection, on Active Directory as well as Samba. > [!NOTE] > > If you have multiple sources with multiple domains and connectivity across the domains, you must provide a Kerberos configuration file. > > - Each virtual appliance uses a single Kerberos configuration file. If you have multiple domains, configure them as multiple realms within the same file. #### Name Resolution - The virtual appliance must resolve the host name of the share both forward and in reverse. The service principal is built from the canonical name returned by the reverse lookup, so if reverse resolution returns a different name, or none, the KDC rejects the request. Verify both directions from the virtual appliance with `getent hosts ` and `getent hosts `. Both must return the same fully qualified name. - Configure the source with the fully qualified host name, not an IP address. An IP address produces a service principal that the KDC does not recognize. - If the realm is not in the DNS that the virtual appliance already uses, add a host entry in the `hosts.yaml` file on the virtual appliance instead of pointing the appliance's resolver at the domain controller. One malformed line disables every entry in the file. For more information, refer to [Configuring Virtual Appliances](). ### SailPoint File Upload Utility The SailPoint File Upload Utility provides a way for you to upload files to the cloud automatically. You may use the SailPoint File Upload Utility with the Delimited File source. For more information about downloading and using the SailPoint File Upload Utility, refer to [SailPoint File Upload Utility.]() > [!NOTE] > > **Best Practice** > > For best results, delimited files should not exceed 500 MB. # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The Delimited File connector uses the following default correlation and object configurations. ## Correlation For the Delimited File connector, a correlation rule must be defined to correlate the accounts to identities. There is no default correlation rule with this connector. ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | id | Account | | id | Group | ### Default Account Attributes The Delimited File connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. > [!IMPORTANT] > > When you upload an updated account schema, the Delimited File source checks if any of the new attributes were included in the old schema. The source keeps the settings (description, entitlement, multi-valued, type, etc.) for any previously included attributes. The source also removes any attributes that are not found in newly discovered or uploaded schema, as long as the attributes aren't used in other configurations. | Attribute Name | Description | | --- | --- | | id | The unique ID for the account. | | name | The username of the account. | | givenName | The first or given name of the user associated with the account. | | familyName | The last, family name, or surname of the user associated with the account. | | e-mail | The primary email address of the user associated with the account. | | location | The location associated with this account. | | manager | Reference to the manager of this particular account. | | groups | The groups or roles that reference account group objects. | | IIQDisabled | This is an optional attribute. SailPoint recommends that you work with Services to create a Build Map Rule specific to your company's needs.
This is a Boolean attribute to set an account as enabled or disabled in SailPoint. You can add the IIQDisabled attribute in the source account schema or use the Build Map Rule to set the value as true/false based on the incoming data from the file. For more information, refer to the [SailPoint Rule Guide](). | > [!NOTE] > > The default input for `id` and `name` are set as **Account ID** and **Account Name** respectively. The `groups` attribute is multi-valued and entitlement, by default. ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The Delimited File connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. | Attribute Name | Description | | --- | --- | | id | Unique ID for the group. | | name | The name of the group. | | displayName | The preferred display name for the group. | | created | Date and time when the group was created. | | description | Multi-purpose field used to capture a description or comments. | | modified | Date and time when the group was modified. | | entitlements | The access rights and entitlements that the group has access to. | | groups | The groups and roles that reference to account group objects. | | permissions | The permissions associated with the account. | ## Multi-Group Object Schemas The Delimited File source supports multi-group object schemas. You can define additional group objects or entitlement types (such as roles) for a source and aggregate those into SailPoint. ### Data Import You can import accounts for the Delimited File source. This step must be performed only after you have defined the account schema. There are two ways to load accounts for this source: - Use the SailPoint File Upload utility as mentioned in the [Prerequisites]() section. > **Best Practice** > > For best results, delimited files should not exceed 500 MB. - Manually aggregate accounts. For more information, refer to [Manually Aggregating Accounts from a Flat File](). ### File Structure In a delimited file, each row represents one account (with the exception of multi-valued values). Each column has the ability to hold values of data that are associated with the account and are of a certain fixed order. These columns should be in the same order as the Account Schema. Their data can be left blank as long as the fields are not required. The file should be sorted based on the Account ID attribute. This is especially important for handling multi-valued attributes. > [!NOTE] > > The first row of the file is the header of the file, and will not be skipped. | ID | name | givenName | familyName | This header row will be skipped | | --- | --- | --- | --- | --- | | 1 | jdoe | John | Doe | This is the first account | | 2 | msmith | Mary | Smith | This is the second account | ### Handling Multi-Valued Attributes Some attributes, like groups, support the ability to have multiple values and are stored as a list. In order to model this, you will put each value on a separate row for that field. All additional values should be repeated. | ID | name | ... | groups | ... | This header row will be skipped. | | --- | --- | --- | --- | --- | --- | | 1 | jdoe | ... | Admins | ... | This is the first account. | | 1 | jdoe | ... | Employee | ... | | | 2 | msmith | ... | Employee | ... | This is the second account. | > [!NOTE] > > The `name` attribute is a single-valued attribute. This will yield jdoe with Admins and Employee groups, and msmith with a single Employee group. # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Records with the comment character are also fetched during aggregation The normal behavior of a comment character (for example, `#`) is to distinguish comments from the records. The connector should skip any lines which contain the character. **Resolution:** To prevent the aggregation of comment characters in the records, remove the comment character first and save the file. Re-enter the comment character, save the file and run the aggregation again. ## Data is not correctly aggregating when merging is enabled **Resolution:** In the Merging of File Settings section, enable the following checkboxes and retry the use case: **Data sorted by the indexColumn(s)** **Ignore case while merging** ## Entitlement attributes don't populate correctly when the delimited file uses a custom delimiter If you've defined a delimiter other than the default comma (`,`), aggregated entitlement data isn't populated correctly. **Resolution:** In the Parsing of File Settings section, enter your custom delimiter in the text box and retry the use case. For more information, refer to [Define a Group Data Parsing Delimiter](). ## STS AssumeRole denied... verify the target role's trust policy The trust policy does not allow the virtual appliance's instance profile role, or the external ID does not match. **Resolution** - If the message notes that **Account ID** was not configured, and the role is in another account, set **Account ID**. ## STS rejected the virtual appliance's instance profile credentials No valid instance profile is attached to the virtual appliance instance. **Resolution** - Review the prerequisites. For more information, refer to [Prerequisites](). ## Unable to read the virtual appliance's EC2 instance profile credentials The virtual appliance is not on EC2, has no instance profile, or the IMDSv2 hop limit is below 2. ## STS rejected the AssumeRole request... MaxSessionDuration **Role Session Duration (seconds)** exceeds the target role's **Maximum session duration**. **Resolution** - Lower the field or raise the role's limit. ## S3 403 Forbidden - access denied The assumed role lacks `s3:GetObject` on the object, or a bucket policy blocks it. ## The KDC returned an error for the service ticket request, and the error itself could not be read The service ticket is too large for UDP and the KDC is requesting a retry over TCP, which the connector cannot process. Less often, `cifs/` is not a recognized service principal. **Resolution** - Set `udp_preference_limit = 1` under `[libdefaults]` in the Kerberos configuration file on the virtual appliance. If the error persists, confirm the service principal with `kvno cifs/`. For more information, refer to [Prerequisites](). ## Kerberos cannot locate a KDC for the realm The Kerberos configuration file in use has no entry for the realm, or the connector did not find the file you placed on the virtual appliance and fell back to the default Java location. **Resolution** - Add the realm and its KDC to the `[realms]` section of the Kerberos configuration file, and confirm the file is in the directory configured in **Kerberos Configuration Directory**. The connector logs which configuration file it used at the start of each connection. ## The KDC has no service principal for this server No `cifs/` or `HOST/` service principal is registered for the host name in use, or **Host** is set to an IP address or an alias. **Resolution** - Set **Host** to the fully qualified name registered in Active Directory or Samba. On Windows, confirm the service principal with `setspn -Q cifs/`. ## Kerberos rejected the login because the clocks are too far apart The virtual appliance and KDC clocks differ by more than the realm's tolerance, which is five minutes by default. **Resolution** - Synchronize the virtual appliance clock with the KDC. ## Kerberos does not recognize the service account. Verify the username and that the realm is correct and spelled in upper case. The service account does not exist in the realm, or **Username** and **Kerberos Realm** combine into the wrong principal. **Resolution** - Correct **Username** or **Kerberos Realm**. The message names the principal that was attempted. ## Pre-authentication information was invalid The service account password is incorrect. **Resolution** - Correct the **Password**. ## The KDC and the VA share no common Kerberos encryption type. Enable AES on the service account. The account and KDC have no common Kerberos encryption type. **Resolution** - Enable the AES128 and AES256 Kerberos encryption types on the Active Directory user. ## The server did not offer Kerberos during SMB negotiation The share accepts only NTLM, or the Windows server is in a workgroup. **Resolution** - Enable Kerberos on the share, and join or promote the Windows server into a domain. The connector does not fall back to NTLM. ## SMB share '\' on \ is not a disk share, so files cannot be read from it. Configure a file share. **Share Name** is set to an administrative or printer share, such as `IPC$`. **Resolution** - Set **Share Name** to a disk share. ## The SMB server does not publish a share by that name. Verify the share name. The share name does not exist on the server. **Resolution** - Correct **Share Name**. Enter the share name only, without the server name or leading backslashes. On Windows, confirm the name with `Get-SmbShare`. ## The SMB server authenticated the service account but denied access. Grant the account read permission on the share and on the file. The service account authenticated, but it lacks permission on the share or the file. **Resolution** - Grant the service account Read permission on the share ACL and on the NTFS folder and file. ## Ensure there is valid data present in file The SMB share served a header-only or stale file after **Test Connection** opened the file. **Resolution** - Confirm that the share path is the folder that contains the data file, and that the file size on the share matches the file size on the file server. On Windows, confirm the path with `Get-SmbShare`.