# SailPoint HashiCorp Vault Integration (On-Premise) Connector Documentation

> HashiCorp Vault Integration (On-Premise) Connector Documentation

# Documentation

# Connecting SailPoint and HashiCorp Vault Integration (On-Premise)

To connect SailPoint with HashiCorp Vault, perform the following tasks:

## Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Sources**.
3. Select **Create New**.
4. Search for the connector by entering the name in the search box, and then select **Actions**.
5. In the **Actions** dropdown list, select the setup method:

   - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started.

     > **Note**
     >
     > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>). For more information, contact your SailPoint Customer Service Manager.
   - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup.

### Configuring a Source Using Express Setup

Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data.

1. Review the directions and select **Start Express Setup**.
2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**.

   > **Note**
   >
   > The source name must be unique. You can change these settings later in the source configuration.
3. Select **Virtual Appliance**. A virtual appliance is a Linux-based virtual machine that connects to your sources and apps using SailPoint APIs, connectors, and integrations. For more information about configuring and deploying virtual appliances, refer to [SailPoint Virtual Appliances](<https://documentation.sailpoint.com/saas/help/va/index.html>).
4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
5. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section.
6. Select **Finish**.

   After a successful test connection, the system creates your source and prompts you to run an aggregation.

   - If you want to aggregate now, select **Aggregate**.

     - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**.
     - To see the list of aggregated source accounts, go to **Account Management \> Accounts**.
   - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet.

### Configuring a Source Using Standard Setup

Use Standard Setup to configure the connector for full feature support.

1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
4. Under **Connection Type**, select **Direct Connection** or **Flat File**.

   - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
   - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable.
5. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source.
6. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
7. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
8. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.
2. In the **Source Owner** dropdown list, select the identity that owns this source.

   - To find a source owner, begin entering their name.
3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](<https://documentation.sailpoint.com/saas/help/va/index.html>).
4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information.
6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
7. (Optional) Select **Create Manual Work Items** to allow the connector to create manual work items for certain operations. You can also enable this option so the source supports additional source management features such as creating accounts and access profile management.

   > **Important**
   >
   > Once you enable this feature, you cannot disable it.

   For more information on manual work items in SailPoint, refer to [Work Items](<https://developer.sailpoint.com/docs/api/work-items>). For more information on SailPoint features, refer to [SailPoint Identity Services](<https://documentation.sailpoint.com/saas/help/index.html>).
8. Select **Save**.

## Connection Settings

Enter the values required to connect to your HashiCorp Community Vault instance.

> [!NOTE]
>
> **Screenshot**
>
> [![Connection Settings page with the Host URL and API Token fields](<https://documentation.sailpoint.com/connectors/hashicorp_vault_integration_onprem/va/help/img/connection_settings.png>)](<https://documentation.sailpoint.com/connectors/hashicorp_vault_integration_onprem/va/help/img/connection_settings.png>)

**To configure the connection settings:**

1. In **Host URL**, enter the HashiCorp Vault server URL. Use a format such as `http://<host>:<port>` or `https://<host>:<port>`.
2. In **API Token**, enter the API token used to authenticate with HashiCorp Vault. Use the token value that you created in [Prerequisites](<https://documentation.sailpoint.com/connectors/hashicorp_vault_integration_onprem/va/help/index.html#prerequisites>).
3. Select **Save**.

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Dataset Management

Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history.

> [!NOTE]
>
> Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>) for more information.

For more information, refer to [Managing Datasets and Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html>) for datasets, resources, owner correlation, and aggregation.

## Datasets

A *dataset* is a named group of one or more related resources that the source aggregates together.

When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources.

> [!NOTE]
>
> Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them.

### Dataset Aggregation

Configure aggregation on the **Dataset Aggregations** tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to [Configuring Dataset Aggregations](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

## Resources

A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model.

In the UI, each resource appears under **Dataset Management** \> **Resources** with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation.

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

### Owner Correlation

Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to [Configuring Owner Correlation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-owner-correlation>).

## Supported Datasets

Go to **Dataset Management \> Datasets** on your HashiCorp Vault Integration (On-Premise) source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation.

> [!NOTE]
>
> Configure aggregation for each dataset separately. For more information, refer to [Dataset Aggregation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

> [!NOTE]
>
> The datasets require the `idn:agentic-identity-governance` license.

| Dataset name | Dataset ID | Associated resources | Description |
| --- | --- | --- | --- |
| **Vault UserPass** | `hashicorp-vault:userpass-account` | [Vault UserPass](<#vault-userpass>) | Vault non-token identities (userpass today; AppRole later). Emitted when `identity.is_token` is false. |
| **Vault Token** | `hashicorp-vault:tokens` | [Vault Token](<#vault-token>) | Vault token accessor metadata. The connector never retrieves the token string. Emitted when `identity.is_token` is true. |

For resource details, refer to [Supported Resources](<#supported-resources>).

### Dataset Aggregations

Dataset aggregation collects resource objects from the managed system and loads them into SailPoint. Repeat the configuration for each dataset on the source.

### Configuring Dataset Aggregation

To configure dataset aggregation for a dataset:

1. Go to **Admin \> Connections \> Sources**, and open your source.
2. Go to **Dataset Management \> Datasets**.
3. Select the dataset you want to configure.
4. Select the **Dataset Aggregations** tab.

   On the **Dataset Aggregations** tab, configure how resource objects from the selected dataset are aggregated into SailPoint. The tab contains **Scheduled Aggregations**, **Manual Aggregation**, and **Latest Aggregation**.

#### Scheduled Aggregations

Scheduled aggregations run on a schedule to keep the dataset synchronized with the managed system.

1. On the **Dataset Aggregations** tab, select **Enable Schedule** to turn on scheduled aggregations.

When scheduled aggregations are enabled, SailPoint aggregates all resource objects in the dataset on the configured schedule.

#### Manual Aggregation

Manual aggregation runs once and collects all resource objects in the dataset.

1. On the **Dataset Aggregations** tab, select **Start Aggregation**.

SailPoint starts the aggregation immediately. When the run completes, results appear in the **Latest Aggregation** section.

#### Viewing Aggregation Results

After an aggregation completes, review its status in the **Latest Aggregation** section on the **Dataset Aggregations** tab.

The **Latest Aggregation** section shows:

- **Start Time** - when the aggregation started
- **Resource Objects Scanned** - the number of resource objects the aggregation processed
- **Status** - whether the aggregation succeeded or failed

Select **Details** to view additional information about the most recent run. To view prior runs, select **Aggregation History**.

## Supported Resources

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

> [!NOTE]
>
> When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources.

Resource schemas appear under **Dataset Management \> Resources**. Each resource is read-only.

| Resource name | Type | Associated dataset | Resource ID |
| --- | --- | --- | --- |
| **[Vault Token](<#vault-token>)** | Credential | Vault Token | `hashicorp-vault:token` |
| **[Vault UserPass](<#vault-userpass>)** | Account | Vault UserPass | Requires source clarification |

> [!IMPORTANT]
>
> The connector does not retrieve secret payloads or token values.

**To review the resource schemas after you create the source:**

1. Go to **Admin \> Connections \> Sources**.
2. Open your **HashiCorp Vault Integration (On-Premise)** source.
3. Select **Dataset Management \> Resources**.
4. Select a resource.
5. Open the **Schema** tab.

## Vault Token

| Property | Value |
| --- | --- |
| Resource ID | `hashicorp-vault:token` |
| Associated dataset | Vault Token |
| Type | Credential |
| Identity attribute | `accessor` |
| Display attribute | `tokenDisplayName` |

### Attributes

| Attribute | Description | Type | Required |
| --- | --- | --- | --- |
| `accessor` | Unique token accessor identifier. | string | Yes |
| `displayName` | Token display name reported by Vault. The value might not be unique. | string | No |
| `tokenDisplayName` | Unique composite display name. | string | No |
| `path` | Authentication path used to create the token. | string | No |
| `tokenType` | Token type - `service` or `batch`. | string | No |
| `entityId` | Associated Vault entity ID. | string | No |
| `identityPolicies` | Top-level identity policies assigned to the token. | array of strings | No |
| `dataPolicies` | Policies returned by the token accessor lookup. | array of strings | No |
| `meta` | Token metadata serialized as a JSON string. | string | No |
| `creationTime` | Creation time in Unix epoch seconds. | integer | No |
| `issueTime` | Token issue timestamp. | string | No |
| `expireTime` | Token expiration timestamp. | string | No |
| `creationTtl` | Initial time to live in seconds. A value of `0` means no time limit. | integer | No |
| `explicitMaxTtl` | Explicit maximum time to live in seconds. A value of `0` means no time limit. | integer | No |
| `ttl` | Remaining time to live in seconds. A value of `0` identifies a root token or no time limit. | integer | No |
| `numUses` | Remaining uses. A value of `0` means unlimited uses. | integer | No |
| `orphan` | Indicates whether the token outlives its parent. | boolean | No |
| `renewable` | Indicates whether the token can be renewed. | boolean | No |
| `mountAccessor` | Unique authentication mount accessor. | string | No |
| `resolvedPolicies` | Flattened ACL rules. | string | No |
| `isServicePrincipal` | Indicates whether the identity qualifies as a service principal. | boolean | No |

## Vault UserPass

| Property | Value |
| --- | --- |
| Resource ID | Requires source clarification |
| Associated dataset | Vault UserPass |
| Type | Account |
| Classification | Machine |
| Identity attribute | `identity` |
| Display attribute | `username` |

### Attributes

The schema includes 26 attributes. None of the attributes are entitlements.

| Attribute | Description | Type |
| --- | --- | --- |
| `identity` | Composite resource identity, unique across mounts. Composed as the mount accessor, a hyphen, and the identity name at emit time. | string |
| `username` | Userpass username. | string |
| `authMethod` | Auth method. The current value is `userpass`. AppRole is planned later. | string |
| `mountName` | Auth mount name. For example, `userpass/`. | string |
| `mountType` | Auth mount type. | string |
| `mountAccessor` | Auth mount accessor. | string |
| `identityPolicies` | Top-level identity policies. | string |
| `tokenPolicies` | Policy template applied to issued tokens. | string |
| `tokenBoundCidrs` | CIDR restrictions applied to issued tokens. | string |
| `tokenTtl` | Token time to live, in seconds. | int |
| `tokenMaxTtl` | Maximum token time to live, in seconds. | int |
| `tokenExplicitMaxTtl` | Explicit maximum token time to live, in seconds. | int |
| `tokenPeriod` | Token period, in seconds. | int |
| `tokenNumUses` | Maximum token uses. A value of `0` means unlimited uses. | int |
| `tokenNoDefaultPolicy` | Indicates whether issued tokens omit the default policy. | boolean |
| `tokenType` | Token type. Values are `default`, `service`, or `batch`. | string |
| `resolvedPolicies` | Flattened ACL rules as a JSON string. | string |
| `signalMountType` | Derived signal for the authentication mount type. | string |
| `signalIsToken` | Derived signal that indicates whether the identity is a token. This value is false for userpass accounts. | boolean |
| `signalEntityId` | Derived signal for the associated Vault entity ID. | string |
| `signalPolicyCount` | Derived signal for the number of identity policies. | int |
| `signalHasRootPolicy` | Derived signal that indicates whether the account has the root policy. | boolean |
| `signalHasSudoCapability` | Derived signal that indicates whether the account has the sudo capability. | boolean |
| `signalWritablePathCount` | Derived signal for the count of paths that grant create, update, or delete. | int |
| `signalDisplayNameLooksServiceAccount` | Heuristic signal that indicates whether the display name appears to identify a service account. | boolean |
| `isServicePrincipal` | Indicates whether the account qualifies as a service principal. | boolean |

# Integrating SailPoint with HashiCorp Vault Integration (On-Premise)

This document provides the requirements and field definitions you need to configure a HashiCorp Vault Integration (On-Premise) connector.

Use the connector to discover and aggregate non-human identities (NHIs) from on-premises HashiCorp Vault (Community version) into SailPoint. The connector aggregates Vault token metadata and userpass account metadata.

> [!NOTE]
>
> This is a SailPoint source connector. It is not the HashiCorp Vault Credential Provider.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

| Feature | Description |
| --- | --- |
| Test connection | Validates the connection to HashiCorp Community Vault. |
| Dataset aggregation | Aggregation Tokens and UserPass Accounts |

> [!NOTE]
>
> Your organization must have SailPoint Agentic Fabric to use this connector. Contact your Customer Success team for more information.
>
> For more information, refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>).

### Non-Human Identity Discovery

- Aggregate Vault tokens and UserPass accounts

Refer to Dataset Management for more information.

Refer to [Discovering Potential Non-Human Accounts](<https://documentation.sailpoint.com/saas/help/agentic_fabric/nhi/non_human_accounts.html#discovering-potential-non-human-accounts>) for more information.

## Supported Managed Systems

The HashiCorp Vault Integration (On-Premise) source supports the following managed systems:

- HashiCorp Vault Community edition, deployed on-premises

## Prerequisites

- Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).

Before you configure the HashiCorp Vault Integration (On-Premise) source, create a Vault ACL policy and a Vault token.

### Creating the Vault ACL Policy

1. Create a Vault ACL policy that grants the permissions listed in [Required Permissions](<#required-permissions>).
2. Save the policy and record its name.

### Creating the Vault Token

1. Run the following command. Replace `<policy-name>` with the ACL policy name.

   ```text
   vault write auth/token/create policies=<policy-name> period="720h" renewable=true
   ```

   The connector does not automatically regenerate an expired token. Configure the token's period. If you do not configure a period, the default is 32 days. If a token expires, you can manually renew it.
2. Copy the token value and store it securely.
3. Use the token value for **API Token** when you configure the source.

## Required Permissions

Grant the Vault token a policy with the following minimum read permissions. Create this policy before you create the token.

```text
path "*" {
  capabilities = ["list", "read"]
}
path "auth/token/lookup-accessor" {
  capabilities = ["update"]
}
path "auth/token/accessors" {
  capabilities = ["list", "sudo"]
}
path "auth/token/renew-self" {
  capabilities = ["update"]
}
```

Each rule supports the following connector operations.

| Path | Capabilities | Purpose |
| --- | --- | --- |
| `*` | `list`, `read` | Reads the authentication mounts and userpass account metadata the connector aggregates. |
| `auth/token/lookup-accessor` | `update` | Looks up the metadata for each token accessor. |
| `auth/token/accessors` | `list`, `sudo` | Lists the token accessors available in the Vault instance. |
| `auth/token/renew-self` | `update` | Renews the connector's own token so the connection remains valid. |