Skip to content

Integrating SailPoint with IBM AIX

SailPoint's AIX connector is used for Create, Read, Update, and Delete operations on the IBM AIX operating system. These systems remain a common presence in many enterprise environments and SailPoint is able to manage these systems through SSH-based communication.

This document is designed to provide information about requirements and definitions you'll need to configure working instances of AIX sources in SailPoint.

If you have user accounts in an AIX source that you want to load into SailPoint, you can create a direct connect source for AIX and load that data into your system. To manage that data, either create an identity profile based on the source or verify that the accounts you load are correlated to an existing identity.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

SailPoint AIX Connector supports for the following features.

Note

Before you can use any item marked with an asterisk (*), SailPoint must activate the feature for your site.

  • Load and *provision accounts
  • *Password management
  • *Access Certifications (certification of entitlements connected to accounts)
  • Delete Accounts

For more information on features, refer to Source Features.

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

  • The password policy defined in SailPoint applies to accounts on this source.
  • If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

Privilege Level Description
High Administrative level access to accounts
Medium Administrative level access for a specific role or function
Low Only basic access of data

Note

To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to Managing Privilege Classification.

Prerequisites

Supported Managed Systems

The AIX connector supports the following versions of the operating system:

  • AIX 7.2

Administrator Permissions

Sudo Users and Permissions for AIX Sources

AIX sources support the aggregation of sudoer commands for accounts and groups. The /etc/sudoers file has the user permissions.

Prerequisites:

  • The admin user must have permissions to execute the /usr/bin/awk command. You must update the /etc/sudoers file entry for the admin user with the /usr/bin/awk command.
  • You must add the new multi-valued schema attribute, sudoCommands - which collects all the necessary user commands and stores them - to the user and group schemas.
  • If you want to aggregate the sudo commands from multiple sudo files, then you must provide the list of files as a separate config attribute in the source config XML. For example, you can use:
<entry key="sudoCmdFiles" value="/etc/sudoers.d/special_user.conf,/etc/sudoers.d/special_group.conf"/>

Note

The default command that collects the sudo commands is:

awk '/^[^#]/' /etc/sudoers

In this example, commented lines are skipped and the remaining content of the /etc/sudoers file is aggregated in to a temporary file on the AIX host.

If you want to use a custom command for aggregating file data, you can configure this command as part of the source config XML. For example, you can use:

  • Key - sudoUserCommand
  • Value - awk '/^[^#]/' /etc/sudoers

Read Only Permissions

If you want to use the sudo user to perform only read-only operations, it must be configured with the following rights and permissions.

For Account Aggregation only

Rights to execute the following commands with root privilege:

/usr/sbin/lsuser, /bin/echo, /bin/rm -f spt_tmp_*

An entry in the /etc/sudoers file should look similar to the following:

username ALL = (root) PASSWD : /usr/sbin/lsuser, /bin/echo, /bin/rm -f spt_tmp_*

For Entitlements Aggregation only

Rights to execute the following commands with root privilege:

/usr/sbin/lsgroup, /bin/echo, /bin/rm -f spt_tmp_*

An entry in the /etc/sudoers file should look similar to the following:

username ALL = (root) PASSWD : /usr/sbin/lsgroup, /bin/echo, /bin/rm -f spt_tmp_*

Important

If you modify any of the commands in the application definition, then you'll need to make the same changes in the /etc/sudoers file. Verify command paths on AIX computers as they might differ from the values mentioned here.

AIX Updated Administrator Permissions

Rights to execute the following commands with root privilege:

/usr/sbin/lsuser, /usr/sbin/lsgroup, /usr/bin/chmod, /usr/bin/mkuser, /usr/sbin/userdel, /usr/bin/chuser, /usr/bin/chgroup, /usr/bin/mkgroup, /usr/sbin/rmgroup, /usr/bin/passwd, /bin/rm -f spt_tmp_*, /bin/echo,  /usr/bin/pwdadm,/usr/bin/awk

An entry in the /etc/sudoers file should look similar to the following:

username ALL = (root) PASSWD: /usr/sbin/lsuser, /usr/sbin/lsgroup, /usr/bin/chmod, /usr/bin/mkuser, /usr/sbin/userdel, /usr/bin/chuser, /usr/bin/chgroup, /usr/bin/mkgroup, /usr/sbin/rmgroup, /usr/bin/passwd, /bin/rm -f spt_tmp_*, /bin/echo, /usr/bin/pwdadm,/usr/bin/awk

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.