# SailPoint IBM AIX Connector Documentation > IBM AIX Connector Documentation # Documentation # Additional Information This section describes additional information related to the AIX Connector: - The AIX sources support the MD5, SHA-1, and SHA-2 cryptographic hash functions. - The AIX source aggregates details about the last password updated (date and time) in the `lastPasswordUpdated` attribute. If those details are not available, the `lastPasswordUpdated` attribute will be empty. - To add user-friendly definitions for entitlements on direct connect sources, refer to [Managing Entitlements](). # Connecting SailPoint and IBM AIX To connect SailPoint with AIX, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 8. Under **Connection Type**, select **Direct Connection** or **Flat File**. - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable. 9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source. 10. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Select **Save**. ## Connection Settings Configure a secured direct connection between the IBM AIX source and SailPoint. > [!NOTE] > > **Screenshot** > > [![Connection Settings]()]() 1. Enter the AIX **Unix Server Host** name or the IP address managed by the source. 2. Enter the AIX **SSH Port** number used for SSH communication. The default is port `22`. 3. Enter the **Username** of the sudo or root user that has the required permissions, as noted in [Required Permissions](). 4. Enter the **Password** for the sudo or root user. > **Note** > > Select the **Sudo User** checkbox if the user account is not the root user. 5. Enter the **Set Prompt** to set the source shell prompt. Default - `PS1='SAILPOINT>'` 6. Enter the **SSH Shell** present on the AIX system. Default - `sh`. 7. Select **Save**. ## Configure File Transfer Protocol for Aggregation In the **Additional Settings** tab, you can configure the file transfer protocol you want to use for aggregation operations. > [!NOTE] > > **Screenshot** > > [![Additional Settings]()]() 1. Do one of the following: - Select the **SFTP** radio button to use Secure File Transfer Protocol (SFTP) for aggregation operations. This is the default. - Select the **SCP** radio button to use Secure Copy Protocol (SCP) for aggregation operations. 2. Select **Save**. ## Configuration Parameters The following table lists the configuration parameters of AIX connector: > [!NOTE] > > Attributes marked with an asterisk (\*) are mandatory. | Parameter | Description | | --- | --- | | Unix Server Host\* | Hostname / IP address of AIX computer | | SSH Port\* | SSH port configured. Default value: `22` | | Not a 'root' user | Indicates if the specified User ID is not root | | User Name\* | User ID on the AIX computer that you want to use for connector operations | | Password\* | Password of the managed system user account that you want to use for connector operations | | Private Key File Path | Path to Private Key File. Private or Public key authentication will have precedence over password authentication | | Passphrase For Private Key | Passphrase provided for creating a Private Key | ### Additional Configuration Parameters for SSH Configuration You can add additional configuration parameters for SSH configuration in the source XML file. > [!NOTE] > > **Default command for setting shell prompt on a UNIX computer** > > In the following command, `SetPrompt` is the target source attribute and `PS1=’SAILPOINT` is the value of the target source attribute. > > ```text > > ``` > > If the command for setting a shell prompt is different than the default command, change the value of the target source attribute. If the target source attribute is not found, add the following new entry in the target source XML file: > > For example, the entry value for a TCSH shell is as follows: > > ```text > > ``` > [!NOTE] > > **Verify that the default shell is present on your system to execute the commands** > > If the default shell present on your UNIX system is different, modify the value of the target source attribute. If the target source attribute is not found, add the following new entry in the target source XML file: > > ```text > > ``` ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Integrating SailPoint with IBM AIX SailPoint's AIX connector is used for Create, Read, Update, and Delete operations on the IBM AIX operating system. These systems remain a common presence in many enterprise environments and SailPoint is able to manage these systems through SSH-based communication. This document is designed to provide information about requirements and definitions you'll need to configure working instances of AIX sources in SailPoint. If you have user accounts in an AIX source that you want to load into SailPoint, you can create a direct connect source for AIX and load that data into your system. To manage that data, either create an [identity profile]() based on the source or verify that the accounts you load are [correlated]() to an existing identity. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features SailPoint AIX Connector supports for the following features. > [!NOTE] > > Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site. - Load and \*provision accounts - \*Password management - \*Access Certifications (certification of entitlements connected to accounts) - Delete Accounts For more information on features, refer to [Source Features](). ### Password Management If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following: - The password policy defined in SailPoint applies to accounts on this source. - If you change the password for an application connected to this source, the change will automatically be made to the source itself. For more information on configuring password management, refer to [Password Management Overview](). ## Privilege Classification SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements. | Privilege Level | Description | | --- | --- | | High | Administrative level access to accounts | | Medium | Administrative level access for a specific role or function | | Low | Only basic access of data | > [!NOTE] > > To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin. For more information, refer to [Managing Privilege Classification](). ## Prerequisites - Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the [Virtual Appliance Reference Guide](). ## Supported Managed Systems The AIX connector supports the following versions of the operating system: - AIX 7.2 ## Administrator Permissions ### Sudo Users and Permissions for AIX Sources AIX sources support the aggregation of `sudoer` commands for accounts and groups. The `/etc/sudoers` file has the user permissions. **Prerequisites:** - The admin user must have permissions to execute the `/usr/bin/awk` command. You must update the `/etc/sudoers` file entry for the admin user with the `/usr/bin/awk` command. - You must add the new multi-valued schema attribute, `sudoCommands` - which collects all the necessary user commands and stores them - to the user and group schemas. - If you want to aggregate the sudo commands from multiple sudo files, then you must provide the list of files as a separate config attribute in the source config XML. For example, you can use: ```text ``` > [!NOTE] > > The default command that collects the sudo commands is: > > ```text > awk '/^[^#]/' /etc/sudoers > ``` > > In this example, commented lines are skipped and the remaining content of the `/etc/sudoers` file is aggregated in to a temporary file on the AIX host. > > If you want to use a custom command for aggregating file data, you can configure this command as part of the source config XML. For example, you can use: > > - **Key** - `sudoUserCommand` > - **Value** - `awk '/^[^#]/' /etc/sudoers` ### Read Only Permissions If you want to use the sudo user to perform only read-only operations, it must be configured with the following rights and permissions. **For Account Aggregation only** Rights to execute the following commands with root privilege: ```text /usr/sbin/lsuser, /bin/echo, /bin/rm -f spt_tmp_* ``` An entry in the `/etc/sudoers` file should look similar to the following: ```text username ALL = (root) PASSWD : /usr/sbin/lsuser, /bin/echo, /bin/rm -f spt_tmp_* ``` **For Entitlements Aggregation only** Rights to execute the following commands with root privilege: ```text /usr/sbin/lsgroup, /bin/echo, /bin/rm -f spt_tmp_* ``` An entry in the `/etc/sudoers` file should look similar to the following: ```text username ALL = (root) PASSWD : /usr/sbin/lsgroup, /bin/echo, /bin/rm -f spt_tmp_* ``` > [!IMPORTANT] > > If you modify any of the commands in the application definition, then you'll need to make the same changes in the `/etc/sudoers` file. Verify command paths on AIX computers as they might differ from the values mentioned here. ### AIX Updated Administrator Permissions Rights to execute the following commands with root privilege: ```text /usr/sbin/lsuser, /usr/sbin/lsgroup, /usr/bin/chmod, /usr/bin/mkuser, /usr/sbin/userdel, /usr/bin/chuser, /usr/bin/chgroup, /usr/bin/mkgroup, /usr/sbin/rmgroup, /usr/bin/passwd, /bin/rm -f spt_tmp_*, /bin/echo, /usr/bin/pwdadm,/usr/bin/awk ``` An entry in the `/etc/sudoers` file should look similar to the following: ```text username ALL = (root) PASSWD: /usr/sbin/lsuser, /usr/sbin/lsgroup, /usr/bin/chmod, /usr/bin/mkuser, /usr/sbin/userdel, /usr/bin/chuser, /usr/bin/chgroup, /usr/bin/mkgroup, /usr/sbin/rmgroup, /usr/bin/passwd, /bin/rm -f spt_tmp_*, /bin/echo, /usr/bin/pwdadm,/usr/bin/awk ``` # Machine Account Attributes Machine account attributes are used in provisioning configurations for machine accounts. After you have [created the required machine account subtypes](), you can use the machine account attributes to provision machine accounts in your SailPoint tenant. Refer to [Machine Identity Security Overview]() for more information. > [!NOTE] > > Attributes marked with an asterisk (\*) are mandatory. ## Machine Account Provisioning Attributes | Create Account Attribute | Description | | --- | --- | | User Name\* | The username for the account. | | password\* | The password for the account. | # Provisioning The IBM AIX connector supports provisioning, allowing you to create and manage accounts and entitlements in AIX directly from SailPoint. **Prerequisite:** Your system is configured for provisioning. When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*. When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment. For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account. > [!IMPORTANT] > > This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail. ## Default Create Account Attributes | Account Attributes | Generator | Description | | --- | --- | --- | | username | Create Unique Account ID | This generator uses the value in the Pattern Used field to generate a unique user name for the new account. | | password | Create Password | This generator creates an initial password for the new account that matches the password policy assigned to the associated AIX source in SailPoint. | | id | Disable | The identity of the user | | pgrp | Disable | The primary group of the user | | home | Disable | The home directory of the user | | shell | Disable | The default shell of the user | | gecos | Disable | The General Electric Comprehensive Operating System (GECOS) information for the user. The user's name, phone numbers, and other generic personal information are stored here. | | login | Disable | Indicates whether the user can log in to the system with the login command. Possible values are:
\- true (default) - The user can log in to the system.
\- false - The user cannot log in to the system. | | rlogin | Disable | Permits access to the account from a remote location with the telnet or `rlogin` commands. Possible values are:
\- true (default) - The user account can be accessed remotely.
\- false - The user account cannot be accessed remotely. | | su | Disable | Indicates whether another user can switch to the specified user account with the `su` command. Possible values are:
\- true (default) - Another user can switch to the specified account.
\- false - Another user cannot switch to the specified account. | | admin | Disable | Defines the administrative status of the user. Possible values are:
\- true - The user is an administrator. Only the root user can change the attributes of users defined as administrators.
\- false (default) - The user is not an administrator. | | sugroups | Disable | Lists the groups that can use the `su` command to switch to the specified user account. The Value parameter is a comma-separated list of group names, or a value of ALL to indicate all groups. An `!` (exclamation point) in front of a group name excludes that group. If this attribute is not specified, all groups can switch to this user account with the `su` command. | | admgroups | Disable | Lists the groups the user administrates. The `Value` parameter is a comma-separated list of group names. | | umask | Disable | Determines file permissions. This value, along with the permissions of the creating process, determines a file's permissions when the file is created. The default is `022`. | | default\_roles | Disable | Specifies the default roles for the user. The `Value` parameter, a comma-separated list of valid role names, can only contain roles assigned to the user in the roles attribute. You can use the `ALL` keyword to signify that the default roles for the user are all their assigned roles. | # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The IBM AIX connector uses the following default correlation and object configurations. ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | User Name | Account | | Group Name | Group | ### Default Account Attributes The IBM AIX connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. | Attribute Name | Description | | --- | --- | | User Name | Name of the user on the AIX computer that you want to use for connector operations | | gecos | The General Electric Comprehensive Operating System (GECOS) information for User. The user's name, phone numbers, and other generic personal information are stored here. | | id | User ID | | pgrp | Primary group of user | | groups | Secondary groups of user | | home | Home directory of user | | shell | Default shell of user | | login | Indicates whether the user can log in to the system with the login command. Possible values are:
\- **true** (default) - The user can log in to the system.
\- **false** - The user cannot log in to the system. | | su | Indicates whether another user can switch to the specified user account with the `su` command. Possible values are:
\- **true** (default) - Another user can switch to the specified account.
\- **false** - Another user cannot switch to the specified account. | | rlogin | Permits access to the account from a remote location with the `telnet` or `rlogin` commands. Possible values are:
\- **true** (default) - The user account can be accessed remotely.
\- **false** - The user account cannot be accessed remotely. | | daemon | Indicates whether the user specified by the `Name` parameter can execute programs using the `cron` daemon or the `src` (system resource controller) daemon. Possible values are:
\- **true** (default) - The user can initiate `cron` and `src` sessions.
\- **false** - The user cannot initiate `cron` and `src` sessions. | | admin | Defines the administrative status of the user. Possible values are:
\- **true** - The user is an administrator. Only the root user can change the attributes of users defined as administrators.
\- **false** (default) - The user is not an administrator. | | dce\_export | Allows the DCE registry to overwrite the local user information with the DCE user information during a DCE export operation. Possible values are:
\- **true** - Local user information will be overwritten.
\- **false** - Local user information will not be overwritten. | | sugroups | Lists the groups that can use the `su` command to switch to the specified user account. The `Value` parameter is a comma-separated list of group names, or a value of `ALL` to indicate all groups. An `!` (exclamation point) in front of a group name excludes that group. If this attribute is not specified, all groups can switch to this user account with the `su` command. | | admgroups | Lists the groups the user administrates. The `Value` parameter is a comma-separated list of group names. For additional information on group names, refer to the `adms` attribute of the `/etc/security/group` file. | | tpath | Indicates the user's trusted path status. The possible values are:
\- **always** - The user can only execute trusted processes. This implies that the user's initial program is in the trusted shell or some other trusted process.
\- **notsh** - The user cannot invoke the trusted shell on a trusted path. If the user enters the secure attention key (SAK) after logging in, the login session ends.
\- **nosak** (default) - The secure attention key (SAK) is disabled for all processes run by the user. Use this value if the user transfers binary data that may contain the SAK sequence.
\- **on** - The user has normal trusted path characteristics and can invoke a trusted path (enter a trusted shell) with the secure attention key (SAK). | | ttys | Lists the terminals that can access the account specified by the `Name` parameter. The `Value` parameter is a comma-separated list of full path names, or a value of ALL to indicate all terminals. The values of RSH and REXEC also can be used as terminal names. An `!` (exclamation point) in front of a terminal name excludes that terminal. If this attribute is not specified, all terminals can access the user account. If the `Value` parameter is not ALL, then `/dev/pts` must be specified for network logins to work properly. | | expires | Identifies the expiration date of the account. The `Value` parameter is a 10-character string in the `MMDDhhmmyy` form, where `MM` = month, `DD` = day, `hh` = hour, `mm` = minute, and `yy` = last 2 digits of the years 1939 through 2038. All characters are numeric. If the `Value` parameter is 0, the account does not expire. The default is 0. See the `date` command for more information. | | auth1 | Lists additional mandatory methods for authenticating the user. The `auth1` attribute has been deprecated and may not be supported in a future release. The `SYSTEM` attribute should be used instead. The authentication process will fail if any of the methods specified by the `auth1` attribute fail.
\- The `Value` parameter is a comma-separated list of `Method`;`Name` pairs.
\- The `Method` parameter is the name of the authentication method.
\- The `Name` parameter is the user to authenticate. If you do not specify a `Name` parameter, the name of the user being authenticated is used.
\- Valid authentication methods for the `auth1` and `auth2` attributes are defined in the `/etc/security/login.cfg` file. | | auth2 | Lists additional optional methods for authenticating the user. The `auth2` attribute has been deprecated and may not be supported in a future release. The `SYSTEM` attribute should be used instead. The authentication process will not fail if any of the methods specified by the `auth2` attribute fail.
\- The `Value` parameter is a comma-separated list of `Method`;`Name` pairs.
\- The `Method` parameter is the name of the authentication method.
\- The `Name` parameter is the user to authenticate. If you do not specify a `Name` parameter, the name of the user being authenticated is used. | | umask | Determines file permissions. This value, along with the permissions of the creating process, determines a file's permissions when the file is created. The default is `022`. | | registry | Defines the authentication registry where the user is administered. It is used to resolve a remotely administered user to the local administered domain. This situation may occur when network services unexpectedly fail or network databases are replicated locally. Example values are `files`, `NIS`, or `DCE`. | | SYSTEM | Defines the system authentication mechanism for the user. The value may be an expression describing which authentication methods are to be used or it may be the keyword `NONE`.
The **SYSTEM** mechanism is always used to authenticate the user, regardless of the value of the `auth1` and `auth2` attributes. If the `SYSTEM` attribute is set to `NONE`, authentication is only performed using the `auth1` and `auth2` attributes. If the `auth1` and `auth2` attributes are blank or ignored, as with the TCP socket daemons (`ftpd`, `rexecd`, and `rshd`), no authentication will be performed.
The method names `compat`, `files`, and `NIS` are provided by the security library. Additional methods may be defined in the `/usr/lib/security/methods.cfg` file. | | logintimes | Specifies the times, days, or both, the user is allowed to access the system. The value is a comma-separated list of entries. The `day` variable must be one digit between 0 and 6 that represents one of the days of the week. A 0 (zero) indicates Sunday and a 6 indicates Saturday. The `time` variable is 24-hour military time (1700 is 5:00 p.m.). Leading zeroes are required. Entries not preceded by an `!` (exclamation point) allow access and are called ALLOW entries. Entries prefixed with an `!` (exclamation point) deny access to the system and are called DENY entries. The `!` operator applies to only one entry, not the whole restriction list. It must appear at the beginning of each entry. | | loginretries | Defines the number of unsuccessful login attempts allowed after the last successful login before the system locks the account. The value is a decimal integer string. A zero or negative value indicates that no limit exists. Once the user's account is locked, they will not be able to log in until the system administrator resets the user's `unsuccessful_login_count` attribute in the `/etc/security/lastlog` file to be less than the value of `loginretries`. | | pwdwarntime | Defines the number of days before the system issues a warning that a password change is required. The value is a decimal integer string. A zero or negative value indicates that no message is issued. The value must be less than the difference of the `maxage` and `minage` attributes. Values greater than this difference are ignored, and a message is issued when the `minage` value is reached. | | account\_locked | Indicates if the user account is locked. Possible values include:
\- **true** - The user's account is locked. The values yes, true, and always are equivalent. The user is denied access to the system.
\- **false** (default) - The user's account is not locked. The values no, false, and never are equivalent. The user is allowed access to the system. | | minage | Defines the minimum age (in weeks) a password must be before it can be changed. The value is a decimal integer string. The default is a value of `0`, indicating no minimum age. | | maxage | Defines the maximum age (in weeks) of a password. The password must be changed by this time. The value is a decimal integer string. The default is a value of `0`, indicating no maximum age. | | maxexpired | Defines the maximum time (in weeks) beyond the `maxage` value that a user can change an expired password. After this defined time, only an administrative user can change the password. The value is a decimal integer string. The default is -1, indicating no restriction is set. If the **maxexpired** attribute is 0, the password expires when the `maxage` value is met. If the `maxage` attribute is `0`, the `maxexpired` attribute is ignored. | | minalpha | Defines the minimum number of alphabetic characters that must be in a new password. The value is a decimal integer string. The default is a value of `0`, indicating no minimum number. | | minother | Defines the minimum number of non-alphabetic characters that must be in a new password. The value is a decimal integer string. The default is a value of `0`, indicating no minimum number. | | mindiff | Defines the minimum number of characters required in a new password that were not in the old password. The value is a decimal integer string. The default is a value of `0`, indicating no minimum number. | | maxrepeats | Defines the maximum number of times a character can be repeated in a new password. Since a value of `0` is meaningless, the default value of `8` indicates that there is no maximum number. The value is a decimal integer string. | | minlen | Defines the minimum length of a password. The value is a decimal integer string. The default is a value of `0`, indicating no minimum length. The maximum value allowed is `8`. This attribute is determined by the `minalpha` attribute value added to the `minother` attribute value. If the sum of these values is greater than the `minlen` attribute value, the minimum length is set to the result. | | histexpire | Designates the period of time (in weeks) that a user cannot reuse a password. The value is a decimal integer string. The default is `0`, indicating that no time limit is set. | | histsize | Designates the number of previous passwords a user cannot reuse. The value is a decimal integer string. The default is `0`. | | pwdchecks | Defines the password restriction methods enforced on new passwords. The value is a list of comma-separated method names and is evaluated from left to right. A method name is either an absolute path name or a path name relative to `/usr/lib` of an executable load module. | | dictionlist | Defines the password dictionaries used by the composition restrictions when checking new passwords. The password dictionaries are a list of comma-separated, absolute path names that are evaluated from left to right. All dictionary files and directories must be write-protected from all users except root. The dictionary files are formatted one word per line. The word begins in the first column and terminates with a new-line character. Only 7-bit ASCII words are supported for passwords. If text processing is installed on your system, the recommended dictionary file is the `/usr/share/dict/words` file. | | default\_roles | Specifies the default roles for the user. The Value parameter, a comma-separated list of valid role names, can only contain roles assigned to the user in the roles attribute. You can use the ALL keyword to signify that the default roles for the user are all their assigned roles. | | fsize | Identifies the soft limit for the largest file a user process can create or extend. | | cpu | Sets the soft limit for the largest amount of system unit time (in seconds) that a user process can use. | | data | Identifies the soft limit for the largest process data segment for a user process. | | stack | Specifies the soft limit for the largest process stack segment for a user process. | | core | Specifies the soft limit for the largest core file a user process can create. | | rss | Sets the soft limit for the largest amount of physical memory a user process can allocate. This limit is not enforced by the system. | | nofiles | Sets the soft limit for the number of file descriptors a user process may have open at one time. | | stack\_hard | Specifies the largest process stack segment for a user process. | | time\_last\_login | Specifies the number of seconds since the epoch (00:00:00 GMT, January 1, 1970) since the last successful login. The value is a decimal integer. | | tty\_last\_login | Specifies the terminal on which the user last logged in. The value is a character string. | | host\_last\_login | Specifies the host from which the user last logged in. The value is a character string. | | unsuccessful\_login\_count | Specifies the number of unsuccessful login attempts since the last successful login. The value is a decimal integer. This attribute works in conjunction with the user's `loginretries` attribute, specified in the `/etc/security/user` file, to lock the user's account after a specified number of consecutive unsuccessful login attempts. Once the user's account is locked, the user will not be able to log in until the system administrator resets the user's `unsuccessful_login_count` attribute to be less than the value of `loginretries`. | | lastPasswordUpdated | Specifies the time when user's password last updated. The value is a character string. | | roles | Contains the list of roles for each user. | | groups | Contains the list of groups for each user. | | host\_last\_unsuccessful\_login | Specifies the last unsuccessful host login. | | time\_last\_unsuccessful\_login | Specifies the time of the last unsuccessful login. | | minloweralpha | Defines the minimum number of lowercase alphabetic characters that must be in a new password. The value is a decimal integer string. The default is a value of `0`, indicating no minimum number. | | minupperalpha | Defines the minimum number of uppercase alphabetic characters that must be in a new password. The value is a decimal integer string. The default is a value of `0`, indicating no minimum number. | | minspecialchar | Defines the minimum number of special characters that must be in a new password. The value is a decimal integer string. The default is a value of `0`, indicating no minimum number. | | mindigit | Defines the minimum number of numerical digits that must be in a new password. The value is a decimal integer string. The default is a value of `0`, indicating no minimum number. | | tty\_unsuccessful\_login | Specifies the terminal on which the there was an unsuccessful user login. The value is a character string. | ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The IBM AIX connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. | Attribute Name | Description | | --- | --- | | users | Identifies a list of one or more users which are associated with group | | admin | Specifies whether administrative group or not | | registry | Specifies where the user or group identification information is administrated | | Group Name | Name of the group | | id | Group ID | # Enable Connector Logging This topic provides the steps needed to enable logging on SailPoint using REST APIs. > [!NOTE] > > This topic only applies to VA-based integrations. > [!NOTE] > > The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector. This process is broken up into four steps: 1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging. 2. Get the logging configuration for the existing VA cluster. 3. Update the VA cluster to enable logging levels. 4. Observe logging changes to the logging levels. ### Identify the Virtual Appliance Cluster Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>). 1. Make the following call to the REST API to return a list of available VA clusters: GET /v3/managed-clusters The REST API returns a response that looks similar to the following: ```json [ { "id": "2c9180866166b5b0016167c32ef31a66", "name": "Development Cluster", "description": "Development Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": null }, { "id": "2c9180846a93ce60016ab29f039944de", "name": "Cloud Cluster", "description": "Cloud Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } } ] ``` > **Note** > > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster. 2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute. ### Get the Logging Configuration Get your selected VA's cluster logging configuration and identify the values you need to update. 1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. GET /v3/managed-clusters/{id}/log-config - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response. - If the VA has an existing logging configuration, it returns something similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` You'll need to configure the following information in the response: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). ### Update Logging Configuration Update the VA cluster configuration returned by the REST API to update the logging settings as needed. 1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. PUT /v3/managed-clusters/{id}/log-config 2. Submit your configuration changes to the REST API in a JSON body. - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one. - If the VA returned a configuration, you can edit it to include the changes. The JSON body should be as follows: ```json { "durationMinutes": 60, "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` Consider the following as you edit the JSON: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). If the update was successful, the REST API should return a response similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` ### Observe Logging Changes Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**. ### References The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file. #### Logging Levels | Logging Level | Description | | --- | --- | | ERROR | Designates error events that might still allow the connector to continue. | | WARN | Designates potentially harmful situations. | | INFO | Designates information messages that highlight process at a coarse-grain level. | | DEBUG | Very verbose. Fine grain logging levels used for development and debugging. | | TRACE | Most verbose. Finer grain logging levels than debugging. | #### Logging Classes | Connector | Logging Class | | --- | --- | | Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector | | AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector | | Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT | | Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector | | Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector | | Microsoft Entra ID | sailpoint.connector.AzureADConnector | | Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter | | Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter | | Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT | | Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter | | Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter | | GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter | | Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter | | IBM i | openconnector.connector.IBMiConnector | | Lotus Domino | sailpoint.connector.LotusDomino | | JDBC | sailpoint.connector.JDBCConnector | | Sun One LDAP | sailpoint.connector.LDAPConnector | | Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector | | Microsoft Office365 | sailpoint.connector.Office365Connector | | Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 | | Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT | | Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector | | Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector | | Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter | | Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector | | Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector | | Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector | | PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter | | PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector | | RemedyForce | sailpoint.connector.ForceConnector | | RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter | | Salesforce | sailpoint.connector.ForceConnector | | SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector | | SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector | | SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT | | SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector | | SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter | | SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter | | ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter | | ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter | | Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter | | Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter | | Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter | | SuccessFactors | sailpoint.connector.SuccessFactorsConnector | | Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector | | Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter | | Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter | | Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter | | Web Services | sailpoint.connector.WebServices | | XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter | | Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter | | Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter | # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Test connection fails for managed systems Test Connection fails for managed systems with the following error when the SSH login prompt appears with a delay: ```text [TimeoutException] [Possible suggestions] Tune the parameter . [Error details] Timeout occurred while setting the shell 'sh' ``` This error occurs when the connector tries to log in to the target managed system with SSH and execute the `sh` command. The `sh` command fails because of the delay on the target managed system for the `SSHLogin` prompt to appear. **Resolution** - To resolve this issue, adjust the following timeout parameters in the application Debug page: - **sshWaitTime** - Default value - 500 ms This timeout parameter is responsible for the wait to receive a command output. - **SSHTimeOut** - Default value - 120000 ms This timeout parameter is responsible for tuning the maximum time for a `SSH` command to execute. After this timeout, the connection is dropped and the operation will time out, even if the command execution is in progress on the target host. ## Aggregation/test connection fails with timeout error Aggregation/test connection fails with the following timeout error: ```text Exception during aggregation of Object Type account on Application Reason: Unable to create iterator sailpoint.connector.TimeoutException: [TimeoutException] [Possible suggestions] Tune the parameter . [Error details] Timeout occurred while reading command response. ``` Test Connection fails with following timeout error: ```text [TimeoutException] [Possible suggestions] Tune the parameter . [Error details] Timeout occurred while reading output stream for the executed command. ``` **Resolution** - Change the value of the `sshWaitTime` (in millisecond) application attribute as required using the REST API. Set the following attribute using the SailPoint REST API. Refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)](). - Attribute Key - `sshWaitTime` - Attribute Value - 500 ## Timeout occurs when third-party software is installed on the AIX machine For AIX sources, there is a timeout error. It has been observed that if any of the AIX machines have any third-party software (for example, Centrify) installed, then it does not prompt for the sudo user's password. > [!NOTE] > > If the `sshWaitTime` setting does not solve the problem, connect to the AIX System using the sudo user to check the system's behavior. After executing the following command, the connector should prompt for `%SAILPOINTSUDO` where the user is asked enter the sudo user's password: ```text sudo -p %SAILPOINTSUDO echo TestConnection ``` However, because some third-party software (for example, Centrify), may not prompt for `%SAILPOINTSUDO;`, the AIX source does not detect that it is being asking for the sudo user's password, and therefore doesn't prompt the user. For example, if the system prompts for **CSO Password:**, then the source should recognize that it is actually a prompt for the sudo user's password. Manually configure a custom sudo user password prompt using the `SudoPasswdPrompt` attribute. Set the following attribute using the SailPoint REST API. - Attribute Key - `SudoPasswdPrompt` - Attribute Value: `` For example, for Centrify software you can also use `CSO Password:` as a value. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. # Timeout Errors and Settings Timeout errors might occur when SailPoint is waiting for a response from the Virtual Appliance (VA). These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down. This document is designed to give specific information that can be used to resolve these errors. Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error. > [!IMPORTANT] > > Add the necessary attributes or values before performing the "replace" operation, as missing attributes will cause the operation to fail. To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the VA using the SailPoint REST API. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ### aggregateTimeout **Description:** This parameter is set for the aggregation timeout, measured in seconds. **Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds. For example: If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/aggregateTimeout", "value": 600 } ] ``` ### healthCheckTimeout **Description:** This parameter is set for the test connection and health check timeout. **Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again. For example: If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/healthCheckTimeout", "value": 45 } ] ``` ### provisioningTimeout **Description:** This parameter is set for provisioning timeout. **Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds. For example: If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/provisioningTimeout", "value": 360 } ] ``` ### timeout **Description:** This parameter is set for pass-through authentication timeout. **Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again. For example: If your current time value is 15 seconds, update the `timeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeout", "value": 30 } ] ``` ### apiTimeout **Description:** This parameter is set for API time tracking; customers can check it using an external tool. **Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again. For example: If your current time value is 60 seconds, update the `apiTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/apiTimeout", "value": "75" } ] ``` ### timeoutInSeconds **Description:** This parameter helps prevent the VA from waiting indefinitely for an API response, ensuring efficient handling of API requests. For example: If your current time value is 30 seconds, update the `timeoutInSeconds` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeoutInSeconds", "value": "15" } ] ```