Integrating SailPoint with IBM i

This document is designed to give specific information about the requirements and field definitions needed to get a working instance of an IBM i connector in SailPoint.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The SailPoint IBM i connector supports the following features:

Account Management

Note

Before you can use any item marked with an asterisk (*), SailPoint must activate the feature for your site.

Aggregation, Partitioning Aggregation
*Provision IBM i Accounts
Enable and Disable
Create, Update, Delete
*Password Management
*Access Certifications (certifications of entitlements connected to accounts)
Additional Entitlements (Authorization Lists)

Entitlement Management

Aggregation

Permissions Management

Note

For more information on Permissions Management, refer to Configure Direct Permissions.

Reads direct permissions assigned to user profiles for different resources on the IBM i managed system during accounts and group aggregations, respectively.
Delete Accounts
Revokes account direct permissions through certifications.

For more information on features, refer to Source Features.

Authorization List

The IBM i connector reads the authorization list assigned to accounts and groups as an AUTL attribute during account and entitlement aggregation, respectively.

The IBM i connector supports:

Aggregating Authorization Lists associated with users.
Aggregating Authorization Lists associated with groups.
ADD/Remove Authorization Lists.

Note

USER DEFINED authority (authority other than ALL, CHANGE, or EXCLUDE) in the authorization list is not supported for provisioning operations. If a user tries to add or remove an authorization list having USER DEFINED authority, then the connector displays the following error:

AUT(USER DEFINED) USER DEFINED is not a valid parameter

For example, if a user tries to add an authorization list having user defined authority, the following error message is displayed:

Failed to execute Command: ADDAUTLE USER(<User Name>) AUTL(<AUTL Name>) AUT(USER DEFINED) USER DEFINED is not a valid parameter

Supported Managed Systems

The IBM i connector supports the following versions of IBM i:

IBM i 7.5
IBM i 7.4
IBM i 7.3

Prerequisites

Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the Virtual Appliance Reference Guide.
The administrator account used in Connection Credentials needs to have the required permissions.
To connect with the IBM i system and access the data and services, the connector uses IBM Toolbox for Java (JTOpen). JTOpen requires installation and configuration of the following components on the IBM i system:
- TC1 Licensed Program (TCP/IP Connectivity Utilities)
- Host Server option of IBM i

The IBM i connector utilizes the following services running on the remote port:

Service Name	Port	SSL Port
as-signon	8476	9476
as-rmtcmd	8475	9475
as-svrmap	449	NA

Required Permissions

The IBM i connector requires security officer/user profile with the required permission to accomplish provisioning tasks. The administrator that is configured for the IBM i connector must be assigned sufficient privileges on the IBM i connector to create and update user profiles and group profiles.

For example, the user profile can be configured as an administrator with any one of the following user classes and special authorities, as mentioned in the following table:

Note

Depending on the system security level (QSECURITY), the special authorities assigned to the user differ. Ensure that the created user profiles have the special authorities.

USER CLASS (USRCLS)	SPECIAL AUTHORITY (SPCAUT)
*USER (user)	SECADM, AUDIT, *ALLOBJ
*SECADM (security administrator)	SECADM, AUDIT, *ALLOBJ
*SECOFR (security officer)	*NONE
*SYSOPR (system operator)	SECADM, AUDIT, *ALLOBJ

Note

For configuration of a user profile as an administrator, you can specify different options of user class and special authority in various ways in accordance with your requirements. The table displays a few examples of the different ways in which you can configure the administrator.

Configure Direct Permissions

The directPermissionObjectType configuration attribute contains list of various object types owned by the user. By default, the following direct permission object types are configured (you can change this list, as required):

*LIB
*MSGQ
*FILE
*PGM
*CMD
*MENU
*AUTL
*JOBQ

Important

Enabling direct permissions increases the aggregation time. You must correctly select and configure the direct permission object types.

The supported objects can be added or removed using REST API. For example, if the list has only the following object types, then these objects are aggregated as direct permission object types:

*LIB
*MSGQ

By default, the aggregation of direct permissions is not enabled.

Perform the following steps to enable direct permissions and their aggregation, for the account or the group schema of your IBM i connector:

Note

For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

Use the listSources API to get the source ID.
Use the listSchemas API to get schema ID for the account or group schema for which you want to enable direct permissions.
Use the updateSchema API and enter the following content in body, with the sourceID and the schemaID in the header.
```
{
"op": "replace",
"path": "/includePermissions",
"value": true
}
```

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.