# Integrating SailPoint with IBM i This document is designed to give specific information about the requirements and field definitions needed to get a working instance of an IBM i connector in SailPoint. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The SailPoint IBM i connector supports the following features: ### Account Management > [!NOTE] > > Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site. - Aggregation, Partitioning Aggregation - \*Provision IBM i Accounts - Enable and Disable - Create, Update, Delete - \*Password Management - \*Access Certifications (certifications of entitlements connected to accounts) - Additional Entitlements (Authorization Lists) ### Entitlement Management - Aggregation ### Permissions Management > [!NOTE] > > For more information on Permissions Management, refer to [Configure Direct Permissions](<#configure-direct-permissions>). - Reads direct permissions assigned to user profiles for different resources on the IBM i managed system during accounts and group aggregations, respectively. - Delete Accounts - Revokes account direct permissions through certifications. For more information on features, refer to [Source Features](). ### Authorization List The IBM i connector reads the authorization list assigned to accounts and groups as an AUTL attribute during account and entitlement aggregation, respectively. The IBM i connector supports: - Aggregating Authorization Lists associated with users. - Aggregating Authorization Lists associated with groups. - ADD/Remove Authorization Lists. > [!NOTE] > > USER DEFINED authority (authority other than ALL, CHANGE, or EXCLUDE) in the authorization list is not supported for provisioning operations. If a user tries to add or remove an authorization list having USER DEFINED authority, then the connector displays the following error: > > ```text > AUT(USER DEFINED) USER DEFINED is not a valid parameter > ``` > > For example, if a user tries to add an authorization list having user defined authority, the following error message is displayed: > > ```text > Failed to execute Command: ADDAUTLE USER() AUTL() AUT(USER DEFINED) USER DEFINED is not a valid parameter > ``` ## Supported Managed Systems The IBM i connector supports the following versions of IBM i: - IBM i 7.5 - IBM i 7.4 - IBM i 7.3 ## Prerequisites - Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the [Virtual Appliance Reference Guide](). - The administrator account used in Connection Credentials needs to have the required permissions. - To connect with the IBM i system and access the data and services, the connector uses IBM Toolbox for Java (JTOpen). JTOpen requires installation and configuration of the following components on the IBM i system: - TC1 Licensed Program (TCP/IP Connectivity Utilities) - Host Server option of IBM i The IBM i connector utilizes the following services running on the remote port: | Service Name | Port | SSL Port | | --- | --- | --- | | as-signon | 8476 | 9476 | | as-rmtcmd | 8475 | 9475 | | as-svrmap | 449 | NA | ## Required Permissions The IBM i connector requires security officer/user profile with the required permission to accomplish provisioning tasks. The administrator that is configured for the IBM i connector must be assigned sufficient privileges on the IBM i connector to create and update user profiles and group profiles. For example, the user profile can be configured as an administrator with any one of the following user classes and special authorities, as mentioned in the following table: > [!NOTE] > > Depending on the system security level (QSECURITY), the special authorities assigned to the user differ. Ensure that the created user profiles have the special authorities. | USER CLASS (USRCLS) | SPECIAL AUTHORITY (SPCAUT) | | --- | --- | | \*USER (user) | \*SECADM, \*AUDIT, \*ALLOBJ | | \*SECADM (security administrator) | \*SECADM, \*AUDIT, \*ALLOBJ | | \*SECOFR (security officer) | \*NONE | | \*SYSOPR (system operator) | \*SECADM, \*AUDIT, \*ALLOBJ | > [!NOTE] > > For configuration of a user profile as an administrator, you can specify different options of user class and special authority in various ways in accordance with your requirements. The table displays a few examples of the different ways in which you can configure the administrator. ### Configure Direct Permissions The `directPermissionObjectType` configuration attribute contains list of various object types owned by the user. By default, the following direct permission object types are configured (you can change this list, as required): - `*LIB` - `*MSGQ` - `*FILE` - `*PGM` - `*CMD` - `*MENU` - `*AUTL` - `*JOBQ` > [!IMPORTANT] > > Enabling direct permissions increases the aggregation time. You must correctly select and configure the direct permission object types. The supported objects can be added or removed using REST API. For example, if the list has only the following object types, then these objects are aggregated as direct permission object types: - `*LIB` - `*MSGQ` By default, the aggregation of direct permissions is not enabled. Perform the following steps to enable direct permissions and their aggregation, for the account or the group schema of your IBM i connector: > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. 1. Use the [listSources]() API to get the source ID. 2. Use the [listSchemas]() API to get schema ID for the account or group schema for which you want to enable direct permissions. 3. Use the [updateSchema]() API and enter the following content in body, with the `sourceID` and the `schemaID` in the header. ```json { "op": "replace", "path": "/includePermissions", "value": true } ```