Skip to content

Integrating SailPoint with IBM Security Verify Access

Formerly IBM Security Access Manager / Tivoli Access Manager

This document is designed to provide the information required to configure a working instance of a SailPoint IBM Security Verify Access connector. After it is successfully configured, your organization will be able to manage users of the IBM Security Verify Access system.

Important

To receive assistance from SailPoint Support, you may need to provide access to your IBM Security Verify Access test or development environment.

To manage user data, either create an identity profile based on the source or verify that the accounts you load are correlated to an existing identity.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The IBM Security Verify Access connector supports the following features:

Note

You must activate any item marked with an asterisk (*) in SailPoint, before it can be used.

  • Aggregate IBM Security Verify Access accounts
  • Aggregate the IBM Security Verify Access Group as an entitlement
  • *Provision IBM Security Verify Access accounts
    • Enable and disable
    • Create and update and delete
    • Add or remove entitlement (Groups as entitlement)
    • Delete accounts
  • *Access Certifications (certification of entitlements connected to accounts)

For more information on features, refer to Source Features.

Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

Privilege Level Description
High Administrative level access to accounts
Medium Administrative level access for a specific role or function
Low Only basic access of data

Note

To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to Managing Privilege Classification.

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

  • The password policy defined in SailPoint applies to accounts on this source.
  • If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Supported Versions

SailPoint Security Verify Access Connector supports the following:

  • Supported Versions
    • IBM Security Verify Access 10.0.0
    • IBM Security Verify Access 10.0.6
  • Supported Backend Servers
    • IBM Security Directory Suite version 8.0
    • IBM Security Directory Suite version 10.0

Note

SailPoint has certified the back end servers listed on this page among the multiple back end servers supported by IBM Security Verify Access.

JAR File Prerequisites

Complete the tasks listed on this page before configuring the connector with .jar files.

  • Configure at least one virtual appliance (VA) cluster and successfully test the connection.
  • You must set up a service account that has the required permissions.
  • Ensure that the LDAP directory server associated with IBM Security Verify Access is configured and functional.
  • To support .jar file generation on IBM Security Directory Suite version 10.0, you should use Java version 8.0.7.16-ISS-JAVA-WinX64-FP0016 or later.

Install PDJRTE

Install PDJRTE to configure the IBM Security Verify Access Runtime for Java component which enables the Java application to use Security Verify Access security.

Perform the following steps to install PDJRTE on the LDAP Directory Server Machine:

  1. Copy the license file (PDLIC.txt) from the PDJRTE directory to the root directory (for example, C:\ or / in Unix).

  2. Go to PDJRTE directory through command prompt available on LDAP Directory Server machine.

    For example:

    C:\pdjrte-x.x.x-0\pdjrte\sbin)

    where x.x.x is 9.0.0.

  3. Open Command Prompt and execute the following command:

    • For Windows - pdjrtecfg.bat -action config -interactive
    • For UNIX - pdjrtecfg -action config -interactive
  4. On the UI dialogue box, configure the java run-time environment for Security Verify Access. Select the valid JRE path and select Next.
  5. Enter the existing policy server information (where your Security Verify Access policy server is running [machine details]) as follows:
    • Host name - IP of the configured IBM Security Verify Access
    • Port - 7135 (Default port)
    • Domain - Default (Recommended)
  6. Enable SVA common directory logging (recommended to keep it on for troubleshooting).
  7. Select Finish.

This adds an additional .jar file in the $JDK_HOME\jre\lib\ext directory which is used by the Security Verify Access Connector. For example:

PD.jar
ibmjcefips.jar
ibmjcefw.jar
ibmjceprovider.jar
ibmjsseprovider2.jar
ibmpkcs.jar
local_policy.jar
US_export_policy.jar

Generate Config and Keyfile

On the LDAP Directory Server host, use the com.tivoli.pd.jcfg.SvrSslCfg command to generate the config and keyfile required to communicate with the IBM Security Verify Access. The file path of the config file must be configured in the application configuration. For example:

>java com.tivoli.pd.jcfg.SvrSslCfg -action config -admin_id sec_master -admin_pwd <password> -appsvr_id server1 -host <host> -port <port_number> -mode remote -policysvr <host:7135:1> -authzsvr <host:7136:2> -domain default -cfg_file <path of config file to be generated> -key_file <Path of key file to generate> -cfg_action create

Where host = the IP address for IBM Security Verify Access.

Integration with IBM Security Verify Access

Perform the following steps to integrate with IBM Security Verify Access.

  1. Upload the following .jar files to your source configuration. For more information, refer to Base Configuration.

    Ibmjcefips.jar
Ibmjcefw.jar
Ibmjceprovider.jar
ibmjsseprovider2.jar
ibmpkcs.jar
local_policy.jar
US_export_policy.jar
PD.jar

  2. Log in to the VA with SailPoint user credentials and create a directory as shown below:

    /home/sailpoint/TAM

  3. Copy the PD.properties and PDCA.ks files from PolicyDirector to the /home/sailpoint/TAM directory.

    The PD.properties and PDCA.ks files are located in the $JDK_HOME\jre directory.

    Note

    Optionally, to configure additional SVA sources on a single VA, rename the two files names mentioned above with the source ID. The source ID can be taken from the source URL.

    Using the following source URL as an example:

    https://<SailPoint Host>/ui/admin#admin:connections:sources:614226

    You can create the following file names:

    614226_PDCA.ks

    614226_PD.properties

  4. The config file has an entry pointing to the key file. Update the config file entry (pdcert-url) to point to key file such as pdcert-url=file\:/home/sailpoint/TAM/<keyfileName>

  5. The name keyfileName is a format you must change as provided during generation of config and key file.

  6. Copy the config and keystore files from LDAP server machine generated by the SvrSslCfg command to the /home/sailpoint/TAM directory.

    Important

    For multiple Security Verify Access sources on single VA, you must use unique names for the config and key file.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.