# Integrating SailPoint with IBM Security Verify Access Formerly IBM Security Access Manager / Tivoli Access Manager This document is designed to provide the information required to configure a working instance of a SailPoint IBM Security Verify Access connector. After it is successfully configured, your organization will be able to manage users of the IBM Security Verify Access system. > [!IMPORTANT] > > To receive assistance from SailPoint Support, you may need to provide access to your IBM Security Verify Access test or development environment. To manage user data, either create an [identity profile]() based on the source or verify that the accounts you load are correlated to an existing identity. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The IBM Security Verify Access connector supports the following features: > [!NOTE] > > You must activate any item marked with an asterisk (\*) in SailPoint, before it can be used. - Aggregate IBM Security Verify Access accounts - Aggregate the IBM Security Verify Access Group as an entitlement - \*Provision IBM Security Verify Access accounts - Enable and disable - Create and update and delete - Add or remove entitlement (Groups as entitlement) - Delete accounts - \*Access Certifications (certification of entitlements connected to accounts) For more information on features, refer to [Source Features](). ### Privilege Classification SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements. | Privilege Level | Description | | --- | --- | | High | Administrative level access to accounts | | Medium | Administrative level access for a specific role or function | | Low | Only basic access of data | > [!NOTE] > > To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin. For more information, refer to [Managing Privilege Classification](). ### Password Management If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following: - The password policy defined in SailPoint applies to accounts on this source. - If you change the password for an application connected to this source, the change will automatically be made to the source itself. For more information on configuring password management, refer to [Password Management Overview](). ## Supported Versions SailPoint Security Verify Access Connector supports the following: - Supported Versions - IBM Security Verify Access 10.0.0 - IBM Security Verify Access 10.0.6 - Supported Backend Servers - IBM Security Directory Suite version 8.0 - IBM Security Directory Suite version 10.0 > [!NOTE] > > SailPoint has certified the back end servers listed on this page among the multiple back end servers supported by IBM Security Verify Access. ## JAR File Prerequisites Complete the tasks listed on this page before configuring the connector with .jar files. - Configure at least one [virtual appliance (VA) cluster]() and successfully test the connection. - You must set up a service account that has the required permissions. - Ensure that the LDAP directory server associated with IBM Security Verify Access is configured and functional. - To support .jar file generation on IBM Security Directory Suite version 10.0, you should use Java version 8.0.7.16-ISS-JAVA-WinX64-FP0016 or later. ### Install PDJRTE Install PDJRTE to configure the IBM Security Verify Access Runtime for Java component which enables the Java application to use Security Verify Access security. Perform the following steps to install PDJRTE on the LDAP Directory Server Machine: 1. Copy the license file (`PDLIC.txt`) from the `PDJRTE` directory to the root directory (for example, `C:\` or `/` in Unix). 2. Go to `PDJRTE` directory through command prompt available on LDAP Directory Server machine. For example: `C:\pdjrte-x.x.x-0\pdjrte\sbin)` where *x.x.x* is 9.0.0. 3. Open Command Prompt and execute the following command: - **For Windows** - `pdjrtecfg.bat -action config -interactive` - **For UNIX** - `pdjrtecfg -action config -interactive` 4. On the UI dialogue box, configure the java run-time environment for Security Verify Access. Select the valid JRE path and select **Next**. 5. Enter the existing policy server information (where your Security Verify Access policy server is running `[machine details]`) as follows: - **Host name** - IP of the configured IBM Security Verify Access - **Port** - 7135 (Default port) - **Domain** - Default (Recommended) 6. Enable SVA common directory logging (recommended to keep it on for troubleshooting). 7. Select **Finish**. This adds an additional .jar file in the `$JDK_HOME\jre\lib\ext` directory which is used by the Security Verify Access Connector. For example: ```text PD.jar ibmjcefips.jar ibmjcefw.jar ibmjceprovider.jar ibmjsseprovider2.jar ibmpkcs.jar local_policy.jar US_export_policy.jar ``` ### Generate Config and Keyfile On the LDAP Directory Server host, use the `com.tivoli.pd.jcfg.SvrSslCfg` command to generate the **config** and **keyfile** required to communicate with the IBM Security Verify Access. The file path of the config file must be configured in the application configuration. For example: ```text >java com.tivoli.pd.jcfg.SvrSslCfg -action config -admin_id sec_master -admin_pwd -appsvr_id server1 -host -port -mode remote -policysvr -authzsvr -domain default -cfg_file -key_file -cfg_action create ``` Where *host* = the IP address for IBM Security Verify Access. ### Integration with IBM Security Verify Access Perform the following steps to integrate with IBM Security Verify Access. 1. Upload the following .jar files to your source configuration. For more information, refer to [Base Configuration](). ```text Ibmjcefips.jar Ibmjcefw.jar Ibmjceprovider.jar ibmjsseprovider2.jar ibmpkcs.jar local_policy.jar US_export_policy.jar PD.jar ``` 2. Log in to the VA with SailPoint user credentials and create a directory as shown below: `/home/sailpoint/TAM` 3. Copy the `PD.properties` and `PDCA.ks` files from `PolicyDirector` to the `/home/sailpoint/TAM` directory. The `PD.properties` and `PDCA.ks` files are located in the `$JDK_HOME\jre` directory. > **Note** > > Optionally, to configure additional SVA sources on a single VA, rename the two files names mentioned above with the source ID. The source ID can be taken from the source URL. > > Using the following source URL as an example: > > `https:///ui/admin#admin:connections:sources:614226` > > You can create the following file names: > > `614226_PDCA.ks` > > `614226_PD.properties` 4. The config file has an entry pointing to the key file. Update the config file entry (pdcert-url) to point to key file such as `pdcert-url=file\:/home/sailpoint/TAM/` 5. The name `keyfileName` is a format you must change as provided during generation of config and key file. 6. Copy the config and keystore files from LDAP server machine generated by the **SvrSslCfg** command to the `/home/sailpoint/TAM` directory. > **Important** > > For multiple Security Verify Access sources on single VA, you must use unique names for the config and key file.