Integrating SailPoint with Imprivata Enterprise Access Management (EAM)

Imprivata Enterprise Access Management (EAM) is a secure access platform that streamlines authentication for applications and data. The key features include Secure, No Click Access™, Passwordless Authentication, and Multifactor Authentication (MFA) for remote access, connected devices, and critical workflows. With EAM, employees can access essential systems with just a double-click, improving user experience and minimizing help desk requests.

The SailPoint Imprivata EAM integration manages Imprivata users, user policies, and applications. It also helps certify access to the Imprivata EAM solution.

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of an Imprivata Enterprise Access Management (EAM) integration in SailPoint.

Supported Features

The Imprivata Enterprise Access Management (EAM) integration supports the following features:

Account Management

• For EAM User (Subscriber) as Accounts

  • Aggregation - Read User
  • Create and Modify User
  • Enable/Disable User
  • Change or Set User Passwords
  • Add/Remove Entitlement (User Policy) from the User

  • Add/Remove Entitlement (Applications) from the User

    Note

    • While creating or updating a subscriber, you can also create an account for that subscriber in applications.
    • Remove a subscriber's account from applications.

  • Add, Update and Delete - Proximity Device ID for User

  • Add/Update - User PINs
  • Access Certification - Acknowledge/Revoke User Policies and Applications

Group Management

• Aggregate entitlements (User Policies and Applications)

For more information on features, refer to Source Features.

Supported Managed Systems

The Imprivata Enterprise Access Management (EAM) integration supports the following versions:

• For Imprivata Enterprise Access Management 25.1 and earlier, the supported API version is Future 7.
• For Imprivata Enterprise Access Management 25.2 and later, the supported API version is SailPoint.

Prerequisites

• Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.
• Verify that an MS SQL Server database is installed in your environment. For more information, refer to MS SQL Database Setup Considerations.
• Ensure to perform the data extraction process to import the latest Imprivata EAM data into the MS SQL database. For more information, refer to Aggregation Considerations.
• Verify the Provisioning System Adaptor Name is configured in your Imprivata source. If it does not already exist, you must manually create it. For more information, refer to Provisioning System Adaptor Settings Requirements. To provide the necessary API access permissions to the Provisioning System Adaptor, refer to API Access Settings Requirements.

MS SQL Database Setup Considerations

If you are installing the MS SQL database setup for the first time, follow these steps:

1. Verify that an MS SQL Server database can be accessed by both the Imprivata EAM and SailPoint Virtual Appliance (VA).

2. Use the provided MS SQL script to create the required database and table.

   The script sets up the Imprivata database and creates a minimum-permission user with the username Imprivata, which is used for source configuration. You can modify the database name, user permissions, and username / password before running the script.

Aggregation Considerations

• Aggregation relies on the MS SQL database. You must perform the data extraction process to import the latest Imprivata EAM data into the MS SQL database. To keep the MS SQL database updated, periodically run data extraction to enable the connector to aggregate the latest data. For more information, refer to Updating MS-SQL Database Configuration for Data Extraction.
• After creating a user, it will not be immediately included in the MS SQL database. Run the data extraction process before performing any further operations on the user.
• During account aggregation, only Proximity Device IDs are fetched from the Imprivata EAM managed system. All other details are sourced from the MS SQL database.
• Account aggregation and entitlement aggregation utilize data from the MS SQL database. To keep MS SQL data in sync with real-time data, regularly run the data extraction process.

Provisioning System Adaptor Settings Requirements

Follow the steps below to identify and activate a Provisioning System Adaptor:

1. Find the Provisioning System Adaptor Name in your Imprivata source.

   To find the Provisioning System Adaptor Name in your Imprivata administrative console:

   1. Select the gear box in the top right corner of the Imprivata Enterprise Access Management interface to access the settings.

   2. Select SPML Provisioning.

      The list of Provisioning System Adaptors displays. If none exist, create a new Provisioning System Adaptor.

   3. Enable the desired adaptor before use.

   4. On the SPML provisioning page, select the Yes radio button for the "Enable Client Request Authentication?" option.
   5. Select Save to save the settings.

2. Go to Imprivata EAM integration Connection Settings page to complete further configuring steps with the managed system. For more information, refer to Connection Settings.

API Access Settings Requirements

Follow the steps below to ensure that the Provisioning System Adaptor has the necessary API access permissions to function correctly within your Imprivata Enterprise Access Management environment:

1. Select the gear icon in the top-right corner of the Imprivata Enterprise Access Management interface to access the settings.
2. Select API Access.
3. In the API Access, select the option Allow full API Access via ProveID Web and ProveID Embedded to enable API access for the Provisioning System Adaptor.
4. Choose the appropriate API access setting based on your Imprivata Enterprise Access Management version:
   • For version 25.2 and later, select Sailpoint.
   • For version 25.1 and earlier, select Future 7.

Certificate Requirements

You can set up any SSL or TLS certificate required for configuring the Imprivata EAM integration with the MS SQL Server by following the instructions in Uploading a Certificate Manually to a Virtual Appliance.

Required Permissions

Permissions for Database User

The Imprivata EAM integration uses the database user context to support aggregation and read operations. The database user specified in the application configuration must have the appropriate rights to fetch data from the specified database tables.

Permissions for Imprivata SPML User

Specify the user during Provisioning Adapter configuration with the necessary permissions to execute SPML APIs.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.