# SailPoint Imprivata Enterprise Access Management (EAM) Connector Documentation > Imprivata Enterprise Access Management (EAM) Connector Documentation # Documentation # Connecting SailPoint and Imprivata Enterprise Access Management (EAM) To connect SailPoint with Imprivata Enterprise Access Management (EAM), perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 8. Under **Connection Type**, select **Direct Connection** or **Flat File**. - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable. 9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source. 10. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Drag and drop the required files into the **Upload Files** box, or upload them from your computer. > **Warning** > > Ensure that the file you upload is not vulnerable or malicious. The following Imprivata.jar files are required to be uploaded in the VA cluster: `MSSQL server driver jar` 9. Select **Save**. ## Connection Settings Provide the information required to connect to the Imprivata EAM: > [!NOTE] > > **Screenshot** > > [![Connection Settings]()]() [![Connection Settings database fields]()]() 1. Enter the **Base URL** of the Imprivata system. For example: `https://` 2. Enter the **Provisioning System Adaptor Name** to connect to the Imprivata managed system. 3. Enter the **Username** and **Password** for the account that has permission to access the Imprivata managed system. This account should have the necessary privileges to perform the required actions. 4. Enter the MS SQL server address in the **Database URL** field where the Imprivata database is hosted. For example, `jdbc:sqlserver://\MSSQLSERVER:1433` 5. Enter the name of the MS SQL database that stores the Imprivata data in the **Database Name** field. 6. Enter the **Database User Name** and **Database Password** for the account that has access to the Imprivata database. This account should have the appropriate permissions to read and write data. 7. Select the required MS SQL **Database Driver Class** that matches your database version. This driver is required to establish the connection between the Imprivata EAM integration and the Imprivata database. 8. Select **Save**. ## Aggregation Settings Configure settings related to account aggregation. > [!NOTE] > > **Screenshot** > > [![Aggregation Settings]()]() 1. Enter an **Account Filter** to define the scope of user accounts included in account aggregation. The account filter supports SQL filters on the `Tmp_OSSubscribers` table. For example: `Tmp_OSSubscribers.FIRSTNAME = 'Peter'` `Tmp_OSSubscribers.USERNAME NOT LIKE 'A%'` 2. Enter the **Page Size**, which is the number of records to aggregate in a single page. The default value is 100, and the maximum allowed value is 500. 3. Select **Save**. ## Application Settings Provide the following details for configuring application related passwords and account attribute mappings in the Imprivata Enterprise Access Management (EAM) connector: > [!NOTE] > > **Screenshot** > > [![Application Settings]()]() 1. If an application requires application account attributes, enter **Attribute Name** and **Attribute Value** for that application in the **Application Account Attribute Mapping** section. Use the **Add** option to include more attributes as needed. For example, `applicationUsername`, `applicationGroup`, `applicationPIN`, `applicationSite`. 2. Enter the default application password for your application in the **Application Password** field. 3. If the application requires additional passwords in its account credentials, you can provide them in **Application Password 2** and **Application Password 3** respectively. 4. Select **Save**. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Updating MS-SQL Database Configuration for Data Extraction To keep the MS SQL database up to date with the Imprivata EAM managed system, you need to run the data extraction process periodically. The Imprivata EAM integration only aggregates data from the MS SQL database, so there is a risk of aggregating outdated data if the MS SQL database is not updated using the data extraction process. You can complete the data extraction process for the MS SQL database using either of the following methods: - [Manually Updating MS SQL Database with Imprivata EAM Data](<#manually-updating-ms-sql-database-with-imprivata-eam-data>) - [Automatically Updating MS SQL Database with Imprivata EAM Data](<#automatically-updating-ms-sql-database-with-imprivata-eam-data>) ## Manually Updating MS SQL Database with Imprivata EAM Data Follow these steps to perform the data extraction from the MS SQL database: 1. Create a data extraction user in the Imprivata managed system with the appropriate permissions: 1. Create a designated service account (in any domain). > **Important** > > The Imprivata EAM integration is set up to only work with a `DataExtractionUser` account name. Ensure to use this name only while creating the service account. 2. Create a user policy with only the password modality enabled and assign it to the previously created `DataExtractionUser` user account. 3. Verify that the designated user can authenticate with the Imprivata EAM managed system. 2. Generate an Ostick token for the data extraction user: 1. To execute the data extraction API, you need to get an OStick token by executing the authUser API with the following details: - **Username**: The username of the `DataExtractionUser`. - **Password**: The password of the `DataExtractionUser`. - **DomainName**: The domain name of the `DataExtractionUser`. Following is an example of the CURL request for the authUser API: ```text curl --location 'https:///sso/ProveIDWeb/v1/AuthUser' \ --header 'Content-Type: text/xml' \ --header 'Accept: text/xml' \ --header 'isx-product: 9ac34f7f-22fc-40d0-aec3-9dc3d8bfc327' \ --data ' DataExtractionUser Domain_Name Password true ' ``` 2. You will receive an AuthTicket in the response, which must be URL-encoded before using it in the Data Extraction API. 3. Run the Data Extraction API with the following details: - **server** (*Required*): Specifies the target database address. For example, IPName, or FQDN. - **port** (*Optional*): Defines the port on which the target database is running. The default is 1433. - **databaseName** (*Optional*): Defines the target database name. The default is `OneSignStaging`. - **user** (*Required*): Part of the credential used to access the target database. - **password** (*Required*): Part of the credential used to access the target database. Following is an example of the CURL request for the Data Extraction API: ```text curl --location '>/sso/ProveIDWeb/v18/DataExtraction' \ --header 'isx-product: 9ac34f7f-22fc-40d0-aec3-9dc3d8bfc327' \ --header 'Content-Type: text/xml' \ --header 'Accept: text/xml' \ --header 'Authorization: OStick ostick.ticket=rO0ABXQAAzEuMnQAJGZlNmY0YzEzLTBkMzctNDFjNy1hZjRjLTEzMGQzN2UxYzcyZXQAJDEwNmJhZjNkLTRiODUtNDQ1YS1hYmFmLTNkNGI4NTI0NWE3MHNyAA5qYXZhLnV0aWwuRGF0ZWhqgQFLWXQZAwAAeHB3CAAAAZWkdpZleHNyABFqYXZhLmxhbmcuQm9vbGVhbs0gcoDVnPruAgABWgAFdmFsdWV4cAB0AAB3BAAAAAF0AANQV0R3BP%2F%2F%2F%2F93iAAAAMIAAACAYmoas2KMf5MH4yzQWIlT3Ljam%2Bg2FN3l65qaCAWTB4d6VYGuOw5mflD0W4X18jkDP0Si5CpfAsdc9F0EhJzOS8%2FjPD0c%2FjPI62F89rWhsV%2BbCQ8Dbvj6OsYKaja%2BESYCu4OvpqePjPdPKMiNOMMayHbG7NVZRNf6YVcHMpZY6h0%3D' \ --header 'Accept-Encoding: identity' \ --header 'Connection: Keep-Alive' \ --data ' sqlserver my-ms-sql-server-address 1433 OneSignStaging imprivata imprivata v1 2025-01-01 00:00:00 +00:00 truncateTarget keepReportFiles 300 10000000 ' ``` ## Automatically Updating MS SQL Database with Imprivata EAM Data Automatically updating an MS SQL database with Imprivata EAM data using an SSIS package for secure API-based data extraction and loading into SQL Server from Imprivata's OneSign system helps you with the following: - Creates the required database and their tables. - Automates AuthTicket based API authentication. - Uses the AuthTicket to securely extract data via a second API. - Loads retrieved data into SQL Server. - Supports scheduled and repeatable execution through SQL Server Agent. ### Prerequisites Before proceeding with this process, ensure that the following components are available on your system: 1. SQL Server Integration Services (SSIS) SSIS must be installed and enabled on your SQL Server instance. This is necessary for creating and executing SSIS packages. 2. Supported SQL Server Versions This process is compatible with the following SQL Server versions: - SQL Server 2017 (v14) - SQL Server 2019 (v15) - SQL Server 2022 (v16) 3. SQL Server Management Studio (SSMS) SSMS should be installed on the machine where you will be managing the SSIS packages and SQL Server objects. 4. SQL Server Agent The SQL Server Agent service must be enabled on your SQL Server instance. This is required for scheduling and automating the execution of SSIS packages. 5. Required Access Permissions Ensure that you have the following access permissions: - Deploy packages to SSISDB (if using SSIS Catalog) You must have permission to deploy SSIS packages to the SSISDB catalog if you plan to use the SSIS Catalog deployment method. - View and edit SSIS package parameters You should have permission to view and modify SSIS package parameters to configure the necessary settings for the data extraction process. - Create and manage SQL Server Agent jobs You must have permission to create and manage SQL Server Agent jobs, which will be used to schedule and execute the SSIS packages. - File access permission for `.dtsx` package (if using File System method) To deploy the SSIS package using the File System method, ensure that you have the necessary file access permissions to read and execute the `.dtsx` package file. - Read/write access to target SQL Server database You must have read and write permissions on the target SQL Server database where the extracted data will be loaded. ### Downloading MS SQL Configuration File Refer to the following required versions to download the MS SQL Configuration file: - [MS SQL Configuration 2017]() - [MS SQL Configuration 2019]() - [MS SQL Configuration 2022]() ### Updating the MS SQL Database Automatically with Imprivata EAM Data Follow these steps to update the MS SQL database automatically with Imprivata EAM data: 1. [Creating a Database for Data Extraction](<#creating-a-database-for-data-extraction>) 2. [Running a Scheduled Job for Data Extraction](<#running-a-scheduled-job-for-data-extraction>) ### Creating a Database for Data Extraction 1. Open the SQL script Open the `create_imprivate_onsign_database.sql` script file. To download the SQL script, refer to [Imprivata EAM - Database script](). 2. Update login credentials Locate the line: ```text CREATE LOGIN WITH PASSWORD = '<2Strong2Remember!>'; ``` 1. Replace `` with the desired username. 2. Replace `<2Strong2Remember!>` with your chosen password. 3. Replace all placeholders Replace every occurrence of login credentials throughout the script with the login credentials you [updated](<#update-login-credentials>). 4. Execute the script Run the modified SQL script on your Microsoft SQL Server instance that you are going to deploy to SSISDB. ### Running a Scheduled Job for Data Extraction You can use either of the following methods to run a scheduled job for data extraction from the MS SQL database. #### Method 1: Running Package Through SSISDB Follow these steps to run the package using SSISDB: 1. Import the package into SSISDB. 1. Go to **Integration Services Catalogs \> SSISDB \> \[`YourFolderName`\]**. 2. Right-click the **Deploy Package** folder. 3. Select **Package Deployment** from the dropdown at the right top corner. 4. Browse the packages folder and then, select **Deploy**. After selecting the package, select **Refresh**. 5. Select **Next** two times to go the **Select Destination** option. 6. Select **Connect** and provide the path using the **Browse** option. (For example, `/SSISDB/Project/`) 7. Select **Next** and then **Deploy** to complete the process. 2. Configure runtime variables in SSISDB. 1. In SSMS, go to the deployed package under **SSISDB**. 2. Right-click the package \> **Configure**. 3. Under the Parameters tab, provide values for: | Parameters | Definition | Type of the Parameters | | --- | --- | --- | | AuthTicketUrl | The URL to get Auth token | String | | DataExtractionUrl | The URL to extract the data | String | | DatabaseUser | The SQL Server User | String | | DatabasePassword | The SQL Server login password | String | | DatabaseServer | The SQL Server Instance name or IP | String | | DatabaseName | Target SQL database name | String | | Username | Imprivata User | String | | Password | Imprivata password | String | | Domain | The domain for authentication | String | | ProductId | The ID of the product | String | 4. Select **Save and Close**. 3. Schedule the package with SQL Server Agent. 1. Go to **SQL Server Agent \> Jobs**. 2. Right-click **Jobs \> New Job**. 3. On the General tab, provide the following details: `Name: [Provide Name for the Event]` 4. Go to **Steps \> New**, provide the following details: - **Step Name**: Name of the step - **Type**: SQL Server Integration Services Package - **Package source**: SSIS Catalog. - **Server**: Your SQL instance. - **Package**: Select your deployed SSISDB package. 5. Under **Schedules**, define frequency (for example, Daily at 2:00:00). 6. Select **Save**, and then **Enable** the job. #### Method 2: Running Package Directly from File System This method allows you to schedule a `.dtsx` file without SSISDB or Visual Studio. > [!NOTE] > > - You do not need to deploy the `.dtsx` package into SSISDB or import it into a Visual Studio project to schedule it. > - You can directly schedule and execute the `.dtsx` file from the File System by referencing its path by following the steps in [SQL Server Agent Job Setup (File System)](<#sql-server-agent-job-setup-file-system>). To run the package directly from the File System, ensure the following: - The SQL Server Agent service account has permission to access the `.dtsx` file path. - All necessary variables and configuration values (for example, API URLs and connection strings) are defined within the package or passed via command-line arguments (if needed). - The `.dtsx` file is stored on a local or network path accessible to SQL Server. ##### SQL Server Agent Job Setup (File System) Follow these steps to schedule and execute the `.dtsx` file from the File System using a SQL Server Agent job setup: 1. In SSMS, go to **SQL Server Agent \> Jobs \> New Job**. 2. Under the **Steps** tab **\> New**: - **Type**: Enter the SQL Server Integration Services Package - **Package Source**: Enter the File System - **Package**: Browse or type the full path to the `.dtsx` file. - Configure logging and error handling, if needed. 3. Under **Schedules**, define your execution schedule. 4. Select **Save** to save the job. ##### Verify Execution of SQL Server Agent Job Follow these steps to manually test SQL Server Agent job execution: 1. In **SQL Server Agent \> Jobs**, right-click your job. 2. Select **Start Job at Step**. 3. Monitor progress in real time. 4. Review history logs after execution for errors or success confirmation. # Integrating SailPoint with Imprivata Enterprise Access Management (EAM) > [!NOTE] > > **Integration** > > This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager. Imprivata Enterprise Access Management (EAM) is a secure access platform that streamlines authentication for applications and data. The key features include Secure, No Click Access™, Passwordless Authentication, and Multifactor Authentication (MFA) for remote access, connected devices, and critical workflows. With EAM, employees can access essential systems with just a double-click, improving user experience and minimizing help desk requests. The SailPoint Imprivata EAM integration manages Imprivata users, user policies, and applications. It also helps certify access to the Imprivata EAM solution. This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of an Imprivata Enterprise Access Management (EAM) integration in SailPoint. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The Imprivata Enterprise Access Management (EAM) integration supports the following features: ### Account Management - For EAM User (Subscriber) as Accounts - Aggregation - Read User - Create and Modify User - Enable/Disable User - Change or Set User Passwords - Add/Remove Entitlement (User Policy) from the User - Add/Remove Entitlement (Applications) from the User > **Note** > > - While creating or updating a subscriber, you can also create an account for that subscriber in applications. > - Remove a subscriber's account from applications. - Add, Update and Delete - Proximity Device ID for User - Add/Update - User PINs - Access Certification - Acknowledge/Revoke User Policies and Applications ### Group Management - Aggregate entitlements (User Policies and Applications) For more information on features, refer to [Source Features](). ## Supported Managed Systems The Imprivata Enterprise Access Management (EAM) integration supports the following versions: - For Imprivata Enterprise Access Management 25.1 and earlier, the supported API version is Future 7. - For Imprivata Enterprise Access Management 25.2 and later, the supported API version is SailPoint. > [!NOTE] > > When setting up the Imprivata EAM integration, ensure that you are using Microsoft SQL Server version 2017 or later. ## Prerequisites - Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](). - Verify that an MS SQL Server database is installed in your environment. For more information, refer to [MS SQL Database Setup Considerations](<#ms-sql-database-setup-considerations>). - Ensure to perform the data extraction process to import the latest Imprivata EAM data into the MS SQL database. For more information, refer to [Aggregation Considerations](<#aggregation-considerations>). - Verify the Provisioning System Adaptor Name is configured in your Imprivata source. If it does not already exist, you must manually create it. For more information, refer to [Provisioning System Adaptor Settings Requirements](<#provisioning-system-adaptor-settings-requirements>). To provide the necessary API access permissions to the Provisioning System Adaptor, refer to [API Access Settings Requirements](<#api-access-settings-requirements>). ### MS SQL Database Setup Considerations If you are installing the MS SQL database setup for the first time, follow these steps: 1. Verify that an MS SQL Server database can be accessed by both the Imprivata EAM and SailPoint Virtual Appliance (VA). 2. Use the provided MS SQL script to create the required database and table. The script sets up the Imprivata database and creates a minimum-permission user with the username Imprivata, which is used for source configuration. You can modify the database name, user permissions, and username / password before running the script. ### Aggregation Considerations - Aggregation relies on the MS SQL database. You must perform the data extraction process to import the latest Imprivata EAM data into the MS SQL database. To keep the MS SQL database updated, periodically run data extraction to enable the connector to aggregate the latest data. For more information, refer to [Updating MS-SQL Database Configuration for Data Extraction](). - After creating a user, it will not be immediately included in the MS SQL database. Run the data extraction process before performing any further operations on the user. - During account aggregation, only Proximity Device IDs are fetched from the Imprivata EAM managed system. All other details are sourced from the MS SQL database. - Account aggregation and entitlement aggregation utilize data from the MS SQL database. To keep MS SQL data in sync with real-time data, regularly run the data extraction process. ### Provisioning System Adaptor Settings Requirements Follow the steps below to identify and activate a Provisioning System Adaptor: 1. Find the Provisioning System Adaptor Name in your Imprivata source. To find the Provisioning System Adaptor Name in your Imprivata administrative console: 1. Select the gear box in the top right corner of the Imprivata Enterprise Access Management interface to access the settings. 2. Select **SPML Provisioning**. The list of Provisioning System Adaptors displays. If none exist, create a new Provisioning System Adaptor. 3. Enable the desired adaptor before use. 4. On the SPML provisioning page, select the **Yes** radio button for the "Enable Client Request Authentication?" option. 5. Select **Save** to save the settings. 2. Go to Imprivata EAM integration Connection Settings page to complete further configuring steps with the managed system. For more information, refer to [Connection Settings](). #### API Access Settings Requirements Follow the steps below to ensure that the Provisioning System Adaptor has the necessary API access permissions to function correctly within your Imprivata Enterprise Access Management environment: 1. Select the gear icon in the top-right corner of the Imprivata Enterprise Access Management interface to access the settings. 2. Select **API Access**. 3. In the API Access, select the option **Allow full API Access via ProveID Web and ProveID Embedded** to enable API access for the Provisioning System Adaptor. 4. Choose the appropriate API access setting based on your Imprivata Enterprise Access Management version: - For version 25.2 and later, select **Sailpoint**. - For version 25.1 and earlier, select **Future 7**. ### Certificate Requirements You can set up any SSL or TLS certificate required for configuring the Imprivata EAM integration with the MS SQL Server by following the instructions in [Uploading a Certificate Manually to a Virtual Appliance](). > [!NOTE] > > Refer to [Updating MS-SQL Database Configuration for Data Extraction]() and [Uploading a Certificate Manually to a Virtual Appliance]() for more information. ## Required Permissions ### Permissions for Database User The Imprivata EAM integration uses the database user context to support aggregation and read operations. The database user specified in the application configuration must have the appropriate rights to fetch data from the specified database tables. ### Permissions for Imprivata SPML User Specify the user during Provisioning Adapter configuration with the necessary permissions to execute SPML APIs. # Machine Account Attributes ## Machine Account Provisioning Attributes The following table lists the attributes in the machine account creation template, including the type, generator, and description for each attribute. > [!IMPORTANT] > > Account attributes marked with an asterisk (\*) are mandatory attributes for machine account creation. | Attribute | Type | Description | | --- | --- | --- | | firstName\* | string | First name of the account | | lastName\* | string | Last name of the account | | username\* | string | Username of the account | | password\* | secret | Password of the account | | emailAddress\* | string | Email of the account | | domainName\* | string | Domain name of the account | | userDisabled | boolean | Whether the account is disabled | | proxDeviceID | string | Prox Card ID of the account | | userPIN | secret | PIN of the account | For more information, refer to [Machine Identity Security Overview](). # Uploading a Certificate Manually to a Virtual Appliance ## Import a Certificate and Keychain to the Virtual Appliance > [!IMPORTANT] > > When adding a certificate to the virtual appliance (VA), ensure that the certificate you copy is in Privacy-Enhanced Mail (PEM) format. - Before manually adding a new certificate for the source to your virtual appliance's truststore, ensure the following: - The virtual appliance (VA) is not connected to the source. - Connection testing between the source and VA is suspended. - Scheduled aggregations are temporarily paused, if necessary. - The source server has been configured for TLS. - The `va-config-.yaml` file has been configured for your virtual appliance. - You must complete the following steps for every virtual appliance on the virtual appliance cluster connected to the source: 1. Copy the PEM-encoded certificates to the `/home/sailpoint/certificates` directory. This directory might not be empty because it's where the VA adds any certificates it gets from the source. 2. Restart the CCG using the following command: `sudo systemctl restart ccg` 3. Watch the `/home/sailpoint/log/ccg-start.log` file. If successful, the import should log messages from the form: ```text {"@timestamp":"2017-04-21 06:57:12 +0000","level":"INFO","type":"ccg","message":"Checking CCG Sources certificates"} {"@timestamp":"2017-04-21 06:57:12 +0000","level":"INFO","type":"ccg","message":"Cert files found: [\"/home/sailpoint/certificates/411818.pem\"]"} 06:57:12 +0000","level":"INFO","type":"ccg","message":"Importing cert /home/sailpoint/certificates/411818.pem"} ``` > **Note** > > If you see an error instead of the log messages above, this is an indication that your certificate is in an invalid format. Verify you're using a PEM format for your certificate and then try again. - Sometimes the export of a certificate may not work properly with the VA. Using the openSSL command to get the certificate is a good way to get the latest certificate. 1. Use the openSSL command to get the latest certificate: 1. Run the following command in openSSL: `openssl s_client -connect server.example.com:636 > output < /dev/null` 2. From the command output file, copy the certificate content between `--BEGIN CERTIFICATE--` and `--END CERTIFICATE--`. 3. Create a new file called `cert.pem` in the `/home/sailpoint/certificates` folder. 4. Save the copied certificate contents in the new `cert.pem` file. 2. Restart the CCG using the following command: `sudo systemctl restart ccg` # Provisioning The Imprivata Enterprise Access Management (EAM) connector supports provisioning, allowing you to create and manage accounts and entitlements in Imprivata Enterprise Access Management (EAM) directly from SailPoint. **Prerequisite:** Your system is configured for provisioning. When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*. When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment. For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account. > [!IMPORTANT] > > This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail. ## Default Create Account Attributes > [!IMPORTANT] > > Account attributes marked with an asterisk(\*) are mandatory attributes for account creation. | Account Attribute | Type | Generator | Description | | --- | --- | --- | --- | | domainName\* | String | Static | The domain name of the user. This field must be filled with the user's domain. | | emailAddress | String | Identity Attribute - Work Email | The email address of the user. | | firstName | String | Identity Attribute - Given Name | The user's first name. | | lastName | String | Identity Attribute - Family Name | The user's last name. | | password | String | Create Password | The password of the user. | | proxDeviceID | String | Disable | The Prox Card Id of the user. | | userDisabled | Boolean | Static | The default user disable status. | | userPIN | String | Disable | The PIN of the user. | | username\* | String | Identity Attribute - Username | The username of the user. | # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The Imprivata Enterprise Access Management (EAM) connector uses the following default correlation and object configurations. ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | userPolicyName | userPolicy | | applicationID | application | ### Default Account Attributes The Imprivata Enterprise Access Management (EAM) connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. | Attribute Name | Description | | --- | --- | | applications | The applications the user is assigned to. | | applicationAccounts | A list of application accounts for the external system. | | distinguishedName | The user's distinguished name. | | domainName | The name of the domain. | | emailAddress | The user's email address. | | externalSystemName | The name of the connected external system. | | firstName | The user's first name. | | lastName | The user's last name. | | subscriberID | The unique identifier assigned to the user. This is an Account ID which must not be changed. | | userDisabled | Indicates whether the user account is disabled. | | username | The user's login name. | | userPolicy | The policy or group the user is assigned to. | | userPrincipalName | The user's unique identifier in a domain (UPN). | | lastSuccessfulAuthentication | The user's last successful authentication date and time. | | lastSuccessfulAuthenticationActivity | The user's last successful authentication activity e.g. authentication mode. | | lastFailedAuthentication | The user's last Failed authentication date and time. | | lastFailedAuthenticationActivity | The user's last Failed authentication activity e.g. authentication mode. | | lastSuccessfulAdministratorLogin | The user's last successful authentication date and time as an administrator. | | lastFailedAdministratorLogin | The user's last Failed authentication date and time as an administrator. | | applicationSuccessfulLoginActivities | The details of application's last successful authentication. | | applicationFailedLoginActivities | The details of application's last failed authentication. | ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Application Attributes Object Type: application | Attribute Name | Description | | --- | --- | | applicationID | The unique identifier for the application. This is an Entitlement ID. | | applicationName | The name of the application. | | successfulLoginCount | The total number of successful logins to the application. | | failedLoginCount | The total number of failed logins to the application. | ### Default User Policy Attributes Object Type: userPolicy | Attribute Name | Description | | --- | --- | | userPolicyID | The unique ID of the user policy. | | userPolicyName | The name of the user policy. This is an Entitlement ID. | # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Certification Error ### User Doesn't Exist in the Database During Single Account Aggregation. **Resolution**: Run the data extraction process before proceeding with the single aggregation. For more information, refer to [Updating MS-SQL Database Configuration for Data Extraction](). ## Test Connection Failure If a test connection fails, it may be due to one of the following errors: ### The Specified External Provisioning System Cannot Be Found. **Resolution**: Ensure the **Provisioning Systems Adaptor Name** is correct and exists in the Imprivata EAM managed system. For more information, refer to [Provisioning System Adaptor Settings Requirements](). ### The Specified External Provisioning System Has Been Disabled in Imprivata. **Resolution**: Ensure the **Provisioning Systems Adaptor** is enabled. For more information, refer to [Provisioning System Adaptor Settings Requirements](). ### Failed to Connect to the Imprivata EAM System. The following error message occurs during the test connection: ```text [ ConnectionFailedException ] [ Possible suggestions ] Ensure that the host is accessible. [ Error details ] Failed to connect to the Imprivata EAM System. Connect to :443 failed: Connection refused (Connection refused) ``` **Resolution**: Ensure the host URL is correct and the host is running. ### Driver Could Not Establish a Secure Connection to SQL Server. The following error message occurs: ```text Error - encrypt" property is set to "true" and "trustServerCertificate" property is set to "false" but the driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption ``` **Resolution**: Append the following in your Database URL: `;encrypt=true;trustServerCertificate=true` ### Failed to Execute the Database Query. 'STRING\_AGG' Is Not a Recognized Built-in Function Name. The following error message occurs: ```text Error - [ ConnectorException ] [ Possible suggestions ] Please check the SQL syntax and database connection. [ Error details ] Failed to execute the database query. 'STRING_AGG' is not a recognized built-in function name. ``` **Resolution**: Verify the Microsoft SQL Server version. The supported versions for the Imprivata EAM integration are Microsoft SQL Server 2017 and later. The `STRING_AGG` function is not recognized as a built-in function in versions of Microsoft SQL Server prior to 2017. Microsoft SQL Server 2016 and earlier versions do not support this function. For more information on supported MS SQL versions, refer to [Supported Managed Systems](). ## Single Account Aggregation Failure ### The User Does Not Exist in the Database During Single Account Aggregation. **Resolution**: Run the Data Extraction process before proceeding with the single aggregation. ## Enabling Account Failure ### Failure While Creating a User with Enabled Status or Changing the Status of an Existing User to Enabled. When the `userDisabled` attribute is not specified or its value is set to false, the new user is treated as enabled in the SPML request. The Imprivata EAM integration further checks the domain user setting and user license availability. If both the SPML request and the Imprivata EAM domain user setting enable the new user, but the user license limit is exceeded, the new user is created but disabled. **Resolution**: Check if the license limit is exceeded and try again.