# SailPoint Imprivata VPAM Connector Documentation

> Imprivata Vendor Privileged Access Management (VPAM) Connector Documentation

# Documentation

# Connecting SailPoint and Imprivata VPAM

To connect SailPoint with Imprivata VPAM, perform the following tasks:

## Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

> [!IMPORTANT]
>
> By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration.

**To configure a new source:**

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Sources**.
3. Select **Create New**.
4. Search for the connector by entering the name in the search box, and then select **Actions**.
5. In the **Actions** dropdown list, select the setup method:

   - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started.

     > **Note**
     >
     > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>). For more information, contact your SailPoint Customer Service Manager.
   - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup.

### Configuring a Source Using Express Setup

Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data.

1. Review the directions and select **Start Express Setup**.
2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**.

   > **Note**
   >
   > The source name must be unique. You can change these settings later in the source configuration.
3. Select **Virtual Appliance**. A virtual appliance is a Linux-based virtual machine that connects to your sources and apps using SailPoint APIs, connectors, and integrations. For more information about configuring and deploying virtual appliances, refer to [SailPoint Virtual Appliances](<https://documentation.sailpoint.com/saas/help/va/index.html>).
4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
5. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section.
6. Select **Finish**.

   After a successful test connection, the system creates your source and prompts you to run an aggregation.

   - If you want to aggregate now, select **Aggregate**.

     - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**.
     - To see the list of aggregated source accounts, go to **Account Management \> Accounts**.
   - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet.

### Configuring a Source Using Standard Setup

Use Standard Setup to configure the connector for full feature support.

1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
4. Under **Connection Type**, select **Direct Connection** or **Flat File**.

   - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
   - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable.
5. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source.
6. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
7. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
8. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.
2. In the **Source Owner** dropdown list, select the identity that owns this source.

   - To find a source owner, begin entering their name.
3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](<https://documentation.sailpoint.com/saas/help/va/index.html>).
4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information.
6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system.
   - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.
8. Select **Save**.

## Connection Settings

Provide the information required to connect to the Imprivata VPAM managed system:

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/img/conn_settings.png>)](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/img/conn_settings.png>)

1. Enter the **Base URL** of the Imprivata VPAM system. For example:

   `https://<domainName>.securelinkcloud.net/rss-servlet`
2. Enter the **Username** for the account that has permission to access the Imprivata managed system. This account should have the necessary privileges to perform the required actions.
3. Enter the **Client ID** generated in the Imprivata VPAM system. For more information, refer to [To generate Client Credentials from the managed Imprivata VPAM system](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/index.html#prerequisites>).
4. Enter the **Client Secret** generated in the Imprivata VPAM system.

   > **Important**
   >
   > Ensure you enter the most recent client secret when configuring Imprivata VPAM operations, as Imprivata supports rotating secrets.
5. Select **Save**.

## Feature Management

Provide the information to manage the features for your configuration of Imprivata VPAM:

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/img/feature_manage.png>)](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/img/feature_manage.png>)

1. Select **Manage User** to manage standard users.
2. Select **Manage Vendor Rep** to manage vendor representatives.
3. Select **Save**.

## Aggregation Settings

Configure settings related to account aggregation.

### Filter Settings for Accounts

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/img/filter_acc.png>)](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/img/filter_acc.png>)

1. Enter the **User Filters** to define the scope of the users included in account aggregation processes.
2. Enter the **Vendor Rep Filters** to define the scope of the vendor representative accounts included in account aggregation processes.

For more information on configuring account filters, refer to [Filter Examples for Accounts](<#filter-examples-for-accounts>).

### Filter Settings for Entitlements

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/img/filter_entitlements.png>)](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/img/filter_entitlements.png>)

1. Enter the **User Group Filters** to define the scope for grouping users based on their attributes during entitlement aggregation.
2. Enter the **Role Filters** to define the scope of the roles aggregated during entitlement aggregation.
3. Enter the **Credentials Category Filters** to define the scope of the credentials category during entitlement aggregation.
4. Enter the **Application Group Filters** to define the scope of the applications within a specific group aggregated during entitlement aggregation.

For more information on configuring entitlement filters, refer to [Filter Examples for Entitlements](<#filter-examples-for-entitlements>).

### Pagination Settings

> [!NOTE]
>
> **Screenshot**
>
> [![alt text](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/img/page_settings.png>)](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/img/page_settings.png>)

1. Enter the **Page Size**, which is the number of records to aggregate in a single page. The default value is 100, and the maximum allowed value is 100.
2. Select **Save**.

## Configuring Filter Settings

Here are examples of filters that can be used with the Imprivata VPAM to retrieve specific data based on different criteria.

> [!NOTE]
>
> To access any of the links in the Imprivata documentation below, the user must exist on the Imprivata VPAM managed system.

### Filter Examples for Accounts

| Type | Filter Example | Description |
| --- | --- | --- |
| User | `filters['name']=[User_Name1]`<br>OR<br>`filters['name']=[User_Name1]&filters['status']=1` | This allows you to retrieve users by their name or by a combination of name and status. For more information, refer to example of [User Filters](<https://sailpoint.securelinkcloud.net/rss-servlet/api-documentation/index_sle.html#_user_2>) in Imprivata documentation. |

### Filter Examples for Entitlements

| Type | Filter Example | Description |
| --- | --- | --- |
| User Group | `filters['name']=[Usergrp_Name1]`<br>OR<br>`filters['name']=[Usergrp_Name1],[Usergrp_Name2]` | This allows you to retrieve user groups by their name. You can specify a single user group name or multiple user group names separated by commas. For more information, refer to example of [User Group Filters](<https://sailpoint.securelinkcloud.net/rss-servlet/api-documentation/index_sle.html#_user_group>) in the Imprivata documentation. |
| Role | `filters['name']=[Role_Filter1]`<br>OR<br>`filters['name']=[Role_Filter1],[Role_Filter2]` | This allows you to retrieve roles by their name. You can specify a single role name or multiple role names separated by commas. For more information, refer to example of [Role Filters](<https://sailpoint.securelinkcloud.net/rss-servlet/api-documentation/index_sle.html#_role>) in the Imprivata documentation. |
| Application Group | `filters['name']=[ApplicationGroup_Filter1]`<br>OR<br>`filters['name']=[ApplicationGroup_Filter1],[ApplicationGroup_Filter2]` | This allows you to retrieve application groups by their name. You can specify a single application group name or multiple application group names separated by commas. For more information, refer to example of [Application Group Filters](<https://sailpoint.securelinkcloud.net/rss-servlet/api-documentation/index_sle.html#_application_group>) in the Imprivata documentation. |
| Credentials Category | `filters['name']=[CredCategory_Filter1]`<br>OR<br>`filters['name']=[CredCategory_Filter1],[CredCategory_Filter2]` | This allows you to retrieve credentials categories by their name. You can specify a single credentials category name or multiple credentials category names separated by commas. For more information, refer to example of [Credential Category Filters](<https://sailpoint.securelinkcloud.net/rss-servlet/api-documentation/index_sle.html#_credential_category>) in the Imprivata documentation. |

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

> [!IMPORTANT]
>
> Run the Test Connection only once during the initial setup to verify connectivity with the source. If the test completes successfully but the source becomes unhealthy later, do not run Test Connection again. Instead, try other operations, as Test Connection cannot handle rotating client secrets.

## SailPoint Application Onboarding

> [!IMPORTANT]
>
> SailPoint application onboarding is only available to business and business plus customers. For more information, contact your SailPoint CSM.

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Integrating SailPoint with Imprivata Vendor Privileged Access Management (VPAM)

> [!NOTE]
>
> **Integration**
>
> This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

The SailPoint Imprivata Vendor Privileged Access Management (VPAM) connector provides governance capabilities for users and vendor representatives in the Imprivata VPAM system. The Imprivata VPAM connector capabilities include aggregating and provisioning users and vendor representatives, and adding or removing entitlements at the user and vendor representative level.

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of an Imprivata VPAM connector in SailPoint.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Imprivata VPAM connector supports the following features:

### Account Management

#### For Standard Users

- Manage standard users as "Accounts" in SailPoint
- Manage "User Groups", "Roles", and "Credential Category" as Entitlements in SailPoint
- Account aggregation
- Entitlement aggregation
- Create and modify users
- Enable or disable users
- Add or remove entitlements
- Aggregation and provisioning of custom attributes. For more information, refer to [Custom Attributes](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/schema.html#custom-attributes>).
- Access certification
- Delete account

#### For Vendor Representatives

- Manage vendor representatives as "Accounts" in SailPoint
- Manage "Application Groups" and "Credential Category" as Entitlements in SailPoint
- Account aggregation
- Entitlement aggregation
- Create and modify vendor representatives
- Enable or disable vendor representatives
- Add or remove entitlements
- Provisioning of custom attributes. For more information, refer to [Custom Attributes](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/schema.html#custom-attributes>).
- Access certification

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

## Supported Managed Systems

The Imprivata VPAM connector supports integration with the Vendor Privileged Access Management (VPAM) on an on-premise system.

## Prerequisites

- Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
- You must have a valid "Client" to perform successful operations. A Client uniquely identifies the user, and its components (ID and secret) must be treated with the same consideration as user credentials.

  > **Steps to generate Client Credentials from the managed Imprivata VPAM system**
  >
  > 1. Go to the **System Admin \> Settings \> API Keys**.
  > 2. Select **API keys**.
  > 3. Select **Create Client**.
  >
  >    Upon Client creation, an ID and a secret will be provided, which can be used to obtain an access token.

> [!NOTE]
>
> **Steps to find Vendor ID from the managed Imprivata VPAM system**
>
> 1. Go to the Imprivata VPAM portal \> **Vendors** section.
> 2. Select **View Vendors**.
> 3. Select the **Vendor Name** under which you want to create a new Vendor Rep.
>
>    You will find the `vendorId` at the end of the URL.

## Required Permissions

### Permissions for Users

| Permission | Category | Description | Department(s) |
| --- | --- | --- | --- |
| MANAGE\_CREDENTIALS | Credentials | Allows a user to manage credentials | \- |
| CREATE\_USER | User/User Group | Allows a user to create other users. | Global |
| EDIT\_USER | User/User Group | Allows a user to update other users. | Global |
| DELETE\_USER | User/User Group | Allows a user to delete other users. | Global |
| VIEW\_USER | User/User Group | Allows a user to view other users. | Global |
| VIEW\_USER\_GROUP | User/User Group | Allows a user to view user groups. | \- |
| VIEW\_ROLE | User/User Group | Allows a user to view the current system roles and permissions. | \- |

### Permissions for Vendor Representatives (Vendor Reps)

| Permission | Category | Description | Department(s) |
| --- | --- | --- | --- |
| MANAGE\_CREDENTIALS | Credentials | Allows a user to manage credentials | \- |
| CREATE\_VENDOR\_REP | Vendor | Allows a user to create vendor reps. | \- |
| EDIT\_VENDOR\_REP | Vendor | Allows a user to edit vendor reps. | \- |
| VIEW\_VENDOR | Vendor | Allows a user to view vendors. | Global |
| VIEW\_VENDOR\_REP | Vendor | Allows a user to view vendor reps. | \- |
| DELETE\_VENDOR\_REP | Vendor | Allows a user to delete vendor reps. | \- |
| APPROVE\_USER\_CONNECTION | Vendor | Allows a user to approve vendor rep user connection requests. | \- |

# Machine Account Attributes

## Machine Account Provisioning Attributes

Machine account creation uses the same attribute keys as standard account creation. For attribute descriptions, refer to [Account Attributes](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/schema.html#default-account-attributes>).

The following table lists the attributes in the machine account creation template, including the type, requirement status, and generator for each attribute.

| Attribute | Type | Required | Generator | Description |
| --- | --- | --- | --- | --- |
| userType | string | Yes | Static | The type of the user. The default static value is user. |
| userId | string | Yes | Static | The user ID for login. Enter a unique user ID for the machine account. |
| name | string | Yes | Static | The full name of the machine account. |
| email | string | Yes | Static | The email of the machine account. |
| vendorId | int | No | Disable | The ID of the vendor associated with the account. |
| departmentId | int | No | Disable | The ID of the department that the account belongs to. |
| phone | string | No | Disable | The phone number of the account. |
| altPhone | string | No | Disable | The alternative phone number of the account. |
| disabled | boolean | No | Disable | If true, the account is disabled. |
| localAddress | string | No | Disable | Network restrictions for the client. |
| remoteAddress | string | No | Disable | Network restrictions for the client. |
| sendRegistrationEmail | boolean | No | Disable | If true, sends a registration email to the newly created account. Defaults to false. |
| authProvider | string | No | Disable | The authentication provider to use for the account. |
| department | string | No | Disable | The name of the department associated with the account. |
| notes | string | No | Disable | Notes for the account. |
| approvalAccessChange.accessOption | string | No | Disable | If present, determines how access is set. Possible values are ENABLE, ENABLE\_FOR, and ENABLE\_UNTIL. ENABLE requires the ENABLE\_INDEFINITE\_ACCESS permission. |
| approvalAccessChange.accessPeriod | string | No | Disable | Used when accessOption is ENABLE\_FOR. Possible values are HOURS, DAYS, and WEEKS. |
| approvalAccessChange.accessTimeFloat | int | No | Disable | Used when accessOption is ENABLE\_FOR. Determines how many weeks, days, or hours access is allowed. |
| approvalAccessChange.dateAccessExpires | string | No | Disable | Used when accessOption is ENABLE\_UNTIL. Determines the date the access expires. |

### Classification

This connector uses the `userType` attribute to identify the account. The default static value is user.

# Provisioning

The Imprivata VPAM connector supports provisioning, allowing you to create and manage accounts and entitlements in Imprivata VPAM directly from SailPoint.

**Prerequisite:** Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

> [!IMPORTANT]
>
> This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

## Provisioning Attributes

The following list outlines which account attributes SailPoint uses to create a profile for new Imprivata VPAM accounts:

- [For Users](<#for-users>)
- [For Vendor Representatives (Vendor Reps)](<#for-vendor-representatives-vendor-reps>)

> [!IMPORTANT]
>
> Account attributes marked with an asterisk(\*) are mandatory attributes for account creation.

### For Users

| Account Attribute | Type | Generator | Description |
| --- | --- | --- | --- |
| userType\* | String | Static Value - User | The type of the User. |
| userId\* | String | Identity Attribute - Username | The User ID for login. |
| name\* | String | Identity Attribute - Display Name | The full name of the User. |
| email\* | String | Identity Attribute - Work Email | The email of the User. |
| sendRegistrationEmail | String | Disabled | If true, sends a registration email to the newly-created User. Defaults to false. |
| department | String | Disabled | The name of the department associated with the User. |
| departmentId | Integer | Disabled | The ID of the Department that the User belongs to. |
| phone | Boolean | Static | The phone number of the User. |
| altPhone | String | Disabled | The alternative phone number of the User. |
| remoteAddress | String | Disabled | Network restrictions for the Client. |
| localAddress | String | Disabled | Network restrictions for the Client. |
| authProvider | String | Disabled | Authentication provider to use for the User. |
| status | Integer | Disabled | The status of the user, where<br>0 : active<br>1 : disabled<br>2 : unregistered<br>3 : deleted |

### For Vendor Representatives (Vendor Reps)

> [!NOTE]
>
> The `vendorId` is a unique identifier assigned to each Vendor in the Imprivata VPAM system. You will need this Vendor ID when creating a new Vendor Rep associated with that specific Vendor. For more information, refer to [Steps to find Vendor ID from the managed Imprivata VPAM system.](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/index.html#prerequisites>)

| Account Attribute | Type | Generator | Description |
| --- | --- | --- | --- |
| userType\* | String | Static Value - vendorRep | The type of the Vendor Rep. |
| vendorId\* | Integer | Disabled | The ID of the Vendor associated with the Vendor Representatives. |
| name\* | String | Identity Attribute - Display Name | The full name of the Vendor Representatives. |
| email\* | String | Identity Attribute - Work Email | The email of the Vendor Representatives. |
| phone | Boolean | Static | The phone number of the Vendor Representatives. |
| altPhone | String | Disabled | The alternative phone number of the Vendor Representatives. |
| disabled | String | Identity Attribute - Username | If true, this Vendor Representatives has been disabled. |
| department | String | Disabled | The name of the department associated with the Vendor Representatives. |
| notes | String | Disabled | The notes for the Vendor Representatives. |
| authProvider | String | Disabled | Authentication provider to use for the Vendor Rep. |
| approvalAccessChange.accessOption | String | Disabled | If present, determines how the access will be set for this Vendor Representatives. Possible values are "ENABLE", "ENABLE\_FOR", "ENABLE\_UNTIL". ENABLE needs the ENABLE\_INDEFINITE\_ACCESS permission. |
| approvalAccessChange.accessPeriod | String | Disabled | Used when accessOption is present and set to "ENABLE\_FOR". Determines the access period used to calculate when access expires for a Vendor Representatives. Possible values are "HOURS", "DAYS", "WEEKS". |
| approvalAccessChange.accessTimeFloat | Integer | Disabled | Used when accessOption is present and set to "ENABLE\_FOR". Determines for how many weeks, days or hours access will be allowed for this Vendor Rep. |
| approvalAccessChange.dateAccessExpires | String | Disabled | Used when accessOption is present and set to "ENABLE\_UNTIL". Determines the date the access expires for this Vendor Representatives. |

# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The Imprivata VPAM connector uses the following default correlation and object configurations.

## Default Correlation Configuration

Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements.

You can customize the correlation configuration. Refer to [Assigning Source Accounts to Identities](<https://documentation.sailpoint.com/saas/help/accounts/correlation.html>) for more information.

When you first create the Imprivata VPAM source, the default correlation mapping is:

| Account Attribute | Operation | Identity Attribute |
| --- | --- | --- |
| userId | Equals | Username |
| email | Equals | Work Email |

You can modify the correlation configuration in accordance with your requirements.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| id | Account |
| id | userGroup |
| id | role |
| id | applicationGroups |
| id | credentialCategory |

### Default Account Attributes

The Imprivata VPAM connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description |
| --- | --- |
| id | The ID of the User/ Vendor Rep. This is the Account ID which should not get changed. |
| name | The full name of the User/ Vendor Rep |
| dateLastLogin | The last login date of the User/ Vendor Rep |
| dateLastActive | The last active date of the User/ Vendor Rep |
| adminUser | If true, the User is an administrator. Type: Boolean |
| userType | The type of the User |
| statusText | A text representation of the status of the User/ Vendor Rep |
| totalLoginCount | The total number of times the User/ Vendor Rep has logged in. Type: Integer |
| department | The name of the Department associated with the User/ Vendor Rep |
| noAutoDisable | If true, the User will not be disabled automatically. Type: Boolean |
| approvalRequestIds | The IDs of the Approval Requests associated with the User/ Vendor Rep |
| userId | The User ID for login |
| email | The email of the User/ Vendor Rep |
| departmentId | The ID of the Department that the User belongs to. Type: Integer |
| phone | The phone number of the User/ Vendor Rep |
| altPhone | The alternative phone number of the User/ Vendor Rep |
| status | The status of the User/ Vendor Rep. Values: 0 = active, 1 = disabled, 2 = unregistered. Type: Integer |
| authProvider | Authentication provider to use for the User |
| active | If true, the Vendor Rep has been registered. Type: Boolean |
| disabled | If true, this Vendor Rep is disabled. Type: Boolean |
| dateAccessExpires | The date when access for the Vendor Rep expires. |
| vendorId | The ID of the Vendor associated with the Vendor Rep Type: Integer |
| userGroups | The User Groups that the User belongs to. Type: userGroup, Entitlement, Multivalued |
| roleIds | The IDs of the Roles assigned to the User. Type: role, Entitlement, Multivalued |
| applicationGroupIds | A list of Application Group IDs assigned to the Vendor Rep. Required when the chosen Vendor has Application Groups enabled. Type: applicationGroups, Entitlement, Multivalued |
| credentialCategoryId | The ID of the Credential Category associated with the User/ Vendor Rep. Type: credentialCategory, Entitlement |

> [!NOTE]
>
> The `vendorId` is a unique identifier assigned to each Vendor in the Imprivata VPAM system. You will need this Vendor ID when creating a new Vendor Rep associated with that specific Vendor. For more information, refer to [Steps to find Vendor ID from the managed Imprivata VPAM system](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/index.html#prerequisites>).

### Custom Attributes

The Imprivata VPAM connector supports custom fields, allowing you to extend the default user attributes.

> [!NOTE]
>
> Provisioning of custom attribute is supported for vendor representatives only.

To utilize custom fields, follow these steps:

1. Create the custom field on the Imprivata VPAM managed portal:

   1. Go to **System Admin \> Settings \> User Fields**.
   2. Click on **New**.
   3. Add a Label for the custom field and select the appropriate **Type**.
   4. Select **Save**.
2. Add the created custom field to the SailPoint Account Schema:

   1. In the SailPoint Account Schema, add a new field with the prefix `customFields` followed by the custom field name.

      For example, if the created custom field name is `officeLocation`, then in the schema, it should be defined as `customFields.officeLocation`.

      This helps SailPoint recognize and include the custom field during the aggregation process.
   2. After adding the custom field to the account schema, you can also include it in the Create Account template for provisioning.

      This ensures that the custom field is populated with the appropriate value when creating new user accounts in Imprivata VPAM source.

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default User Group Attributes

The Imprivata VPAM connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

Object Type: `userGroup`

| Attribute Name | Description |
| --- | --- |
| id | The unique identifier of the User Group. This is an Entitlement ID. |
| name | The name of the User Group. |
| description | The description of the User Group |
| userCount | The number of Users associated with this User Group. Type: Integer |
| gkGroupCount | The number of Gatekeeper Groups associated with this User Group. Type: Integer |
| isSeamless | If true, this Gatekeeper Group is Seamless. Type: Boolean |
| groupType | The type of the User Group |
| applicationIds | The list of Application IDs associated with the User Group. Type: String, Multi-Valued |
| adminUserIds | The list of User IDs that are User Group administrators associated with the User Group. Type: String, Multi-Valued |

### Default Role Attributes

The Imprivata VPAM connector supports roles. The following attributes must be configured on the managed system and in the SailPoint source schema to manage roles.

Object Type: `role`

| Attribute Name | Description |
| --- | --- |
| id | The unique ID for the role. This is an Entitlement ID. |
| name | The name of the role. |
| description | The description of the role. |
| roleBindIds | An array of role bind IDs with this role assigned. |

### Application Groups Attributes

Object Type: `applicationGroups`

The following lists the application groups attributes:

| Attribute Name | Description |
| --- | --- |
| id | The unique ID of the application group. This is an Entitlement ID. |
| name | The name of the application group. |
| vendorId | The ID of the vendor that owns the application group. Type: Integer |
| appCount | The number of applications that the application group contains. Type: Integer |
| vrepCount | The number of vendor reps that the application group contains. Type: Integer |

### Credential Category Attributes

Object Type: `credentialCategory`

The following lists the credential category attributes:

| Attribute Name | Description |
| --- | --- |
| id | The unique ID of the credential category. This is an Entitlement ID. |
| name | The name of the credential category. |
| description | The description of the credential category. |

## Default Machine Identity Attributes

Machine Identity attributes define the multiple types of machine identities that can be assigned to the managed system's user accounts.

For more information, refer to [Machine Identity Security Overview](<https://documentation.sailpoint.com/saas/help/machine/index.html>).

# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## User ID must have at least 5 characters

**Resolution**: The Imprivata VPAM server has a limitation that requires user IDs to contain a minimum of 5 characters.

## Vendor Rep email is already used

**Resolution**: The email ID you are using is already associated with a Vendor Rep account on the Imprivata VPAM portal. Use a different email ID.

## The Application Groups specified are invalid

**Resolution**: You are attempting to create a Vendor Rep in one Vendor while assigning Application Groups from another Vendor. Ensure that you add Application Groups from the same Vendor in which you are creating the new Vendor Rep.

## One of the features should be enabled, either Manage User or Manage Vendor Rep, on Test Connection

**Resolution**: You have not selected either the Manage User or Manage Vendor Rep checkbox in the [Feature Management](<https://documentation.sailpoint.com/connectors/imprivata_vpam/va/help/connecting.html#feature-management>) menu. Select at least one option to proceed.

## Invalid configuration exception on Test Connection

**Resolution**: This error occurs when the Base URL, Client ID, or Client Secret is configured incorrectly. Verify the credential values you have provided.

## Invalid token while creating Vendor Rep with error code: 401

**Resolution**: Confirm whether the permission for the role `APPROVE_USER_CONNECTION` has been granted.