Connecting SailPoint and JDBC

To connect SailPoint with JDBC, perform the following tasks:

Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

To configure a new source:

1. Sign in to SailPoint.
2. Go to Admin > Connections > Sources.
3. Select Create New.
4. Search for the connector by entering the name in the search box, and then select Configure.
5. In the Source Name field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
6. In the Description field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
7. In the Source Owner field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to Assigning a Source Owner.

8. Under Connection Type, select Direct Connection or Flat File.

   • Direct Connection - A direct connection fetches data from the Virtual Appliance Cluster you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the Virtual Appliance Reference Guide.
   • Flat File - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable.

9. If you selected Direct Connection, in Virtual Appliance Cluster, select the virtual appliance cluster that will be used as the application connector for the source.

10. (Optional) Select a governance group to grant its members source or role sub-admin level oversight of the source and its access. For more information, refer to Creating and Managing Governance Groups.
11. If this source represents a primary system containing your organization's personnel records, select the Authoritative Source checkbox. For more information, refer to Creating Identity Profiles.
12. Select Continue. The source is created, and you are navigated to the Source Setup > Base Configuration page. Continue to configure your connected source there.

Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.

2. In the Source Owner dropdown list, select the identity that owns this source.

   • To find a source owner, begin entering their name.

3. In the Virtual Appliance Cluster dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to SailPoint Virtual Appliances.

4. (Optional) If enabled for your organization, select the Use a Credential Provider checkbox to manage the source's authentication using a credential provider.

   Note

   To add a credential provider, go to Admin > Connections > Credential Providers. For more information about credential providers, refer to Credential Providers.

5. Configure the authentication to allow SailPoint to connect to the source. Refer to Connection Settings for more information.

6. (Optional) In the Governance Group for Source Management dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to Associating Governance Groups with a Source.

7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   • Enable Provisioning - Set the toggle to Enabled to allow the source to create, update, and deactivate accounts in the connected source system.

   • Disable Provisioning - Set the toggle to Disabled to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.

8. Select Save.

Connection Settings

Configure how SailPoint connects to the database in the connection settings for accounts and groups. The following topics describe the additional files and settings the connection requires.

Connector Files

1. Upload the JDBC driver for your database into the Upload Files field. The current file (if there is one) and upload history are listed below the drag-and-drop box. For more information on the supported driver .jar files for the related databases, refer to Required JDBC Driver JAR Files.

   Warning

   Ensure that the file you upload is not vulnerable or malicious.

   Note

   You must download the library from a trusted source and validate the authenticity of the download location via inspection of valid SSL/TLS certificates. You must also validate the authenticity of the library by inspecting digital signatures or validating checksums when that information is made available.

2. (Optional) Upload the SQLJDBCDriver.config and krb5.config files used to connect to a Microsoft SQL Server Database using Windows authentication. The current file and upload history are listed below the button.

   Warning

   Ensure that the file you upload is not vulnerable or malicious.

   Important

   This step is necessary to connect a Microsoft SQL server database using Kerberos authentication.

   Once you upload the file to the selected location, you may need to restart the Cloud Connection Gateway (CCG) service on the Virtual Appliance. This is to make sure that the previous cached configuration file - if one exists - is removed and a fresh configuration file is used. For more information, refer to the Virtual Appliance Troubleshooting Guide in Compass. You may need to log in to your Compass account access this information.

   Note

   For more information on Windows authentication and its requirements, refer to Windows Authentication and Kerberos.

   Drag and drop the file onto the Upload Files box to upload it, or select anywhere within the Upload Files box to choose the file on your computer.

3. Select Save.

Windows Authentication and Kerberos

The following topics contain information for configuring a connection to SQL database servers using Windows authentication and the Kerberos authentication protocol that supports it.

Windows Authentication

Windows authentication can go by many names. Some of the most common names include:

• Windows authentication
• Windows domain authentication
• Domain authentication
• Integrated authentication
• Kerberos authentication

In this topic, the terms "Windows authentication" and "Kerberos" are used.

When you connect using a Windows user account, the JDBC SQL Server source validates the account name and password using the Windows principal token in the operating system. In other words, the user identity is validated by Windows, not the source. The source doesn't ask for a password and it doesn't validate the identity. Windows authentication is the default authentication mode. It is much more secure than SQL Server authentication. A connection made using Windows authentication is sometimes called a trusted connection, because the SQL server trusts the credentials provided by Windows.

Windows authentication supports the following:

• The Kerberos authentication scheme
• Password policy enforcement with regard to complexity validation for strong passwords
• Account lockout
• Password expiration

By using Windows authentication, Windows groups can be created at the domain level and a login can be created on the SQL Server source for the entire group. Managing access at the domain level can simplify account administration.

<name>@<realm>

For more information, refer to Connecting through Windows Authentication in the Microsoft documentation.

Windows Authentication Compatibility Check

To properly support Windows authentication, the virtual appliance must be able to resolve the SQL server host, the key distribution center (KDC), and the default Kerberos realm.

To check if the VA can resolve the necessary components, run the following command, replacing <host_fqdn> with each component's fully qualified domain name:

nslookup <host_fqdn>

For example:

• Verify resolvability with the SQL server:

  nslookup MYSQLSERVER.EXAMPLE.COM
  

• Verify resolvability with the KDC:

  nslookup MYKDC.EXAMPLE.COM
  

• Verify resolvability with the Kerberos realm:

  nslookup EXAMPLE.COM
  

Kerberos

The SailPoint JDBC connector supports Windows authentication using the Kerberos authentication scheme as an underlying protocol for authentication information exchange.

To provide a Login Module Configuration File and a Kerberos Configuration File, refer to Base Configuration.

Kerberos Prerequisites

• The SQLJDBCDriver.config and krb5.config files should be uploaded to the source.

• Update the useMssqlKerberosAuth parameter in the source XML using the REST API.

  Parameter	Description
  useMssqlKerberosAuth	Boolean. Default - false.

  This parameter should be set to true when you need to connect to a Microsoft SQL server database with Kerberos authentication.

  [
      {
          "op": "add",
          "path": "/connectorAttributes/useMssqlKerberosAuth",
          "value": true
      }
  ]
  

  Note

  For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

Login Module Configuration File

Filename: SQLJDBCDriver.config

A login module configuration file consists of one or more entries, each specifying which underlying authentication technology should be used for a particular application or applications. The login module configuration file for this connector allows the SQL JDBC driver to acquire Kerberos credentials.

Each login module configuration file entry consists of a name followed by one or more login module-specific entries. Each entry is terminated by a semicolon. Groups of entries are enclosed by braces.

For more information, refer to Creating a login module configuration file in Using Kerberos integrated authentication to connect to SQL Server in the Microsoft documentation.

Kerberos Configuration File

Filename: krb5.config

The krb5.config file contains the Kerberos configuration information, including the locations of key distribution centers (KDCs), administration daemons for the Kerberos realms of interest, defaults for the current realm and for the Kerberos applications, and mappings of host names onto the Kerberos realms. This file must reside on all Kerberos clients.

The format of the krb5.config consists of section headings in square brackets. Each section can contain zero or more configuration variables (called relations), of the form:

relation = relation-value

or

relation-subsection = {
    relation= relation-value
    relation= relation-value

For more information, refer to Creating a Kerberos configuration file in the Microsoft documentation.

JDBC Pooling Parameters

The following parameters are not displayed on the UI, but are used to tune JDBC pooling.

To add the parameter to SailPoint, use the following JSON example and add in the required parameter and value. Add it to the source XML using the SailPoint REST API.

{
    "op": "add",
    "path": "/connectorAttributes/<attribute_name>",
    "value": "<value>"
}

Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to Review and Test.

2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.

3. Select Test Connection.

SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to Discovered Applications in the SailPoint user interface.

For more information, refer to Application Onboarding in the SailPoint SaaS documentation.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.