# Connecting SailPoint and JDBC To connect SailPoint with JDBC, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 8. Under **Connection Type**, select **Direct Connection** or **Flat File**. - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable. 9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source. 10. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Select **Save**. ## Connection Settings Configure how SailPoint connects to the database in the connection settings for [accounts]() and [groups](). The following topics describe the additional files and settings the connection requires. ### Connector Files > [!NOTE] > > **Screenshot** > > [![Connector Files]()]() > > [![Connector Files continued]()]() 1. Upload the JDBC driver for your database into the **Upload Files** field. The current file (if there is one) and upload history are listed below the drag-and-drop box. For more information on the supported driver .jar files for the related databases, refer to [Required JDBC Driver JAR Files](). > **Warning** > > Ensure that the file you upload is not vulnerable or malicious. > **Note** > > You must download the library from a trusted source and validate the authenticity of the download location via inspection of valid SSL/TLS certificates. You must also validate the authenticity of the library by inspecting digital signatures or validating checksums when that information is made available. 2. (Optional) Upload the `SQLJDBCDriver.config` and `krb5.config` files used to connect to a Microsoft SQL Server Database using Windows authentication. The current file and upload history are listed below the button. > **Warning** > > Ensure that the file you upload is not vulnerable or malicious. > **Important** > > This step is necessary to connect a Microsoft SQL server database using Kerberos authentication. > > Once you upload the file to the selected location, you may need to restart the Cloud Connection Gateway (CCG) service on the Virtual Appliance. This is to make sure that the previous cached configuration file - if one exists - is removed and a fresh configuration file is used. For more information, refer to the [Virtual Appliance Troubleshooting Guide]() in Compass. You may need to log in to your Compass account access this information. > **Note** > > For more information on Windows authentication and its requirements, refer to [Windows Authentication and Kerberos](<#windows-authentication-and-kerberos>). Drag and drop the file onto the **Upload Files** box to upload it, or select anywhere within the **Upload Files** box to choose the file on your computer. 3. Select **Save**. ### Windows Authentication and Kerberos The following topics contain information for configuring a connection to SQL database servers using Windows authentication and the Kerberos authentication protocol that supports it. #### Windows Authentication Windows authentication can go by many names. Some of the most common names include: - Windows authentication - Windows domain authentication - Domain authentication - Integrated authentication - Kerberos authentication In this topic, the terms "Windows authentication" and "Kerberos" are used. > [!IMPORTANT] > > To configure Windows authentication, you must properly configure [Kerberos](<#kerberos>). When you connect using a Windows user account, the JDBC SQL Server source validates the account name and password using the Windows principal token in the operating system. In other words, the user identity is validated by Windows, not the source. The source doesn't ask for a password and it doesn't validate the identity. Windows authentication is the default authentication mode. It is much more secure than SQL Server authentication. A connection made using Windows authentication is sometimes called a trusted connection, because the SQL server trusts the credentials provided by Windows. Windows authentication supports the following: - The Kerberos authentication scheme - Password policy enforcement with regard to complexity validation for strong passwords - Account lockout - Password expiration By using Windows authentication, Windows groups can be created at the domain level and a login can be created on the SQL Server source for the entire group. Managing access at the domain level can simplify account administration. > [!NOTE] > > When you create a service account to authenticate with Microsoft SQL, configure the account using the required format: > > ```text > @ > ``` > > In this format, `` refers to the account's username and `` is the domain name. For more information, refer to [Connecting through Windows Authentication]() in the Microsoft documentation. > [!NOTE] > > The linked document is not maintained by SailPoint and is subject to change without notice. ##### Windows Authentication Compatibility Check To properly support Windows authentication, the virtual appliance must be able to resolve the SQL server host, the key distribution center (KDC), and the default Kerberos realm. To check if the VA can resolve the necessary components, run the following command, replacing `` with each component's fully qualified domain name: ```bash nslookup ``` For example: - Verify resolvability with the SQL server: ```bash nslookup MYSQLSERVER.EXAMPLE.COM ``` - Verify resolvability with the KDC: ```bash nslookup MYKDC.EXAMPLE.COM ``` - Verify resolvability with the Kerberos realm: ```bash nslookup EXAMPLE.COM ``` > [!NOTE] > > You may to change your DNS configuration on Virtual Appliance. For more information on changing the DNS, refer to [Network Troubleshooting](). #### Kerberos The SailPoint JDBC connector supports Windows authentication using the Kerberos authentication scheme as an underlying protocol for authentication information exchange. To provide a Login Module Configuration File and a Kerberos Configuration File, refer to [Base Configuration](<#base-configuration>). ##### Kerberos Prerequisites - The SQLJDBCDriver.config and krb5.config files should be uploaded to the source. - Update the `useMssqlKerberosAuth` parameter in the source XML using the REST API. | Parameter | Description | | --- | --- | | `useMssqlKerberosAuth` | Boolean. Default - `false`. | This parameter should be set to `true` when you need to connect to a Microsoft SQL server database with Kerberos authentication. ```json [ { "op": "add", "path": "/connectorAttributes/useMssqlKerberosAuth", "value": true } ] ``` > **Note** > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ##### Login Module Configuration File **Filename:** SQLJDBCDriver.config > [!IMPORTANT] > > This file is mandatory to be provided for Windows Authentication. You can upload the file via [Base Configuration](<#base-configuration>) tab. A login module configuration file consists of one or more entries, each specifying which underlying authentication technology should be used for a particular application or applications. The login module configuration file for this connector allows the SQL JDBC driver to acquire Kerberos credentials. Each login module configuration file entry consists of a name followed by one or more login module-specific entries. Each entry is terminated by a semicolon. Groups of entries are enclosed by braces. For more information, refer to *Creating a login module configuration file* in [Using Kerberos integrated authentication to connect to SQL Server]() in the Microsoft documentation. > [!NOTE] > > The linked document is not maintained by SailPoint and is subject to change without notice. ##### Kerberos Configuration File **Filename:** krb5.config The krb5.config file contains the Kerberos configuration information, including the locations of key distribution centers (KDCs), administration daemons for the Kerberos realms of interest, defaults for the current realm and for the Kerberos applications, and mappings of host names onto the Kerberos realms. This file must reside on all Kerberos clients. The format of the krb5.config consists of section headings in square brackets. Each section can contain zero or more configuration variables (called relations), of the form: ```text relation = relation-value ``` or ```text relation-subsection = { relation= relation-value relation= relation-value ``` > [!NOTE] > > For single domain environments, Kerberos connectivity may succeed without a defined KDC and Realm or any configuration file. This may occur if the Kerberos client loaded on the client computer can resolve and reach the default Kerberos realm and KDC automatically. > > If you have multiple sources with multiple domains and connectivity across the domains, you must provide a `krb5.config` file. > > - Each Virtual Appliance uses a single `krb5.config` file. If you have multiple domains, configure them as multiple realms within the same file. For more information, refer to [Creating a Kerberos configuration file]() in the Microsoft documentation. > [!NOTE] > > The linked document is not maintained by SailPoint and is subject to change without notice. ### JDBC Pooling Parameters The following parameters are not displayed on the UI, but are used to tune JDBC pooling. To add the parameter to SailPoint, use the following JSON example and add in the required parameter and value. Add it to the source XML using the SailPoint REST API. ```json { "op": "add", "path": "/connectorAttributes/", "value": "" } ``` > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. | Parameter | Description | | --- | --- | | `pool.maxWait` | Maximum time to wait for connection to become available in milliseconds. The default value is 60000 milliseconds. | | `pool.evictRuns` | Wait time between closing idle connections in milliseconds. The default value is 300000 milliseconds. | | `pool.maxActive` | Maximum number of connections. The default value is 10 connections. | | `pool.maxIdle` | Maximum number of idle connections. The default value is 5 idle connections. | | `pool.minEvictIdle` | Minimum idle time to close connection in milliseconds. The default value is 6000000 milliseconds. | ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation.