# Connecting SailPoint and LDAP To connect SailPoint with LDAP, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 8. Under **Connection Type**, select **Direct Connection** or **Flat File**. - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable. 9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source. 10. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Select **Save**. ## Connection Settings Choose the appropriate authentication type and provide the information required to connect and interact with the source. 1. Select an option from the **Authorization Types** dropdown list: - **Simple**: To use a clear-text password for the Service Account. - **SASL EXTERNAL (Certificates)**: To use certificate-based secured authorization. - **None**: If you do not want to use authorization when connecting to the server. 2. Enter the **Hostname or IP Address** for the LDAP server. 3. Enter the **Port** number that the server communicates through (the default is 389). Ensure to enter correct port number for certificate-based authorization. 4. Depending on your selected Authorization Type, complete the following fields: - If you select **Simple** or **None**: > **Screenshot** > > [![Simple or None authentication fields]()]() 1. Enter the **Service Account** DN that points to a user in the LDAP tree who can manage the LDAP server (for example: `cn=Admin,dc=example,dc=com`). 2. Enter the **Password** for the Service Account. 3. (Optional) Select **Enable Transport Layer Security (TLS)** to connect securely to the server. - If you select **SASL EXTERNAL (Certificates)**, additional fields appear: > **Screenshot** > > [![SASL EXTERNAL certificate authentication fields]()]() > **Important** > > You must provide an Encrypted Private Key for certificate-based secured authorization. 1. Enter the content of the client-certificate file in **Certificate**. 2. Enter the client's encrypted private-key contents in **Private Key**. 3. Enter the passphrase password in **Private Key Password** to parse and decrypt the private key. 4. (Required) Select **Enable Transport Layer Security (TLS)** to connect securely to the server. 5. Select **Save**. > [!NOTE] > > For existing sources, it is mandatory to add the `encrypted` attribute through a PATCH API as an additional configuration setting to support certificate-based authorization. > > Endpoint: `PATCH /v3/sources/{sourceId}` > > Request Body: > > ```json > [ > { > "op": "add", > "path": "/connectorAttributes/encrypted", > "value": "clientCertificate,privateKeyPassword,private_key" > } > ] > ``` ## Account and Group Settings Provide the information required to search the accounts and groups managed by your system. The search DNs defines the list of container distinguished names along with other relevant attributes that define the scope for this application. Accounts and groups can have different sets of search DNs and you can define different scopes for each of them. ### Account Search Scope > [!NOTE] > > **Screenshot** > > [![Account Search Scope]()]() Multiple Search DN entries can be configured to define the account search scope. > [!NOTE] > > At least one Search DN needs to be configured for the account search scope. To configure the account search scope, complete the following: 1. Enter the **Search DN** (distinguished name) to search for the accounts that you want to load. For example: `ou=HR,dc=org,dc=com` 2. (Optional) Enter the **LDAP Search Filter** to specify an optional filter that limits the results returned by the **Search DN**. For example, to filter for entries that do not represent a person, enter the following: `(!(objectclass=person))` 3. (Optional) Enter the **Group Member Search DN** to specify the group memberships of the users that you are loading. > **Note** > > If no value is provided, then the default scope of Group Membership is the **Search DN** value. 4. Select **Save**. ### Group Search Scope > [!NOTE] > > **Screenshot** > > [![Group Search Scope]()]() > [!NOTE] > > By default, if the scope is not defined for groups, the connector uses the Account search scope. To configure the group search scope, complete the following: 1. (Optional) Enter the **Search DN** (distinguished name) to search for the groups that you want to load. For example: `ou=Groups,dc=org,dc=com` 2. (Optional) Enter the **LDAP Search Filter** to specify an optional filter that limits the results returned by the **Search DN**. For example, to fetch groups that start with the letter `g`, enter the following: `(cn=g*)` 3. Select **Save**. > [!NOTE] > > Only `group.iterateSearchFilter` will be respected during group aggregation. ## Additional Settings Use these additional settings to further configure aggregation, enable and disable operations, lock and unlock operations, and the LDAP password attribute. For sample data information for the fields and corresponding LDAP server, refer to [Sample Configuration Data for LDAP Servers](<#sample-configuration-data-for-ldap-servers>). ### Aggregation Configuration > [!NOTE] > > **Screenshot** > > [![Aggregation Configuration]()]() To configure aggregation, complete the following as required: 1. Select the **Delta Aggregation** checkbox to aggregate changes in the account which occurred since the last aggregation was completed. 2. Select the **Delta Iteration Mode** used to detect changes in the directory during delta aggregation. Make sure the directory server supports the selected Delta Iteration Mode. > **Note** > > - The **Modify Time Stamp** option does not fetch details of deleted objects. > - For **USN Change** and **Change Log** to function properly, the configuration settings need to be updated on the LDAP server. 3. (Only applicable if you select the **USN Change** option from the **Delta Iteration Mode** drop-down menu) Enter the **Deleted Objects Container DN** for the appropriate container for deleted objects. You need to configure the Deleted Container DN to fetch the deleted objects in delta aggregation. For example: `CN=Deleted Objects,dc=sailpoint,dc=com` 4. Enter the **Page Size** to set the maximum number of results fetched by a single page during the search operation. The default is `100`. 5. Configure **Unique Account Attribute** with an attribute that never changes for the account in its life cycle and can be used to uniquely identify the account. > **Note** > > To support account move and rename operations, ensure to provide a Unique Account Attribute for the configured LDAP server. For more information, refer to [Account Move/Rename Operation](). 6. Configure **Enable Group Membership Cache** to enable group membership caching during account aggregation. Aggregating account data from Generic LDAP servers can take a long time, especially when many accounts have multiple group memberships. This can slow down performance during aggregation. To solve this issue, you can enable group membership caching. This feature creates an internal cache of group membership data during aggregation, which reduces processing time and improves performance. This feature is enabled by default for newly created sources. For existing sources, update your source configuration by adding the following entry: ```json [ { "op": "add", "path": "/connectorAttributes/enableGroupMembershipCache", "value": true } ] ``` where: - `true` - Enables group membership caching - `false` - Disables caching (default) > **Note** > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. 7. Select **Save**. ### Enable and Disable Operation Configuration > [!NOTE] > > **Screenshot** > > [![Enable and Disable Operation Configuration]()]() To configure the enable and disable operations, complete the following: 1. Configure **Revoke Attribute Name** with an attribute that indicates whether the account is enabled or disabled. > **Note** > > The Revoke Attribute Name and Restore Attribute Name should be the same on your LDAP server. 2. Configure the **Revoke Attribute Value** with the value needed to set the Revoke Attribute while the account is being disabled. 3. In the **Revoke Action** field, configure the required action to perform during the revoke operation. If this value needs to be updated, the action can be **ADD** or **REPLACE**. Leave this field blank to remove the Revoke Attribute from the account. 4. Configure **Restore Attribute Name** with an attribute that indicates whether the account is enabled or disabled. 5. Configure the **Restore Attribute Value** with the value needed to set the Restore Attribute while the account is being enabled. 6. In the **Restore Action** field, configure the required action to perform during the restore operation. If this value needs to be updated, the action can be **ADD** or **REPLACE**. Leave this field blank to remove the Restore Attribute from the account. 7. Select **Save** after you have completed your configuration. ### Lock and Unlock Operation Configuration > [!NOTE] > > **Screenshot** > > [![Lock and Unlock Operation Configuration]()]() To configure the lock and unlock operations, complete the following: 1. Enter a **Lock Attribute Name** to indicate whether the account is locked or unlocked. 2. Enter the **Unlock Attribute Name(s)** that need to be updated during the Unlock Operation. Enter multiple values by adding an attribute and then pressing the Enter key. 3. Configure **Unlock Attribute Value** with the value SailPoint sets for the attributes listed in the **Unlock Attribute Name(s)** list. Leave this field blank to remove the Unlock Attributes from the account during the Unlock Operation. 4. In the **Unlock Action** field, configure the required action to perform during the Unlock Operation. If this value needs to be updated, the action can be **ADD** or **REPLACE**. Leave this field blank to remove the Unlock Attributes from the account. 5. Select **Save**. ### Password Attribute Name Configuration > [!NOTE] > > **Screenshot** > > [![Password Attribute Name Configuration]()]() To configure the password attribute, complete the following: 1. Enter the **Password Attribute Name** for the LDAP server. 2. Enter the **Password Expiry Attribute Name** to update when the administrator reset operation is performed. For example: `pwdReset` `passwordExpirationTime` 3. Enter the **Immediate Password Expiry Attribute Value** to be set for the password expiry attribute when the administrator resets the password for the user. For example, set the value for `pwdReset` attribute to `true`. 4. Select **Save**. ### Sample Configuration Data for LDAP Servers Use the following table as a reference for sample configuration data for the fields on the **Additional Settings** page. The first row lists each LDAP server and the associated values can be found by going down the column and locating the row with the attribute you want to configure. | Attributes | ADAM | OUD | DS 389 | Tivoli | Novell | SunOne | | --- | --- | --- | --- | --- | --- | --- | | Password Attribute Name | userPassword | userPassword | userPassword | userPassword | userPassword | userPassword | | Revoke Attribute Name | msDS-UserAccountDisabled | orcllsEnabled | nsAccountLock | N/A | loginDisabled | nsRoleDN | | Restore Attribute Name | msDS-UserAccountDisabled | orcllsEnabled | nsAccountLock | N/A | loginDisabled | nsRoleDN | | Lock Attribute Name | N/A | pwdaccountlockedtime | passwordLockout | pwdAccountLockedTime | lockedByIntruder | passwordLockout | | Unlock Attribute Name(s) | N/A | pwdFailureTime, pwdaccountlockedtime | passwordLockout | pwdAccountLockedTime, pwdFailureTime | lockedByIntruder | pwdAccountLockedTime, pwdReset | | Revoke Action | N/A | N/A | REPLACE | N/A | N/A | N/A | | Restore Action | REPLACE | N/A | N/A | N/A | N/A | N/A | ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation.