Skip to content

Integrating SailPoint with Lightweight Directory Access Protocol

This document is designed to give specific information about requirements and field definitions needed to configure a working instance of a Lightweight Directory Access Protocol (LDAP) connector. The LDAP source is generic, so you can configure connections with any LDAP server.

Your configuration may vary based on the LDAP server you connect to.

Tip

To support LDAP managed systems that are not on the supported list or are integrated LDAP server systems, the implementation must follow the Generic LDAP connector design. Ensure the configuration is updated according to the provided documentation and guidelines to ensure full functionality.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

Note

Before you can use any item marked with an asterisk (*), SailPoint must activate the feature for your site. For more information on SailPoint features, refer to Source Features.

The SailPoint LDAP source supports the following features:

  • Load LDAP accounts
  • *Provision LDAP accounts
  • *Access Certifications (certification of entitlements connected to accounts)
  • *Password management
  • Delta Aggregation for accounts
  • Unlock account
  • Enable and disable accounts
  • Delete accounts
  • Account Move and Rename

Schema for Multiple Groups

To use multiple group schema, add the following entry to the source XML:

<entry key="LDAPApplicationVersion" value="2.0"/>

For more information, refer to Schema Reference.

Supported Managed Systems

Lightweight Directory Access Protocol (LDAP) is a generic solution to interact with many types of LDAP systems. It provides flexibility to configure the source with all the details required to connect most LDAP systems.

SailPoint is certified to work with the following LDAP servers:

  • ADAM (AD LDS)
  • ODSEE
  • Novell (NetIQ) eDir
  • IBM Tivoli DS
  • OpenLDAP
  • Oracle Internet Directory
  • DS 389
  • Oracle Unified Directory (OUD)

Prerequisites

  • Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.
  • Create a service account on LDAP with the required permissions.

Required Permissions

  • The LDAP source requires that the service account must be an administrator account and that the directory server has administrator credentials.
  • The LDAP source must have read/write permissions over the directory information tree to manage LDAP data.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.