Skip to content

Integrating SailPoint with ACF2

Connecting SailPoint to your ACF2 source allows you to configure an ACF2 managed system which can aggregate, provision, and monitor ACF2 activities. SailPoint can update the managed system in real time with user and password changes.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The ACF2 source supports the following features:

  • User aggregation, including connections to ACF2 groups (based on UIDs)
  • Group aggregation based on:
    • UIDs in ACF2 rules
    • ACF2 Roles X-ROL
    • ACF2 Sources X-SGP (for DB2 users)
  • Create, update and delete ACF2 Users
  • Enable and disable ACF2 users
  • Connect or disconnect an ACF2 user to a group (based on UID, Role, or Source)
  • Change ACF2 users' passwords and passphrases
  • Aggregation and provisioning of ACF2 user-defined fields

  • TLS support and Mutual TLS

    For more information on implementing TLS 1.2, refer to TLS Communication.

  • Client authentication

    The ACF2 source supports client authentication, which validates every incoming request from the provisioning engine before executing the request. The source requires the client to send the credentials of a registered user with every request for proper authentication.

    For more information, refer to Security Configurations for Mainframe Integration Components.

  • Customizable account aggregation managed by the ACF2 application.

    For more information, refer to Support for Account Aggregation Filter.

  • Support for the prefix value to be passed in the plan. For more information, refer to Support for Prefix Value.

  • Support for the following ACF2 features:
    • Access requests and remediation of X-ROL and X-SGP Entities for ACF2
    • Entitlement aggregation includes roles (X-ROL) by default
    • Aggregation of sources (X-SGP)
      • Request a new role for an account while removing an existing source from an account
      • Request a new source for an account while removing an existing source from an account (if configured)

Password Management

You can define and configure the password policy for the Mainframe source you created. For more information, refer to Managing Password Policies.

Important

After making a change on the source, be aware of the following:

  • The Password Policy defined in SailPoint applies to the accounts in the source.
  • If you change the password for the source connected to this connector, the change will automatically be made to the source itself.

Supported Managed Systems

The ACF2 connector provides support for the following versions of IBM z/OS:

  • z/OS 3.2
  • z/OS 3.1
  • z/OS 2.5
  • z/OS 2.4

The ACF2 agent must also be installed on the platform z890 / z990 processor at driver level 55 or above in order to support the ASN-and-LX-reuse facility.

Note

The ACF2 connector supports ACF2 release version R16.

Prerequisites

Required Permissions

The ACF2 service account must have ACCOUNT + SECURITY rights.

Note

The service account is the user account which is used to authenticate with the Mainframe System. This is done through the Mainframe Connector and it is referenced as the Username attribute on the ACF2 source.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.