Revoking Connections

By default, the RACF connector automatically removes a user's connection when they are disconnected from a group. You can configure the connector to revoke connections instead of removing them.

1. Use SailPoint REST API to update the source:

   PATCH {apiUrl}/v3/sources/{sourceId}
   [ 
    {
     "op": "add",
      "path": "/connectorAttributes/updateRevokeAttrOnConnection",
     "value": "Y"
     }
   ]
   

2. Add the REVOKED attribute in the splConnectionAttributes:

   PATCH {apiUrl}/v3/sources/{sourceId}
   [
    {
     "op": "add",
      "path": "/connectorAttributes/splConnectionAttributes/REVOKED",
     "value": "true"
    }
   ]
   

If a user initiates a disconnect operation from a group, the connector will now send a command to revoke the connection's attributes instead of completely removing the connection. For user-to-group connections, if the connection is currently in a revoked state, it will be resumed; otherwise, a new connection will be created.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.