Skip to content

Integrating SailPoint with RACF

Connecting SailPoint to your Resource Access Control Facility (RACF) source allows you to configure the RACF-managed system. The system can aggregate, provision, and monitor RACF activities to update SailPoint in real time with User and password changes.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The RACF source supports the following features:

  • Create, update and delete RACF User Profiles
  • Manage RACF Group Profiles related to RACF User Profiles
  • Change the passwords or passphrases for RACF User Profiles
  • Enable or disable RACF Users
  • Revoke connections instead of removing them. For more information, refer to Revoking Connections.
  • Aggregate and provision RACF custom fields
  • Differentiate between suspended users and locked users if provided an incorrect password or passphrase
  • Support for resource aggregation and provisioning as additional group schema, and requesting permissions for accounts and groups.
  • Management of Multi-Factor Authentication (MFA) attributes. For more information, refer to Support for Multi-Factor Authentication Attribute Management.
  • Connection Attribute management. For more information, refer to Connection Attribute Management.
  • TLS Support. For more information on implementing support for TLS 1.2, refer to TLS Communication.
  • Configure a filter for account aggregation. For more information, refer to Support for Account Aggregation Filter.
  • Group hierarchy for the SUBGROUP attribute of a GROUP object on the RACF managed system
  • Support for the prefix value to be passed in the plan. For more information, refer to Support for Prefix Value.

The details of supported features are:

Features Users
Create ✔
Aggregate ✔
Password Management ✔
Group Entitlements (Read, Request, Revoke) ✔ Groups

Group Entitlements

Group Entitlements are entitlement types for which SailPoint provides the ability to aggregate additional details from the managed system. These objects have a separate schema-defining list of attributes. The aggregation task fetches the attributes as additional details when aggregation is run for that Group Entitlement type.

Features Groups
Aggregation ✔
Read Group hierarchy ✔

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

  • The password policy defined in SailPoint applies to accounts on this source.
  • If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Supported Managed Systems

The RACF source provides support for the following versions of IBM z/OS:

  • z/OS 3.2
  • z/OS 3.1
  • z/OS 2.5
  • z/OS 2.4

The RACF connector must also be installed on platform z890 or z990 and the processor should be at driver level 55 or above in order to support the ASN-and-LX-reuse facility.

Prerequisites

The following respective components for z/OS versions must be installed for TLS communication:

z/OS Version Cryptographic Services z/OS Security Level 3
z/OS 3.2 System SSL Base: FMID HCPT520 System SSL Security Level: FMID JCPT521

Required Permissions

The service account configured for SailPoint in the RACF source must have the SPECIAL attribute to provision all RACF entries. To limit the scope of the service account, the group-SPECIAL attribute may be set to the user's connection to the group as needed. Aggregations and SYNC (GET) operations are done under the control of the CTSACS STC user.

Note

Protected users don't need Special or Auditor privileges for account or group aggregation. Protected users may be used only if ALLOW_ADMIN_WITHOUT_PSWD is set to Y in RSSPARM.

To add the SPECIAL attribute to the RACF user (administrator) use the following command:

ALU 'userid' SPECIAL

To add the group-SPECIAL attribute to the RACF user (administrator) for a specific group, use the following command:

CONNECT 'userid' GROUP(<group_name>) SPECIAL

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.