Skip to content

Integrating SailPoint with RACF LDAP

The RACF LDAP Mainframe connector mainly uses LDAP interfaces to communicate with z/OS LDAP server. The RACF LDAP Mainframe connector supports capability to read and provision RACF LDAP users and entitlements.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The connector for RACF LDAP Mainframe supports the following features:

Note

Before you can use any of the following items marked with an asterisk (*), SailPoint must activate the feature for your site.

  • Load accounts from RACF LDAP
  • *Provision RACF LDAP accounts
  • *Access certifications (certification of entitlements connected to accounts)
  • *Password management

For more information on features, refer to Source Features.

Account Management

  • Manage RACF LDAP users as accounts
  • Aggregate and refresh accounts
  • Create, update, or delete accounts
  • Enable and disable accounts
  • Change account passwords
  • Add or remove entitlements

Group Management

  • Group aggregation

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

  • The password policy defined in SailPoint applies to accounts on this source.
  • If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Note

The racfPassword and racfPassPhrase attributes are supported for password change operations on RACF managed system. If the length of a password is eight characters or fewer then the connector uses the racfPassword password attribute. If the length of a password provided is greater than eight characters then the connector uses the racfPassPhrase password attribute.

Supported Versions

The RACF LDAP Mainframe connector supports the following managed systems:

  • IBM Tivoli Directory Server for z/OS 3.2 with SDBM LDAP back end
  • IBM Tivoli Directory Server for z/OS 3.1 with SDBM LDAP back end
  • IBM Tivoli Directory Server for z/OS 2.5 with SDBM LDAP back end
  • IBM Tivoli Directory Server for z/OS 2.4 with SDBM LDAP back end

Prerequisites

Complete the following prerequisites for the directory servers prior to configuring the connector:

  • Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.
  • Create a user account on RACF LDAP with the Required Permissions.

  • Enable the LDAP_COMPAT_FLAGS environment variable by setting it to 1. The SDBM attributes - which are in DN format - are returned in Uppercase format by default. This may result in duplicate entitlement entries in SailPoint.

    To avoid this, enabling the LDAP_COMPAT_FLAGS environment attribute ensures that the SDBM attribute values are returned in mixed-case format.

    The LDAP_COMPAT_FLAGS environment variable value can be configured in LDAP server environment variables file. By default, the file name is /etc/ldap/ds.envvars.

  • Use IBM Security Verify Access

    Note

    IBM Security Verify Access is formerly known as IBM Tivoli Directory Server.

Required Permissions

  • The service account configured for SailPoint must have the correct read/write privileges over the RACF directory information tree to manage the RACF data.
  • The administrator user must have a SPECIAL attribute to manage all RACF entries. To limit the scope of the service account, a group-SPECIAL user can be created for the requirement.
  • The administrator user must have a password.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.