# Integrating SailPoint with RACF LDAP

The RACF LDAP Mainframe connector mainly uses LDAP interfaces to communicate with z/OS LDAP server. The RACF LDAP Mainframe connector supports capability to read and provision RACF LDAP users and entitlements.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The connector for RACF LDAP Mainframe supports the following features:

> [!NOTE]
>
> Before you can use any of the following items marked with an asterisk (\*), SailPoint must activate the feature for your site.

- Load accounts from RACF LDAP
- \*Provision RACF LDAP accounts
- \*Access certifications (certification of entitlements connected to accounts)
- \*Password management

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

### Account Management

- Manage RACF LDAP users as accounts
- Aggregate and refresh accounts
- Create, update, or delete accounts
- Enable and disable accounts
- Change account passwords
- Add or remove entitlements

### Group Management

- Group aggregation

### Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

- The password policy defined in SailPoint applies to accounts on this source.
- If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to [Password Management Overview](<https://documentation.sailpoint.com/saas/help/pwd/index.html>).

> [!NOTE]
>
> The **racfPassword** and **racfPassPhrase** attributes are supported for password change operations on RACF managed system. If the length of a password is eight characters or fewer then the connector uses the **racfPassword** password attribute. If the length of a password provided is greater than eight characters then the connector uses the **racfPassPhrase** password attribute.

## Supported Versions

The RACF LDAP Mainframe connector supports the following managed systems:

- IBM Tivoli Directory Server for z/OS 3.2 with SDBM LDAP back end
- IBM Tivoli Directory Server for z/OS 3.1 with SDBM LDAP back end
- IBM Tivoli Directory Server for z/OS 2.5 with SDBM LDAP back end
- IBM Tivoli Directory Server for z/OS 2.4 with SDBM LDAP back end

## Prerequisites

Complete the following prerequisites for the directory servers prior to configuring the connector:

- Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
- Create a user account on RACF LDAP with the [Required Permissions](<#required-permissions>).
- Enable the `LDAP_COMPAT_FLAGS` environment variable by setting it to `1`. The SDBM attributes - which are in DN format - are returned in Uppercase format by default. This may result in duplicate entitlement entries in SailPoint.

  To avoid this, enabling the `LDAP_COMPAT_FLAGS` environment attribute ensures that the SDBM attribute values are returned in mixed-case format.

  The `LDAP_COMPAT_FLAGS` environment variable value can be configured in LDAP server environment variables file. By default, the file name is `/etc/ldap/ds.envvars`.
- Use IBM Security Verify Access

  > **Note**
  >
  > IBM Security Verify Access is formerly known as IBM Tivoli Directory Server.

## Required Permissions

- The service account configured for SailPoint must have the correct read/write privileges over the RACF directory information tree to manage the RACF data.
- The administrator user must have a SPECIAL attribute to manage all RACF entries. To limit the scope of the service account, a **group-SPECIAL** user can be created for the requirement.
- The administrator user must have a password.