# Integrating SailPoint with Top Secret

Connecting SailPoint to your Top Secret source allows you to configure a Top Secret-managed system. The managed system can aggregate, provision, and monitor Top Secret activities to update SailPoint in real time with user updates and password changes.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Top Secret (TSS) source supports the following features:

- User aggregation, including connections to TSS profiles and groups
- Profiles and group aggregation
- Create, update and delete TSS users
- Enable and disable TSS users
- Connect and disconnect TSS users to a profile or group
- Change a TSS user's password and passphrases
- Client Authentication

  The Top Secret source supports client authentication, which validates every incoming request from the Provisioning Engine before executing that request. To authenticate, the source requires the client to send a registered user's credentials with every request.

  For more information, refer to [Security Configurations for Mainframe Integration Components](<https://documentation.sailpoint.com/connectors/mainframe/top_secret/va/help/configuring_top_secret_for_integration.html#security-configurations-for-mainframe-integration-components>).
- TLS Encryption

  For more information on implementing the support for TLS 1.2, refer to [Enabling TLS Communication](<https://documentation.sailpoint.com/connectors/mainframe/top_secret/va/help/configuring_top_secret_for_integration.html#enabling-tls-communication>).
- Setting the account aggregation scope for the accounts managed by the Top Secret application.

  For more information, refer to [Support for Account Aggregation Filter](<https://documentation.sailpoint.com/connectors/mainframe/top_secret/va/help/configuring_top_secret_for_integration.html#support-for-account-aggregation-filter>).
- Support for the prefix value to be passed in the plan. For more information, refer to [Support for Prefix Value](<https://documentation.sailpoint.com/connectors/mainframe/top_secret/va/help/configuring_top_secret_for_integration.html#support-for-prefix-value>).

### Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

- The password policy defined in SailPoint applies to accounts on this source.
- If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to [Password Management Overview](<https://documentation.sailpoint.com/saas/help/pwd/index.html>).

## Supported Managed Systems

The Top Secret source provides support for the following versions of IBM z/OS:

- z/OS 3.1
- z/OS 2.5
- z/OS 2.4

The Top Secret Connector must also be installed on platform z890 or z990 and the processor should be at driver level 55 or above in order to support the ASN-and-LX-reuse facility.

> [!NOTE]
>
> The Top Secret connector supports Top Secret release version R16.

## Prerequisites

- Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
- Configure the SailPoint Connector for Top Secret Version 4.0.03. Refer to [Mainframe E-Fixes](<https://community.sailpoint.com/knowledge/Release-Notes-for-Mainframe-E-Fixes>).
- Top Secret Version Release - R16 or R15
- Install and configure the SailPoint Connector Gateway. For more information, refer to [Installing and Configuring Connector Gateway](<https://documentation.sailpoint.com/connectors/mainframe/top_secret/va/help/configuring_top_secret_for_integration.html#installing-and-configuring-connector-gateway>).

## Required Permissions

Set operations, activated from SailPoint, are handled in Top Secret under the Managed System Administrator User ID. Therefore, this User ID must be a Control ACID. The Control type depends on the scope of the accounts managed by SailPoint. If all accounts are managed by SailPoint, then it must be Security Control ACID (SCA).

For more information, refer to [Account Attributes](<https://documentation.sailpoint.com/connectors/mainframe/top_secret/va/help/schema.html#default-account-attributes>).