# SailPoint Microsoft Active Directory Connector Documentation > Microsoft Active Directory Connector Documentation # Documentation # Active Directory PowerShell Commands You can enable Windows PowerShell to execute commands on your Active Directory system. All standard Active Directory commands are supported on your system. For more information on Active Directory PowerShell commands, refer to [ActiveDirectory Module documentation](). > [!NOTE] > > You can use PowerShell commands to find your configuration information if it's running on a computer connected to the domain. To get your forest and domain information, complete the following: 1. Select the Windows **Start** button, search for **PowerShell**, and then select **Windows PowerShell**. 2. To view your domain information, enter the following command: `Get-ADDomain`, and then press the **Enter** key. 3. To view your forest information, enter the following command: `Get-ADForest`, and then press the **Enter** key. ## Active Directory Module for Windows PowerShell To get the closest Domain Controller for a particular domain, the Active Directory source calls IQService. As a prerequisite, the Active Directory module for Windows PowerShell on the IQService machine must be installed and the Active Directory DS role must be installed on a machine. To enable the Active Directory module for Windows PowerShell, complete the following: 1. Go to **Server manager \> Features \> Remote Server Administration Tools \> AD DS & LDS tools** and select **Active Directory module for Windows PowerShell**. To enable the Active Directory module for Windows PowerShell using PowerShell commands, complete the following: 1. Select the Windows **Start** button, search for **PowerShell**, and then select **Windows PowerShell**. 2. In the PowerShell console window, use the `Install-WindowsFeature` cmdlet to install the module. Specify the feature name (`RSAT-AD-PowerShell`) and add the `-IncludeAllSubFeature` parameter to add any child features. For example: ```text Install-WindowsFeature -Name RSAT-AD-PowerShell -IncludeAllSubFeature ``` # Configuring Advanced Microsoft Active Directory Parameters Configure advanced connector behavior using cache settings and source configuration parameters. ## Group Managed Service Accounts (gMSA) Cache Settings The connector caches gMSA account passwords for service accounts to optimize the password retrieval during operations like bulk provisioning. These settings are configurable in the connector and allow administrators to optimize password retrieval and caching behavior for gMSA accounts. The TTL value is validated in code, so only positive integers are accepted; invalid values are ignored and the connector uses the default setting. ### `gMSAPasswordCacheEnabled` - **Type**: Boolean (true/false) - **Default**: `true` - **Description**: Enables or disables caching of gMSA (group Managed Service Account) passwords. When set to `true`, the connector caches retrieved gMSA passwords to improve performance and reduce repeated calls to IQService. By default, caching is enabled. ### `gMSAPasswordCacheTTLMinutes` - **Type**: Integer - **Default**: `15` - **Description**: Specifies the time-to-live (TTL) for cached gMSA passwords in minutes. - **Allowed Values**: Any positive integer (\> 0). If set to a value less than or equal to zero, the default of 15 minutes is used. - **For example**: Setting this to `10` caches passwords for 10 minutes. ## Additional Configuration Parameters This section contains information on additional parameters you can configure to modify connector behavior that are not available in the UI. Configure these parameters in the source configuration using the SailPoint REST API. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. This page contains the following sections: - Additional Configuration Parameters - Additional binary/SID/GUID Attributes - Caching Ports ### Configuring Parameters The following attributes can be added in the source configuration using the REST API: #### `rollbackCreatedAccountOnError` To roll back a created account when one or more requested attributes for that account fail during provisioning operations, set this attribute to `true` as follows: ```json [ { "op": "add", "path": "/connectorAttributes/rollbackCreatedAccountOnError", "value": true } ] ``` #### `gmsaMsDSSupportedEncryptionTypesInNumeric` By default, the `msDS-SupportedEncryptionTypes` attribute for gMSA accounts is returned as a text representation (for example, `AES128,AES256`). This can cause mismatches during provisioning verification, as the provisioned value is typically numeric (for example, `24`). When `gmsaMsDSSupportedEncryptionTypesInNumeric` is set to `true` in the source configuration using the REST API, the connector returns the attribute in its numeric format, matching the behavior of regular service accounts: ```json [ { "op": "add", "path": "/connectorAttributes/gmsaMsDSSupportedEncryptionTypesInNumeric", "value": true } ] ``` #### `reportPostScriptFailuresAsWarnings` When set to `true`, native postscript errors are returned as warnings instead of errors for all update operations. The value for `reportPostScriptFailuresAsWarnings` must be passed as a string. This ensures that attributes are successfully provisioned to Active Directory and reflect in SailPoint. ```json [ { "op": "add", "path": "/connectorAttributes/reportPostScriptFailuresAsWarnings", "value": "true" } ] ``` #### `unlockOnChangePassword` The default behavior of unlocking the account on change password can be turned off by setting the `unlockOnChangePassword` attribute to `false`. The value for `unlockOnChangePassword` must be passed as a string. Default: `true`. ```json [ { "op": "add", "path": "/connectorAttributes/unlockOnChangePassword", "value": "true" } ] ``` #### `setAttributeLevelResult` Set it to `true` to enable attribute request level results. The value for `setAttributeLevelResult` must be passed as a string. Default: `false`. Enabling this parameter marginally increases the time taken to process the request. ```json [ { "op": "add", "path": "/connectorAttributes/setAttributeLevelResult", "value": "true" } ] ``` #### `aggregationMaxRetries` Count of maximum retry attempts for Active Directory aggregation in case of failures with retry-able errors. The value for `aggregationMaxRetries` must be passed as a string. Default: `5`. ```json [ { "op": "add", "path": "/connectorAttributes/aggregationMaxRetries", "value": "5" } ] ``` #### `aggregationRetryThreshold` Delay in seconds between each retry attempt of aggregation. The value for `aggregationRetryThreshold` must be passed as a string. Default: `10` seconds. ```json [ { "op": "add", "path": "/connectorAttributes/aggregationRetryThreshold", "value": "10" } ] ``` #### `manageLync` Microsoft Lync/Skype for Business Server to be managed by the connector. Add the `manageLync` attribute in the source configuration using the REST API: ```json [ { "op": "add", "path": "/connectorAttributes/manageLync", "value": true } ] ``` #### `authSearchAttributes` List of attributes used to search for a user during Pass Through Authentication. Configure the `authSearchAttributes` attribute in the source configuration using the REST API: ```json [ { "op": "add", "path": "/connectorAttributes/authSearchAttributes", "value": ["sAMAccountName", "msDS-PrincipalName", "mail"] } ] ``` #### `memoryStoreSizeInElements` Defines the number of cache elements to store in memory (RAM). The value for `memoryStoreSizeInElements` must be passed as a string. To store all elements in memory and nothing on disk, specify the value as `-2`: ```json [ { "op": "add", "path": "/connectorAttributes/memoryStoreSizeInElements", "value": "-2" } ] ``` #### `disableComputePreloading` Default: `false` To disable auto detection of group membership pre-loading for forests, set the value to `true`. The value for `disableComputePreloading` must be passed as a boolean: ```json [ { "op": "add", "path": "/connectorAttributes/disableComputePreloading", "value": true } ] ``` #### `useSingleThreadedCookieSearch` During full aggregation, dirsync cookies are fetched per domain using concurrent threads. To fetch cookies sequentially on a single thread, set the value to `true`. The value for `useSingleThreadedCookieSearch` must be passed as a boolean: ```json [ { "op": "add", "path": "/connectorAttributes/useSingleThreadedCookieSearch", "value": true } ] ``` #### `displayAttributeForContacts` `CN` is used as the default display name for contact objects in SailPoint. To use another schema attribute, define the attribute name as the value of this parameter: ```json [ { "op": "add", "path": "/connectorAttributes/displayAttributeForContacts", "value": "firstName" } ] ``` #### `disableFspAggregation` Default: `false` To disable aggregating foreign memberships of any user, set the value to `true`. The value for `disableFspAggregation` must be passed as a boolean: ```json [ { "op": "add", "path": "/connectorAttributes/disableFspAggregation", "value": true } ] ``` #### Turning Chase Referrals Off The LDAP extended control notifies the Active Directory Directory Services (AD DS) managed system not to generate any additional references (crossRef objects) in response to a search query. With this control in a search request, the search operation is limited to the domain scope. You must validate if it is required to fetch any information from multiple domains. Adding configuration details to the required domain(s) in the source definition is mandatory. Active Directory search does not depend on referrals to fetch information from the managed system. To aggregate the complete data, the Domain Setting configuration in Active Directory sources must be updated with required information. To turn chase referrals off, complete the following: 1. Add the attribute `ldapExtendedControls` using the SailPoint REST API. > **Note** > > This attribute is generated with the LDAP extended control: 'LDAP\_SERVER\_DOMAIN\_SCOPE\_OID' (value = 1.2.840.113556.1.4.1339). Newly created Active Directory sources have this control by default, previous sources do not have any impact and continue to work as expected. ##### `ldapExtendedControls` For an Active Directory managed system not to generate further references (crossRef objects) in response to the search query, add the following entry in the source configuration using the REST API: ```json [ { "op": "add", "path": "/connectorAttributes/ldapExtendedControls", "value": ["1.2.840.113556.1.4.1339"] } ] ``` Active Directory connector search does not rely on referrals to fetch information from the managed system. To aggregate comprehensive data, Domain Settings configuration must be up to date with required information. #### `skipDeletedObjScopeCheckInDelta` Default: `false` If set to `true` during account delta aggregation, the connector does not call Active Directory to check whether the deleted object was in scope of the source. The value for `skipDeletedObjScopeCheckInDelta` must be passed as a string. ```json [ { "op": "add", "path": "/connectorAttributes/skipDeletedObjScopeCheckInDelta", "value": "true" } ] ``` If the deleted object is present in the SailPoint database, it is deleted from the database. If the deleted object is not in the SailPoint database, no further action is performed. #### `skipObjTypeCheckForMembersInDelta` Default: `false` If set to `true` during account delta aggregation, the connector does not call Active Directory to check if the objectType of a member is added or removed from a group. The value for `skipObjTypeCheckForMembersInDelta` must be passed as a string: ```json [ { "op": "add", "path": "/connectorAttributes/skipObjTypeCheckForMembersInDelta", "value": "true" } ] ``` If the object is present in the SailPoint database, membership is updated. #### `skipBindUsingDNS` Default: `false` If set to `true`, the DNS server is not used to find the Domain Controller for any given domain in serverless configuration. The value for `skipBindUsingDNS` must be passed as a string: ```json [ { "op": "add", "path": "/connectorAttributes/skipBindUsingDNS", "value": "true" } ] ``` The connector always calls IQService to find the domain controller. #### `skipGetObjInMembershipDelta` Default: `false` If set to `true`, the connector does not call Active Directory to get additional attributes of the changed object intercepted during delta aggregation: ```json [ { "op": "add", "path": "/connectorAttributes/skipGetObjInMembershipDelta", "value": "true" } ] ``` The connector fetches these additional attributes if the user has entitlement changes along with attribute changes, or if the user has add, remove, or both entitlement changes. When `skipGetObjInMembershipDelta` is set to `true`, the resource object sent to SailPoint contains only the attributes intercepted during delta aggregation. #### `searchInContainers` Default: `false` By default, pass-through authentication (PTA) searches for users in the entire domain defined (when multiple searchDNs are configured), which can delay PTA. To limit PTA to configured search DNs only, set the following entry to `true` in the source configuration using the REST API (applies to pass-through authentication only). The value for `searchInContainers` must be passed as a boolean: ```json [ { "op": "add", "path": "/connectorAttributes/searchInContainers", "value": true } ] ``` #### `disableLDAPHostnameVerification` To disable hostname verification during LDAP communication over TLS, configure the following attribute in the source configuration using the REST API. The value for `disableLDAPHostnameVerification` must be passed as a boolean: ```json [ { "op": "add", "path": "/connectorAttributes/disableLDAPHostnameVerification", "value": true } ] ``` #### `skipIterateSearchFilterInPTA` Default: `false` If set to `true`, the connector does not consider the iterate search filter configured for a single search DN to authenticate the user in pass-through authentication (PTA). The value for `skipIterateSearchFilterInPTA` must be passed as a boolean: ```json [ { "op": "add", "path": "/connectorAttributes/skipIterateSearchFilterInPTA", "value": true } ] ``` If the `searchInContainers` flag is set to `true`, it takes precedence over `skipIterateSearchFilterInPTA`. #### `buildPartialROOnAuthentication` Default: `false` By default, when `buildPartialROOnAuthentication` is set to `false`, the connector builds a full resource object, which can take time and cause login delay. When `buildPartialROOnAuthentication` is set to `true` in the source configuration using the REST API, the connector builds a partial resource object and sets identity, display, and other attributes used in correlation such as `samAccountName`, improving login performance. The value for `buildPartialROOnAuthentication` must be passed as a boolean: ```json [ { "op": "add", "path": "/connectorAttributes/buildPartialROOnAuthentication", "value": true } ] ``` #### `domainIterateSearchFilter` (Applicable only for User Delta Aggregation) Define this attribute in domain settings to override the iterate filter defined in Search Scope for Users. #### `disableContainerFilterForDelta` (Applicable only for Delta Aggregation) This attribute skips the iterate search filter when set to `true` while performing DirSync delta aggregation. ### Additional binary/SID/GUID Attributes To display additional binary/SID/GUID attributes, use the following entries: #### `attrsDisplayInBinaryFormat` To display attribute values in binary format, which is also the default display format: ```json [ { "op": "add", "path": "/connectorAttributes/attrsDisplayInBinaryFormat", "value": ["Attribute name1", "Attribute name2"] } ] ``` #### `attrsDisplayInSIDFormat` To display attribute values in SID format: ```json [ { "op": "add", "path": "/connectorAttributes/attrsDisplayInSIDFormat", "value": ["Attribute name1", "Attribute name2"] } ] ``` #### `attrsDisplayInGUIDFormat` To display attribute values in GUID format: ```json [ { "op": "add", "path": "/connectorAttributes/attrsDisplayInGUIDFormat", "value": ["Attribute name1", "Attribute name2"] } ] ``` ### Caching Ports Port numbers for the caching mechanism to replicate cached data across different task servers. > [!NOTE] > > SailPoint recommends that the ports are open and not in use by another application. #### `enableCache` To enable cache, set the value to `true`: ```json [ { "op": "add", "path": "/connectorAttributes/enableCache", "value": true } ] ``` #### `cacheRmiPort` The default value is `40001`. #### `cacheRemoteObjectPort` The default value is `40002`. #### `cacheReplicationTimeout` Maximum time in minutes to wait for membership cache replication on task server. Default: `10` minutes ```json [ { "op": "add", "path": "/connectorAttributes/cacheReplicationTimeout", "value": 20 } ] ``` #### `cacheSocketTimeoutMillis` Maximum time in milliseconds to wait for client sockets to send messages to a remote listener. Default: `2000` milliseconds. ```json [ { "op": "add", "path": "/connectorAttributes/cacheSocketTimeoutMillis", "value": 5000 } ] ``` # Configuring Additional Microsoft Active Directory Settings Configure optional aggregation, authentication, provisioning, and Microsoft workload settings for the source. ## Aggregation and Aggregation Partitioning Settings In the **Additional Settings** \> **Aggregation Settings** section, you can configure the aggregation settings. > [!NOTE] > > **Screenshot** > > [![Aggregation Settings]()]() To configure aggregation settings, complete the following: 1. (Optional) Select the **Delta Aggregation** checkbox to aggregate delta changes in the following: - Create linked mailbox and update linked mailbox properties. - Mail enabled distribution list membership changes for the shadow account. For more information on testing delta aggregation, refer to [Delta Aggregation](<#delta-aggregation>). 2. (Optional) Select the **Disable Foreign Security Principal Aggregation** checkbox to disable aggregating foreign memberships of any user. > **Note** > > This is applicable for multi-forest source configurations. 3. (Optional) Select the **Aggregate Cross-Domain Group Hierarchy** checkbox to retrieve cross-domain group memberships for group objects during entitlement aggregation. 4. (Optional) Select the **Disable Sort** checkbox to disable sorting of the aggregation results. 5. (Optional) Select the **Preload Entitlements** checkbox to load entitlements before aggregation. 6. (Optional) Enter the **Page Size** to control the number of results that display on a single page. The default is `1000`. 7. Select **Save**. ### Aggregation Partitioning In the **Additional Settings** \> **Partitioning Settings** section, you can configure the partitioning account aggregation settings. Partitioning aggregation processes the data in parallel, across multiple threads to help increase the performance of aggregation tasks. > [!NOTE] > > **Screenshot** > > [![Aggregation Partitioning]()]() 1. Select **Enable Partitioning** if you want to process data in parallel across multiple threads. 2. Enter the **Number of Partitioning Threads** the connector uses to concurrently execute the aggregation partitions. By default, it is set to 2 partitioning threads. If the VA is configured for multiple CPU cores, you can configure a higher number of partition threads to increase the performance. > **Note** > > The **Number of Partitioning Threads** should equal the number of CPU cores on the VA multiplied by 2. 3. Select **Enable Auto Partitioning** to automatically define partitions for account aggregation. 4. From the **Number of Partitions** dropdown, select the number of partitions. This helps improve the performance of auto partitioning and can be tuned by selecting the appropriate partition count. For higher user populations, a higher partition count is preferred. 5. Select **Save**. ## Delta Aggregation > [!NOTE] > > This includes changes such as when a user or group has been added, updated, or deleted on the managed system. This version supports aggregation of delta changes for the Move and Rename operations. In SailPoint, the Active Directory source uses the distinguishedName as the Account ID (unique identifier). As such, moving users in Active Directory looks like a delete and add of separate accounts. In addition, SailPoint cannot simply update the distinguishedName since it is an Active Directory identifier. For more information, refer to [Identity Attributes Account ID](). By default, Active Directory supports the DirSync mode of delta aggregation which is based on the DirSync feature of Active Directory. ### Testing Delta Aggregation For delta aggregation to work properly, a start point is required from where the system detects changes. To retrieve changes from the last iteration, a full aggregation must be performed first during which the reference point is maintained. Once the full aggregation completes, select the **Delta Aggregation** checkbox in the user interface to create a separate delta aggregation task to retrieve delta changes that occurred post the full aggregation. For more information, refer to [Aggregation and Aggregation Partitioning Settings](<#aggregation-and-aggregation-partitioning-settings>). Perform the following steps to test delta aggregation: 1. Execute the Account and Account - Group Aggregation task. 2. Select the **Delta Aggregation** checkbox from the Active Directory source configuration page. Create a task with the delta aggregation flag set for Account Aggregation. 3. Perform Create/Update/Delete/Revoke operations for Accounts/Groups on the directory server. 4. Execute the account aggregation task again to bring delta changes, which will now be executed in delta mode. 5. Confirm the changes have been retrieved into SailPoint. ## Pass Through Authentication (PTA) Settings In the **Additional Settings** \> **Pass Through Authentication Settings** section, you can configure the PTA settings. > [!NOTE] > > **Screenshot** > > [![Pass Through Authentication Settings]()]() To configure additional settings to customize the PTA operation, complete the following: 1. (Optional) Select the **Partial Resource Object** checkbox to build user objects with a limited set of attributes for Active Directory users who are getting authenticated using pass through authentication. This can improve performance on pass through authentication. For the Active Directory source, the pass through authentication sets up all the available attributes instead of setting the identity attribute and display attribute only, while building the partial resource object. 2. (Optional) Enter **Authentication Attributes** to specify attributes that are used during resource object authentication. To add multiple entries, specify an attribute and then press the **Enter** key. 3. Select **Save**. ## Provisioning Settings In the **Additional Settings** \> **Provisioning Settings** section, you can configure the provisioning settings. > [!NOTE] > > **Screenshot** > > [![Provisioning Settings]()]() To configure additional settings to customize the provisioning connector operation, complete the following: 1. (Optional) Select the **Rollback Partially Created Account** checkbox to rollback a created account in case one or more required attributes for that account fails during provisioning. 2. (Optional) Enter the **Native Rules** to configure before or after scripts to be run during provisioning. To add multiple entries, specify a rule and then press the **Enter** key. 3. Select **Save**. ## Password Policy, Shared Mailbox Management, and Skype for Business Settings In the **Additional Settings** \> **Additional Settings** section, you can configure password policy, shared mailbox management, and Skype for Business settings. > [!NOTE] > > **Screenshot** > > [![Additional Settings]()]() To configure additional settings to customize behavior, complete the following: 1. (Optional) Select the **Enforce Password Policy** checkbox to enable Active Directory to enforce its password policy. After enabling password management on the source, be aware of the following: - The password policy defined in SailPoint applies to accounts on this source. - If you change the password for apps connected to this source, the change will automatically be made to the source itself. - Ensure that the **IQService Host** and **IQService Port** fields are configured on the [IQService Settings]() page. > **Note** > > The Active Directory source will not respect the **Enforce Password Policy** when the Admin password reset feature is used. 2. (Optional) Select the **Shared Mailbox Management** checkbox to enable shared mailboxes. Shared mailboxes are a special type of mailbox where multiple users can read and send email from a common email address. A shared mailbox is a type of user mailbox that does not have its own username and password. As a result, users cannot log into them directly. To access a shared mailbox, users must first be granted **Send As** or **Full Access** permissions to the mailbox after which, user signs into their own mailboxes and then can access the shared mailbox by adding it to their Outlook profile. 3. (Optional) Select the **Manage Skype for Business** checkbox to enable management of Skype for Business. 4. Select **Save**. # Serverless Configuration for Active Directory The Active Directory connector supports serverless configuration, enabling dynamic discovery using IQService. > [!IMPORTANT] > > Configuring IQService is mandatory when using serverless configuration to perform aggregation operations. To configure the Active Directory source in serverless mode, update the field values on the Forest Settings and Domain Settings as described below: ## Forest Configuration 1. Go to **Settings \> Forest Settings**. 2. Enter the **Forest Name** and keep all other fields blank including **Global Catalog Server**. For more information, refer to [Forest Settings](). ## Domain Configuration 1. Go to **Settings \> Domain Settings**. 2. Enter the **Forest Name** you want to configure for this domain. 3. In the **Servers** field, clear and remove all listed server hostnames or IP addresses. 4. Ensure the following mandatory attribute remains populated: - Domain DN - Service Account - Password For more information, refer to [Domain Settings](). # Connecting SailPoint and Microsoft Active Directory To connect SailPoint with Microsoft Active Directory, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 8. Under **Connection Type**, select **Direct Connection** or **Flat File**. - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable. 9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source. 10. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Forest Settings](<#forest-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Select **Save**. ## Forest Settings An Active Directory forest is a set of all the directory partitions in a particular Active Directory instance that includes all domain, configuration, schema, and optional application information. Multiple forests can share the Active Directory responsibilities across an enterprise. To support a multi-forest configuration for the Active Directory source, configure multiple forests. You can find the details of your existing configuration by using PowerShell commands. For more information, refer to [Active Directory PowerShell Commands](). > [!NOTE] > > **Screenshot** > > [![Forest Settings]()]() To configure forest settings, complete the following: 1. Enter the **Forest Name** you want to set for a new forest to use in an organization. For example, `corp.exampleorg.com`. 2. (Optional) Enter the **Global Catalog Server** information using the following format: `IP address or FQDN:Port Number`. > **Note** > > The Active Directory connector validates the configuration of global catalog during the test connection and health check operations. 3. (Optional) Select **Use gMSA as a Service Account** to use group Managed Service Account (gMSA) as a Service Account and provide the Service Account in UPN format. For more information, refer to [Group Managed Service Accounts (gMSA) Cache Settings](). > **Note** > > Ensure you select **Strong (SASL)** as the **Authentication Type**. IQService configuration is also mandatory to use gMSA as a Service Account. For more information, refer to [Configuring IQService to use gMSA as a service account for Active Directory](). 4. (Optional) Enter the **Service Account User** with the required permissions using the following format: `Domain Name\User Name`. 5. (Not required when **Use gMSA as a Service Account** is selected) Enter the **Password** for the service account. 6. (Optional) Select the **Authentication Type** from the drop-down menu. - **Simple** - The account to authenticate is identified by the DN of the entry for that account, and the proof identity comes in the form of a password. SailPoint recommends that you **Use Transport Layer Security (TLS)** with simple authentication as this encrypts data during transit. - **Strong (SASL)** - Strong (SASL) authentication bind is performed, which uses kerberos or NTLM depending upon whether the SailPoint system is in a network (of service account domain) or outside network. Strong (SASL) has implicit security layer for data encryption. For Strong (SASL) authentication to work, you must use the following format: `UserName@DNSDomainName.com`. For more information, refer to [Strong (SASL) Authentication Requirements](). 7. (Not required when **Use gMSA as a Service Account** is selected) By default, the **Use Transport Layer Security (TLS)** checkbox is selected. When selected, you must also specify the TLS port in the **Global Catalog Server** field. For more information on TLS communication, refer to [Securing the Active Directory Application](). 8. (Optional) Select the **Resource Forest** checkbox if this is a dedicated resource forest to manage Microsoft Exchange resources. For more information, refer to [Active Directory Resource Forest Topology Exchange Management](). 9. (Optional) To create another forest, select **Add Another** + **Add Forest Configuration** and repeat the previous steps. To delete the Forest configuration that is not required, use the bin icon. 10. Select **Save**. ## Domain Settings This page displays the list of forests that you have configured and enables you to configure domains. > [!NOTE] > > **Screenshot** > > [![Domain Settings]()]() > [!IMPORTANT] > > To manage users, groups and their memberships across different domains, ensure there is a two-way trust between those domains. Also, ensure that IQService Service Account has the necessary permissions to access them. To create and set up a new domain, complete the following: 1. Select the **Forest Name** you want to configure for this domain from the drop-down menu. 2. Enter the **Domain DN**. 3. (Optional) Select **Use gMSA as a Service Account** to use group Managed Service Account (gMSA) as a Service Account and provide the Service Account in UPN format. > **Note** > > Ensure you select **Strong (SASL)** as the **Authentication Type**. IQService configuration is also mandatory to use gMSA as a service account. For more information, refer to [Configuring IQService to use gMSA as a service account for Active Directory](). 4. Enter the **Service Account** with the required permissions. - When you are using Simple authentication, use: `Domain Name\User Name`. - When you are using Strong (SASL) authentication, use: `UserName@DNSDomainName.com` 5. (Not required when **Use gMSA as a Service Account** is selected) Enter the **Service Account Password**. 6. (Optional) Enter the **Servers** information for the domain controller servers that you want to configure using the following format: `IP Address or FQDN`. To configure multiple servers, enter a server and then press the **Enter** key. If you have configured two or more servers and the connection to the first server fails, the source attempts to bind to the next domain controller server in the list. > **Note** > > If you do not provide the IP or FQDN information, it is a server-less bind that requires the correct DNS configuration. 7. (Optional) Enter the **Port** number. 8. Select the **Authentication Type** from the drop-down menu. - **Simple** - The account to authenticate is identified by the DN of the entry for that account, and the proof identity comes in the form of a password. SailPoint recommends that you **Use Transport Layer Security (TLS)** with simple authentication as this encrypts data during transit. - **Strong (SASL)** - Strong (SASL) authentication bind is performed, which uses kerberos or NTLM depending upon whether the SailPoint system is in a network (of service account domain) or outside network. Strong (SASL) has implicit security layer for data encryption. For Strong (SASL) authentication to work, you must use the following format: `UserName@DNSDomainName.com`. For more information, refer to [Strong (SASL) Authentication Requirements](). 9. (Not required when **Use gMSA as a Service Account** is selected) By default, the **Use Transport Layer Security (TLS)** checkbox is selected. When selected, you must specify the TLS port in the **Port** field. A valid SSL certificate must be placed on the virtual appliances in the following path: `/home/sailpoint/certificates/ad-resource.cer`. For more information, refer to [TLS Configuration on Virtual Appliances](). 10. (Optional) To configure another domain, select **Add Another** + **Add Domain Configuration** and repeat the previous steps. To delete the Domain configuration that is not required, use the bin icon. 11. Select **Save**. ## Account and Group Settings This page enables you to configure account, user, contact, managed service account, and group search options. The search DNs define the list of distinguished names of the containers along with other relevant attributes the define the scope for this connector. The search scope defines how far down in the tree to search from the base DN. > [!NOTE] > > DN/OU paths are case-sensitive. > [!IMPORTANT] > > Connector-level partitioning for aggregation is supported for accounts only and does not apply to other object types. If auto partitioning is not enabled, each of these search DNs is also considered as a partition for partitioned full aggregation. Users, Contacts, Managed Service Accounts, and Groups can have different sets of searchDNs to define different scope for each of them. In cases where the scope is not defined for Groups, it follows the Account's Search Scope. Defining one search DN to the minimum is required to successfully configure the connector. ### User Search Scope If the **Group Membership Search DN** attribute is not defined then the connector brings all the group memberships associated with the respective account, which are returned by APIs instead of falling back to the scope defined by **Search DN**. > [!NOTE] > > **Screenshot** > > [![User Search Scope]()]() To configure the user's search, complete the following: 1. In the **Search DN** field, enter the distinguished name of the domain or OU that defines the scope for users. 2. (Optional) Specify an **Iterate LDAP Search Filter** string to limit the results returned by the search DN. For more information on the search syntax, refer to the Microsoft Active Directory: LDAP Syntax Filters wiki. 3. (Optional) Specify **Group Membership Search DN** to determine the group membership of the users that you are loading. Separate multiple entries with a semicolon. 4. (Optional) Specify a **Group Membership Search Filter** as an LDAP search filter string that applies while fetching the user's group membership. 5. (Optional) Select **Add Another** + **Add User Search Scope** to create another search filter or select **Delete** to remove a search filter. 6. Once you have configured all the search scopes, select **Save**. ### Contact Search Scope > [!NOTE] > > **Screenshot** > > [![Contact Search Scope]()]() To configure the contact's search, complete the following: 1. (Optional) In the **Search DN** field, enter the distinguished name of the domain or OU that defines the scope for contacts. 2. (Optional) Specify an **Iterate LDAP Search Filter** string to limit the results returned by the search DN. For more information on the search syntax, refer to the Microsoft Active Directory: LDAP Syntax Filters wiki. 3. (Optional) Specify **Group Membership Search DN** to determine the group membership of the contacts that you are loading. Separate multiple entries with a semicolon. 4. (Optional) Select **Add Another** + **Add Contact Search Scope** to create another search filter or select **Delete** to remove a search filter. 5. Once you have configured all the search scopes, select **Save**. ### Managed Service Account Search Scope > [!NOTE] > > **Screenshot** > > [![Managed Service Account Search Scope]()]() To configure the managed service account's search, complete the following: 1. (Optional) In the **Search DN** field, enter the distinguished name of the domain or OU that defines the scope for the managed service account. 2. (Optional) Specify an **Iterate LDAP Search Filter** string to limit the results returned by the search DN. For more information on the search syntax, refer to the Microsoft Active Directory: LDAP Syntax Filters wiki. 3. (Optional) Specify **Group Membership Search DN** to determine the group membership of the managed service accounts that you are loading. Separate multiple entries with a semicolon. 4. (Optional) Select **Add Another** + **Add Managed Service Account Search Scope** to create another search filter or select **Delete** to remove a search filter. 5. Once you have configured all the search scopes, select **Save**. ### Group Search Scope > [!NOTE] > > If you don't define the search scope for Groups, the connector uses the same search scope it uses for Accounts. > [!NOTE] > > **Screenshot** > > [![Group Search Scope]()]() To configure the group's search, complete the following: 1. (Optional) In the **Search DN** field, enter the distinguished name of a container for a group to define the search scope of groups. 2. (Optional) Specify an **Iterate LDAP Search Filter** string to limit the results returned by the search DN. 3. (Optional) Select **Add Another** + **Add Group Search Scope** to create another search filter or select **Delete** to remove a search filter. 4. Once you have configured all the search scopes, select **Save**. ## IQService Settings Install IQService to support execution of provisioning operations and native rules. IQService is required by the Active Directory connector for all provisioning, and for reading certain fields from a user's entry, including Terminal Services and Lync attributes. For more information, refer to [IQService Settings](). ## Exchange Settings Use this page to configure the exchange server. > [!NOTE] > > **Screenshot** > > [![Exchange Settings]()]() To configure the exchange settings, complete the following: 1. (Optional) Select the **Exchange Forest** where the exchange servers are installed from the drop-down menu. > **Important** > > If you select an exchange forest, the **Exchange Host**, **Service Account**, **Password**, and **Account Forest** fields are mandatory. 2. (Optional) In the **Exchange Host** field, enter the exchange host name or IP address of the system where IQService is installed. 3. (Optional) Enter the **Service Account** user with the required permissions using the following format: `Domain Name\User Name`. 4. (Optional) Enter the **Service Account Password**. 5. (Optional) In the **Account Forest** field, enter the name of the account's or user's forests served by this exchange server. 6. (Optional) By default, the **Use Transport Layer Security (TLS)** checkbox is selected. 7. (Optional) To configure another exchange server, select **Add Another** + **Add Exchange Configuration** and repeat the previous steps. 8. Select **Save**. > [!NOTE] > > If your user belongs to a particular domain, ensure to mention that forest name in the `accountForestList`. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Connecting to Microsoft Active Directory Configure the connection between SailPoint and Microsoft Active Directory, then configure optional settings for your environment. - [Connecting SailPoint and Microsoft Active Directory]() - Configure the base, forest, domain, account, group, IQService, and Exchange settings. - [Serverless Configuration for Active Directory]() - Configure dynamic discovery using IQService. - [Configuring Additional Microsoft Active Directory Settings]() - Configure aggregation, authentication, provisioning, and Microsoft workload settings. - [Configuring Advanced Microsoft Active Directory Parameters]() - Configure cache settings and source configuration parameters. # Integrating SailPoint with Microsoft Active Directory This document is designed to give specific information about the requirements and field definitions needed to get a working instance of an Active Directory connector in SailPoint. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. The SailPoint Active Directory connector offers complete management of your Active Directory infrastructure, which can be distributed across multiple domains/multiple forests. You can manage users, contacts, groups, Exchange mailbox, mail users, mail contacts, and Skype users from a single source. For more information on what you can do with the Active Directory connector, refer to [Supported Features](<#supported-features>). ## Architecture > [!NOTE] > > **Screenshot** > > [![Architecture]()]() There are three main architecture components: - SailPoint - Virtual Appliance Cluster (virtual appliances are in the customer's-controlled environment and updated by SailPoint) with Cloud Connector Gateway (CCG) - Customer Environment > [!NOTE] > > SailPoint recommends reviewing the Virtual Appliance and Cloud Connector Gateway documentation before starting the configuration of your connector. SailPoint has the UI and the REST API interface. This interface has the following internal services: - SSO - Access Review - Password - Provisioning - Task Processing Engine (performs aggregation, refresh, synchronization operations, and serves multiple tenants) ## Supported Features > [!NOTE] > > Before you can use any item above marked with an asterisk (\*), SailPoint must activate the feature for your site. The connector supports the following features: - Load and \*Provision - Active Directory Accounts - Exchange Mailboxes - Skype for Business Accounts - Active Directory Contacts - Manages Active Directory Contacts as Accounts - Aggregation, Refresh Account, and Delta Aggregation of Contacts > **Note** > > The Entitlement aggregation only fetches child entitlements that are associated with the same domain. - Create/ Delete Contacts - Add or Remove Entitlements - Create Exchange Mail Contact - Active Directory Service Accounts (Managed Service Accounts/ Group Managed Service Accounts) - Account Aggregation - Create or Refresh - Add or Remove Entitlements - Delete Account - Resource Forest Topology Exchange Management. For more information, see [Active Directory Resource Forest Topology Exchange Management](). - Aggregate Linked Mailbox properties for the Account Forest User - Aggregate Mail User or Mail Contact from the Resource Forest Exchange - Delta Aggregation supports aggregation for the following delta changes: - Create Linked Mailbox or Update Linked Mailbox Properties - Mail enabled Distribution List membership changes for the shadow account - Create Linked Mailbox for the Account Forest User - Delta aggregation (using DirSync search) to fetch changes since last aggregation from Active Directory. For more information, see [Delta Aggregation](). - \*Access Certifications (certification of entitlements connected to accounts) - Authentication - \*Password management - Password Interception - The Active Directory source supports the Active Directory group hierarchy For more information on features, see [Source Features](). #### User Features | Feature | Accounts | Contacts | Service Accounts | | --- | --- | --- | --- | | Aggregate | ✔ | ✔ | ✔ | | Partitioning Aggregation | ✔ | N/A | N/A | | Delta Aggregation | ✔ | ✔ | N/A | | Authentication | ✔ | N/A | N/A | | Create | ✔ | ✔ | ✔ | | Delete | N/A | ✔ | N/A | | Password Management | ✔ | N/A | N/A | | Enable/Disable | ✔ | N/A | N/A | | Entitlement (Read, Request, or Revoke) | ✔ Groups | ✔ Groups | ✔ Groups | | Exchange (Read or Create) - Mailbox | ✔ | N/A | N/A | | Exchange (Read or Create) - Mail User | ✔ | N/A | N/A | | Exchange (Read or Create) - Mail Contact | N/A | ✔ | N/A | | Skype for Business Account (Read or Create) | ✔ | N/A | N/A | #### Group Entitlements Group Entitlements are the entitlement types for which SailPoint provides ability to aggregate additional details of these entitlement types from the managed system. These objects have separate schema defining list of attributes that aggregation task fetches as additional details when aggregation is run for that Group Entitlement type. | Feature | Groups | sharedMailBox | | --- | --- | --- | | Aggregation | ✔ | ✔ | | Read Group Hierarchy | ✔ | N/A | #### Shared Mailbox Management The Active Directory source supports managing Shared Mailbox as additional group object. ##### Supported Operations | Operations | Details/Features | | --- | --- | | Aggregation | Aggregate Shared Mailbox as Account Group Object. Aggregation of User's Shared Mailbox assignment as an entitlement. | | Add or Remove Shared Mailboxes | Add or remove Shared Mailboxes to users, as an entitlement. | ### Privilege Classification SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements. | Privilege Level | Description | | --- | --- | | High | Administrative level access to accounts | | Medium | Administrative level access for a specific role or function | | Low | Only basic access of data | > [!NOTE] > > To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin. For more information, refer to [Managing Privilege Classification](). ## Supported Managed Systems #### Supported Active Directory Domain Services (AD DS) Functional Levels - Microsoft Windows Server 2025 - Microsoft Windows Server 2016 - Microsoft Windows Server 2012 R2 - Microsoft Windows Server 2012 - Microsoft Windows Server 2008 R2 > [!NOTE] > > Microsoft has not made any changes in the functional level for Active Directory in Microsoft Windows Server 2019 and 2022. > > As a result, Microsoft Windows Server 2016 is the latest Active Directory functional level supported. #### Supported Microsoft Exchange Servers - Microsoft Exchange Server 2019 - Microsoft Exchange Server 2016 #### Supported Microsoft Lync\\Skype for Business Servers - Microsoft Skype for Business Server 2019 - Microsoft Skype for Business Server 2015 Supports AWS Managed Microsoft AD Service. ## Prerequisites This page lists the prerequisites required to integrate SailPoint with Active Directory. - Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](). - Create an Active Directory service account with the [Required Permissions](). A service account is a special user account that is created for the sole purpose of running a particular service or application on the Windows operating system. Services use the service accounts to log on and interact with the operating system. - Secure Active Directory connector. - Configure SailPoint for provisioning. > [!IMPORTANT] > > Before you start using the connector, install and register IQService on any Windows system with any of the supported Operating Systems. For more information on installing and registering IQService, refer to [IQService Settings](). > > IQService installation now enforces TLS configuration by default to improve security and safeguard your environment. To proceed with the installation, ensure you have completed the necessary prerequisites for TLS configuration. For more information, refer to [Configuring TLS and Client Authentication for IQService](). ### Domain and Trust Requirements If the Authentication Type is set to Strong (SASL), then the IQService host must be in the same domain or in a trusted domain. For a source managing multiple domain trees, either from the same or different forests, there must be a two-way trust relationship between them. ### Managing Service Accounts (MSA and gMSA) Prerequisites For managing Managed Service Accounts (MSA) or group Managed Service Accounts (gMSA), the following prerequisites are required: - For reading `msDS-GroupMSAMembership` and `msDS-AllowedToActOnBehalfOfOtherIdentity` gMSA object properties, IQService is required and Active Directory Module for Windows PowerShell must be enabled on the IQService Host. - For Provisioning operations of MSA and gMSA objects, IQService is required and Active Directory Module for Windows PowerShell must be enabled on the IQService Host. - To use group Managed Service Account (gMSA) for forest and domain settings, ensure you select Strong (SASL) as the authentication type. - The permissions for gMSA accounts are similar to those of service accounts. No special permissions are needed for gMSA accounts. For more information, refer to [Required Permissions](). > **Important** > > Configuration of IQService is mandatory to utilize gMSA as a service account for forest and domain settings in Active Directory. For more information, refer to [Configuring IQService to use gMSA as a service account for Active Directory](). Refer to [Using gMSA as a Service Account]() for more information. ### Strong (SASL) Authentication Requirements Strong (SASL) authentication internally uses kerberos authentication to authenticate the service account. To utilize Strong (SASL) authentication, ensure the following requirements are fulfilled: - Service account in the User Principal Name (UPN) format. For example, `UserName@DNSDomainName.com`. - For domain settings, use a non-TLS port. TLS is not supported with Strong (SASL) authentication. # Configuring TLS and Client Authentication for IQService IQService, also referred to as the Integration Service, is a Windows service that enables SailPoint to participate in a Windows environment and access information only available through Windows APIs. It is a lightweight service that must be installed on any supported Windows server that has connectivity to the target systems you want to manage in SailPoint. IQService can be installed on any Windows operating system that meets the requirements specified in [Prerequisites](<#prerequisites>) of IQService. > [!CAUTION] > > If you have IdentityIQ and SailPoint Human Fabric in your environment, install a separate instance of IQService for each system. - **TLS Communication** - TLS Communication between IQService and the VA is supported and must be configured to secure this solution. - **Client Authentication** - IQService can authenticate a client while connecting to it. IQService-based sources support Client Authentication, a feature which authenticates every incoming request from SailPoint before executing them. To ensure the authentication works correctly, IQService expects the client to send the credentials of a registered user with every request. Before processing a request, IQService first confirms that the user is registered with it and then authenticates the credentials with Windows. > [!NOTE] > > Client Authentication is mandatory for operations that use the IQService when the TLS communication is enabled for IQService. > > SailPoint recommends using a privileged access user as the registered user for client authentication. You can also use the IQService Service Log On user for this purpose. ## Prerequisites > [!NOTE] > > **For TLS Communication between the VA and IQService** > > - The IQService host's X.509 certificate with Extended Key Usage (EKU) used as Server Authentication must be available in the Personal Certificate Store of the host. The subject of the certificate should match the FQDN of the IQService host. An example subject is `iqservice.test.com`. > - The matching private key must be present in the host's RSA key directory. > - If the IQService host's X.509 certificate is not available, create a CSR (Certificate Signing Request) from the IQService host. > - Submit the CSR to a trusted (internal or third party) certificate authority (CA) for signing. Ensure that the CA is on trusted root CA in the host. > - The configuration of Client Authentication is *mandatory* when TLS communication is enabled for IQService. > [!NOTE] > > **For Client Authentication** > > - To configure client authentication when the IQService host is added to any domain, you need to have a domain user whose credentials can be used to authenticate a connection between SailPoint and IQService. > - If the IQService host is not added to any domain, the Windows local user from the IQService host can be used authenticate a connection between SailPoint and IQService instead of the domain user. > > > **Note** > > > > No specific additional user permissions are required. > [!IMPORTANT] > > If you are updating your IQService instance to use a TLS port, ensure that you disable the existing non-TLS port. This is crucial to maintain secure communication and prevent potential security vulnerabilities arising from the simultaneous use of both TLS and non-TLS ports. For more information, refer to [Disabling Non-TLS Communication for an Existing IQService Instance](<#disabling-non-tls-communication-for-an-existing-iqservice-instance>). ## TLS Configuration Between VA and IQService 1. Download IQService from SailPoint via a source that requires it. 1. Select **Download IQService**. 2. Unzip the downloaded **IQService.zip** archive into the desired location. For example, `C:\SailPoint\IQService\` 2. Install IQService to communicate with SailPoint on the TLS port only. ```text IQService.exe -i -o ``` This command installs IQService with the name **IQService-Instance1** and the provided TLS port number. 3. On the managed source configuration, in the **Integration Service** panel, enable the **Enable Transport Layer Security (TLS)** checkbox. ## TLS Configuration Check List ### IQService Host - The X.509 certificate is located in the Local Computer's Personal certificate store. - A private key that matches the certificate is present in the Local Computer's store and is correctly associated with the certificate. For example, as displayed in the following screenshot, you can confirm if the certificate has a private key. A certificate with a private key (on the right, highlighted in green) has a different icon than a certificate without one (highlighted in red). [![TLS certificate with and without private key]()]() - The Enhanced Key Usage extension includes the Server Authentication (1.3.6.1.5.5.7.3.1) object identifier. - The IQService host's fully qualified domain name (FQDN) must be in the common name (CN) in the **Subject** field in the X.509 certificate, and it must be a DNS entry in the **Subject Alternative Name** extension in the X.509 certificate. An example of IQService's FQDN is `iqservice.test.com`. Refer to the following examples. > [!NOTE] > > **Common Name (CN) in the Subject field in X.509 certificate** > > [![Common Name in X.509 certificate Subject field]()]() > [!NOTE] > > **DNS entry in the Subject Alternative Name extension in the X.509 certificate** > > [![DNS entry in X.509 certificate Subject Alternative Name extension]()]() - The X.509 certificate must be trusted by the IQService host. Trust is established by configuring the IQService host to trust the root CA to which the issuing CA chains. Refer to the following examples: > [!NOTE] > > **X.509 certificate (Non trusted)** > > [![Non-trusted X.509 certificate]()]() > [!NOTE] > > **X.509 certificate (Trusted)** > > [![Trusted X.509 certificate]()]() ### Virtual Appliance Configuration The virtual appliance (VA) must trust the IQService X.509 certificate. Trust is established by configuring the VA to trust the root CA to which the issuing CA chains. To establish trust between the VA and the root CA: 1. Add the root CA cert in the `/home/sailpoint/certificates` directory of the VA. 2. Restart the CCG service. [![TLS virtual appliance configuration]()]() > [!NOTE] > > Ensure to export the full certificate chain and convert it into a single PEM / Base64 formatted file. > [!NOTE] > > **Steps to Export and Convert the Certificate Chain** > > 1. Using the Microsoft Management Console (MMC), export the certificate chain as a `.p7b` file in DER/Binary format. > 2. Use the following OpenSSL command to convert the `.p7b` file to a `.pem` file: > > ```text > openssl pkcs7 -print_certs -in certchain.p7b -inform DER -out certificate.pem -outform PEM > ``` > 3. Place the output `.pem` file onto the VA. The CCG will then load the certificates from this file. > > ##### Handling Multiple Certificate Chains > > If you have multiple certificate chains (For example, one for VA to IQService communication and another for VA to AD communication), each chain must be placed in a separate PEM file. ## Configuration of IQService Client Authentication 1. On the IQService host, run the following command: ```text IQService.exe -a ``` For example: `IQService.exe -a "Corp\John.Doe"` - The domain user must be in the `msDS-PrincipalName` format: ```text \ ``` - If you are using a local user, it must be in the following format: ```text localuser ``` - You must use the user name as an **IQService User** name in the same format. 2. Configure the **IQService User** and **IQService Password** on the IQService-based source. Ensure that the IQService user value set here is the same that you registered on earlier on IQService. ## Securing Communication Between IQService and AD Domain Controller or Target System > [!NOTE] > > For IQService to connect using TLS and self-signed certificates, you must install the certificate in **Trusted Root Certification Authorities** on the IQService host. The configured IQService User must have all access/permissions to read all the installed Certificates. 1. Export the server certificate and copy the exported .cer file to the IQService host. 2. Double-click the .cer file and select **Install Certificate**. 3. Select **Next**. 4. Choose **Place all certificates in the following store** and select **Browse...** 5. Select **Show physical stores**. 6. Expand **Trusted Root Certification Authorities** and select **Local Computer**. 7. Select **OK**. 8. Select **Next**, then **Finish**. ## Disabling Non-TLS Communication for an Existing IQService Instance If you are enabling TLS communication for an existing IQService instance that previously used non-TLS communication, you must ensure that non-TLS communication is disabled for that same instance. You can achieve this using one of the following methods: **Method 1** 1. Set the existing non-TLS port to zero (0) or any negative number (such as -1, -2, -3 ) using the command line: ```text IQService.exe -p ``` For example, ```text IQService.exe -p 0 ``` ```text IQService.exe -p -1 ``` > **Note** > > Ensure to disable the non-TLS port for both the primary service and the secondary service (if configured). 2. After setting the port, restart the IQService. **Method 2** Optionally, you can delete the non-TLS port entry from the IQService instance registry configuration. > [!WARNING] > > Directly editing the registry can cause serious, potentially unrecoverable errors if done incorrectly. Only modify fields that are specifically intended for modification. Following are the steps to delete non-TLS port entry from IQService instance: 1. Locate the registry configuration for your IQService instance. You can find the registry path for the primary service at: ```text HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint\IQService Instances\ ``` You can find the registry path for the secondary service at: ```text HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint\IQService Instances\\Secondary ``` Replace `` with the name of your IQService instance. 2. Look for the port attribute. 3. Delete the port attribute entry. After completing one of these methods, the IQService will only communicate using TLS, ensuring secure communication between the IQService and other components. To verify that the non-TLS port has been successfully disabled for your IQService instance, run the following command: ```text IQService.exe -v ``` After running this command, the output should display only the Configured TLS Port information along with the corresponding TLS port number, such as `Configured TLS Port : ` ## Troubleshooting ### TLS Communication > [!NOTE] > > **Failed to connect to IQService. Please check TLS configuration for IQService.** > > **Resolution**: > > - Ensure that the certificate is placed at correct path in VA: `/home/sailpoint/certificates` > - This error message might come if IQService is an older version or a non-TLS port is provided. Ensure your IQService is upgraded to latest IQService and TLS port is provided. > [!NOTE] > > **java.security.cert.CertificateException: No subject alternative names present** > > **Resolution**: > > - Ensure that the certificate is properly placed in VA: `/home/sailpoint/certificates`. > - Check communication between IQService host and VA. > - Ensure that the DNS settings are correct. Alternatively add the appropriate mapping entry for IQService host in `hosts.yaml` file in the `/home/sailpoint` directory. > > > **Note** > > > > For information on creating a hosts.yaml file, refer to [Configuring a Hosts.yaml File](). > [!NOTE] > > **Connection Reset** > > **Resolution**: Verify the following: > > - This could be because IQService TLS is disabled and you have provided TLS port. Ensure that the **Enable Transport Layer Security (TLS)** checkbox is selected. > - This could be because the hostname of the IQService server does not match the FQDN of the TLS certificate. Verify that the hostname matches the FQDN or the SubjectAlternateName DN is the same as the FQDN of the TLS certificate. If they are not the same, use the following commands to specify the certificate FQDN for IQService and then restart IQService: > > ```text > iqservice.exe -m hostname.example.com > iqservice.exe -t > ``` > [!NOTE] > > **Connection refused** > > **Resolution** - Ensure your IQService service is running. > [!NOTE] > > **Failed to connect to IQService. Please check TLS configuration for IQService.** > > **Resolution** - This could be because the IQService version is older. Ensure your IQService service is upgraded to latest version. Deselect the **Enable Transport Layer Security (TLS)** checkbox for non-TLS communication. > [!NOTE] > > **Line: 1 Column:1: Content is not allowed in prolog.** > > **Resolution** - If you want to use the IQService TLS functionality, use the latest CCG version and IQService version. If you are not using the latest CCG version and IQService version, ensure that the **Enable Transport Layer Security (TLS)** checkbox is unchecked on source configuration. > [!NOTE] > > **Unrecognized SSL message, plaintext connection?** > > **Resolution** - If you want to use the IQService TLS functionality, ensure that latest CCG version and IQService is deployed. If you are not using the latest CCG version and IQService version, ensure that the **Enable Transport Layer Security (TLS)** checkbox is unchecked on source configuration. ### Client Authentication The following errors may be returned from IQService. > [!NOTE] > > **No such user registered with IQService.** > > **Resolution**: > > - Ensure that you have registered and configured the IQService user and password on IQService host using the following command: > > ```text > IQService -a username > ``` > - Ensure that you have provided the correct IQService user or password. Use the latest CCG version and IQService version. > [!NOTE] > > **Client authentication failed with error - The user's password must be changed before signing in** > > **Resolution** - The IQService user's password could be expired. To resolve the issue, change the password for the IQService user. > [!NOTE] > > **Client authentication failed with error - The user's account has expired** > > **Resolution** - Password could be expired for IQService user. To resolve the issue, change the password for IQService user. > [!NOTE] > > **Client authentication failed with error - The referenced account is currently locked out and may not be logged on to.** > > **Resolution** - Ensure that the IQService user is not locked. > [!NOTE] > > **Client authentication failed with error - This user can't sign in because this account is currently disabled** > > **Resolution**: Ensure that the IQService user is not disabled. > [!NOTE] > > **Client authentication failed with error - Your account has time restrictions that keep you from signing in right now** > > **Resolution** - The reason could be IQService user has enabled logon hours and you are trying to perform an operation outside of their defined logon hours. Ensure that logon hours are correctly configured. > [!NOTE] > > **The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters.** > > **Resolution** - This is the error that displays if you are trying to perform client authentication with an old CCG version but the latest IQService version. You need to remove the user details from IQService using the command: `IQService -x username`. Also remove IQService user and password from source config. # IQService Settings Install IQService to support execution of provisioning operations and native rules. IQService is required by the Active Directory connector for all provisioning, and for reading certain fields from a user's entry, including Terminal Services and Lync attributes. > [!IMPORTANT] > > This instance of IQService is configured to listen on a TLS port by default to improve security and safeguard your environment. To establish a secure connection, ensure to follow the following steps: > > - Enable the TLS configuration flag in your source application. > - Refer to the [Configuring TLS and Client Authentication for IQService]() page for detailed instructions on configuring TLS for IQService, including client authentication. > > Ensuring proper TLS configuration is crucial for maintaining the security of your IQService deployment. Before you start using the connector, install and register IQService on any Windows system with any of the supported Operating Systems. For more information on installing and registering IQService, refer to the [IQService Administrator's Guide](). You must install IQService to support the following SailPoint features: - Provisioning: - Active Directory Accounts - Exchange Mailboxes - Loading and Provisioning Skype for Business Accounts - Certification of Active Directory Entitlements (if you want to automatically revoke disapproved items) > **Note** > > If you want to create manual tasks for revoked items, you'll need to use Expert Services to edit your Active Directory source settings. For more information, refer to Certifications Overview. - Password management for Active Directory accounts If you don't need this functionality, IQService does not need to be running, and you can leave the **IQService Host** and **IQService Port** fields blank. Entering incorrect values for these fields causes the test connection process to erroneously report a failure to connect to the application. ## IQService Installation > [!NOTE] > > **Screenshot** > > [![Download IQService]()]() > [!NOTE] > > IQService has the built-in capability to auto update (this is the default). To enable the auto update capability, UpdateService must be configured alongside the IQService installation. Refer to [Configuring IQService Auto Update](). ### Download IQService To download the IQService installation, complete the following: 1. Download and install IQService using one of the following methods: - Select the **Download IQService** button. - Download, install, and configure IQService by following the steps mentioned in the [IQService Administrator's Guide]() for Installing and Registering IQService. > **Note** You are only entitled to download components for which you have an active license with SailPoint and the availability of a component for download does not grant you a license to use a component or entitle you to use a component for which you do not have an active license. Contact your Account Representative or CSM for more information. 2. Unzip the downloaded `IQService.zip` archive into the desired location. For example, `C:\SailPoint\IQService\`. Verify the DLLs are trusted by checking the properties of the DLL files. 3. Run one of the following commands to install IQService and specify the TLS port information: - Run the following command to install IQService without specifying the TLS port: ```text IQService.exe -i ``` This command installs IQService with a name of `IQService-Instance1` and connects to port 5050 (if available). - Run the following command to install IQService with the TLS port: ```text IQService.exe -i -o ``` This command installs IQService with a name of `IQService-Instance1` and connects to the specified port number. For more information on requirements and procedures to set up TLS communication and client authentication, refer to [Configuring TLS and Client Authentication for IQService](). - Run the following command to install IQService to communicate on TLS and non-TLS ports: ```text IQService -i -p -o ``` This command installs IQService with a name of `IQService-Instance1` and the specified TLS and non-TLS ports. 4. Start the service from the services applet or from the command line, using the following command: `IQService.exe -s` ## Configure IQService Settings > [!NOTE] > > **Screenshot** > > [![Configure IQService]()]() To configure the IQService settings, complete the following: 1. (Optional) In the **IQService Host** field, enter the FQDN/IP of the system where IQService is installed. 2. (Optional) Enter the **IQService Port** number used to connect. If you enable TLS, configure the corresponding IQService TLS port. 3. (Optional) Enter the **IQService User** for client authentication. 4. (Optional) Enter the **IQService Password** for the IQService user. 5. (Optional) By default, the **Use Transport Layer Security (TLS)** checkbox is selected. When selected, the **IQService User** and **IQService Password** fields are mandatory. For more information, refer to [Configuring TLS and Client Authentication for IQService](). 6. Select **Save**. # Machine Account Attributes Machine account attributes are used in provisioning configurations for machine accounts. After you have [created the required machine account subtypes](), you can use the machine account attributes to provision machine accounts in your SailPoint tenant. Refer to [Machine Identity Security Overview]() for more information. > [!NOTE] > > Attributes marked with an asterisk (\*) are mandatory. ## Machine Account Provisioning Attributes The following table provides a reference summary of Create Machine Account attributes. | Create Machine Account Attribute | Description | | --- | --- | | ObjectType\* | The Active Directory object class for machine account creation. The default value is `msDS-GroupManagedServiceAccount` (gMSA). | | distinguishedName\* | The distinguished name (DN) where the machine account is created. For example: `CN=,OU=,DC=`. | | sAMAccountName\* | The machine account logon/profile name in Active Directory. | | dNSHostName\* | The FQDN assigned to the service account. For example: `gMSAName.domain.com`. | | sn | Surname/last name value for the account object. | | givenName | Given name/first name value for the account object. | | msDS-SupportedEncryptionTypes | Supported encryption type(s) for the gMSA. The default is `AES256`. | | msDS-ManagedPasswordInterval | Password rotation interval (in days) for the managed service account. | | msDS-GroupMSAMembership | Principals allowed to use the gMSA. Multi-valued attribute. | | msDS-AllowedToActOnBehalfOfOtherIdentity | Principals allowed to act on behalf of this account. Multi-valued attribute. | | description | Description/comment for the machine account. | | servicePrincipalName | Service principal names (SPNs) associated with the machine account. Multi-valued attribute. | # Provisioning The Microsoft Active Directory connector supports provisioning, allowing you to create and manage accounts and entitlements in Microsoft Active Directory directly from SailPoint. **Prerequisite:** Your system is configured for provisioning. When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*. When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment. For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account. > [!IMPORTANT] > > This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail. ## Default Create Account Attributes > [!NOTE] > > - For an account that has been moved or renamed in Active Directory since the last aggregation, ensure that the change is aggregated before performing any provisioning operation on the account. > - The Active Directory source no longer connects to Read Only Domain Controllers (RODC) for provisioning operations using serverless binding. The following generators create required information for a new Active Directory account. You may need to edit the contents. | Account Attribute | Generator | Description | | --- | --- | --- | | ObjectType | Static | The type of account to be created. The default is `User`. For users, the object type must be `User`. For contacts, the object type must be `Contact`. For group managed service accounts, the object type must be `msDS-GroupManagedServiceAccount`. For managed service accounts, the object type must be `msDS-ManagedServiceAccount`. | | distinguishedName | Generator | Distinguished name of the new account. The default Generator is **Create Unique Account ID**. This generator uses the value in the **Pattern Used** field to generate a unique DN for the new account.

Note: You must change the OU in the **Pattern Used** field in the `distinguishedName` attribute. | | sAMAccountName | Generator | `sAMAccountName` of the new account. The default Generator is **Create Unique LDAP Attribute**. This generator uses the value in the **Pattern Used** field to generate the `sAMAccountName` for the Active Directory account. | | displayName | Identity Attribute | Display name of the new account. The default Attribute is **Display Name** (`displayName`). | | manager | Generator | Manager for the new account. The default Generator is **Get Manager LDAP DN**. | | mail | Identity Attribute | Email address of the new account. The default Attribute is **Work Email** (`email`). | | password | Generator | Password for the new account. The default Generator is **Create Password**. This generator creates an initial password for the new account that matches the password policy assigned to the associated Active Directory source in SailPoint. | | givenName | Identity Attribute | First name associated with the account. The default Attribute is **First Name** (`firstname`). | | sn | Identity Attribute | Last name associated with the account. The default Attribute is **Last Name** (`lastname`). | | pwdLastSet | Static | This attribute can only be set as `true` or `false`. When set to `true`, the `pwdLastSet` attribute value is set to `0` and it selects the **User must change password on logon** checkbox for the Active Directory user object's account in ADUC. When set to `false`, the `pwdLastSet` attribute value is set to `-1` and sets this attribute to the current time, and it deselects the **User must change password on logon** checkbox. The default Static Value is `false`. | | primaryGroupDN | Static | Default group of the new account. | | description | Static | Description of the new account. | | telephoneNumber | Identity Attribute | Telephone number of the new account. The default Attribute is **Alternate Phone Number** (`phone`). | | userPrincipalName | Disabled | The unique name of the entity within the domain, in the format `"name@domain"`. | | title | Disabled | The title associated with the entity. | | department | Disabled | User's department. | | employeeID | Disabled | Numerically identifies an employee within an organization. | | company | Disabled | Company name of an employee. | ## Provisioning Considerations Note the following when provisioning the Active Directory source: - You can specify the attributes for other operations, such as account updates, through the provisioning policy APIs. - The Active Directory source has a `skipDeletedObjScopeCheckInDelta` attribute that you can set to configure the binding of deleted and recycled objects in Active Directory and process them in SailPoint accordingly. - Active Directory does not show the `InvalidCastException` attribute in logs when provisioning a Lync account. - Active Directory updates the `msExchHideFromAddressLists` attribute value in a 'modify' provisioning operation. - Active Directory returns the attribute level results by setting the `setAttributeLevelResult` attribute to `"true"`. Attribute provisioning failures do not result in the failure of subsequent attributes with the same error. > **Note** > > The value must be inside quotation marks because it is passed as a string, not a boolean value. - Active Directory clears the description attribute when provisioned with an empty string. - Refer to [Default Create Account Attributes](<#default-create-account-attributes>) for more information on provisioning attributes. - Refer to the following SailPoint best practice documents for guidance on these common account-creation requirements: - [Generating Usernames in Identity Security Cloud]() - [Provisioning with Passwords in Identity Security Cloud]() - [Provisioning Multi-Valued Attributes]() ## Special Provisioning Attributes for Move/Rename Requests | Attribute | Description | | --- | --- | | AC\_NewName | A string attribute to rename the user. For example, `CN=abc`. | | AC\_NewParent | A string attribute to move the user to a new OU. For example, `OU=xyz,DC=pqr,DC=com`. | The `AC_NewName` and `AC_NewParent` attributes are special attributes to handle the move and rename operations and can be sent in the Attributes Map and AccountRequest instead of AttributeRequest. ## Exchange Mailbox Attributes Note the following when working with mailbox attributes: - If you send an email address in the `mail` attribute, the exchange may not use it, if the Email Policy in the exchange is set to create it differently. The email address is not taken and sent back to Active Directory after it is created, based on the policy. - For the Active Directory source, the `mailNickname`, `homeMBD`, and `msExchHideFromAddressLists` attributes are case insensitive when processed by IQService. - The Active Directory source sets the MS-Exchange attributes - `homeMDB` and `mailNickname` - as AD attributes, if MS-Exchange is not enabled. The following are additional attributes required to create a mailbox: | Attribute | Mapping Type | Description | | --- | --- | --- | | homeMDB | Disable | The exchange mailbox store domain name required to create a mailbox. For example: `SomeExchangeDB`. The `homeMDB` attribute is in the format of `'SomeExchangeDB'`, not `'CN=SomeExchangeDB'`. | | mailNickname | Disable | The exchange alias that you can use to update or disable the mailbox. For example: `firstname.lastname`. | | msExchHideFromAddressList | Disable | The attribute to hide from the Exchange address lists. | | externalEmailAddress | Disable | The external email address, required for mail contact creation. | ### Updating Exchange Mailbox Attributes The Active Directory connector supports updating any Exchange mailbox attributes supported by the `Set-Mailbox` cmdlet, using the following methods: 1. Add the attribute in the provisioning policy with `Exch_` as a prefix. For example, to set the `HiddenFromAddressListsEnabled` exchange attribute, add the attribute name as `Exch_HiddenFromAddressListsEnabled` in the provisioning policy. 2. Provide a comma separated list of exchange attributes for `exchangeAttributes`. For example, for the `HiddenFromAddressListsEnabled` provisioning policy attribute, use the SailPoint REST API to set up the `exchangeAttributes` attribute with a value such as `HiddenFromAddressListsEnabled`. > **Note** > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ## Attributes for Skype for Business The `msRTCSIP-UserEnabled` attribute must be updated as part of the Create Profile section. By default, provisioning of the following attributes is supported: | Attribute | Description | | --- | --- | | SipAddress | This attribute contains the SIP address of a given user. | | SipDomain | This attribute contains the SIP domain of a given user. | | SipAddressType | This attribute contains the SIP address type of a given user. Skype for Business Server generates a SIP address for the new user when SipAddressType is provided in combination with SipDomain. | | Registrar Pool | This attribute contains the Registrar pool of a given user. | | msRTCSIP-UserEnabled | This attribute indicates whether the user is currently enabled for Microsoft Lync/Skype for Business Server. | ## Schema and Provisioning Attributes of Group Managed Service Accounts (gMSA) Objects For the provisioning of the following gMSA attributes, you must add them manually for existing sources. By default, they are available for new sources. | Account Attribute | Mapping Type | Description | | --- | --- | --- | | dNSHostName | Disable | The DNS host name of the service account. This attribute is mandatory for gMSA provisioning. | | msDS-SupportedEncryptionTypes | Disable | The supported encryption types for the service account. This is a multi-valued attribute. | | msDS-ManagedPasswordInterval | Disable | The number of days for the password change interval. | | msDS-GroupMSAMembership | Disable | The principals that are allowed to retrieve the managed password of this Group Managed Service Account. This is a multi-valued attribute. | | msDS-AllowedToActOnBehalfOfOtherIdentity | Disable | The accounts that can act on behalf of this Group Managed Service Account. This is a multi-valued attribute. | | servicePrincipalName | Disable | The service principal names for the service account. This is a multi-valued attribute. | ## Provisioning Attributes for Contacts Add the `displayAttributeForContacts` attribute as an additional parameter for Contacts. `CN` is used as the default value for the display name of Contact objects. The Display attribute can be set using the `connector_displayAttributeForContact` config attribute. For example, to set it to `firstName`, use the SailPoint REST API and set the value of `connector_displayAttributeForContact` to `firstName`. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ## Provisioning Attribute for Resource Forest Topology Exchange Management The following String-type attribute, required for creating a Linked Mailbox, is available by default for new sources. For existing sources, add it manually in the Create Profile section. | Account Attribute | Mapping Type | Description | | --- | --- | --- | | shadowAccountDN | Disable | Distinguished Name of the Linked Mailbox Shadow Account to be created. It is required for creating a new Linked Mailbox. | ## Individual Attribute Notes ### `accountExpires` Attribute For the Active Directory source, the `accountExpires` attribute must be defined as a string. The value of the `accountExpires` attribute can be set in the Microsoft defined timestamp that represents the number of 100-nanosecond intervals since January 1, 1601 (UTC). The value can also be entered in a human readable format: `MM/DD/YYYY HH:MM:SS AM TimeZone`. For example, `05/11/2019 12:00:00 AM IST`. A value of `0`, `never`, or `9223372036854775807` indicates that the account never expires. The value of the `accountExpires` attribute is displayed in the `MM/DD/YYYY hh:mm:ss aa Z` format. For example, if previously the time of account expiry was displayed as `5/14/2019 12:0:0 AM IST`, it will now be displayed as `05/14/2019 12:00:00 AM IST`. ### `never` as a Value of the `accountExpires` Attribute The Active Directory source supports `never` as a value of the `accountExpires` attribute in provisioning, when the `timeZone` attribute is present in the source configuration. > [!NOTE] > > SailPoint recommends that the `accountExpires` attribute must be defined as a string. However, the Active Directory source accepts an integer value for the `accountExpires` attribute in account provisioning if it is not a string. ### `timeZone` Attribute The Active Directory source supports the `timeZone` attribute. The `timeZone` attribute defines a time zone that you want to provision accounts in or change in the default setting of the `accountExpires` attribute and display. The `timeZone` attribute accepts values in the string format. Valid values are: - `epoch` - use if you want to provision and see the `accountExpires` attribute in Active Directory epoch format. - `Continent/City` - this format is similar to the standard format that Java supports. For example, if you want to provision accounts and see the `accountExpires` attribute in Indian Standard Time then `timeZone` must be set as `Asia/Kolkata`. ### Rolling Back a Created Account The Active Directory source supports rollback of a created account in case provisioning of one or more requested attributes fails during the provisioning operation. Set the `rollbackCreatedAccountOnError` attribute to `true`. # Required Permissions ## Service Account Permissions A service account is a special user account that is created for the sole purpose of running a particular service or application on the Windows operating system. Services use the service accounts to log on and interact with the operating system. The service account must have appropriate permissions on Active Directory. The Domain Controller must be accessible from the IQService host computer. > [!NOTE] > > The permissions discussed in the following section grant limited account creation privileges to a user. This user can create and modify most accounts. It cannot manage the administrator user account, the user accounts of administrators, the server operators, account operators, backup operators, and print operators. To manage these user types, you must assign the appropriate security permissions or add the user to groups having higher permissions. For example, domain administrators. The service account specified in the application must be the member of the Account Operators group. More granular permissions can be assigned to users for specific portions of the directory, but this is discouraged by Microsoft best practices for Active Directory access control. The required permissions depend on the use cases that are implemented, but could include: | Operations | Service Account Permissions | | --- | --- | | Load Accounts | Read All Properties
Read Members | | Provision Accounts | Write All Properties
Write Members
Create User Objects | | Password Management | Change Password
Reset Password
Read `pwdLastSet`
Write `pwdLastSet` | | Enable/Disable Accounts | Read `userAccountControl`
Write `userAccountControl` | | Unlock Accounts | Read `lockoutTime`
Write `lockoutTime` | ## Permissions for Special Operations Some special operations need additional permissions. | Operations | Service Account Permissions | | --- | --- | | Delta Aggregation | Additional permissions are required for "Replicating directory changes" and "Read permissions on the Deleted Object Container". For more information, refer to [Required Permissions for Delta Aggregation](<#required-permissions-for-delta-aggregation>). | | Provision Exchange Mailbox | Must be a member of Exchange Recipient Management group. | ## Microsoft Skype for Business Server For the Active Directory source, there are updated service account permissions to load and provision Microsoft Lync/Skype for Business. One of the following permissions is required, depending on the service account type: - For Microsoft Skype for Business Server user management, the service account must be a member of the RTCUniversalServerAdmins and CSUserAdministrator domain groups. The account must also be a member of the local Administrator group on the system running IQService. - For Microsoft Skype for Business Server user management, a service account must be a member of a custom group with SQL permission and the CSUserAdministrator domain group. The account must also be a member of the local Administrator group on the system running IQService. - The account must also be a member of local Administrator group on the system running IQService and ensure that: - IQService can access the Lync/Skype for Business Server through port 1433 of the SQL Server. - IQService accounts have direct access to the database to successfully provision the account. The required permissions for the Custom group and CSUserAdministrator domain group in SQL are: | Database Instance | Security login | Database Role Membership | Databases | | --- | --- | --- | --- | | RTCLOCAL | Group required to be added in SQL server: Custom Group and CSUserAdministrator | DB\_Owner | RTC, XDS, RTCDYN | | RTC | Group required to be added in SQL server: Custom Group and CSUserAdministrator | DB\_Owner | RTCXDS, XDS | ## Permissions for Managing Group Managed Service Accounts (gMSA) For managing Managed Service Accounts and Group Managed Service Accounts (gMSA), the following permissions are required: - Aggregation and Refresh Account: Member of account operators group. - Create: In addition to account operators, service accounts must have full permission on the Active Directory container from which service account is to be managed. ## Foreign Security Principals Permissions For Foreign Security Principals (FSP) to be aggregated, created, or modified a single service account must have full delegated permissions on the FSP container. Use the Delegation Control Wizard to delegate permissions to the service Account. To delegate permissions using the Delegation Control Wizard, complete the following: 1. Open **Active Directory Users and Computers**. 2. Right-click on the **ForeignSecurityPrincipals** container, select **Delegate Control**, and then select **Next**. 3. Select the **Add** button to add a service account user and then select **Next**. 4. Select **Create a custom task to delegate** and then select **Next**. 5. Select **This folder, existing objects in this folder and creation of objects in this folder**. 6. On the next screen, select **Full Control** under **Permissions**, and then select **Next**. 7. Select **Finish**. ## Permissions for Managing Contact Objects For managing contacts, the contacts must be delegated to Account Operators group. Use the Delegation Control Wizard to delegate permissions to the contact. To delegate permissions using the Delegation Control Wizard, complete the following: 1. Open **Active Directory Users and Computers**. 2. Right-click on the domain and select **Delegate Control**. 3. Select **Next**. 4. Select **Account Operators** group. 5. Select **Next**. 6. Select **Create a custom task to delegate**. 7. Select **Next**. 8. Select **Only the following objects in the folder** option, then select **Contact Objects** and **Create and Delete selected objects in the folder**. 9. On the next screen, select **Full Control** under **Permissions**, and then select **Next**. 10. Select **Finish**. ## Required Permissions for Delta Aggregation You must give the service account both of the additional permissions to support delta aggregation. To provide the additional permissions, complete the following: 1. To provide Replicating directory changes permissions to the service account. 1. In the Active Directory Users and Computers browser menu, select **View**, and then right-click and select the **Advanced features** checkbox. 2. Right-click the domain node and select **property**, and then open the **Security** tab. 3. Add the user to the list of **Security Principals**. 4. Select the user and select the **Allow** checkbox for **Replicating Directory Changes** permission. 2. To provide Read permissions on the Deleted Object Container to the service account. 1. Log on to any domain controller in the target domain with a user account that is a member of the Domain Administrators group. 2. Open a command prompt. Enter the following command: `dsacls "" /takeownership`. In the above command, the `Deleted objects container DN` is the distinguished name of the deleted objects container. For example, `dsacls "CN=Deleted Objects,DC=SailPoint,DC=Com" /takeownership` 3. Press the **Enter** key. 4. To grant Read permission to the objects in the Deleted Objects container to a user type, enter the following command: `dsacls "" /G \:LCRP`. In the above command, LCRP stands for the list object and read properties permission. For example, `dsacls "CN=Deleted Objects,DC=SailPoint,DC=Com" /G SailPoint\John:LCRP` 5. Press the **Enter** key. ## Permissions for Shared Mailbox Management For aggregation of Shared Mailboxes and user's Shared Mailbox Membership, the service account must be a member of the Account Operator Group and Recipient Management Group. For the Create or Update operation on a Shared Mailbox and when assigning a Shared Mailbox to a user account: - The service account must be a member of Account Operator Group and Recipient Management Group. - Update the Send As permission of the Shared Mailbox, the service account must have the Active Directory Permissions Exchange Role. By default, every member of the Organization Management group has Exchange Role with higher capabilities, which is not required for this operation. Hence SailPoint recommends creating a custom Exchange Admin Role Group. To create a custom Exchange admin role group, complete the following: 1. On the Exchange admin center page, select **Permissions** in the left pane. 2. Under the admin roles tab, select the **\+** icon to create a new Role Group. 3. On the Role Group window, enter the **Name** and **Description**. 4. From the list of Roles that are displayed, search and select **Active Directory Permissions Role** and then select **Save**. This creates a Universal Security Group with the given name under the Microsoft Exchange Security Groups organization unit. Add the service account to this group. # Resource Forest Specific Configuration Attributes Use these attributes to configure resource forest domains, applications, and Microsoft Exchange schemas. ## Resource Forest Specific Domain Configuration Attributes This section lists additional Resource Forest specific configuration parameters: ### `disableShadowAccountMembership` By default, the connector considers the memberships of Shadow Account as Master Account's memberships. To discard membership of the shadow account, set this Boolean (or String) attribute to `true` under `domainSettings` of the respective Resource Forest domain, using the SailPoint REST API. Update the value of `disableShadowAccountMembership` that is present under `connector_domainSettings` (map) of the Resource Forest domain. For example: ```xml ``` > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ### `shadowAccountMembershipFilter` By default, the connector retrieves all memberships of the Shadow Account, but these memberships can be filtered based on an LDAP filter. Update the value of `shadowAccountMembershipFilter` that is present under `connector_domainSettings` (map) of the Resource Forest domain using the SailPoint REST API. For example, if only the distribution group of the Shadow Account is considered, you can use the `shadowAccountMembershipFilter` attribute with a value such as `(!groupType:1.2.840.113556.1.4.803:=2147483648))`. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ### `provisionGroupToShadowAccount` By default, the connector supports assigning only Universal and Global Distribution List groups from the Resource Forest Domain to the Shadow Account. To override this and support all other types of group provisioning to the Shadow Account, pass this attribute in the metadata of the AttributeRequest for the `memberOf` attribute as given in the following example: ```xml ``` ## Resource Forest Specific Application Configuration Attributes This section lists additional Resource Forest Application configuration parameters: ### `supportFSPsFromResourceForest` Set this Boolean attribute to `true` to enable aggregating and provisioning FSPs from the Resource Forest Domains for the Master Account. By default, the value is `false`. ## Microsoft Exchange Schema Attributes In addition to the existing Microsoft Exchange account schema attributes, the following new attributes are added in the schema for new applications. For existing Active Directory applications, the following schema attributes must be added manually if required: | Attribute | Description | | --- | --- | | `msExchRecipientTypeDetails` | Type of the Microsoft Exchange recipient object. Value 2 indicates that the mailbox type is a Linked Mailbox. | | `shadowAccountDN` | The distinguished name of the Linked Mailbox Shadow Account (disabled account which was created while creating the Linked Mailbox). | | `shadowAccountGuid` | The `objectGuid` of the Linked Mailbox Shadow Account. | # Active Directory Resource Forest Topology Exchange Management In Active Directory Account Forest - Resource Forest Topology, all user accounts exist in one or more Forests called Account Forests, while resources have a dedicated Active Directory Forest called a Resource Forest. The Resource Forest may have deployments like Microsoft Exchange or Skype Server. The Active Directory connector supports managing Exchange Linked Mailbox, Mail user, and Mail contact from the Resource Forest. Whenever a user from the Account Forest requests a mailbox, a Linked Mailbox is created on the Resource Forest Exchange server with an associated disabled user. The connector uses the following terms: - Shadow Account for disabled user - Master Account for the user of Account Forest The connector aggregates all Exchange properties of the Shadow Account and maps these to the corresponding Master Account. The connector relies on the connection details provided under the [Exchange Settings](), [Forest Settings](), and [Domain Settings]() to carry out all the supported operations. ## Prerequisite Minimum one-way trust from Exchange Resource Forest to Account Forest. ## Administrator Permissions - For read operations of the Linked mailbox properties, the service account from the Resource Forest Domain must be a member of the Account Operator group. - For all provisioning operations of the Linked mailbox, the service account from the Resource Forest Domain must be a member of the Recipient Management group. # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The Microsoft Active Directory connector uses the following default correlation and object configurations. ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | distinguishedName | Account | | distinguishedName | Group | ### Default Account Attributes The Microsoft Active Directory connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. > [!NOTE] > > Attributes with an asterisk (\*) are the Terminal Services/Remote Desktop Services attributes. By default, these attributes are not added to the schema and provisioning policy for performance optimization. To manage Terminal Services attributes, add these attributes to the schema and provisioning policy. See [Attributes for Terminal Services](<#attributes-for-terminal-services>). > [!IMPORTANT] > > When an attribute contains more than 1500 values, ensure to define it as a multi-valued attribute. | Attribute Name | Description | | --- | --- | | accountFlags | This attribute contains a list of the flags enabled on an account. | | businessCategory | The types of business performed by an organization. Each type is one value of this multi-valued attribute. For example, "engineering", "finance", and "sales". | | carLicense | This attribute type contains the license plate or vehicle registration number associated with the user. | | cn | This attribute type contains names of an object. Each name is one value of this multi-valued attribute. If the object corresponds to a person, it is typically the person's full name. For example, "Martin K Smith", "Marty Smith" and "printer12". | | department | This attribute contains the user's department. | | departmentNumber | This attribute contains a numerical designation for a department within your enterprise. | | description | This attribute type contains human-readable descriptive phrases about the object. Each description is one value of this multi-valued attribute. For example, "Updates are done every Saturday, at 1am.", and "distribution list for sales". | | destinationIndicator | This attribute type contains country and city strings associated with the object (the addressee) needed to provide the Public Telegram Service. The strings are composed in accordance with CCITT Recommendations F.1 \[F.1\] and F.31 \[F.31\]. Each string is one value of this multi-valued attribute. For example, "AASD" as a destination indicator for Sydney, Australia. "GBLD" as a destination indicator for London, United Kingdom. The directory does not ensure that values of this attribute conform to the F.1 and F.31 CCITT recommendations. It is the application's responsibility to ensure destination indicators that it stores in this attribute are appropriately constructed. | | displayName | This attribute contains the preferred name to be used for this person throughout the application. | | distinguishedName | This attribute contains the distinguished name by which the user is known. This default attribute must not be changed for a provisioning operation. | | dNSHostName | This attribute contains the fully qualified domain name for the service account. | | employeeNumber | This attribute contains the numerical identification key for this person within your enterprise. | | employeeType | This attribute contains a descriptive type for this user. For example, contractor, full time, or part time. | | externalEmailAddress | This attribute contains external email address of the mail user. Mail user is an AD user having mailbox outside of organization. | | facsimileTelephoneNumber | This attribute type contains telephone numbers and any required parameters for facsimile terminals. Each telephone number is one value of this multi-valued attribute. | | givenName | This attribute type contains name strings that are the part of a person's name that is not their surname. Each string is one value of this multi-valued attribute. For example, "John", "Sue", and "David". | | homeMDB | Exchange mailbox store DN. Required for mailbox creation. | | homePhone | This attribute contains the employees home phone number. | | homePostalAddress | This attribute contains the employees mailing address. | | initials | This attribute type contains strings of initials of some or all of an individual's names, except the surname(s). Each string is one value of this multi-valued attribute. For example, "J. A." and "J". | | internationalISDNNumber | This attribute type contains Integrated Services Digital Network (ISDN) addresses, as defined in the International Telecommunication Union (ITU) Recommendation E.164 \[E.164\]. Each address is one value of this multi-valued attribute. For example, "0198 444 444". | | l | This attribute type contains names of a locality or place, such as a city, county, or other geographic region. Each name is one value of this multi-valued attribute. For example, "Austin", "Chicago", and "Brisbane". | | mail | This attribute type contains the RFC822 mailbox for the user. | | mailNickname | Exchange Alias. | | manager | This attribute type contains the distinguished name of the manager to whom this person reports. | | memberOf | This attribute type contains the account group membership for this person on the application. | | memberOfSharedMailbox | This attribute type contains a list of shared mailboxes that the user has permissions for. | | mobile | This attribute type contains the mobile telephone number of this person. | | msDS-PrincipalName | Name of the entity in the following format: `NetBIOS domain name\sAMAccountName`. | | msExchHideFromAddressLists | Hide from Exchange address lists. | | msExchRecipientTypeDetails | This attribute type contains the type of the Microsoft Exchange recipient object. | | msNPAllowDialin | Indicates whether the account has permission to dial in to the RAS server. | | msNPCallingStationID | If this property is enabled, the server verifies the caller's phone number. If the caller's phone number does not match the configured phone number, the connection attempt is denied. | | msRADIUSCallbackNumber | The phone number that is used by the server is set by either the caller or the network administrator. If this property is enabled, the server calls the caller back during the connection process. | | msRADIUSFramedIPAddress | Use this property to assign a specific IP address to a user when a connection is made. | | msRADIUSFramedRoute | Define a series of static IP routes that are added to the routing table of the server running the Routing and Remote Access service when a connection is made. | | NetBIOSName | Domain NetBIOS Name of the account. | | o | This attribute type contains the names of an organization. Each name is one value of this multi-valued attribute. | | objectClass | The values of the objectClass attribute describe the kind of object which an entry represents. The objectClass attribute is present in every entry, with at least two values. One of the values is either "top" or "alias". | | objectguid | Globally unique identifier of the object. | | objectSid | Windows Security Identifier. | | objectType | Indicates type of the Active Directory objects. For example, User, Contact | | ou | This attribute type contains the names of an organizational unit. Each name is one value of this multi-valued attribute. For example, "Sales", "Human Resources", and "Information Technologies". | | pager | This attribute type contains the telephone number of this person's pager. | | physicalDeliveryOfficeName | This attribute type contains names that a Postal Service uses to identify a specific post office. For example, "Austin, Downtown Austin" and "Chicago, Finance Station E". | | postalAddress | This attribute type contains addresses used by a Postal Service to perform services for the object. Each address is one value of this multi-valued attribute. For example, "1111 Elm St.AustinTexas$USA". | | postalCode | This attribute type contains codes used by a Postal Service to identify postal service zones. Each code is one value of this multi-valued attribute. For example, "78664", to identify Pflugerville, TX, in the USA. | | postOfficeBox | This attribute type contains postal box identifiers use by a postal service to locate a box on the premises of the Postal Service rather than a physical street address. Each postal box identifier is a single value of this multi-valued attribute. For example, "Box 27". | | preferredDeliveryMethod | This attribute type contains an indication of the preferred method of getting a message to the object. For example, if the mhs-delivery Delivery Method is preferred over telephone-delivery, which is preferred over all other methods, the value would be: "mhs $ telephone". | | preferredLanguage | This attribute type contains the preferred written or spoken language of this person. | | primaryGroupDN | This attribute contains the distinguished name of the user's primary group. | | primaryGroupID | This attribute contains the RID of the user's primary group. | | pwdLastSet | This attribute contains the time of the last password reset. | | registeredAddress | This attribute type contains postal addresses to be used for deliveries that must be signed for or require a physical recipient. Each address is one value of this multi-valued attribute. For example, "ReceptionistXYZ Technologies6034 Courtyard Dr.Austin, TXUSA". | | roomNumber | This attribute type contains the room or office number or this person's normal work location. | | sAMAccountName | This attribute type contains the sAMAccountName for this user. | | secretary | This attribute type contains the distinguished name of this person's secretary. | | seeAlso | This attribute type contains the distinguished names of objects that are related to the subject object. Each related object name is one value of this multi-valued attribute. For example, the person object "cn=Elvis Presley,ou=employee,o=XYZ\\, Inc." is related to the role objects "cn=Bowling Team Captain,ou=sponsored activities,o=XYZ\\, Inc." and "cn=Dart Team,ou=sponsored activities,o=XYZ\\, Inc.". Since the role objects are related to the person object, the seeAlso attribute contains the distinguished name of each role object as separate values. | | shadowAccountDN | This attribute contains the distinguished name of the linked mailbox shadow account. | | shadowAccountGuid | This attribute contains the ObjectGuid of the linked mailbox shadow account. | | sn | This attribute type contains name strings for surnames, or family names. Each string is one value of this multi-valued attribute. For example, "Smith". | | st | This attribute type contains the full names of states or provinces. Each name is one value of this multi-valued attribute. For example, "Texas". | | street | This attribute type contains site information from a postal address (that is, the street name, place, avenue, and the house number). Each street is one value of this multi-valued attribute. For example, "15 Main St.". | | telephoneNumber | This attribute type contains telephone numbers that comply with the ITU Recommendation E.123 `[E.123]`. Each number is one value of this multi-valued attribute. | | teletexTerminalIdentifier | The withdrawal of Recommendation F.200 has resulted in the withdrawal of this attribute. | | telexNumber | This attribute type contains sets of strings that are a telex number, country code, and answer back code of a telex terminal. Each set is one value of this multi-valued attribute. | | title | This attribute type contains the persons job title. Each title is one value of this multi-valued attribute. For example, "Vice President", "Software Engineer", and "CEO". | | uid | This attribute type contains computer system login names associated with the object. Each name is one value of this multi-valued attribute. For example, "s9709015", "admin", and "Administrator". | | userPrincipalName | This attribute contains the unique name of the entity within the domain using the format `name@domain`. | ## List of LDAP Attribute Names and Associated Name in Active Directory Active Directory Display Names and LDAP Names to be used while importing as a CSV file. | Name in Active Directory | LDAP Name (Header in CSV File) | | --- | --- | | First Name | `givenName` | | Middle Name/Initials | `initials` | | Last Name | `sn` | | Logon Name | `userPrincipalName` | | Logon Name (Pre Windows 2000) | `sAMAccountName` | | Display Name | `displayName` | | Full Name | `name`/`cn` | | Description | `description` | | Office | `physicalDeliveryOfficeName` | | Telephone Number | `telephoneNumber` | | Email | `mail` | | Web Page | `wWWHomePage` | | Password | `password` | | Street | `streetAddress` | | PO Box | `postOfficeBox` | | City | `l` | | State/Province | `st` | | Zip/Postal Code | `postalCode` | | Country | `co` | | Country 2 Digit Code - e.g., US | `c` | | Country Code - e.g., 840 for the US | `countryCode` | | Add to Groups | `memberOf` | | Remove from Groups | `removememberOf` | | Account Expires (use the same date format as the server) | `accountExpires` | | User Account Control | `userAccountControl` | | User Photo | `thumbnailPhoto` / `exchangePhoto` (supports high resolution photos) / `jpegPhoto` / `photo` / `thumbnailLogo` | | Profile Path | `profilePath` | | Login Script | `scriptPath` | | Home Folder | `homeDirectory` | | Home Drive | `homeDrive` | | Log on to | `userWorkstations` | | Home | `homePhone` | | Pager | `pager` | | Mobile | `mobile` | | Fax | `facisimileTelephoneNumber` | | IP Phone | `ipPhone` | | Notes | `info` | | Title | `title` | | Department | `department` | | Company | `company` | | Manager | `manager` | | Mail Alias | `mailNickName` | | Simple Display Name | `displayNamePrintable` | | Hide from Exchange Address Lists | `msExchHideFromAddressLists` | | Sending Message Size (KB) | `submissionContLength` | | Receiving Message Size (KB) | `delivContLength` | | Accept Messages from Authenticated Users Only | `msExchRequireAuthToSendTo` | | Reject Messages From | `unauthOrig` | | Accept Messages From | `authOrig` | | Send on Behalf | `publicDelegates` | | Forward To | `altRecipient` | | Deliver and Redirect | `deliverAndRedirect` | | Recipient Limits | `msExchRecipLimit` | | Use Mailbox Store Defaults | `mDBuseDefaults` | | Issue Warning at (KB) | `mDBStorageQuota` | | Prohibit Send at (KB) | `mDBOverQuotaLimit` | | Prohibit Send and Receive at (KB) | `mDBOverHardQuotaLimit` | | Do not Permanently Delete Messages Until the Store Has Been Backed Up | `deletedItemFlags` | | Keep Deleted Items for (days) | `garbageCollPeriod` | | Outlook Mobile Access | `msExchOmaAdminWirelessEnable` | | Outlook Web Access | `protocolSettings` | | Allow Terminal Server Logon | `tsAllowLogon` | | Terminal Services Profile Path | `tsProfilePath` | | Terminal Services Home Directory | `tsHomeDir` | | Start the Following Program at Logon | `tsInheritInitialProgram` | | Starting Program File Name | `tsInitialProgram` | | Start In | `tsWorkingDir` | | Connect Client Drive at Logon | `tsDeviceClientDrives` | | Connect Client Printer at Logon | `tsDeviceClientPrinters` | | Default to Main Client Printer | `tsDeviceClientDefaultPrinter` | | End Disconnected Session | `tsTimeOutSettingsDisConnections` | | Active Session Limit | `tsTimeOutSettingsConnections` | | Idle Session Limit | `tsTimeOutSettingsIdle` | | When Session Limit Reached or Connection Broken | `tsBrokenTimeOutSettings` | | Allow Reconnection | `tsReConnectSettings` | | Remote Control | `tsShadowSettings` | | Protect Accidental Deletion | `preventDeletion` | | Manager Can Update Members | `managerCanUpdateMembers` | | Primary Group ID | `primaryGroupID` | | Administrative Group | `msExchAdminGroup` | | Exchange Server Name | `msExchHomeServerName` | | Managed By | `managedBy` | | externalEmailAddress (internal name: `targetAddress`) | `targetAddress` | | Add Proxy Addresses | `proxyAddresses` | | Automatically Update Email-Address Based on Recipient Policy | `msExchPoliciesExcluded` | | Employee Identifier | `employeeID` | | The user's division | `division` | ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The Microsoft Active Directory connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. | Attribute Name | Description | | --- | --- | | cn | This attribute type contains names of an object. Each name is one value of this multi-valued attribute. If the object corresponds to a person, it is typically the person's full name. For example, "Martin K Smith", "Marty Smith" and "printer12". | | description | This attribute type contains human-readable descriptive phrases about the object. Each description is one value of this multi-valued attribute. For example, "Updates are done every Saturday, at 1am.", and "distribution list for sales". | | distinguishedName | This attribute contains the distinguished name by which the user is known. | | GroupScope | This attribute type contains the group scope. | | GroupType | This attribute type contains the group type. | | mailNickname | Exchange distribution group name. | | memberOf | This attribute type contains the group membership for this person on the application. | | msDS-PrincipalName | Name of the entity in the following format: `NetBIOS domain name\sAMAccountName`. | | NetBIOSName | Domain NetBIOS Name of the group. | | o | This attribute type contains the names of an organization. Each name is one value of this multi-valued attribute. | | objectSid | Windows Security Identifier. | | objectguid | Globally unique identifier of the object. | | ou | This attribute type contains the names of an organizational unit. Each name is one value of this multi-valued attribute. For example, "Sales", "Human Resources", and "Information Technologies". | | owner | This attribute type contains the owner of the object. | | sAMAccountName | This attribute type contains the sAMAccountName for this group. | ## Attributes for Terminal Services Attributes marked with an asterisk (\*) in [Default Account Attributes](<#default-account-attributes>) are the Terminal Services/Remote Desktop Services attributes described here. By default, these attributes are not added to the schema and provisioning policy for performance optimization. To manage Terminal Services attributes, add these attributes to the schema and provisioning policy. Alternatively, you can uncomment these attributes from the connector registry and import it again. | Attribute Name | Description | | --- | --- | | TS\_TerminalServicesProfilePath | The roaming or mandatory profile path to be used when the user logs on to the RD Session Host server. | | TS\_TerminalServicesHomeDrive | The root drive for the user. | | TS\_TerminalServicesHomeDirectory | The root directory for the user. | | TS\_TerminalServicesInitialProgram | The path and file name of the application that the user wants to start automatically when the user logs on to the RD Session Host server. | | TS\_TerminalServicesWorkDirectory | The working directory path for the user. | | TS\_EnableRemoteControl | A value that specifies whether to allow remote observation or remote control of the user's Remote Desktop Services session. | | TS\_AllowLogon | A value that specifies whether the user is allowed to log on to the RD Session Host server. | | TS\_BrokenConnectionAction | A value that specifies the action to be taken when a Remote Desktop Services session limit is reached. | | TS\_ReconnectionAction | A value that specifies if reconnection to a disconnected Remote Desktop Services session is allowed. | | TS\_ConnectClientDrivesAtLogon | A value that specifies if mapped client drives should be reconnected when a Remote Desktop Services session is started. | | TS\_ConnectClientPrintersAtLogon | A value that specifies whether to reconnect to mapped client printers at logon. The value is one if reconnection is enabled, and zero if reconnection is disabled. | | TS\_DefaultToMainPrinter | A value that specifies whether to print automatically to the client's default printer. The value is one if printing to the client's default printer is enabled, and zero if it is disabled. | | TS\_MaxConnectionTime | The maximum duration of the Remote Desktop Services session, in minutes. After the specified number of minutes have elapsed, the session can be disconnected or terminated. | | TS\_MaxDisconnectionTime | The maximum amount of time, in minutes, that a disconnected Remote Desktop Services session remains active on the RD Session Host server. After the specified number of minutes have elapsed, the session is terminated. | | TS\_MaxIdleTime | The maximum amount of time that the Remote Desktop Services session can remain idle, in minutes. After the specified number of minutes has elapsed, the session can be disconnected or terminated. | ## Microsoft Lync/Skype for Business Server Attributes | Attribute Name | Description | | --- | --- | | msRTCSIP-UserEnabled | Whether the user is currently enabled for Microsoft Lync/Skype for Business Server. | | DialPlan | Name of the user DialPlan. | | LineServerURI | The line server URL. | | EnabledForFederation | Whether a user is enabled for federation. | | PublicNetworkEnabled | Whether a user is enabled for access outside the network. | | EnterpriseVoiceEnabled | Whether a user's EnterpriseVoiceEnabled service is enabled. | | LineURI | The line Uniform Resource Identifier (URI). | | SipAddress | This attribute contains the SIP address of a given user. | | VoicePolicy | The name of the Voice Policy. | | MobilityPolicy | The name of the Mobility Policy. | | ConferencingPolicy | The name of the Conferencing Policy. | | PresencePolicy | The name of the Presence Policy. | | VoiceRoutingPolicy | The name of the VoiceRouting Policy. | | RegistrarPool | The name of the registrar pool. | | LocationPolicy | The name of the Location Policy. | | ClientVersionPolicy | The name of the ClientVersion Policy. | | ClientPolicy | The name of the Conferencing Policy. | | ExternalAccessPolicy | The name of the ExternalAccess Policy. | | HostedVoicemailPolicy | The name of the HostedVoicemail Policy. | | PersistentChatPolicy | The name of the PersistentChat Policy. | | UserServicesPolicy | The name of the UserServices Policy. | | ExperiencePolicy | The name of the Experience Policy. | | ArchivingPolicy | The name of the Archiving Policy. | | LegalInterceptPolicy | The name of the LegalIntercept Policy. | | PinPolicy | The name of the Pin Policy. | | LyncPinSet | Whether a user's pin is set. | | LyncPinLockedOut | Whether a user's pin is locked. | ## Managed Service Account Attributes You can automate the process of adding managed service account attributes to the account schema, with the toggle option for Managed Service Account Attributes during Account Schema configuration. This reduces your efforts by automating the managed service account attributes addition process. It allows the segregation of various feature attributes within the account schema for better retrieval. Select **Include Attributes in Schema** for managing service account attributes to automate the process of adding Service Account attributes to the account schema during Account Schema configuration. > [!NOTE] > > Only these attributes are certified for provisioning and read operations for managing Managed Service Accounts and group Managed Service Accounts (gMSA). | Attribute Name | Description | | --- | --- | | msDS-AllowedToActOnBehalfOfOtherIdentity | Accounts that can act on the behalf of this Group Managed Service Account. Values of this multi-valued attribute must be in Distinguished Name format. IQService is required to read and provision this property. | | msDS-GroupMSAMembership | Principals allowed to use this Group Managed Service Account. Values of this multi-valued attribute must be in Distinguished Name format. IQService is required to read and provision this property. | | msDS-ManagedPasswordInterval | Interval in days after which Active Directory changes the password of the Managed Service Account. | | msDS-SupportedEncryptionTypes | Supported Encryption Types for the Managed Service Account. This attribute can have multiple values. For example, RC4, AES128, AES256. | | servicePrincipalName | Service principal names for the Managed Service Account. This attribute is multi-valued. For example, `MyService/Host1.example.com`. | # Securing the Active Directory Application Secure the Active Directory application by using the following communication paths based on the operations performed. SailPoint recommends securing every communication path for the Active Directory application by following the configurations outlined below: - Source (VA) and Active Directory Domain Controller (for most of the read operations): [TLS Configuration on Virtual Appliances]() is required to secure this path. - Source (VA) and IQService (for provisioning and read operations for Skype management): TLS Configuration Between VA and IQService is required to secure this path. For more information, refer to [Configuring TLS and Client Authentication for IQService](). - IQService and Active Directory Domain Controller (for provisioning and read operations for Skype management): TLS configuration between IQService and Active Directory Domain Controller is required to secure this path. ## Securing Communication Path Between IQService and Active Directory Domain Controller / Target System For IQService to connect using TLS and self-signed certificates, you must install the certificate in Trusted Root Certification Authorities on the IQService host. To install a certificate, complete the following: 1. Export the server certificate and copy the exported `.cer` file to the IQService host. 2. Double-click the `.cer` file, select **Install Certificate**, and select **Next**. 3. Choose **Place all certificates in the following store** and select **Browse**. 4. Select **Show physical stores**. 5. Expand **Trusted Root Certification Authorities** and select **Local Computer**. 6. Select **OK**. 7. Select **Next**, and then **Finish**. ## Certification for Microsoft Advisory ADV190023 The Active Directory source is certified for the Microsoft [ADV190023 Advisory](). All source functionality works correctly when LDAP channel Binding and LDAP Signing configuration are enabled on Domain Controller. These settings are only applicable over secure channel using TLS protocol, ensure that TLS is configured. # TLS Configuration on Virtual Appliances Enabling a source to communicate with a virtual appliance using a TLS connection encrypts all data sent between the source and the VA. ## Sources That Support TLS The following sources can be configured to communicate over a TLS connection: - [Active Directory]() - [ACF2]() - [Top Secret]() - [IBM i]() - [OpenLDAP]() - [Oracle Internet Directory]() - [RSA]() - [RACF]() ## Manually Uploading a Certificate to a Virtual Appliance ### Import a Certificate and Keychain to the Virtual Appliance > [!IMPORTANT] > > When adding a certificate to the virtual appliance (VA), ensure that the certificate you copy is in Privacy-Enhanced Mail (PEM) format. - Before manually adding a new certificate for the source to your virtual appliance's truststore, ensure the following: - The virtual appliance (VA) is not connected to the source. - Connection testing between the source and VA is suspended. - Scheduled aggregations are temporarily paused, if necessary. - The source server has been configured for TLS. - The `va-config-.yaml` file has been configured for your virtual appliance. - You must complete the following steps for every virtual appliance on the virtual appliance cluster connected to the source: 1. Copy the PEM-encoded certificates to the `/home/sailpoint/certificates` directory. This directory might not be empty because it's where the VA adds any certificates it gets from the source. 2. Restart the CCG using the following command: `sudo systemctl restart ccg` 3. Watch the `/home/sailpoint/log/ccg-start.log` file. If successful, the import should log messages from the form: ```text {"@timestamp":"2017-04-21 06:57:12 +0000","level":"INFO","type":"ccg","message":"Checking CCG Sources certificates"} {"@timestamp":"2017-04-21 06:57:12 +0000","level":"INFO","type":"ccg","message":"Cert files found: [\"/home/sailpoint/certificates/411818.pem\"]"} 06:57:12 +0000","level":"INFO","type":"ccg","message":"Importing cert /home/sailpoint/certificates/411818.pem"} ``` > **Note** > > If you see an error instead of the log messages above, this is an indication that your certificate is in an invalid format. Verify you're using a PEM format for your certificate and then try again. - Sometimes the export of a certificate may not work properly with the VA. Using the openSSL command to get the certificate is a good way to get the latest certificate. 1. Use the openSSL command to get the latest certificate: 1. Run the following command in openSSL: `openssl s_client -connect server.example.com:636 > output < /dev/null` 2. From the command output file, copy the certificate content between `--BEGIN CERTIFICATE--` and `--END CERTIFICATE--`. 3. Create a new file called `cert.pem` in the `/home/sailpoint/certificates` folder. 4. Save the copied certificate contents in the new `cert.pem` file. 2. Restart the CCG using the following command: `sudo systemctl restart ccg` ## Using an External Certificate Authority (CA) ### Add the Certificate to the Virtual Appliance If you're using an external certificate authority, you only have to connect to the VA from the source to import the certificate. **Prerequisites:** - The ability to use TLS 1.0 - 1.2 - You have created at least one virtual appliance cluster - CA root and intermediate certificates are in the Java CAcerts keystore - The certificate is on the source **Complete the following steps:** 1. In the source, ensure that the following are true: - The **Hostname** for the source matches the hostname in the virtual appliance's configuration. - The source is connected to the virtual appliance you configured to use TLS. > **Note** > > If you are using Active Directory with IQService enabled, the Hostname cannot be an IP Address. 2. Change the **Port** to **636**. > **Screenshot** > > [![Change the port to 636]()]() 3. If available, select the **Advanced Options** checkbox. 4. In the **Use TLS** field, select the **Enable** checkbox. > **Screenshot** > > [![Enable Use TLS]()]() 5. Test the connection. > **Note** > > The source's certificate is auto-imported to the VA. ### Replace an Expired Certificate Issued by an External Certificate Authority When your certificate has expired, replace it on the source and then reboot your VA. **Prerequisites** - Complete the process described in [Add the Certificate to the Virtual Appliance](<#add-the-certificate-to-the-virtual-appliance>). **Complete the following steps:** 1. Add the new certificate on the source with a new name. 2. Restart the CCG using the following command: `sudo systemctl restart ccg` > [!NOTE] > > The source's certificate is auto-imported to the VA. ## Using an Internal Certificate Authority ### Add the Certificate to the Virtual Appliance If you're using your own certificate authority, you will need to add the root and intermediate certificates to the VA. > [!NOTE] > > This process might also be required if your source is not automatically uploading the certificate from the VA. **Prerequisites:** - You have created at least one virtual appliance cluster - The certificate is on the source **Complete the following steps:** 1. Import the certificate and the entire key chain (Root and Intermediate Certificates) to the VA as described in [Import a Certificate and Keychain to the Virtual Appliance](<#import-a-certificate-and-keychain-to-the-virtual-appliance>). 2. Restart the CCG using the following command: `sudo systemctl restart ccg` 3. In the source, ensure that the following are true: - The **Hostname** for the source matches the hostname in the virtual appliance's configuration. - The source is connected to the virtual appliance you configured to use TLS. > **Note** > > If you are using Active Directory with IQService enabled, the Hostname cannot be an IP Address. 4. Change the **Port** to **636**. > **Screenshot** > > [![Change the port to 636]()]() 5. If available, select the **Advanced Options** checkbox. 6. In the **Use TLS** field, select the **Enable** checkbox. > **Screenshot** > > [![Enable Use TLS]()]() 7. Test the connection. > [!NOTE] > > The source's certificate is auto-imported to the VA. ### Replace an Expired Certificate Issued by an Internal Certificate Authority If you're using an internal CA, you need to add the new certificate on both the source and the VA with a new name. **Prerequisites:** - Complete the process described in [Add the Certificate to the Virtual Appliance](<#add-the-certificate-to-the-virtual-appliance_1>) **Complete the following steps:** 1. Add the new certificate on the source with a new name. 2. Import certificate and entire key chain (Root and Intermediate Certificates) to VA as described in [Import a Certificate and Keychain to the Virtual Appliance](<#import-a-certificate-and-keychain-to-the-virtual-appliance>). 3. Restart the CCG using the following command: `sudo systemctl restart ccg` 4. Test the connection. # Enable Connector Logging This topic provides the steps needed to enable logging on SailPoint using REST APIs. > [!NOTE] > > This topic only applies to VA-based integrations. > [!NOTE] > > The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector. This process is broken up into four steps: 1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging. 2. Get the logging configuration for the existing VA cluster. 3. Update the VA cluster to enable logging levels. 4. Observe logging changes to the logging levels. ### Identify the Virtual Appliance Cluster Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>). 1. Make the following call to the REST API to return a list of available VA clusters: GET /v3/managed-clusters The REST API returns a response that looks similar to the following: ```json [ { "id": "2c9180866166b5b0016167c32ef31a66", "name": "Development Cluster", "description": "Development Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": null }, { "id": "2c9180846a93ce60016ab29f039944de", "name": "Cloud Cluster", "description": "Cloud Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } } ] ``` > **Note** > > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster. 2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute. ### Get the Logging Configuration Get your selected VA's cluster logging configuration and identify the values you need to update. 1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. GET /v3/managed-clusters/{id}/log-config - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response. - If the VA has an existing logging configuration, it returns something similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` You'll need to configure the following information in the response: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). ### Update Logging Configuration Update the VA cluster configuration returned by the REST API to update the logging settings as needed. 1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. PUT /v3/managed-clusters/{id}/log-config 2. Submit your configuration changes to the REST API in a JSON body. - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one. - If the VA returned a configuration, you can edit it to include the changes. The JSON body should be as follows: ```json { "durationMinutes": 60, "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` Consider the following as you edit the JSON: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). If the update was successful, the REST API should return a response similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` ### Observe Logging Changes Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**. ### References The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file. #### Logging Levels | Logging Level | Description | | --- | --- | | ERROR | Designates error events that might still allow the connector to continue. | | WARN | Designates potentially harmful situations. | | INFO | Designates information messages that highlight process at a coarse-grain level. | | DEBUG | Very verbose. Fine grain logging levels used for development and debugging. | | TRACE | Most verbose. Finer grain logging levels than debugging. | #### Logging Classes | Connector | Logging Class | | --- | --- | | Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector | | AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector | | Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT | | Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector | | Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector | | Microsoft Entra ID | sailpoint.connector.AzureADConnector | | Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter | | Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter | | Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT | | Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter | | Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter | | GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter | | Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter | | IBM i | openconnector.connector.IBMiConnector | | Lotus Domino | sailpoint.connector.LotusDomino | | JDBC | sailpoint.connector.JDBCConnector | | Sun One LDAP | sailpoint.connector.LDAPConnector | | Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector | | Microsoft Office365 | sailpoint.connector.Office365Connector | | Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 | | Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT | | Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector | | Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector | | Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter | | Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector | | Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector | | Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector | | PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter | | PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector | | RemedyForce | sailpoint.connector.ForceConnector | | RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter | | Salesforce | sailpoint.connector.ForceConnector | | SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector | | SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector | | SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT | | SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector | | SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter | | SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter | | ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter | | ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter | | Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter | | Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter | | Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter | | SuccessFactors | sailpoint.connector.SuccessFactorsConnector | | Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector | | Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter | | Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter | | Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter | | Web Services | sailpoint.connector.WebServices | | XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter | | Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter | | Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter | # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](). For more information, refer to the Active Directory Connector - FAQ and Troubleshooting document. ## Exchange Connection Fails with Certificate Revocation Error When attempting to connect to a Microsoft Exchange server, the operation fails with the following error message: ```text The SSL certificate could not be checked for revocation. The server used to check for revocation might be unreachable ``` This error occurs when the client (such as an IQService machine) cannot access the Certificate Revocation List (CRL) distribution point specified in the SSL certificate. **Resolution**: Follow these steps to validate your configuration: - In your application configuration, verify that the ExchHost parameter is set to the complete FQDN of the Exchange server. - Confirm that the SSL certificate for the Exchange server has been correctly imported on the server running IQService. The certificate must be placed in the Trusted Root Certification Authorities folder. - The certificate's Subject Alternative Name (SAN) field must contain an entry that exactly matches the FQDN of the Exchange server. ## Authentication Error Error occurred while authentication user: `Xyz` ```text Unable to use PTA with SASL ``` **Resolution**: Check the UPN name being used. Kerberos Authentication requires `userPrincipalName` as the primary requirement, and due to differences in the domain for `userPrincipalName`, the PTA authentication is failing. You must use the correct domain. For example, if you have two domains: ```text Abc.com xyz.abc.com ``` and you want to perform PTA for users present at `xyz.abc.com`, the format should be `username@xyz.abc.com`. ## Referrals During Account Aggregation During account aggregation, you might see one of the following errors: ```text Referrals during account aggregation or aggregation leading to javax.naming.PartialResultException ``` OR ```text Get Object failed with javax.naming.PartialResultException ``` OR ```text Pass-through authentication taking a long time to authenticate ``` Referrals occur when a domain controller redirects client requests to other servers or domains that might contain the requested information. This can happen when the domain controller does not have the necessary information to complete the request. **Resolution**: To avoid getting referrals and improve the performance of the AD connector, use the SailPoint REST APIs: > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. 1. Set the `ldapExtendedControls` attribute with a value such as `sample_ldapExtendedControls_value`. Refer to [LDAP Extended Controls]() for more information. > **Note** > > You can set multiple LDAP extended controls using the `ldapExtendedControls` attribute. 2. Verify the following entry is configured in source configuration: ```json "ldapExtendedControls": ["1.2.840.113556.1.4.1339"] ``` ## Exchange Provisioning Error You may see the following error during exchange provisioning: ```text Errors returned from IQService: Connecting to remote server <> failed with the following error message: The WinRM client cannot process the request. Basic Authentication is currently disabled in the client configuration. Change the client configuration and try the request again. ``` **Resolution**: Complete the following: 1. Check whether the Windows Remote Management service is installed on both the IQService and exchange server machine, and the service is up and running. To validate this, open PowerShell as an administrator and execute the following commands, before exchange provisioning: ```powershell winrm qc winrm e winrm/config/listener ``` 2. Ensure that the internal firewall is turned off. 3. If the steps mentioned above are unable to resolve the error, complete the following for the exchange server: 1. Open a PowerShell prompt as an administrator and run: ```powershell winrm get winrm/config/client ``` 2. If the Basic auth is set to false, then run the following command to set it to true: ```powershell winrm set winrm/config/client/auth '@{Basic="true"}' ``` ## Create Account Operation Error Create Account operation fails with the following error: ```text Errors returned from IQService. Failed to update attributes. There is no such object on the server. ``` Although the account gets created on Active Directory, some attributes are not configured. **Resolution**: If the manager attribute is present in `AccountRequest` (of the provisioning plan), confirm that the value of this attribute contains the distinguished name of the manager, instead of the name strings. ## Create New Account or Set Password Operation Error Error message: ```text Error occurred while setting password for the account. Exception has been thrown by the target of an invocation. One or more input parameters are invalid. ``` The above issue is observed for the following versions of Microsoft Windows Servers: - Microsoft Windows Server 2016 - Microsoft Windows Server 2012 R2 with KB 4012219 installed - Microsoft Windows Server 2012 with KB 4012220 installed - Microsoft Windows Server 2008 R2 with KB 4012218 installed **Resolution**: Ensure that the following Local Security Policy is set to **Not Defined**, or if it is enabled then ensure that the Local Security Policy contains the service account which is configured on the Active Directory source: ```text Network access: Restrict clients allowed to make remote calls to SAM ``` For Local Security Policy, go to **Local Computer Policy \> Computer Configuration \> Windows Settings \> Security Settings \> Local Policies \> Security Options**. ## Delta Aggregation Error Active Directory source delta aggregation may fail with the following error: ```text javax.naming.NoPermissionException: [LDAP: error code 50 - 00002105: LdapErr: DSID-0C0909F1, comment: Error processing control, data 0, v2580; remaining name 'dc=XX,dc=XXX,dc=XXX' ``` **Resolution**: Add the 'replicating directory changes' permission on the service account. Alternatively, add the service account to a security group that has the 'replicating directory changes' permission. ## Organizational Units (OU) Child Objects Don't Update Following a Delta Aggregation If you make a change to an OU which contains accounts or groups, such as renaming or moving it, a delta aggregation doesn't pick up the changes. This is a limitation in Microsoft DirSync Control. Refer to [Polling for Changes Using the DirSync Control]() for more information. **Resolution**: Perform a full aggregation to capture the changes and update the child objects. You might have to do this regularly to ensure the data is up to date. ## PowerShell cmdlets Used for Exchange (Mail Contacts) and Skype Related Operations The following are the PowerShell cmdlets used by the Active Directory source: - For Exchange (Mail Contact): All provisioning operations are performed through IQService. Contacts are created using ADSI APIs, and are mail-enabled using the `Enable-MailContact` PowerShell cmdlet if `externalEmailAddress` is provided in the plan. Other cmdlets used for Contacts (cmdlets run remotely on the exchange server itself using WinRM) are as follows: - `Get-MailContact` - `Disable-MailContact` - `Set-MailContact` - Skype related operations: Skype cmdlets (all Skype cmdlets run locally on the IQService machine that requires administrative tools installed on the machine): - `Get-CsUser` - `Get-CsClientPinInfo` - `Set-CsUser` - `Move-CsUser` - `Enable-CsUser` - `Disable-CsUser` - `Set-CsClientPin` - `Lock-CsClientPin` - `Unlock-CsClientPin` - `Grant-Cs` - `Remove-Cs` The source user for provisioning of Exchange Server must be Remote Shell enabled. To enable Remote Shell for a user, set the `RemotePowerShellEnabled` parameter to `$True` on the `Set-User` cmdlet. For example, `Set-User UserName -RemotePowerShellEnabled $True`. ## Test Connection Error for TLS Test connection for the Active Directory source fails when TLS is on. **Resolution**: Ensure that the correct AD DC certificate has been imported in the VA certificates folder in case of SailPoint. Verify whether it is a valid certificate before putting it on the VA: Perform the test connection on port 636 for the intended certificate on an LDAP browser. If the test connection is successful for the SSL connection, it indicates that the certificate is from the correct domain, and you can import it in the certificate folder on the VA server. ## Account Aggregation Error Error message: ```text LDAP: error code 12 - 00000057: LdapErr: DSID-0C090AFA, comment: Error processing control error in Active Directory full account aggregation ``` **Resolution**: Complete the following: 1. Add the `disableSort` attribute using the SailPoint REST API. Set up the `disableSort` attribute with a value such as `true`. 2. Change the server order in the domain. If there is only one entry in the servers list, try adding some other servers present in the domain. This can be done on the UI by setting the **Servers** field, or by editing the "servers" element in the source XML as provided in the following example: ```xml Server1 Server2 ``` 3. Change the value of `pageSize` (if it is set to 100, change it to 1000 and vice versa) and verify the aggregation result. ## Password Change Error Active Directory Password change fails with the following error message: ```text Caught exception in bind for server ``` **Resolution**: Verify if the service account used in the source has the required permissions mentioned in the [Service Account Permissions]() section. ## Directory Service Attribute or Value Already Exists Error During Provisioning During provisioning, the following error occurs: ```text The specified directory service attribute or value already exists. ``` This error indicates that an attribute or value being provisioned already exists in the managed system. **Resolution**: Following are the steps to resolve the error: 1. Set `setAttributeLevelResult` to `true` (in the String value) in the source configuration. 2. Perform the provisioning again and check for the attribute that failed. 3. Identify the failed attribute in the provisioning result. 4. Add the identified failed attribute to the `provisionAttributesWithSetOperation` in the source configuration using the SailPoint REST APIs as shown below: ```json "provisionAttributesWithSetOperation": ["customAttribute1", "customAttribute2"] ``` For example, during a modify operation when attributes like `countryCode`, which are already present in the managed system with some default values, throws an error. In that case, add that attribute to the source configuration using the SailPoint REST APIs as shown below: ```json "provisionAttributesWithSetOperation": ["countryCode"] ``` Refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community for more information on SailPoint's REST APIs. 5. Perform the provisioning again to verify that the error has been resolved. ## Unable to Aggregate Objects from Other Domains in a Multi-Domain Active Directory Environment **Resolution**: Ensure that all the relevant domains are added to the domain settings configuration. This will enable the system to pull objects from all specified domains during the Account and Group aggregation processes. For more information, refer to [Domain Settings](). For example, if objects from a specific domain, such as `"dc=sde3t,dc=eix,dc=com"`, are not being aggregated, you need to add the corresponding domain configuration under the `domainSettings` key to the source XML. Here's an example of how to configure the domain details: ```json "domainSettings": [ { "password": "passWordvalue", "servers": [ "DNSNameofDC" ], "port": 654, "forestName": "eix.com", "authorizationType": "simple", "user": "domainName\\serviceAccount", "domainDN": "DC=domainName,DC=lab", "useSSL": true } ] ``` ## Provisioning Fails while Adding/Updating Exchange Attribute The following error appears while provisioning Exchange attributes: ```text Example: Caught exception in Modify for identity CN=[EXT_KPMG] Test Ad28,OU=EXTERNALS,OU=USERS,OU=PRESP,OU=ES,OU=BUILDINGS,DC=gestamp,DC=com. System.DirectoryServices.DirectoryServicesCOMException (0x8007300A): The specified directory service attribute or value does not exist. ``` This error occurs due to the misconfiguration of the Exchange settings. **Resolution**: Verify the debug level IQTrace logs. Ensure that the valid forest name is configured for `accountForestList` under [Exchange Settings](). For example, if a newly created user belongs to `DC=domainXYZ,DC=com`, the `accountForestList` should also contain the same forest name (such as `domainXYZ.com`). Here's an example showing how to configure this in the source XML: ```xml Forest2 domainXYZ.com ``` ## Changing the Domain of an Account via a PowerShell Script Within the Same AD Source Fails **Resolution**: Move/Rename operations are allowed within the same domain only. ## Provisioning Error While Using a Non domain Joined IQService The following error appears when using a non-domain-joined IQService during provisioning: ```text Caught exception in getting current schema. Will Continue...Current security context is not associated with an Active Directory domain or forest," Active Directory schema validation is failing. ``` **Resolution**: Add the `skipADSchemaCheck` attribute with a value of `true` to skip Active Directory schema validation during provisioning. For example, set `"skipADSchemaCheck": true` in the source configuration. ## AcceptSecurityContext Fails with Error Code 49 The following error occurs if the user account is a member of the Protected Users security group. ```text LDAP: error code 49 AcceptSecurityContext ``` By default, membership in this group applies strict, non-configurable security protections to the account. **Resolution**: To resolve this issue, remove the account from the Protected Users group. ## IQService Fails to Start, Restart, or Establish a Connection If you experience one or more of the following issues with IQService: - The IQService stops unexpectedly during operation. - The IQService fails to restart when prompted. - Client connections fail with a TLS handshake error. - Operations cannot be completed due to a permissions issue. - The IQService reports that it failed to create a session. These symptoms often indicate that the account running the service lacks the necessary privileges to operate correctly on the server. **Resolution**: To resolve these issues, change the IQService logon account to the Local System account, and then restart the service. ## User is Trying to Reset a Password Using SET Operation in Admin Context **Resolution**: To set a password in admin context, you must include the `preExpire` attribute with a value of `true` within the password change request in the provisioning plan. The following is an example of a provisioning plan: ```xml true ``` ## DC Zone Name Contains an Underscore (\_) **Resolution**: 1. Open Ethernet properties and go to: **TCP/IPv4 Settings \> Advanced \> WINS** tab. 2. Select **Enable NetBIOS over TCP/IP**. 3. Configure the IP address in the domain settings. ## Provisioning Fails with the Error "Failed to update attribute externalEmailAddress." The following error occurs during provisioning when Exchange Settings are configured as Enable-MailUser using the `externalEmailAddress` attribute: ```text Failed to update attribute externalEmailAddress The specified directory service attribute or value does not exist ``` **Resolution**: Use the `targetAddress` attribute instead of `externalEmailAddress` in your provisioning configuration. Because `externalEmailAddress` is only a display name in the Exchange UI, the AD connector requires the internal LDAP attribute, which is `targetAddress`. ## Test Connection Error with Unknown Host While configuring an Active Directory source, you might see the following error: ```text Detected password less authentication, but failed to retrieve passwords with error: Unknown Host ``` **Resolution**: On the virtual appliance, run the following command to confirm that the virtual appliance can connect to IQService: ```powershell nslookup ``` ## Partial Account Created During Provisioning Triggers Another Create Operation A partial account might be created when provisioning fails for some attributes. The connector then attempts to create the account again. **Resolution**: Set the `rollbackCreatedAccountOnError` attribute to `true` so the connector removes the newly created account when the provisioning flow fails for some attributes. ```json [ { "op": "add", "path": "/connectorAttributes/rollbackCreatedAccountOnError", "value": true } ] ``` > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. Refer to [Additional Configuration Parameters]() for more information. ## Accounts Dropped from Aggregation and Re-Added on Subsequent Runs Accounts might be dropped from aggregation and then re-added on subsequent aggregation runs. **Resolution**: Increase the `healthCheckTimeout` value in the source configuration using the SailPoint REST API. For example, set the value to 600: Refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community for more information on SailPoint's REST APIs. ```json [ { "op": "replace", "path": "/connectorAttributes/healthCheckTimeout", "value": 600 } ] ``` If increasing `healthCheckTimeout` does not resolve the issue, remove `PREFER_UUID` from the `featuresString` attribute. Preserve other features already configured on the source. For example: ```json [ { "op": "replace", "path": "/connectorAttributes/featuresString", "value": "AUTHENTICATE, ENABLE, MANAGER_LOOKUP, SEARCH, UNLOCK, UNSTRUCTURED_TARGETS, GROUP_PROVISIONING, SYNC_PROVISIONING, PASSWORD, CURRENT_PASSWORD, GROUPS_HAVE_MEMBERS, NO_PERMISSIONS_PROVISIONING, NO_GROUP_PERMISSIONS_PROVISIONING, DELETE" } ] ``` # Timeout Errors and Settings Timeout errors might occur when SailPoint is waiting for a response from the Virtual Appliance (VA). These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down. This document is designed to give specific information that can be used to resolve these errors. Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error. > [!IMPORTANT] > > Add the necessary attributes or values before performing the "replace" operation, as missing attributes will cause the operation to fail. To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the VA using the SailPoint REST API. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ### aggregateTimeout **Description:** This parameter is set for the aggregation timeout, measured in seconds. **Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds. For example: If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/aggregateTimeout", "value": 600 } ] ``` ### healthCheckTimeout **Description:** This parameter is set for the test connection and health check timeout. **Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again. For example: If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/healthCheckTimeout", "value": 45 } ] ``` ### provisioningTimeout **Description:** This parameter is set for provisioning timeout. **Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds. For example: If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/provisioningTimeout", "value": 360 } ] ``` ### timeout **Description:** This parameter is set for pass-through authentication timeout. **Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again. For example: If your current time value is 15 seconds, update the `timeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeout", "value": 30 } ] ``` ### apiTimeout **Description:** This parameter is set for API time tracking; customers can check it using an external tool. **Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again. For example: If your current time value is 60 seconds, update the `apiTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/apiTimeout", "value": "75" } ] ``` ### timeoutInSeconds **Description:** This parameter helps prevent the VA from waiting indefinitely for an API response, ensuring efficient handling of API requests. For example: If your current time value is 30 seconds, update the `timeoutInSeconds` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeoutInSeconds", "value": "15" } ] ``` # Using gMSA as a Service Account > [!IMPORTANT] > > Ensure that the "PowerShell module for Active Directory" is installed on the IQService machine. > [!IMPORTANT] > > Use Strong (SASL) authentication when you configure a group Managed Service Account (gMSA). You cannot use gMSA with simple bind, including simple bind with or without Transport Layer Security (TLS). **To configure IQService to use a Group Managed Service Account (gMSA):** 1. Create a gMSA account: 1. Open PowerShell as an administrator on the domain controller. 2. Run the following command to create a gMSA user, if not already existing: ```powershell New-ADServiceAccount -DNSHostName domainFQDNName -PrincipalsAllowedToRetrieveManagedPassword "" ``` For example, ```powershell New-ADServiceAccount gMSAuser1 -DNSHostName Monday.weekday.lab -PrincipalsAllowedToRetrieveManagedPassword "IQSERVICE$" ``` This command creates the gMSA account like `gMSAuser1` and allows the domain controllers and read only domain controllers to retrieve the password. After you create the account, grant the IQService host permission to retrieve the managed password, as described later in this topic. IQService does not need to be installed on a domain controller. 2. Restart the domain controller or run `klist purge -li 0x3e7` to refresh your credentials. 3. Grant the IQService host permission to retrieve the gMSA password by running the following command on the domain controller: ```powershell Set-ADServiceAccount -Identity -PrincipalsAllowedToRetrieveManagedPassword "" ``` For example, ```powershell Set-ADServiceAccount -Identity gMSAuser1$ -PrincipalsAllowedToRetrieveManagedPassword gMSAuser1$ "IQService$" ``` > **Note** > > Replace `IQServiceHostComputerName$` with the NetBIOS name of the IQService host computer account. Include the trailing `$`. If the gMSA account is also the Windows service logon account for IQService, include the gMSA account in `PrincipalsAllowedToRetrieveManagedPassword`, for example: ```powershell Set-ADServiceAccount -Identity myMSAAccount$ -PrincipalsAllowedToRetrieveManagedPassword "myMSAAccount$", "IQServiceServer$" ``` If a domain user or local user runs IQService instead of the gMSA account, add that logon user to `PrincipalsAllowedToRetrieveManagedPassword` rather than the gMSA account name. 4. On the IQService host, install the gMSA account by running the following command: ```powershell Install-ADServiceAccount -Identity '' ``` For example, ```powershell Install-ADServiceAccount -Identity 'CN=gMSAuser1,CN=Managed Service Accounts,DC=Weekday,DC=lab' ``` 5. Add the User Principal Name (UPN) to the gMSA account. Strong (SASL) authentication requires a UPN. Use the following format: `@` For example: `myMSAAccount@weekday.lab` Where: - **username** is the name of the gMSA account, for example: `myMSAAccount`. - **domain name** is the Active Directory domain, for example: `weekday.lab`. On the domain controller, set the UPN in Active Directory Users and Computers under **Managed Service Accounts** by opening the gMSA account properties and entering the UPN. 6. On the IQService host, grant the gMSA account Full Control on the IQService instance folder and registry key, then configure the Windows service. If you skip folder and registry permissions, IQService might fail to start. For example, you might see error 551053. 1. Select the IQService instance folder, open **Properties**, and go to the **Security** tab. 2. Select **Edit**, add the gMSA account, and under **Object Types**, select **Service Accounts**. 3. Assign **Full Control**, and then select **OK**. 4. Open Registry Editor and go to `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint\IQService Instances\`. 5. Right-click the instance key, select **Permissions**, and add the gMSA account. 6. Under **Object Types**, select **Service Accounts**, assign **Full Control**, and then select **OK**. 7. Open **Services.msc** and locate the IQService instance. 8. Right-click the service and select **Properties**. 9. On the **Log On** tab, set the account name to `myMSAAccount$`. 10. Clear any values in the password fields. 11. Select **Apply** and then **OK**. 12. Restart IQService for the changes to take effect. 7. Configure Active Directory in SailPoint: You cannot use the gMSA account as the IQService user during [IQService Settings]() configuration for client authentication. Configure a domain or local user with a password for that purpose. 1. Ensure that you have added the necessary TLS certificate to the Virtual Appliance (VA) before creating the Active Directory connector. > **Important** > > SailPoint recommends to add the necessary TLS certificate to the Virtual Appliance (VA) before creating the Active Directory connector to ensure a smooth configuration process. 2. Go to the **Domain Settings** in the Active Directory configuration. 3. Select **Use gMSA as a Service Account**. 4. Set Authentication Type to **Strong (SASL)**. 5. Clear **Use Transport Layer Security (TLS)** for the domain LDAP connection and use a non-TLS port (for example, `389`). 6. Provide the necessary domain details, such as **Forest Name**, **Domain DN**, **Servers**, and the gMSA account UPN. 7. Run a test connection to verify the configuration. IQService can use TLS for communication with SailPoint. Domain LDAP authentication for gMSA still uses Strong (SASL) on a non-TLS port. Here's an example of the configuration: ```json { "entry": { "value": { "List": { "Map": { "entry": [ { "key": "authorizationType", "value": "strong" }, { "key": "forestName", "value": "weekday.lab" }, { "key": "domainDN", "value": "DC=weekday,DC=lab" }, { "key": "password" }, { "key": "port", "value": "389" }, { "value": { "Boolean": "true" }, "key": "enablePasswordLessAuthenticationForDomain" }, { "value": { "List": { "String": "myDC.weekday.lab" } }, "key": "servers" }, { "value": { "Boolean": "" }, "key": "useSSL" }, { "key": "user", "value": "myMSAAccount@weekday.lab" } ] } } }, "key": "domainSettings" } } ``` > [!IMPORTANT] > > The GMSAPasswordData service is disabled by default. The gMSA password retrieval does not work unless IQService uses TLS and you enable GMSAPasswordData. > > To enable GMSAPasswordData after upgrading from a previous version, refer to [Configuring TLS and Client Authentication for IQService](). > > For other IQService service and service status, refer to [Option to Enable/Disable Services](). ## Opening Port 88 for gMSA Communication When you use a gMSA account, open port 88 on the firewall for communication between the Virtual Appliance (VA), the IQService server, and Active Directory. If this port is not open, the test connection fails with a timeout error. ## Using Non-TLS LDAP Ports with Strong (SASL) Authentication For domain and forest settings, use a non-TLS LDAP port. TLS is not supported for Strong (SASL) authentication with gMSA, so you cannot use gMSA with simple bind, with or without Transport Layer Security (TLS). > [!NOTE] > > This restriction applies only to the LDAP connection between SailPoint and Active Directory. IQService can still use TLS for its own communication. ## Configuring Forest Settings for gMSA After IQService runs under the gMSA account, configure the Active Directory source forest settings the same way as the domain settings: provide the gMSA account UPN, set the authentication type to Strong (SASL), and use a non-TLS port. For field-level guidance, refer to [Forest Settings]() and [Domain Settings]().