# SailPoint Microsoft Azure SQL Database Connector Documentation > Microsoft Azure SQL Database Connector Documentation # Documentation # Aggregation For more information about Aggregation, refer to [Loading Account Data](). ## Accounts For the Microsoft Azure SQL Database, aggregation brings server login as links and connected database accounts as entitlements. Orphan database accounts are not fetched. ## Entitlement Aggregation Entitlement Aggregation fetches server roles and database roles, except public roles. # Connecting SailPoint and Microsoft Azure SQL Database To connect SailPoint with Microsoft Azure SQL Database, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 8. Under **Connection Type**, select **Direct Connection** or **Flat File**. - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable. 9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source. 10. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Select **Save**. ## Connector Files Upload the .jar file used for the source connection. The current file and upload history are listed below the button. > [!NOTE] > > **Screenshot** > > [![Connector Files]()]() > [!WARNING] > > Ensure that the file you upload is not vulnerable or malicious. 1. Drag and drop the file onto the **Upload Files** box to upload it, or select anywhere within the **Upload Files** box to choose the file on your computer. 2. Select **Save**. ## Connection Settings Enter the credentials needed to connect to and authenticate with the source. > [!NOTE] > > **Screenshot** > > [![Connection Settings]()]() > > [![Connection Settings authentication]()]() > > [![Connection Settings parameters]()]() 1. Go to **Connection Settings**. 2. Select an **Authentication Type**: - **SQL Authentication** - Connect with a SQL login and password. - **Microsoft Entra ID Authentication** - Connect with an App Registration (service principal) using Client ID and Client Secret. 3. Enter the SQL Account **Login Name** used to connect to the Microsoft Azure SQL Database. 4. Enter the **Password** for the associated with the Microsoft Azure SQL Database login name. 5. Enter the **Database URL** to connect to the Microsoft Azure SQL Database. The format is `jdbc:sqlserver://:` Where: - `jdbc:sqlserver://` - Known as the sub-protocol and is constant. This is required. - `server_name` - The address of the server to connect to. - `port_number` - The port to connect to the server. The default is 1433. 6. For Microsoft Entra ID Authentication: a. Select a **Grant Type** for OAuth token requests. The default is **Client Credentials**. b. Enter the **Tenant ID** for your Microsoft Entra tenant. c. Enter the **Client ID** of the App Registration (service principal). The principal must be created as an external user in Azure SQL Database with the permissions the connector needs. d. Enter the **Client Secret** for the App Registration. 7. Enter the fully qualified name of the **Driver Class** supported by JDBC. For example, `com.microsoft.sqlserver.jdbc.SQLServerDriver`. 8. In **Additional Connection Parameters**, enter connection parameters as key-value pairs. For example, `encrypt=true`. Press Enter after each parameter to add it to the list. 9. Select **Save**. ## Additional Settings Configure additional connection parameters for your aggregation. > [!NOTE] > > **Screenshot** > > [![Additional Settings]()]() 1. Go to **Connection Settings \> Additional Settings**. 2. In the **Aggregation Connection Parameters** field, enter one or more parameters that you want to use in the aggregation in the form of a key-value pair. When entering values, press the **Enter** key to add it to the list of additional parameters. For example, `integratedSecurity=true` or `encrypt=true`. 3. Select **Save**. ## Aggregation Settings Configure your aggregation settings by completing the fields on this page. For more information about aggregation, refer to [Aggregation](). > [!NOTE] > > **Screenshot** > > [![Aggregation Settings]()]() > [!NOTE] > > If you leave the **Databases to Include** and **Databases to Exclude** fields blank, SailPoint aggregates all server logins and users from all available databases. 1. Go to **Aggregation Settings**. 2. In the **Databases to Include** field, enter a comma-separated list of database names you want to be included in the aggregation and provisioning operations. 3. In the **Databases to Exclude** field, enter a comma-separated list of database names that you want to exclude from the aggregation and provisioning operations. > **Important** > > If the **Databases to Include** field is populated, any input in the **Databases to Exclude** field is ignored. 4. Select the **Aggregate Database Users Without Roles** checkbox to include database users that do not have an assigned role during account aggregation. 5. Select the **Aggregate Fixed Database Roles From Master** checkbox to include fixed database roles from the master database during group aggregation. 6. In the **Fetch Size** field, enter a value to specify the size of the result set buffer returned by the server to the connector. The default value is 1000. 7. Select **Save**. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Integrating SailPoint with Microsoft Azure SQL Database This document is designed to give specific information about the requirements and field definitions needed to get a working instance of an Azure SQL Database connector. Part of the Azure SQL family, Azure SQL Database is an always-up-to-date, fully managed relational database service built for the cloud. Azure SQL Database is a fully managed platform as a service (PaaS) database engine that handles most of the database management functions such as upgrading, patching, backups, and monitoring without user involvement. Azure SQL Database is always running on the latest stable version of the SQL Server database engine and patched OS with 99.99% availability. PaaS capabilities built into Azure SQL Database enable you to focus on the domain-specific database administration and optimization activities that are critical for your business. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The Azure SQL Database connector supports the following features: > [!NOTE] > > The Azure SQL Database will only connect with an SQL connection. ### Account Management - Manage Microsoft Azure SQL Database Logins as Accounts - Manage Microsoft Azure SQL Database Users Associated to Login Accounts as Attributes of Server Login Account - Aggregate and Refresh Accounts - Create, Update, Delete Accounts - Enable, Disable, and Change Password - Add and Remove Entitlements ### Account - Group Management - Aggregate Microsoft Azure SQL Database Roles and Fixed Server Roles as Account-Groups. - Aggregate and Refresh Groups ### Permissions Management - Permissions directly assigned to accounts and groups as direct permissions during account and group aggregations respectfully. - Revocation of aggregated permissions for accounts through certification. - For more information on direct permissions and how to enable them, refer to [Direct Permission](<#direct-permission>). ### Password Management If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following: - The password policy defined in SailPoint applies to accounts on this source. - If you change the password for an application connected to this source, the change will automatically be made to the source itself. For more information on configuring password management, refer to [Password Management Overview](). ## Prerequisites - Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](). - Identify or create a service account on the Microsoft SQL system. - Obtain the custom Microsoft SQL Server mssql-jdbc-8.4.1.jre8.jar file. For detailed instructions, refer to [How do I obtain the jar file needed for the Microsoft SQL Database direct connect source](). > **Note** > > The Microsoft Azure SQL Database connector shares the same JDBC driver jar that is required for Microsoft SQL Server. ## Supported Managed Systems The Microsoft Azure SQL Database connector supports the following version and modules: - Microsoft SQL Azure (RTM) - 12.0.2000.8 onwards ## Administrator Permissions Login using administrator credentials and create a new user on managed system using the following command: ```sql CREATE LOGIN WITH PASSWORD = '' ``` The following minimum permissions are required for Microsoft Azure SQL Database service accounts (user) based on the operations: ### Test Connection Create respective database user in master database for service login account using the following command: ```sql CREATE USER FOR LOGIN ``` ### Aggregation > [!NOTE] > > In order to access databases other than master, the service account must have database user mapping on the databases with public role defined. Connect to master database and run the following commands: ```sql ALTER ROLE loginmanager ADD MEMBER ALTER SERVER ROLE ##MS_DefinitionReader## ADD MEMBER ``` ### Provisioning The following permissions are required for adding and removing entitlements: - To add or remove fixed server roles to or from login accounts, connect to the master database and run the following command: ```sql ALTER SERVER ROLE ADD MEMBER ``` > **Note** > > Each member of a server role can add or remove other logins to that same role. Only the server admin account or the Azure Active Directory admin account (which can be an Azure Active Directory Group) can add or remove other Logins to or from any of the server roles. The user must have the proper server role assignments to assign the same role to another user. For example, if an administrator has granted ROLE1, ROLE2, and ROLE3 roles to user A, then user A can only grant ROLE1, ROLE2, and ROLE3 to other users. User A cannot assign other roles than those assigned to them. - To add or remove database roles other than fixed database roles to or from user on to the master database, connect to the master database and run the following command: ```sql ALTER SERVER ROLE ##MS_DatabaseManager## ADD MEMBER ``` > **Note** > > Adding or removing to or from fixed database roles form master is not applicable in accordance with Microsoft Azure SQL Database. - To add or remove custom roles to or from user onto a database other than master, connect to the respective database and run the following command: ```sql GRANT ALTER ANY ROLE TO ``` - To add or remove fixed database roles to or from user onto a database other than master, connect to the respective database and run the following command: ```sql ALTER ROLE db_owner ADD MEMBER ``` Use the following commands to manage other permissions: **Create, Enable, Disable, Change Password, or Delete Login** Connect to the master database and run the following command: ```sql ALTER ROLE loginmanager ADD MEMBER ``` **Revoke Permissions on Databases Other Than Master** Connect to the respective database and run the following command: ```sql GRANT CONTROL TO ``` > [!NOTE] > > Granting or revoking permissions to or from accounts and groups is not applicable on the master database in accordance with Microsoft Azure SQL Database. ### Direct Permission Every Microsoft Azure SQL Database securable has associated permissions that can be granted to a principal. Permissions are managed at the server level assigned to logins and server roles, and at the database level assigned to database users and database roles. The model for Azure SQL Database has the database permissions, but the server level permissions aren't available. The Azure SQL Database connector supports the database level permissions assigned to database users that are mapped to a server login or to the database roles as direct permissions. The connector supports direct permissions assigned onto following targets (securables): - DATABASE - DATABASE\_PRINCIPAL (for example, Database User or Database Role) - SCHEMA - ASSEMBLY - ASYMMETRIC\_KEY - SYMMETRIC\_KEYS - OBJECT\_OR\_COLUMN (for example, Stored procedure, Table, or Table column) For example: - `GRANT CONNECT on 'databaseuser@databasename:DATABASE'` - `GRANT EXECUTE on 'databaseuser@databasename:[dbo].[getCustomer](SQL_STORED_PROCEDURE)'` - `GRANT_WITH_GRANT_OPTION CREATE VIEW on 'databaseuser@databasename:DATABASE'` > [!NOTE] > > In accordance with the behavior of Microsoft Azure SQL Database, revocation of permissions on special database roles like loginmanager, dbmanager, and fixed database roles is not applicable. #### Enable Direct Permissions for Aggregation To enable direct permissions and their aggregation for the account and group schema, complete the following: 1. Use the [listSources]() API to get the source ID. 2. Use the [listSchemas]() API to get the schema ID for the account or group schema for which you want to enable direct permissions. 3. Use the [updateSchema]() API and enter the following content in body, with the `sourceID` and the `schemaID` in the header: ```json [    {"op": "add", "path": "/includePermissions", "value": true}] ``` # Machine Account Attributes Machine account attributes are used in provisioning configurations for machine accounts. After you have [created the required machine account subtypes](), you can use the machine account attributes to provision machine accounts in your SailPoint tenant. Refer to [Machine Identity Security Overview]() for more information. The following table provides a reference summary of Create Account attributes. Attributes marked with an asterisk (\*) are mandatory. ## Machine Account Provisioning Attributes | Create Account Attribute | Description | | --- | --- | | name | Max size 20; configured with unique-check settings in template metadata. | | password | No default transform; expected to be provided by request/policy path. | | type\_desc | Allowed values in template include SQL\_Login. | # Provisioning The Microsoft Azure SQL Database connector supports provisioning, allowing you to create and manage accounts and entitlements in Microsoft Azure SQL Database directly from SailPoint. **Prerequisite:** Your system is configured for provisioning. When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*. When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment. For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account. > [!IMPORTANT] > > This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail. ## Default Create Account Attributes The following generators create the required information for a new Microsoft Azure SQL Database account. You might need to edit the contents. > [!NOTE] > > The Microsoft Azure SQL Database source provisioning operation does not fail for the case-sensitive database. | Account Attribute | Generator | Description | | --- | --- | --- | | name\* | Generator | This is the server login name. | | password\* | Generator | Account password for newly created server account. | | type\_desc\* | Static | Description type of the login. | # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The Microsoft Azure SQL Database connector uses the following default correlation and object configurations. ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | name | Account | | native\_identity | Group | # Enable Connector Logging This topic provides the steps needed to enable logging on SailPoint using REST APIs. > [!NOTE] > > This topic only applies to VA-based integrations. > [!NOTE] > > The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector. This process is broken up into four steps: 1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging. 2. Get the logging configuration for the existing VA cluster. 3. Update the VA cluster to enable logging levels. 4. Observe logging changes to the logging levels. ### Identify the Virtual Appliance Cluster Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>). 1. Make the following call to the REST API to return a list of available VA clusters: GET /v3/managed-clusters The REST API returns a response that looks similar to the following: ```json [ { "id": "2c9180866166b5b0016167c32ef31a66", "name": "Development Cluster", "description": "Development Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": null }, { "id": "2c9180846a93ce60016ab29f039944de", "name": "Cloud Cluster", "description": "Cloud Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } } ] ``` > **Note** > > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster. 2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute. ### Get the Logging Configuration Get your selected VA's cluster logging configuration and identify the values you need to update. 1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. GET /v3/managed-clusters/{id}/log-config - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response. - If the VA has an existing logging configuration, it returns something similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` You'll need to configure the following information in the response: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). ### Update Logging Configuration Update the VA cluster configuration returned by the REST API to update the logging settings as needed. 1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. PUT /v3/managed-clusters/{id}/log-config 2. Submit your configuration changes to the REST API in a JSON body. - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one. - If the VA returned a configuration, you can edit it to include the changes. The JSON body should be as follows: ```json { "durationMinutes": 60, "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` Consider the following as you edit the JSON: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). If the update was successful, the REST API should return a response similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` ### Observe Logging Changes Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**. ### References The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file. #### Logging Levels | Logging Level | Description | | --- | --- | | ERROR | Designates error events that might still allow the connector to continue. | | WARN | Designates potentially harmful situations. | | INFO | Designates information messages that highlight process at a coarse-grain level. | | DEBUG | Very verbose. Fine grain logging levels used for development and debugging. | | TRACE | Most verbose. Finer grain logging levels than debugging. | #### Logging Classes | Connector | Logging Class | | --- | --- | | Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector | | AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector | | Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT | | Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector | | Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector | | Microsoft Entra ID | sailpoint.connector.AzureADConnector | | Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter | | Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter | | Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT | | Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter | | Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter | | GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter | | Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter | | IBM i | openconnector.connector.IBMiConnector | | Lotus Domino | sailpoint.connector.LotusDomino | | JDBC | sailpoint.connector.JDBCConnector | | Sun One LDAP | sailpoint.connector.LDAPConnector | | Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector | | Microsoft Office365 | sailpoint.connector.Office365Connector | | Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 | | Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT | | Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector | | Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector | | Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter | | Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector | | Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector | | Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector | | PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter | | PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector | | RemedyForce | sailpoint.connector.ForceConnector | | RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter | | Salesforce | sailpoint.connector.ForceConnector | | SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector | | SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector | | SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT | | SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector | | SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter | | SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter | | ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter | | ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter | | Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter | | Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter | | Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter | | SuccessFactors | sailpoint.connector.SuccessFactorsConnector | | Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector | | Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter | | Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter | | Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter | | Web Services | sailpoint.connector.WebServices | | XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter | | Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter | | Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter | # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Aggregation Error When a login user is created in Microsoft Azure SQL Database and is granted permission only on some of the databases present on the server, and if the aggregation task is run for that source, aggregation fails as the user is not able to access other databases. **Resolution**: In configuration under the **Databases to Include** section, provide the complete list of databases (comma separated list) for which the login user has access. This completes the aggregation successfully, and only details of the users present in the list of included databases will be fetched. ## Transient Errors A transient error, also known as a transient fault, has an underlying cause that soon resolves itself. An occasional cause of transient errors is when the Azure system quickly shifts hardware resources to better load-balance various workloads. Most of these reconfiguration events finish in less than 60 seconds. During this reconfiguration time span, you might have issues with connecting to your database in SQL Database. The connector checks for transient errors and retries the operation for configured number of times by waiting for configured number of seconds. In case you get any of the following errors during connector operation, either increase the configured number attempts and delay parameter in the application Debug page, or else simply retry the operation after a delay of several seconds. List of transient error messages: - `com.microsoft.sqlserver.jdbc.SQLServerException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption.` - `com.microsoft.sqlserver.jdbc.SQLServerException: Database 'mydatabase' on server myserver.database.windows.net' is not currently available. Please retry the connection later.` - `com.microsoft.sqlserver.jdbc.SQLServerException: No route to host (Read failed)` - `com.microsoft.sqlserver.jdbc.SQLServerException: Broken pipe (Write failed)` - `com.microsoft.sqlserver.jdbc.SQLServerException: Connection reset` - `com.microsoft.sqlserver.jdbc.SQLServerException: Connection reset by peer: socket write error` - `java.sql.SQLException: Cannot get a connection, pool error Timeout waiting for idle object` - `Unable to connect to database 'mydatabase'. message = Read timed out, cause = com.microsoft.sqlserver.jdbc.SQLServerException: Read timed out` ## Connection Reset Error When you connect to your Azure SQL Databases using the proxy connection policy and the session is still open without activity, the Azure SQL Gateway will terminate the session after it is idle for more than 30 minutes. This may happen with the connector and connections open inside the connector may get dropped from the network and display the following errors: - `com.microsoft.sqlserver.jdbc.SQLServerException: Connection reset` - `com.microsoft.sqlserver.jdbc.SQLServerException: Connection reset by peer: socket write error` **Resolution**: If you frequently see the provided errors, try changing the connection policy to **Redirect** so that connections won't be terminated. For more information, refer to [Azure SQL Database Connectivity Architecture]().