# SailPoint Microsoft SharePoint Server Connector Documentation > Microsoft SharePoint Server Connector Documentation # Documentation # Connecting SailPoint and Microsoft SharePoint Server To connect SailPoint with Microsoft SharePoint Server, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 8. Under **Connection Type**, select **Direct Connection** or **Flat File**. - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable. 9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source. 10. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Select **Save**. ## Connection Settings Provide the information required to connect and interact with the source. > [!NOTE] > > **Screenshot** > > [![Connection Settings]()]() To configure the connection settings, complete the following: 1. Enter the **Service Account** user with requisite permissions. The format is Domain\\User. For example, *SPServer\\administrator*. 2. Enter the associated **Password** of the service account. 3. Enter the resolvable host name or the IP address of the **SharePoint Server Host**. 4. Select **Save**. ## Aggregation Settings Provide the settings for your aggregation. For more information about aggregation, refer to [Loading Account Data](). > [!NOTE] > > **Screenshot** > > [![Aggregation Settings]()]() > > [![Aggregation Settings]()]() To configure your aggregation settings, complete the following: 1. (*Optional*) Enter the **Include Site Collections** that you want to manage. For example, `http://sp-server:4032/sites/site_collection1`. This is an optional field and is not applicable if you configure **Exclude Site Collections**. You can only mention the URL of a site collection, sub-site URLs are not applicable. 2. (*Optional*) Enter the **Exclude Site Collections** that you want to manage. This is an optional field and not applicable if you configure **Include Site Collections**. You can only mention the URL of a site collection, sub-site URLs are not applicable. 3. (*Optional*) Select the **Manage Subsites** checkbox to manage provisioning operations of groups that reside inside sub-site of a site collection. 4. (*Optional*) Select the **Skip Aggregation of Domain Groups** checkbox ff you do not want to aggregate the domain groups. 5. (*Optional*) Enter the **Page Size** to specify the number of objects shown on a single page for a Site Collection. The page size value has a range of 0 to 999. 6. Select **Save**. ## IQService Settings IQService is a native Windows service that enables SailPoint to participate in a Windows environment and access information only available through Windows APIs. It is a lightweight service that must be installed on any supported Windows Server that has connectivity to the target systems you want to manage in SailPoint. The IQService is used for Before and After Script and connector rules for the Microsoft SharePoint Server connector. > [!WARNING] > > To enhance security, it is mandatory to configure the TLS for IQService. If you continue using non-TLS configuration, any before and after script execution will be disabled to safeguard your environment. Remove non-TLS configuration for IQService to execute any rules and scripts. > [!NOTE] > > **Screenshot** > > [![IQService Settings]()]() ### Download IQService To download the IQService installation complete the following: 1. Select the **Download IQService** button. > **Note** IQService has the built-in capability to auto update (this is the default). To enable the auto update capability, UpdateService must be configured alongside the IQService installation. Refer to [Configuring IQService Auto Update](). Download, install, and configure IQService by following the steps mentioned in the [Identity Security Cloud IQService Administrator's Guide]() for [Installing and Registering IQService](). > **Note** You are only entitled to download components for which you have an active license with SailPoint and the availability of a component for download does not grant you a license to use a component or entitle you to use a component for which you do not have an active license. Contact your Account Representative or CSM for more information. > [!NOTE] > > **Screenshot** > > [![IQService Settings]()]() Configure the IQService details: 1. In the **IQService Host** field, enter the host name or IP address of the system where IQService is installed. 2. Enter the **IQService Port** number used to connect. If you enable TLS, configure the corresponding IQService TLS port. The default is 5050. 3. (*Optional*) Enter the **IQService User** for client authentication. 4. (*Optional*) Enter the **IQService Password** for the IQService user. 5. (*Optional*) Select the **Enable Transport Layer Security (TLS)** checkbox if the connection is over TLS. For more information, refer to [Configuring TLS and Client Authentication for IQService](). 6. Select **Save**. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Integrating SailPoint with Microsoft SharePoint Server Microsoft SharePoint Server is a web-based collaborative platform that integrates with Microsoft Office products. This document is designed to give specific information about the requirements and field definitions needed to getting a working instance of a Microsoft SharePoint Server source. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The Microsoft SharePoint Server connector supports the following features: > [!NOTE] > > Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site. - Load and \*Provision SharePoint Server Accounts - \*Access Certifications (certification of entitlements connected to accounts) For more information on features, refer to [Source Features](). > [!IMPORTANT] > > This instance of IQService is configured to listen on a TLS port by default to improve security and safeguard your environment. To establish a secure connection, ensure to follow the following steps: > > - Enable the TLS configuration flag in your source. > - Refer to [Configuring TLS and Client Authentication for IQService]() for detailed instructions on configuring TLS for IQService, including client authentication. > > Ensuring proper TLS configuration is crucial for maintaining the security of your IQService deployment. > [!WARNING] > > To enhance security, it is mandatory to configure the TLS for IQService. If you continue using non-TLS configuration, any before and after script execution will be disabled to safeguard your environment. Remove non-TLS configuration for IQService to execute any rules and scripts. ## Prerequisites - Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](). - Before you can use any of the features of the connector, IQService must be installed on the computer with the same domain as that of SharePoint Server. For more information about installing IQService, refer to the [IQService]() guide. > **Important** > > IQService installation now enforces TLS configuration by default to improve security and safeguard your environment. To proceed with the installation, ensure you have completed the necessary prerequisites for TLS configuration. For more information, refer to [Configuring TLS and Client Authentication for IQService](). - Install PowerShell version 3.0 or later on the SharePoint Server. - To enable the connector to remotely communicate with the SharePoint Server using PowerShell commands, complete the following on the SharePoint Server computer: 1. Ensure that the **WinRM** service is running on the SharePoint Server and on the IQService system. 2. Run the following command to enable PowerShell remoting: ```text Enable-PSRemoting -Force ``` 3. Run the following command on the SharePoint Server to configure trust between the SharePoint Server system and the IQService system: ```text Set-Item wsman:\localhost\client\trustedhosts "" ``` 4. When IQService establishes a remote PowerShell session with the SharePoint Server, it uses the **CredSSP** authentication mechanism by default. Run the following command to set **CredSSP** as the authentication type for the remote PowerShell session to work on respective computers: On the SharePoint Server: ```text Enable-WSManCredSSP -Role Server ``` On the IQService System: ```text Enable-WSManCredSSP -Role client -DelegateComputer "" ``` With the authentication mechanism set as default, add the `Authentication` attribute using the REST API. > **Note** > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. > **Note** > > SailPoint only supports the CredSSP and Default authentication mechanisms. 5. On the SharePoint Server and IQService system, restart the **WinRM** service for the new settings to take effect: ```text Restart-Service WinRM ``` ## Supported Managed Systems The Microsoft SharePoint Server connector supports the following Microsoft SharePoint server versions: - Microsoft SharePoint Server Subscription Edition - Microsoft SharePoint Server 2019 - Microsoft SharePoint Server 2016 ## Required Permissions - User must be a part of the following groups on the SharePoint Server system: - Remote Desktop Users - WinRMRemoteWMIUsers - WSS\_ADMIN\_WPG - User must have **SPShellAdmin** access role on all the content databases from the SharePoint Server that this connector must manage. This allows the connector to execute SharePoint **cmdlets**. Run the following command on the SharePoint Server to give the **SPShellAdmin** role to the application user: ```text Add-SPShellAdmin -UserName -Database (Get-SPContentDatabase -Identity "WSS_Content") ``` To grant access to all content databases use the following command: ```text Get-SPDatabase | Add-SPShellAdmin DOMAIN\UserName ``` - On the SharePoint Server and IQService host, the Application User must have **Read and Execute** permissions for **Microsoft.PowerShell32** and **Microsoft.PowerShell**. Run the following command on the SharePoint Server and IQService host systems to enable that permission: ```text Set-PSSessionConfiguration -Name "Microsoft.PowerShell32"–ShowSecurityDescriptorUI Set-PSSessionConfiguration -Name "Microsoft.PowerShell" –ShowSecurityDescriptorUI ``` - On the SharePoint Server and IQService system, restart the **WinRM** service for the new settings to take effect: ```text Restart-Service WinRM ``` - The Application User must have access to all SharePoint Web Applications that must be managed by the connector. Create a PowerShell script as follows and execute on SharePoint Management Shell: ```text $webApp = Get-SPWebApplication -Identity "Web App Url" $webApp.GrantAccessToProcessIdentity("Domain\UserName") ``` Add the above lines for each web application. # Configuring TLS and Client Authentication for IQService IQService, also referred to as the Integration Service, is a Windows service that enables SailPoint to participate in a Windows environment and access information only available through Windows APIs. It is a lightweight service that must be installed on any supported Windows server that has connectivity to the target systems you want to manage in SailPoint. IQService can be installed on any Windows operating system that meets the requirements specified in [Prerequisites]() of IQService. > [!CAUTION] > > If you have IdentityIQ and SailPoint Human Fabric in your environment, install a separate instance of IQService for each system. - **TLS Communication** - TLS Communication between IQService and the VA is supported and must be configured to secure this solution. - **Client Authentication** - IQService can authenticate a client while connecting to it. IQService-based sources support Client Authentication, a feature which authenticates every incoming request from SailPoint before executing them. To ensure the authentication works correctly, IQService expects the client to send the credentials of a registered user with every request. Before processing a request, IQService first confirms that the user is registered with it and then authenticates the credentials with Windows. > [!NOTE] > > Client Authentication is mandatory for operations that use the IQService when the TLS communication is enabled for IQService. > > SailPoint recommends using a privileged access user as the registered user for client authentication. You can also use the IQService Service Log On user for this purpose. ## Prerequisites > [!NOTE] > > **For TLS Communication between the VA and IQService** > > - The IQService host's X.509 certificate with Extended Key Usage (EKU) used as Server Authentication must be available in the Personal Certificate Store of the host. The subject of the certificate should match the FQDN of the IQService host. An example subject is `iqservice.test.com`. > - The matching private key must be present in the host's RSA key directory. > - If the IQService host's X.509 certificate is not available, create a CSR (Certificate Signing Request) from the IQService host. > - Submit the CSR to a trusted (internal or third party) certificate authority (CA) for signing. Ensure that the CA is on trusted root CA in the host. > - The configuration of Client Authentication is *mandatory* when TLS communication is enabled for IQService. > [!NOTE] > > **For Client Authentication** > > - To configure client authentication when the IQService host is added to any domain, you need to have a domain user whose credentials can be used to authenticate a connection between SailPoint and IQService. > - If the IQService host is not added to any domain, the Windows local user from the IQService host can be used authenticate a connection between SailPoint and IQService instead of the domain user. > > > **Note** > > > > No specific additional user permissions are required. > [!IMPORTANT] > > If you are updating your IQService instance to use a TLS port, ensure that you disable the existing non-TLS port. This is crucial to maintain secure communication and prevent potential security vulnerabilities arising from the simultaneous use of both TLS and non-TLS ports. For more information, refer to [Disabling Non-TLS Communication for an Existing IQService Instance](<#disabling-non-tls-communication-for-an-existing-iqservice-instance>). ## TLS Configuration Between VA and IQService 1. Download IQService from SailPoint via a source that requires it. 1. Select **Download IQService**. 2. Unzip the downloaded **IQService.zip** archive into the desired location. For example, `C:\SailPoint\IQService\` 2. Install IQService to communicate with SailPoint on the TLS port only. ```text IQService.exe -i -o ``` This command installs IQService with the name **IQService-Instance1** and the provided TLS port number. 3. On the managed source configuration, in the **Integration Service** panel, enable the **Enable Transport Layer Security (TLS)** checkbox. ## TLS Configuration Check List ### IQService Host - The X.509 certificate is located in the Local Computer's Personal certificate store. - A private key that matches the certificate is present in the Local Computer's store and is correctly associated with the certificate. For example, as displayed in the following screenshot, you can confirm if the certificate has a private key. A certificate with a private key (on the right, highlighted in green) has a different icon than a certificate without one (highlighted in red). [![TLS certificate with and without private key]()]() - The Enhanced Key Usage extension includes the Server Authentication (1.3.6.1.5.5.7.3.1) object identifier. - The IQService host's fully qualified domain name (FQDN) must be in the common name (CN) in the **Subject** field in the X.509 certificate, and it must be a DNS entry in the **Subject Alternative Name** extension in the X.509 certificate. An example of IQService's FQDN is `iqservice.test.com`. Refer to the following examples. > [!NOTE] > > **Common Name (CN) in the Subject field in X.509 certificate** > > [![Common Name in X.509 certificate Subject field]()]() > [!NOTE] > > **DNS entry in the Subject Alternative Name extension in the X.509 certificate** > > [![DNS entry in X.509 certificate Subject Alternative Name extension]()]() - The X.509 certificate must be trusted by the IQService host. Trust is established by configuring the IQService host to trust the root CA to which the issuing CA chains. Refer to the following examples: > [!NOTE] > > **X.509 certificate (Non trusted)** > > [![Non-trusted X.509 certificate]()]() > [!NOTE] > > **X.509 certificate (Trusted)** > > [![Trusted X.509 certificate]()]() ### Virtual Appliance Configuration The virtual appliance (VA) must trust the IQService X.509 certificate. Trust is established by configuring the VA to trust the root CA to which the issuing CA chains. To establish trust between the VA and the root CA: 1. Add the root CA cert in the `/home/sailpoint/certificates` directory of the VA. 2. Restart the CCG service. [![TLS virtual appliance configuration]()]() > [!NOTE] > > Ensure to export the full certificate chain and convert it into a single PEM / Base64 formatted file. > [!NOTE] > > **Steps to Export and Convert the Certificate Chain** > > 1. Using the Microsoft Management Console (MMC), export the certificate chain as a `.p7b` file in DER/Binary format. > 2. Use the following OpenSSL command to convert the `.p7b` file to a `.pem` file: > > ```text > openssl pkcs7 -print_certs -in certchain.p7b -inform DER -out certificate.pem -outform PEM > ``` > 3. Place the output `.pem` file onto the VA. The CCG will then load the certificates from this file. > > ##### Handling Multiple Certificate Chains > > If you have multiple certificate chains (For example, one for VA to IQService communication and another for VA to AD communication), each chain must be placed in a separate PEM file. ## Configuration of IQService Client Authentication 1. On the IQService host, run the following command: ```text IQService.exe -a ``` For example: `IQService.exe -a "Corp\John.Doe"` - The domain user must be in the `msDS-PrincipalName` format: ```text \ ``` - If you are using a local user, it must be in the following format: ```text localuser ``` - You must use the user name as an **IQService User** name in the same format. 2. Configure the **IQService User** and **IQService Password** on the IQService-based source. Ensure that the IQService user value set here is the same that you registered on earlier on IQService. ## Securing Communication Between IQService and AD Domain Controller or Target System > [!NOTE] > > For IQService to connect using TLS and self-signed certificates, you must install the certificate in **Trusted Root Certification Authorities** on the IQService host. The configured IQService User must have all access/permissions to read all the installed Certificates. 1. Export the server certificate and copy the exported .cer file to the IQService host. 2. Double-click the .cer file and select **Install Certificate**. 3. Select **Next**. 4. Choose **Place all certificates in the following store** and select **Browse...** 5. Select **Show physical stores**. 6. Expand **Trusted Root Certification Authorities** and select **Local Computer**. 7. Select **OK**. 8. Select **Next**, then **Finish**. ## Disabling Non-TLS Communication for an Existing IQService Instance If you are enabling TLS communication for an existing IQService instance that previously used non-TLS communication, you must ensure that non-TLS communication is disabled for that same instance. You can achieve this using one of the following methods: **Method 1** 1. Set the existing non-TLS port to zero (0) or any negative number (such as -1, -2, -3 ) using the command line: ```text IQService.exe -p ``` For example, ```text IQService.exe -p 0 ``` ```text IQService.exe -p -1 ``` > **Note** > > Ensure to disable the non-TLS port for both the primary service and the secondary service (if configured). 2. After setting the port, restart the IQService. **Method 2** Optionally, you can delete the non-TLS port entry from the IQService instance registry configuration. > [!WARNING] > > Directly editing the registry can cause serious, potentially unrecoverable errors if done incorrectly. Only modify fields that are specifically intended for modification. Following are the steps to delete non-TLS port entry from IQService instance: 1. Locate the registry configuration for your IQService instance. You can find the registry path for the primary service at: ```text HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint\IQService Instances\ ``` You can find the registry path for the secondary service at: ```text HKEY_LOCAL_MACHINE\SOFTWARE\SailPoint\IQService Instances\\Secondary ``` Replace `` with the name of your IQService instance. 2. Look for the port attribute. 3. Delete the port attribute entry. After completing one of these methods, the IQService will only communicate using TLS, ensuring secure communication between the IQService and other components. To verify that the non-TLS port has been successfully disabled for your IQService instance, run the following command: ```text IQService.exe -v ``` After running this command, the output should display only the Configured TLS Port information along with the corresponding TLS port number, such as `Configured TLS Port : ` ## Troubleshooting ### TLS Communication > [!NOTE] > > **Failed to connect to IQService. Please check TLS configuration for IQService.** > > **Resolution**: > > - Ensure that the certificate is placed at correct path in VA: `/home/sailpoint/certificates` > - This error message might come if IQService is an older version or a non-TLS port is provided. Ensure your IQService is upgraded to latest IQService and TLS port is provided. > [!NOTE] > > **java.security.cert.CertificateException: No subject alternative names present** > > **Resolution**: > > - Ensure that the certificate is properly placed in VA: `/home/sailpoint/certificates`. > - Check communication between IQService host and VA. > - Ensure that the DNS settings are correct. Alternatively add the appropriate mapping entry for IQService host in `hosts.yaml` file in the `/home/sailpoint` directory. > > > **Note** > > > > For information on creating a hosts.yaml file, refer to [Configuring a Hosts.yaml File](). > [!NOTE] > > **Connection Reset** > > **Resolution**: Verify the following: > > - This could be because IQService TLS is disabled and you have provided TLS port. Ensure that the **Enable Transport Layer Security (TLS)** checkbox is selected. > - This could be because the hostname of the IQService server does not match the FQDN of the TLS certificate. Verify that the hostname matches the FQDN or the SubjectAlternateName DN is the same as the FQDN of the TLS certificate. If they are not the same, use the following commands to specify the certificate FQDN for IQService and then restart IQService: > > ```text > iqservice.exe -m hostname.example.com > iqservice.exe -t > ``` > [!NOTE] > > **Connection refused** > > **Resolution** - Ensure your IQService service is running. > [!NOTE] > > **Failed to connect to IQService. Please check TLS configuration for IQService.** > > **Resolution** - This could be because the IQService version is older. Ensure your IQService service is upgraded to latest version. Deselect the **Enable Transport Layer Security (TLS)** checkbox for non-TLS communication. > [!NOTE] > > **Line: 1 Column:1: Content is not allowed in prolog.** > > **Resolution** - If you want to use the IQService TLS functionality, use the latest CCG version and IQService version. If you are not using the latest CCG version and IQService version, ensure that the **Enable Transport Layer Security (TLS)** checkbox is unchecked on source configuration. > [!NOTE] > > **Unrecognized SSL message, plaintext connection?** > > **Resolution** - If you want to use the IQService TLS functionality, ensure that latest CCG version and IQService is deployed. If you are not using the latest CCG version and IQService version, ensure that the **Enable Transport Layer Security (TLS)** checkbox is unchecked on source configuration. ### Client Authentication The following errors may be returned from IQService. > [!NOTE] > > **No such user registered with IQService.** > > **Resolution**: > > - Ensure that you have registered and configured the IQService user and password on IQService host using the following command: > > ```text > IQService -a username > ``` > - Ensure that you have provided the correct IQService user or password. Use the latest CCG version and IQService version. > [!NOTE] > > **Client authentication failed with error - The user's password must be changed before signing in** > > **Resolution** - The IQService user's password could be expired. To resolve the issue, change the password for the IQService user. > [!NOTE] > > **Client authentication failed with error - The user's account has expired** > > **Resolution** - Password could be expired for IQService user. To resolve the issue, change the password for IQService user. > [!NOTE] > > **Client authentication failed with error - The referenced account is currently locked out and may not be logged on to.** > > **Resolution** - Ensure that the IQService user is not locked. > [!NOTE] > > **Client authentication failed with error - This user can't sign in because this account is currently disabled** > > **Resolution**: Ensure that the IQService user is not disabled. > [!NOTE] > > **Client authentication failed with error - Your account has time restrictions that keep you from signing in right now** > > **Resolution** - The reason could be IQService user has enabled logon hours and you are trying to perform an operation outside of their defined logon hours. Ensure that logon hours are correctly configured. > [!NOTE] > > **The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters.** > > **Resolution** - This is the error that displays if you are trying to perform client authentication with an old CCG version but the latest IQService version. You need to remove the user details from IQService using the command: `IQService -x username`. Also remove IQService user and password from source config. # Machine Account Attributes Machine account creation uses the same source attributes as standard account creation. For the complete list of supported attributes and their descriptions, refer to [Account Attributes](). For more information, refer to [Machine Identity Security Overview](). > [!NOTE] > > Attributes marked with an asterisk (\*) are mandatory. ## Machine Account Provisioning Attributes | Create Account Attribute | Description | | --- | --- | | AccountName\* | The user account name. | # Provisioning The Microsoft SharePoint Server connector supports provisioning, allowing you to create and manage accounts and entitlements in Microsoft SharePoint Server directly from SailPoint. **Prerequisite:** Your system is configured for provisioning. When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*. When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment. For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account. > [!IMPORTANT] > > This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail. ## Default Create Account Attributes | Account Attribute | Generator | Description | | --- | --- | --- | | AccountName | Create Unique Account ID | Login name of a user. The user must exist in the configured SharePoint user store (for example, Active Directory).

Use the Windows Claim based authentication, the user name must be in encoding format. For example, `i:0#w\|contoso\jim` | # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The Microsoft SharePoint Server connector uses the following default correlation and object configurations. ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | AccountName | Account | | GroupUrl | Group | ### Default Account Attributes The Microsoft SharePoint Server connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. | Attribute Name | Description | | --- | --- | | AccountName | Login name of the user. | | DisplayName | Display name of the user. | | Email | Email address of the user. | | Groups | Collection of groups of which the user is a member. | | OwnedGroups | Groups that the user owns. | | SiteCollections | SharePoint site collections associated with the user. | | SID | Unique security ID for the network account of the user. | | IsDomainGroup | Specifies whether the user is part of Domain group. | | Notes | Notes in the user properties. | | UserName | sAMAccountName of the user. | ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The Microsoft SharePoint Server connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. | Attribute Name | Description | | --- | --- | | GroupUrl | Identity attribute of group in `ParentWeb.Url\GroupName` format. | | GroupName | Name of the group. | | LoginName | Login name of the group. | | ID | Identifier (ID) for the group. | | ParentWeb | Parent web of the group. | | Description | Description for the group. | | AllowMembersEditMembership | Who can edit the membership. | | OnlyAllowMembersViewMembership | Who can view the membership of the group. | | AutoAcceptRequestToJoinLeave | Whether membership requests are automatically accepted. | | AllowRequestToJoinLeave | Whether to allow users to request for membership of the group. | | RequestToJoinLeaveEmailSetting | Membership requests to this email address. | | Owner | Name of the group owner. | | SiteAdmin | Name of site collection administrators. | | ADGroups | List of Active Directory groups which are members of this SharePoint Group. | # Enable Connector Logging This topic provides the steps needed to enable logging on SailPoint using REST APIs. > [!NOTE] > > This topic only applies to VA-based integrations. > [!NOTE] > > The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector. This process is broken up into four steps: 1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging. 2. Get the logging configuration for the existing VA cluster. 3. Update the VA cluster to enable logging levels. 4. Observe logging changes to the logging levels. ### Identify the Virtual Appliance Cluster Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>). 1. Make the following call to the REST API to return a list of available VA clusters: GET /v3/managed-clusters The REST API returns a response that looks similar to the following: ```json [ { "id": "2c9180866166b5b0016167c32ef31a66", "name": "Development Cluster", "description": "Development Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": null }, { "id": "2c9180846a93ce60016ab29f039944de", "name": "Cloud Cluster", "description": "Cloud Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } } ] ``` > **Note** > > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster. 2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute. ### Get the Logging Configuration Get your selected VA's cluster logging configuration and identify the values you need to update. 1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. GET /v3/managed-clusters/{id}/log-config - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response. - If the VA has an existing logging configuration, it returns something similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` You'll need to configure the following information in the response: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). ### Update Logging Configuration Update the VA cluster configuration returned by the REST API to update the logging settings as needed. 1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. PUT /v3/managed-clusters/{id}/log-config 2. Submit your configuration changes to the REST API in a JSON body. - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one. - If the VA returned a configuration, you can edit it to include the changes. The JSON body should be as follows: ```json { "durationMinutes": 60, "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` Consider the following as you edit the JSON: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). If the update was successful, the REST API should return a response similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` ### Observe Logging Changes Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**. ### References The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file. #### Logging Levels | Logging Level | Description | | --- | --- | | ERROR | Designates error events that might still allow the connector to continue. | | WARN | Designates potentially harmful situations. | | INFO | Designates information messages that highlight process at a coarse-grain level. | | DEBUG | Very verbose. Fine grain logging levels used for development and debugging. | | TRACE | Most verbose. Finer grain logging levels than debugging. | #### Logging Classes | Connector | Logging Class | | --- | --- | | Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector | | AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector | | Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT | | Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector | | Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector | | Microsoft Entra ID | sailpoint.connector.AzureADConnector | | Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter | | Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter | | Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT | | Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter | | Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter | | GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter | | Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter | | IBM i | openconnector.connector.IBMiConnector | | Lotus Domino | sailpoint.connector.LotusDomino | | JDBC | sailpoint.connector.JDBCConnector | | Sun One LDAP | sailpoint.connector.LDAPConnector | | Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector | | Microsoft Office365 | sailpoint.connector.Office365Connector | | Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 | | Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT | | Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector | | Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector | | Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter | | Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector | | Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector | | Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector | | PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter | | PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector | | RemedyForce | sailpoint.connector.ForceConnector | | RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter | | Salesforce | sailpoint.connector.ForceConnector | | SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector | | SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector | | SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT | | SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector | | SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter | | SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter | | ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter | | ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter | | Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter | | Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter | | Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter | | SuccessFactors | sailpoint.connector.SuccessFactorsConnector | | Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector | | Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter | | Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter | | Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter | | Web Services | sailpoint.connector.WebServices | | XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter | | Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter | | Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter | # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Exception while creating new PowerShell Session The following error message appears in many scenarios: ```text Exception while creating new PowerShell Session ``` **Resolution**: Perform the following: 1. Ensure that IQService and SharePoint Server are in the same domain. 2. Verify if maximum number of PowerShell users allowed for Application Users are not exceeded. Verify by executing the following command: ```text Get-Item WSMan:\localhost\Shell\MaxShellsPerUser ``` If the number is not adequate then increase the number. For example, ```text Set-Item WSMan:\localhost\Shell\MaxShellsPerUser 50 ``` 3. Application Account has enough privileges as described in [Required Permissions](). 4. Allocate enough memory for PowerShell session. Verify memory space using the following command: ```text Get-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB ``` If number is not adequate then increase the number. For example: ```text Get-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB 256 ``` ## The WS-Management service cannot process the request The following error message appears when the user has exceeded the maximum number of concurrent shells: ```text The WS-Management service cannot process the request. This user is allowed a maximum number of 5 concurrent shells, which has been exceeded. Close the existing shells or raise the quota for this user. ``` **Resolution**: Verify if maximum number of PowerShell users allowed for Application User are not exceeded by executing the following command: ```text Get-Item WSMan:\localhost\Shell\MaxShellsPerUser ``` If number is not adequate increase it. For example: ```text Set-Item WSMan:\localhost\Shell\MaxShellsPerUser 50 ``` ## Access is denied **Resolution**: Verify the following: - If username and password are correctly entered. - If this application user has enough access on SharePoint Server. ## Failed to connect to the SharePoint Server **Resolution**: Verify if SharePoint Server is accessible through IQService. Verify if IP or hostname are resolving correctly. ## Account aggregation fails Account aggregation fails with the following error message in IQService logs: ```text Site Collection Administrator for Site collection: is => ``` **Resolution**: Run the following commands to get the user added as claim user: ```text $webapp=get-spwebapp -Identity "SITE_URL" $webapp.grantaccesstoprocessidentity(''DOMAIN\LOGON_USER") ``` ## Exception while adding account into group The following error message appears while adding `` into group - ``: ```text The specified group does not exist. ``` **Resolution**: Ensure that the following points are satisfied in SharePoint Server environment: 1. Verify if group (``) exists in SharePoint Server. 2. If `` exists, verify if it is residing in a subsite of a site collection and check prefix URL of `` in entitlement catalog. 3. If group is residing in a sub-site of site collection, correctly set up the **Manage Subsites** field. ## Account or Entitlement aggregation fails with an error message Account or group aggregation fails with the following error message from IQService: ```text You can specify either include or exclude list of site collections but not both! ``` **Resolution**: - Ensure that you have selected only **Include Site Collections** or **Exclude Site Collections**. - Ensure that the application xml file has only one list of include or exclude site collections. If both lists are present then delete one of the lists and save the application xml file. For successful aggregation, run account or group aggregation again. ## During account aggregation data loss issue occurs **Resolution**: To avoid the data loss issue during account aggregation, user can change the default value of the `pageSize` as explained in the following example: Current default Value of **pageSize = 500** and **userIndex = 5000** is set with formula as **pageSize = 10% of userIndex**, user can change the formula to **pageSize = 5% of userIndex** and observe the behavior. ## Test Connection or Account Aggregation fails with NT AUTHORITY ANONYMOUS LOGON error Test connection or Account Aggregation fails with the following error: ```text Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON ``` This issue can occur due to incorrect authentication settings or insufficient permissions for the service account running the aggregation process. **Resolution**: From the IQService host, run the following command to check communication with the SharePoint server: 1. Start a remote PowerShell session to a SharePoint server using default authentication and specified credentials. ```text $t = New-PSSession "DNSnameOfSpServer" -Authentication Default -Credential "sp2k19\sp2k19" ``` 2. Run the following command on a remote PowerShell as if you were logged into it directly. ```text Enter-PSSession -Session $t ``` 3. Add the SharePoint PowerShell snap-in to your current session to perform various administrative tasks. ```text Add-PSSnapin Microsoft.SharePoint.PowerShell ``` 4. List all site collections or get details about a specific site collection. ```text Get-SPSite ``` 5. If the command fails, try using `-Authentication CredSSP` instead of `-Authentication Default`. This allows you to run commands on a remote server that access resources on another remote server. In the application debug page, ensure that the authentication key is set to ```text CredSSP: ``` The connector uses `CredSSP` authentication by default. If the authentication key was previously set to `Default`, it may cause the aggregation to fail. 6. Verify that the service account under which the IQservice is running has sufficient permissions to execute the `Get-SPSite` command. If the service account does not have the necessary permissions, change the account's logon settings for the IQservice. 7. Test the connection and perform account aggregation again. # Timeout Errors and Settings Timeout errors might occur when SailPoint is waiting for a response from the Virtual Appliance (VA). These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down. This document is designed to give specific information that can be used to resolve these errors. Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error. > [!IMPORTANT] > > Add the necessary attributes or values before performing the "replace" operation, as missing attributes will cause the operation to fail. To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the VA using the SailPoint REST API. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ### aggregateTimeout **Description:** This parameter is set for the aggregation timeout, measured in seconds. **Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds. For example: If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/aggregateTimeout", "value": 600 } ] ``` ### healthCheckTimeout **Description:** This parameter is set for the test connection and health check timeout. **Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again. For example: If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/healthCheckTimeout", "value": 45 } ] ``` ### provisioningTimeout **Description:** This parameter is set for provisioning timeout. **Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds. For example: If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/provisioningTimeout", "value": 360 } ] ``` ### timeout **Description:** This parameter is set for pass-through authentication timeout. **Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again. For example: If your current time value is 15 seconds, update the `timeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeout", "value": 30 } ] ``` ### apiTimeout **Description:** This parameter is set for API time tracking; customers can check it using an external tool. **Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again. For example: If your current time value is 60 seconds, update the `apiTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/apiTimeout", "value": "75" } ] ``` ### timeoutInSeconds **Description:** This parameter helps prevent the VA from waiting indefinitely for an API response, ensuring efficient handling of API requests. For example: If your current time value is 30 seconds, update the `timeoutInSeconds` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeoutInSeconds", "value": "15" } ] ```