Integrating SailPoint with OnGuard

The SailPoint OnGuard Integration enables comprehensive management of cardholders directly through the SailPoint platform, enabling organizations to streamline their security processes and enhance control over physical access. This integration has capabilities for cardholder management, including the management of access levels and badge types.

This document provides detailed information about the requirements and field definitions necessary to successfully implement and manage an OnGuard Integration.

Supported Features

The SailPoint OnGuard Integration supports the following features:

Account Management

• Manages OnGuard cardholders
• Aggregate and Refresh cardholders
• Create and Update cardholders
• Enable and Disable cardholders
• Add and Remove Entitlements to the cardholder. Refer to Adding and Removing Entitlements for more information.
• Delete Cardholder
• Aggregate and provision custom cardholder attributes

Entitlement Management

Aggregate and refresh the following as group objects:

• Badge Type
• Access Level

Prerequisites

Before you configure your OnGuard connector, you must consider the following prerequisite items:

• Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.
• A valid OnGuard license with part IPC-013-SAILP01.
• The SailPoint OnGuard Integration SKU.
• The OnGuard Event Subscription Service installed and configured.
  • This service is required to receive delta events, since a full aggregation can only run once in a lifetime.
  • For setup instructions, refer to the OnGuard Event Subscription Service Setup documentation.

Prerequisites for the OnGuard System

1. Enable Software Events.

   Ensure that Generate Software Events is enabled under Administration > General System Options so the system can capture events.

Prerequisites for the SailPoint OnGuard Connector (VA ↔ OnGuard Server)

1. Use a Fully Qualified Domain Name (FQDN).

   For a successful connection, always use the FQDN of the machine hosting the OnGuard (On-Premise) solution instead of its IP address. Confirm the FQDN with your OnGuard administrator or IT team.

2. Install the OnGuard Root Certificate in the Java cacerts Store.

   • To establish a trusted SSL connection with OpenAccess, you must install the OnGuard Server Root Certificate into the Java cacerts certificate store.
   • Obtain the root certificate from your OnGuard Server.
   • Add certificate to /home/sailpoint/certificates
   • If you encounter any issues during the import process, refer to Troubleshooting.

Prerequisites for the OnGuard Event Subscription Service (RHEL Machine)

Ensure the Event Subscriber Service is running successfully without errors. For setup instructions, refer to the OnGuard Event Subscription Service Setup documentation.

Prerequisites for the SailPoint OnGuard Connector ( VA↔ Event Subscriber Service)

The OnGuard Event Subscription Service requires mutual TLS (mTLS) to establish secure communication between the SailPoint VA client and the SailPoint OnGuard Event Subscription Service.

Before running the installer, make sure the following keystore and truststore files are prepared:

Server-Side Files

Required on the SailPoint OnGuard Event Subscription Service. For more details, see OnGuard Event Subscription Service Setup.

• Server Identity Keystore (server.p12)

  Contains the server's private key and corresponding certificate.

• Server Truststore (truststore.jks)

  Contains the client's Certificate Authority (CA) certificate(s).

Client-Side Files

Required on the VA side for delta aggregation. For more details, refer to Delta Aggregation Settings.

• Client Identity Keystore (client.p12)

  Contains the client's private key and corresponding certificate.

• Client Truststore (client-truststore.jks)

  Contains the server's Certificate Authority (CA) certificate(s).

Responsibility for File Preparation

• Server-side files (server.p12, truststore.jks) are typically generated and maintained by the OnGuard/Customer IT security team.
• Client-side files (client.p12, client-truststore.jks) are generated and configured by the SailPoint implementer or the customer PKI team, depending on the deployment model.
• It is essential that both parties securely exchange the required CA certificates to ensure successful mTLS handshake.

In the VA, navigate to the path /home/sailpoint/ and create a new directory named OnGuard_Certificates.

Place the client-side files client.p12 and client-truststore.jks inside this folder. These files will be used to configure the mTLS (Mutual TLS) connection within the Delta Aggregation Settings.

Supported Managed Systems

The SailPoint OnGuard connector has been certified for the following OnGuard version:

• OnGuard System 8.3

Required Permissions

In OnGuard, service account permissions are organized through permission groups. To set up the service account, follow these steps:

1. Go to Administration > Users.

2. Create a System Permission Group:

   • Go to the System Permission Groups tab.
   • Select Add and enter the name: (e.g., Min Permission System Group)
   • Assign the appropriate System permissions as required (refer to the below table). Select the Save to apply your configurations.

3. Create a Cardholder Permission Group

   • Go to the Cardholder Permission Groups tab.
   • Select the Add and enter the name: (e.g., Min Permission Cardholder Group)
   • Assign the appropriate Cardholder permissions as required (refer to the below table). Select the Save to apply your configurations.

4. Create a Field/Page Permission Group

   • Go to the Field/Page Permission Groups tab.
   • Create the group (e.g., View/Edit All Fields)
   • Assign the appropriate Field/ Page permissions as required (refer to thrbelow table). Select the Save to apply your configurations.

5. Go to the Users tab and Create a new User. In the permissions section, assign the user to the following groups:

   • System: Select Min Permission System Group
   • Cardholder: Select Min Permission Cardholder Group
   • Field/ Page: Select View/Edit All Fields

6. If the segment is enabled, go to the Segment Access tab and assign the necessary access permissions in the configuration. Ensure these are configured the same as Segment Settings.

7. Select the Save to finalize the user creation.

Please refer to the table below to add permissions to the permission groups.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.