Skip to content

Integrating SailPoint with Astronomer

Astronomer is a managed data orchestration platform built on Apache Airflow, used to author, schedule, and monitor data pipelines across organizations, workspaces, and deployments. The Astronomer connector aggregates the users in an Astronomer organization along with the organization-level role granted to each user, so that SailPoint can govern access to the Astronomer organization. This document provides instructions to configure a new direct connection to an Astronomer source. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Astronomer connector supports the following:

  • Account Aggregation (the organizationRole is aggregated as a managed entitlement as part of the Account).

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

  • You have an active Astronomer organization.
  • You have a user with Organization Owner access.
  • You have generated an API token (Organization-level) from the Astronomer Cloud UI.
  • You have your Settings > General > Organization ID from the Astronomer Cloud UI.

Generate an API Token

  1. Sign in to the Astronomer Cloud UI.
  2. Select your Organization, then go to Settings > Access Management > API Tokens.
  3. Select Add Organization API Token.
  4. Provide a name, an expiry, and assign the Organization Member (or higher) role. The token needs read access to the organization's users.
  5. Copy and securely store the token. The Cloud UI only displays it once.

Resource Link

For more information about authenticating to Astro using API tokens, refer to the Astronomer Authentication documentation.

Note

The linked document is not maintained by SailPoint and is subject to change without notice.

Required Permissions

The API token used for this integration must have sufficient access to read the organization's user data.

  • The token must be an Organization-level token with at least the ORGANIZATION_MEMBER role, which grants read access to the /v1/organizations/{organizationId}/users endpoint.
  • Workspace-level and Deployment-level tokens are not sufficient, as they cannot list organization users.

Official References:

Note

The linked document is not maintained by SailPoint and is subject to change without notice.