Skip to content

Integrating SailPoint with Redpanda Cloud Control Plane

Redpanda Cloud is a fully managed streaming data platform, Kafka API compatible, in which an organization's users, roles, and clusters are administered through a central control plane. This document provides the instructions required to configure a new direct connection between SailPoint and Redpanda Cloud Control Plane for Quick Compliance. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Redpanda Cloud Control Plane connector supports the following:

Account Management

  • Aggregate Users

Entitlement Management

  • Aggregate Roles

Note

This connector is read-only. It supports test connection, account aggregation, and entitlement aggregation for Quick Compliance. Provisioning, de-provisioning, and write operations are not supported. Role assignments are resolved per user from role bindings and mapped to the account roles attribute.

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Before you configure the Redpanda Cloud Control Plane connector, ensure the following requirements are met:

  1. Sign in to the Redpanda Cloud UI with access to an organization.
  2. Go to Organization IAM and select the Service account tab.
  3. Select Create service account and supply a name and a description. The description is required and is limited to 140 characters.
  4. Copy and securely store the Client ID and Client Secret. The secret is displayed only once at creation. If it is lost, rotate it and store the new value.

  5. Record the following values for connector configuration:

    • Base URL
    • Client ID
    • Client Secret

Note

  • Use a service account in the same organization as the users you intend to aggregate. An access token is bound to a single organization. A service account from a different organization returns an empty result set rather than an error.
  • Service accounts are automatically granted the Admin role across all resources in the organization, so no additional role assignment is required for aggregation.
  • The Control Plane API host is shared for every organization. The Base URL is pre-filled and does not normally need to be changed.

Required Permissions

The service account must be able to list users, read role bindings for each account, and list roles. The Admin role held by a service account satisfies these requirements. A service account restricted to Reader can still aggregate, but an account without iam_user_read and iam_rolebinding_read will aggregate accounts with no entitlements attached.

Important

Redpanda's token endpoint requires a non-standard audience parameter of cloudv2-production.redpanda.cloud in addition to the client credentials. A token request that omits it succeeds but returns an opaque token, and every subsequent API call then fails with HTTP 401. The connector supplies this parameter automatically.

For more information about Redpanda Cloud Control Plane, refer to the following:

Note

The linked document is not maintained by SailPoint and is subject to change without notice.