# SailPoint Starburst Connector Documentation

> Starburst Connector Documentation

# Documentation

# Connecting SailPoint and Starburst

To connect SailPoint to the source, perform the following tasks:

## Adding and Configuring the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

1. Go to **Admin \> Connections \> Sources**.
2. Select **Create New**.
3. Search for a source type and select **Actions**.
4. In the **Actions** dropdown, select the setup method:

   - **Express Setup** - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started.

     > **Note**
     >
     > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>). For more information, contact your SailPoint Customer Service Manager.
   - **Standard Setup** - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup.

### Express Setup

1. Review the directions and select **Start Express Setup**.
2. Review the pre-populated source name, source owner, and description. To update, select **Edit**.

   > **Note**
   >
   > Source name must be unique.
3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
4. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** page.
5. Select **Finish**. After a successful test connection, the system creates your source and prompts you to run an aggregation.

   - If you want to aggregate now, select **Aggregate**.

     - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**.
     - To see the list of aggregated source accounts, go to **Account Management \> Accounts**.
   - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet.

### Standard Setup

Configure more detailed settings relative to Express Setup.

1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
4. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
5. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
6. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Here, continue to configure your connected source.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a descriptive **Source Name** for the connection.
2. Enter the **Source Description** that provides details necessary to distinguish it from similar connection sources.
3. In **Source Owner**, begin typing the name of the source owner.
4. (Optional) Select the appropriate **Governance Group for Source Management** from the dropdown list. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
5. Select **Create Manual Work Items** to enable the source to support additional source management features such as creating accounts and access profile management.

   > **Important**
   >
   > Once you enable this feature, it can't be disabled.

   For more information on manual work items, refer to [Work Items](<https://developer.sailpoint.com/docs/api/work-items>). For more information on SailPoint features, refer to [SailPoint Identity Services](<https://documentation.sailpoint.com/saas/help/index.html>).
6. Select **Save**.

## Connection Settings

Configure a secured, direct connection to the source.

1. Enter the Starburst Galaxy API base endpoint as **Base URL**. For example, `https://<account-domain>.galaxy.starburst.io`.
2. Enter the Base64-encoded `clientId:secretKey` value as **API Token**.
3. Select **Save**.

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Dataset Management

Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history.

> [!NOTE]
>
> Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>) for more information.

For more information, refer to [Managing Datasets and Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html>) for datasets, resources, owner correlation, and aggregation.

## Datasets

A *dataset* is a named group of one or more related resources that the source aggregates together.

When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources.

> [!NOTE]
>
> Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them.

### Dataset Aggregation

Configure aggregation on the **Dataset Aggregations** tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to [Configuring Dataset Aggregations](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

## Resources

A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model.

In the UI, each resource appears under **Dataset Management** \> **Resources** with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation.

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

### Owner Correlation

Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to [Configuring Owner Correlation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-owner-correlation>).

## Supported Datasets

Go to **Dataset Management \> Datasets** on your Starburst source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation.

> [!NOTE]
>
> Configure aggregation for each dataset separately. For more information, refer to [Dataset Aggregation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

> [!NOTE]
>
> These resources do not define owner correlation. Each service account is identified by `serviceAccountId` and displayed by `userName`. Each cross-account IAM role is identified by `roleArn` and displayed by `roleName`. Each SQL job is identified by `sqlJobId` and displayed by `name`.

| Dataset name | Associated resources | Dataset ID | Aggregation schedule |
| --- | --- | --- | --- |
| **Service Account** | Service Account | `starburst:service-account` | Every 12 hours (`0 */12 * * *`) |
| **Cross-Account IAM Role** | Cross-Account IAM Role | `starburst:cross-account-iam-role` | Every 12 hours (`0 */12 * * *`) |
| **SQL Job** | SQL Job | `starburst:sql-job` | Every 12 hours (`0 */12 * * *`) |

For resource schema attributes, refer to [Supported Resources](<#supported-resources>), [Service Account Attributes](<#service-account-attributes>), [Cross-Account IAM Role Attributes](<#cross-account-iam-role-attributes>), and [SQL Job Attributes](<#sql-job-attributes>).

### Dataset Aggregations

Dataset aggregation collects resource objects from the managed system and loads them into SailPoint. Repeat the configuration for each dataset on the source.

### Configuring Dataset Aggregation

To configure dataset aggregation for a dataset:

1. Go to **Admin \> Connections \> Sources**, and open your source.
2. Go to **Dataset Management \> Datasets**.
3. Select the dataset you want to configure.
4. Select the **Dataset Aggregations** tab.

   On the **Dataset Aggregations** tab, configure how resource objects from the selected dataset are aggregated into SailPoint. The tab contains **Scheduled Aggregations**, **Manual Aggregation**, and **Latest Aggregation**.

#### Scheduled Aggregations

Scheduled aggregations run on a schedule to keep the dataset synchronized with the managed system.

1. On the **Dataset Aggregations** tab, select **Enable Schedule** to turn on scheduled aggregations.

When scheduled aggregations are enabled, SailPoint aggregates all resource objects in the dataset on the configured schedule.

#### Manual Aggregation

Manual aggregation runs once and collects all resource objects in the dataset.

1. On the **Dataset Aggregations** tab, select **Start Aggregation**.

SailPoint starts the aggregation immediately. When the run completes, results appear in the **Latest Aggregation** section.

#### Viewing Aggregation Results

After an aggregation completes, review its status in the **Latest Aggregation** section on the **Dataset Aggregations** tab.

The **Latest Aggregation** section shows:

- **Start Time** - when the aggregation started
- **Resource Objects Scanned** - the number of resource objects the aggregation processed
- **Status** - whether the aggregation succeeded or failed

Select **Details** to view additional information about the most recent run. To view prior runs, select **Aggregation History**.

## Supported Resources

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

> [!NOTE]
>
> When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources.

Under **Dataset Management** \> **Resources**, the Starburst source lists each object type that is aggregated. Select a resource to review its schema on the **Schema** tab.

| Resource name | Resource type | Resource ID | Identity attribute | Display attribute |
| --- | --- | --- | --- | --- |
| **Service Account** | `Account` | `starburst:service-account` | `serviceAccountId` | `userName` |
| **Cross-Account IAM Role** | `Account` | `starburst:cross-account-iam-role` | `roleArn` | `roleName` |
| **SQL Job** | `Application` | `starburst:sql-job` | `sqlJobId` | `name` |

For the complete resource schemas, refer to [Service Account Attributes](<#service-account-attributes>), [Cross-Account IAM Role Attributes](<#cross-account-iam-role-attributes>), and [SQL Job Attributes](<#sql-job-attributes>).

### Owner Correlation

These resources do not define owner correlation. For more information, refer to [Owner Correlation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-owner-correlation>).

## Service Account Attributes

Use the following schema attributes for the **Service Account** resource in the **Service Account** dataset. Service accounts are machine logins used by tools and automation. Each one has a primary role, optional additional roles, and one or more passwords.

| Attribute Name | Description |
| --- | --- |
| serviceAccountId | Unique identifier of the service account. Resource ID. |
| userName | Username of the service account. Display attribute. |
| roleId | Primary role assigned to the service account. |
| additionalRoleIds | Additional roles assigned to the service account. |
| syncToken | Synchronization token for the service account. |
| classification | Account classification. Service accounts are machine accounts. |
| serviceAccountPasswordIds | Identifiers of the service account's passwords. |
| passwordPrefixes | Prefixes of the service account's passwords. |
| passwordDescriptions | Descriptions of the service account's passwords. |
| passwordCreatedDates | Date and time when each password was created. |

## Cross-Account IAM Role Attributes

Use the following schema attributes for the **Cross-Account IAM Role** resource in the **Cross-Account IAM Role** dataset. Cross-account IAM roles are AWS roles that Galaxy assumes to reach object storage and other AWS data sources for catalogs.

| Attribute Name | Description |
| --- | --- |
| roleArn | Amazon Resource Name (ARN) of the cross-account IAM role. Resource ID. |
| roleName | Name of the cross-account IAM role. Display attribute. |
| roleAlias | Alias of the cross-account IAM role in Galaxy. |
| status | Current status of the role. |
| validationMessage | Details about the role's validation status. |
| classification | Account classification. Cross-account IAM roles are machine accounts. |
| createdAt | Date and time when the role was created. |
| updatedAt | Date and time when the role was last updated. |

## SQL Job Attributes

Use the following schema attributes for the **SQL Job** resource in the **SQL Job** dataset. SQL jobs are scheduled queries. Each one runs under a role on a cron schedule.

| Attribute Name | Description |
| --- | --- |
| sqlJobId | Unique identifier of the SQL job. Resource ID. |
| name | Name of the SQL job. Display attribute. |
| cronExpression | Cron schedule for the SQL job. |
| timezone | Time zone in which the schedule is evaluated. |
| roleId | Role the SQL job runs under. |
| syncToken | Synchronization token for the SQL job. |

# Integrating SailPoint with Starburst

Starburst is a fully managed cloud analytics and data-lakehouse platform built on Trino. It enables organizations to query and govern data distributed across object storage, cloud data warehouses, relational databases, and other connected data sources. A Starburst Galaxy account represents the managed environment in which administrators configure users, roles, clusters, catalogs, access controls, and security policies. People who sign in to the Starburst Galaxy account are treated as accounts by this connector. Each user is identified by a unique Starburst user ID and email address. Access is controlled through roles such as accountadmin, public, and customer-defined roles. Users can receive roles directly or inherit them through Starburst's role hierarchy. This document covers how to configure a new direct connection between SailPoint and Starburst for Quick Compliance. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Starburst connector supports the following:

### Account Management

- Aggregate Users

### Entitlement Management

- Aggregate Roles

### Non-Human Identity Discovery

- Aggregate Service Accounts
- Aggregate Cross-Account IAM Roles
- Aggregate SQL Jobs

> [!NOTE]
>
> Service accounts, cross-account IAM roles, and SQL jobs are aggregated as non-human identity resources through Dataset Management. They are separate from human user account aggregation. These resources do not define owner correlation.

> [!NOTE]
>
> This connector is read-only. It supports test connection, account aggregation, entitlement aggregation, and dataset aggregation for Quick Compliance. Provisioning, de-provisioning, and write operations are not supported.

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Before you configure the Starburst connector, ensure the following requirements are met:

1. Sign in to [Starburst](<https://www.starburst.io/>).
2. Go to **Access \> API Auth Tokens**.
3. Select **Generate New Token**.
4. Enter a meaningful description for the token, and assign an appropriate role to the token.
5. Create the token, then securely copy its Client ID and Secret key.
6. Build the Base64-encoded value of `clientId:secretKey`. Store only the resulting encoded value in the connector credential field as **API Token**.
7. Record the following values for connector configuration:

   - **Base URL** - For example, `https://<account-domain>.galaxy.starburst.io`.
   - **API Token** - The Base64-encoded `clientId:secretKey` value.

For more information, refer to the [Starburst Galaxy API](<https://docs.starburst.io/starburst-galaxy/developer-tools/api/>) documentation.

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

## Required Permissions

The role assigned to the API auth token must be able to read users, roles, service accounts, cross-account IAM roles, and SQL jobs. A token assigned `accountadmin` can call every Galaxy API endpoint. With a valid token, the connector can:

- List users, including their direct and inherited roles
- List roles, including direct grants and inherited grants
- List service accounts, including their roles and password metadata
- List cross-account IAM roles configured on the account
- List SQL jobs and their schedules

# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The Starburst connector uses the following default correlation and object configurations.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| id | Account |

### Default Account Attributes

The Starburst connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description |
| --- | --- |
| id | Unique identifier of the user |
| email | Email address of the user. Display attribute and correlation key. |
| syncToken | Synchronization token for the user. |
| defaultRoleId | Identifier of the user's default role. |
| createdOn | Date and time when the user was created. |
| scimManaged | Whether the user is managed through SCIM. |
| directlyGrantedRoles | Identifiers of roles granted directly to the user. |
| directlyGrantedRoleNames | Names of roles granted directly to the user. |
| directlyGrantedRolePrincipalIds | Principal identifiers of the user's direct role grants. |
| directlyGrantedRolePrincipalTypes | Principal types of the user's direct role grants. |
| directlyGrantedRoleAdminOptions | Admin-option flags of the user's direct role grants. |
| allRoles | Identifiers of every role the user holds, including inherited roles. |
| allRoleNames | Names of every role the user holds. |
| allRolePrincipalIds | Principal identifiers of all of the user's role grants. |
| allRolePrincipalTypes | Principal types of all of the user's role grants. |
| allRoleAdminOptions | Admin-option flags of all of the user's role grants. |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

| Attribute Name | Description |
| --- | --- |
| id | Unique identifier of the role. Entitlement ID. |
| name | Name of the role. Display attribute. |
| description | Description of the role. |
| syncToken | Synchronization token for the role. |
| createdOn | Date and time when the role was created. |
| modifiedOn | Date and time when the role was last modified. |
| owningRoleId | Identifier of the role that owns this role. |
| directlyGrantedRoles | Identifiers of roles granted directly to this role. |
| directlyGrantedRoleNames | Names of roles granted directly to this role. |
| directlyGrantedRolePrincipalIds | Principal identifiers of this role's direct grants. |
| directlyGrantedRolePrincipalTypes | Principal types of this role's direct grants. |
| directlyGrantedRoleAdminOptions | Admin-option flags of this role's direct grants. |
| allRoles | Identifiers of every role this role inherits. |
| allRoleNames | Names of every role this role inherits. |
| allRolePrincipalIds | Principal identifiers of all grants of this role. |
| allRolePrincipalTypes | Principal types of all grants of this role. |
| allRoleAdminOptions | Admin-option flags of all grants of this role. |