Integrating SailPoint with Salesforce

SailPoint's Salesforce connector offers access management of Salesforce users. This integration with Salesforce gives you policy-based access controls so you can be sure only the right users can see and interact with critical information. This integration enables a deep level of access governance which not only allows you to manage internal users but also your public groups.

You can search for specific information about the requirements and field definitions needed to get a working instance of the Salesforce source in SailPoint. To manage the account data, either create an identity profile based on the source or verify that the accounts you load are correlated to an existing identity.

Supported Managed Systems

The Salesforce connector supports:

• Salesforce CRM (sales-cloud)
• Salesforce API version 61

• Salesforce Hyperforce-enabled tenants

  For information on the permissions required to support Hyperforce tenants, refer to Salesforce Hyperforce Tenant User Access.

• Salesforce API version 60

  Note

  The version in the URL is disregarded for existing Salesforce sources. Instead, the connector uses Salesforce API version 60.0 automatically. There is no change in the existing behavior.

Prerequisites

• Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.
• Most of your users need a standard Salesforce user license.
• For External Client Application (ECA) authentication, install External Client Application from Salesforce AppExchange. For information, refer to Installing External Client Application.

For administrator rights and custom profile access on the Salesforce account, refer to required permissions.

Supported Features

The Salesforce connector supports the following features.

Account Management

• *Load and provision accounts
• *Access certifications (Certification of entitlements connected to accounts)
• Enable and disable accounts
• Password Management

• Add and remove associations of the following group objects with User objects:

  • PermissionSet
  • PermissionSetGroup
  • CollaborationGroups
  • PublicGroups
  • Role
  • PermissionSetLicense
  • ManagedPackage
  • DelegateGroup

• Create new Portal Users and Partner Users, and assign licenses

  Note

  Enabling and disabling portal and partner users is not supported.

Account - Group Management

• Aggregate collaboration groups as entitlements during account aggregation

• Aggregate collaboration groups as group objects

  Note

  If you enable or disable a user that has a collaboration group object assigned to it, Salesforce automatically removes it, but it won't update in the SailPoint user interface for that user. To correct this, run the Iterate the User process after the Enable/Disable operation is performed.

• Add or remove collaboration groups as entitlements

• Manages Salesforce profiles as account-groups
• Group aggregation
• Refresh groups

• Aggregate the following objects as group objects:

  • PermissionSet
  • PermissionSetGroup
  • PublicGroup

  • PermissionSetLicense

    Note

    Through certification, permission set licenses cannot be removed until associated permission sets are removed.

  • ManagedPackage

  • Role

    Note

    Includes the role's hierarchy.

  • DelegateGroup

    Note

    DelegateGroup objects can be assigned to active (enabled) users.

    If you disable a user that has a DelegateGroup object assigned to them, Salesforce automatically removes it from the user. However, it doesn't update in SailPoint for that user. To update SailPoint, run the Iterate the User process after performing the Enable/Disable operation.

• Aggregate QueueNames as an entitlement

Enhanced Domains

The Salesforce connector supports use with the Enhanced Domains feature.

Role Hierarchy Management

The Salesforce connector can manage a Role hierarchy in addition to the Role itself. Within the Salesforce system, Role hierarchies are used to extend record access automatically.

Pass-through Authentication

Pass-through authentication enables you to sign in to SailPoint using your Salesforce username and password. To use Pass-through authentication, you must use your Salesforce password and the security token appended to it.

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

• The password policy defined in SailPoint applies to accounts on this source.
• If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.