Integrating SailPoint with Sybase (SAP ASE)

SAP Adaptive Server Enterprise SAP ASE is the new name for the formerly named Sybase Adaptive Server Enterprise (Sybase ASE).

This document is designed to give specific information about the requirements and field definitions needed to get a working instance of a Sybase SAP ASE connector.

Supported Features

The SailPoint Sybase SAP ASE Connector provides support for the following features:

• Accounts
• *Password Management
• *Provisioning
• *Access Certifications (certification of entitlements connected to accounts)
• Delete Account

For more information on features, refer to Source Features.

The Sybase SAP ASE source in SailPoint supports the following group and entitlement objects:

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

• The password policy defined in SailPoint applies to accounts on this source.
• If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Supported Managed Systems

Following versions of ASE are supported by the SailPoint SAP ASE Connector:

• SAP ASE 16.1
• SAP ASE 16.0
• SAP ASE 15.7
• SAP HADR (High Availability Disaster Recovery) SAP ASE 16.0 SP03

Prerequisites

Ensure you've met the following prerequisites before deploying the SailPoint Sybase SAP ASE connector:

• Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.
• Identify or create a service account on the Sybase (SAP ASE) system.

• Download and install a custom SAP ASE JDBC driver, which is required for the proper functionality of SailPoint SAP ASE Connector. For example, jconn4.jar. The jconn4.jar driver is now part of the SDK for SAP Adaptive Server Enterprise (Sybase ASE).

  To download the required driver:

  1. Go to the SAP Marketplace.

  2. In the Search field at the top of the page, enter "SCN Adaptive Server Enterprise SDK".

     A list of downloads is displays.

  3. Download the package appropriate to your version.

Administrator Permissions

You must have access to an administrator account on Sybase SAP ASE system with the following minimum permissions to create a service account:

• SSO_ROLE (System Security Officer)
• SA_ROLE (System Administrator Role)

• Permission to run the following commands during aggregation:

  • CREATE USER <USER_NAME> IDENTIFIED BY <PASSWORD>
  • GRANT select on master..sysloginroles to <USER_NAME>
  • GRANT select on master..sysrvroles to <USER_NAME>

Respective administrator permissions must be provided by an SA or administrator-level login user for the following operations:

• Test Connection
• Aggregation
• Provisioning

Test Connection

Configure the permissions to test the connection to the SAP Sybase database. Access to all databases must be granted to this user.

1. Set the enable granular permissions configuration parameter to 1 as follows in the application debug page:

   sp_configure enable_granular_permissions, 1
   

2. Log in using administrator credentials and create a new user on the managed system using the following command, where loginame is the login user on SAP ASE, password is the user-provided password, and username is the corresponding Database User:

   use [databaseName]
   go
   sp_addlogin [loginname],[password]
   go
   sp_adduser [username]
   go
   

   Note

   Grant access to all databases to the newly created user.

Aggregation

Configure user permissions for aggregation operations.

1. Create the role and assign it to a login user:

   create role [rolename]
   go
   grant role [rolename] to [loginname]
   go
   

2. Activate the role:

   exec sp_modifylogin '[loginname]', 'add default role', '[rolename]'
   go
   

3. Assign the following privileges to role. The service account must have associated user on respective databases to fetch aliases:

   grant select on master..sysloginroles to [rolename]
   go
   grant select on master..syssrvroles to [rolename]
   go
   grant select on master..syslogins to [rolename]
   go
   grant select on sysusers to [rolename]
   go
   grant select on master..sysdatabases to [rolename]
   go
   grant select on sysroles to [rolename]
   go
   grant select on sysalternates to [rolename]
   go
   grant manage security configuration to [rolename]
   go
   

Provisioning

1. Users require the following permissions to perform provisioning operations:

   go
   grant manage any login to [rolename]
   go
   grant manage server to [rolename]
   go
   grant manage roles to [rolename]
   go
   grant change password to [rolename]
   go
   

2. Configure user permissions to conduct database-related operations (add/remove user, add/remove database group, add/drop alias):

   Prerequisite: Service account must have associated user on respective databases and dbo must have manage database permissions privilege.

   use [databaseName]
   go
   grant manage database permissions to [username]
   go
   use [databaseName]
   go
   grant manage any user to [username]
   go
   

Granular Permissions Not Installed on SAP ASE

This section describes the minimum permissions required for the Sybase (SAP ASE) administrator user when the Granular Permissions module is not installed on SAP ASE (sp_configure enable_granular_permissions, 0).

Respective administrator permissions must be provided for the following operations:

• Test Connection
• Aggregation
• Provisioning

The minimum Administrative Account permission required to be granted for provisioning is SSO_ROLE (System Security Officer). The following scripts must be used to create minimum permission user and role. These permissions must be run by a SA or administrator-level login user.

1. Log in using administrator credentials and create a new user on managed system using the following command:

   sp_addlogin [loginname],[password]
   go
   

2. Add a database user:

   use [databaseName]
   go
   sp_adduser [loginname], [databseUserName]
   go
   

3. Grant read-only access to the newly created user using the following command:

   grant select on master..sysloginroles to [username]
   grant select on master..syssrvroles to [username]
   

   Note

   To access user-defined databases, create an account on that database as follows:

   Query to create Database user:

   use [databaseName]
   go
   sp_adduser [username], [databaseUserName]
   go
   

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.