# Integrating SailPoint with Sybase (SAP ASE)

> [!NOTE]
>
> **Integration**
>
> This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

*SAP Adaptive Server Enterprise SAP ASE is the new name for the formerly named Sybase Adaptive Server Enterprise (Sybase ASE).*

This document is designed to give specific information about the requirements and field definitions needed to get a working instance of a Sybase SAP ASE connector.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The SailPoint Sybase SAP ASE Connector provides support for the following features:

- Accounts
- \*Password Management
- \*Provisioning
- \*Access Certifications (certification of entitlements connected to accounts)
- Delete Account

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

> [!NOTE]
>
> Before you can use any item above marked with an asterisk (\*), SailPoint must activate the feature for your site. Please open a support ticket for assistance.

The Sybase SAP ASE source in SailPoint supports the following group and entitlement objects:

| Source Objects | Supported Operation |
| --- | --- |
| Roles as group objects | Read only |
| Aliases, Database\_groups, and Roles as entitlement objects | Add or remove entitlements |

### Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

- The password policy defined in SailPoint applies to accounts on this source.
- If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to [Password Management Overview](<https://documentation.sailpoint.com/saas/help/pwd/index.html>).

## Supported Managed Systems

Following versions of ASE are supported by the SailPoint SAP ASE Connector:

- SAP ASE 16.1
- SAP ASE 16.0
- SAP ASE 15.7
- SAP HADR (High Availability Disaster Recovery) SAP ASE 16.0 SP03

## Prerequisites

Ensure you've met the following prerequisites before deploying the SailPoint Sybase SAP ASE connector:

- Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
- Identify or create a service account on the Sybase (SAP ASE) system.
- Download and install a custom SAP ASE JDBC driver, which is required for the proper functionality of SailPoint SAP ASE Connector. For example, `jconn4.jar`. The `jconn4.jar` driver is now part of the SDK for SAP Adaptive Server Enterprise (Sybase ASE).

  To download the required driver:

  1. Go to the [SAP Marketplace](<https://store.sap.com/dcp/>).
  2. In the **Search** field at the top of the page, enter "SCN Adaptive Server Enterprise SDK".

     A list of downloads is displays.
  3. Download the package appropriate to your version.

## Administrator Permissions

You must have access to an administrator account on Sybase SAP ASE system with the following minimum permissions to create a service account:

- SSO\_ROLE (System Security Officer)
- SA\_ROLE (System Administrator Role)
- Permission to run the following commands during aggregation:

  - `CREATE USER <USER_NAME> IDENTIFIED BY <PASSWORD>`
  - `GRANT select on master..sysloginroles to <USER_NAME>`
  - `GRANT select on master..sysrvroles to <USER_NAME>`

Respective administrator permissions must be provided by an SA or administrator-level login user for the following operations:

- Test Connection
- Aggregation
- Provisioning

### Test Connection

Configure the permissions to test the connection to the SAP Sybase database. Access to all databases must be granted to this user.

1. Set the enable granular permissions configuration parameter to `1` as follows in the application debug page:

   ```sql
   sp_configure enable_granular_permissions, 1
   ```
2. Log in using administrator credentials and create a new user on the managed system using the following command, where `loginame` is the login user on SAP ASE, `password` is the user-provided password, and `username` is the corresponding Database User:

   ```sql
   use [databaseName]
   go
   sp_addlogin [loginname],[password]
   go
   sp_adduser [username]
   go
   ```

   > **Note**
   >
   > Grant access to all databases to the newly created user.

### Aggregation

Configure user permissions for aggregation operations.

1. Create the role and assign it to a login user:

   ```sql
   create role [rolename]
   go
   grant role [rolename] to [loginname]
   go
   ```
2. Activate the role:

   ```sql
   exec sp_modifylogin '[loginname]', 'add default role', '[rolename]'
   go
   ```
3. Assign the following privileges to role. The service account must have associated user on respective databases to fetch aliases:

   ```sql
   grant select on master..sysloginroles to [rolename]
   go
   grant select on master..syssrvroles to [rolename]
   go
   grant select on master..syslogins to [rolename]
   go
   grant select on sysusers to [rolename]
   go
   grant select on master..sysdatabases to [rolename]
   go
   grant select on sysroles to [rolename]
   go
   grant select on sysalternates to [rolename]
   go
   grant manage security configuration to [rolename]
   go
   ```

### Provisioning

1. Users require the following permissions to perform provisioning operations:

   ```sql
   go
   grant manage any login to [rolename]
   go
   grant manage server to [rolename]
   go
   grant manage roles to [rolename]
   go
   grant change password to [rolename]
   go
   ```
2. Configure user permissions to conduct database-related operations (add/remove user, add/remove database group, add/drop alias):

   **Prerequisite**: Service account must have associated user on respective databases and dbo must have **manage database permissions** privilege.

   ```sql
   use [databaseName]
   go
   grant manage database permissions to [username]
   go
   use [databaseName]
   go
   grant manage any user to [username]
   go
   ```

### Granular Permissions Not Installed on SAP ASE

This section describes the minimum permissions required for the Sybase (SAP ASE) administrator user when the **Granular Permissions** module is not installed on SAP ASE (`sp_configure enable_granular_permissions, 0`).

Respective administrator permissions must be provided for the following operations:

- Test Connection
- Aggregation
- Provisioning

The minimum Administrative Account permission required to be granted for provisioning is **SSO\_ROLE (System Security Officer)**. The following scripts must be used to create minimum permission user and role. These permissions must be run by a SA or administrator-level login user.

1. Log in using administrator credentials and create a new user on managed system using the following command:

   ```sql
   sp_addlogin [loginname],[password]
   go
   ```
2. Add a database user:

   ```sql
   use [databaseName]
   go
   sp_adduser [loginname], [databseUserName]
   go
   ```
3. Grant read-only access to the newly created user using the following command:

   ```sql
   grant select on master..sysloginroles to [username]
   grant select on master..syssrvroles to [username]
   ```

   > **Note**
   >
   > To access user-defined databases, create an account on that database as follows:
   >
   > Query to create Database user:
   >
   > ```sql
   > use [databaseName]
   > go
   > sp_adduser [username], [databaseUserName]
   > go
   > ```