Skip to content

Configuring Source Settings

Aggregation Settings

Configure connector settings related to delta aggregation and partitioning in aggregation processes. Refer to Partitioning Settings for the partitioning settings.

Delta Aggregation

Enable delta aggregation to configure the connector to only aggregate accounts which have had changes since the last aggregation process. This feature can help streamline aggregation processes.

Screenshot

Delta Aggregation

  1. Enable Delta Aggregation to aggregate accounts that have changed since the last execution.

    Note

    Delta aggregation based on account object type is only applicable for managed systems that support the delta aggregation operation.

  2. In the Account Delete Status Attribute field, enter an attribute value used to mark objects as deleted during delta aggregation processes. For example:

    deleted=true

  3. Enter the Date Format to use for the date and time data sent for delta aggregation.

  4. In the Server Timezone field, specify the timezone for the source's server.
  5. Select Save.

Common Configuration

  1. In the Connection Timeout (in seconds) field, enter the connection timeout value in seconds.

  2. The Web Services source supports client certificate authentication for the API endpoints with SSL. Enter the valid details in the Client Certificate and Client Private Key fields, respectively. Refer to Converting a Private Key to RSA PEM Format for more information.

  3. In the Account Enable Status Attribute field, enter the attribute name and value to set the account status while loading accounts. The status of accounts with the specified attribute and value is marked as enabled; the status for all other accounts is disabled. For example, if you enter status=Active, the status of all accounts with the status attribute set to Active is enabled.

    Note

    The Account Enable Status Attribute field supports multiple values for status attribute. If you need to enter multiple values for the Account Enable Status Attribute, separate them by using a comma as displayed in the following example: status=Active,Pending

  4. In the Account Lock Status Attribute field, provide the value required to check the account lock status. For example, if you enter status=inactive, the account schema status attribute determines whether the account is locked or not. In this case, all accounts with their status attribute set to inactive are considered locked by the connector, and therefore they are not included in provisioning.

    Note

    The Account Lock Status Attribute field supports multiple values for the status attribute. If you need to enter multiple values for Account Lock Status Attribute, separate them by using a comma as displayed in the following example: status=Locked,Inactive

  5. Select Save.

Converting a Private Key to RSA PEM Format

The connector only supports the PEM format for the Client Certificate and the private key. Additionally, the Web Services connector expects the PEM private key to be an RSA PEM private key. The following process enables you to convert the private key to an RSA private key on a Windows computer:

  1. Download and extract the latest version of openSSL.
  2. Open cmd to the OpenSSL path.
  3. Copy the Private_ADP_Key.key file to the extracted OpenSSL path.

  4. Run the following command:

    openssl rsa -in Private_ADP_Key.key -out rsa_private_key.pem

  5. Use this rsa_private_key.pem file in the connector.

Provisioning Settings

Configure settings related to provisioning operations.

Screenshot

Additional Settings - Provisioning

The Web Services connector supports the following provisioning features:

  • Create Account With "Ent" Request - The Create Account operation executes with entitlement attributes. If the Create Account operation response contains the required attributes, including the identity attribute, the account object is created and the account link displays under the identity from whom the account creation was triggered.

  • Update Attributes with Change Password - Include a password change and an attribute change in a single request. The Change Password operation is used for changing the password on the managed system. If the provisioning plan contains no attribute request with the name "password", the update operation type endpoint is invoked. Enabling this attribute does not include requests for add or remove entitlement operations. Those requests are executed independently.

  • Add or Remove Entitlements in a Single Request - Enable Add or Remove Entitlements in a Single Request to send multiple entitlement requests at once to the managed system as opposed to separately.
  • Skip getObject Call during Create Provisioning - Enable Skip getObject Call during Create Provisioning to skip the getObject call during initial object creation in provisioning operations.
  • Get Object Required for Pass-Through Authentication - The Pass-Through Authentication (PTA) operation is used to perform verification of user credentials. When selected, it executes the Get Object operation to verify if the entered username (considered an Account ID attribute) is present on the target system. When unselected, it skips the Get Object operation. The Pass-Through Authentication operation must have response mapping with account object schema attributes. Refer to Pass-Through Authentication for more information.

Common Configurations for Errors

Screenshot

Additional Settings - Common Configuration

HTTP Errors

You can manually configure HTTP error codes and messages for times when an API endpoint in the Web Services source sends unexpected error codes to flag failure conditions. Manually configuring these codes enables the connector to properly handle them. Configure the source with all possible HTTP error codes and messages that the API endpoint may return. Enter the HTTP Error Keys and their respective HTTP Error Values.

Note

This is not applicable to the child endpoints.

For example:

  • The Web Services source returns the HTTP status code 200, but the response payload contains an error. Without the manually entered HTTP error, the source won't know that it must fail the request.
  • During OAuth token generation, the source needs to regenerate a token to replace an invalid or expired token. You can configure an HTTP error code or message to specify an invalid/expiry token error in this event. The source regenerates and saves the token for OAuth2 authentication, then retries the operation with the newly generated access token.

Object Not Found Error Messages

Enter the error message that the connector displays when it can't find objects or fails to make connections. For example:

404 - Object Not Found

Disable Cookies

The Web Services source can disable cookies while executing HTTP requests. You can disable cookies for all the operations performed except for the authentication API.

Refer to Support for Cookies for more information.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.