Skip to content
Documentation version: IdentityIQ 8.5

Connecting IdentityIQ to SailPoint Agentic Fabric

This section explains how to connect IdentityIQ to Agentic Fabric using the SailPoint Agentic Fabric Integration plugin, enabling IdentityIQ to serve as a trusted identity source for Agentic Fabric.

Prerequisites

Before you begin, make sure the following requirements are met:

  • You are using IdentityIQ 8.5 or later.
  • The IdentityIQ server can establish outbound HTTPS connections to https://<tenant>.api.identitynow.com through any required firewall or proxy.
  • Your browser and operating system are supported. For more information, see Supported Browsers and Operating Systems.
  • An Agentic Fabric tenant is provisioned and accessible. SailPoint creates the tenant and sends an email invitation when it is ready for use.

Generating API Credentials in your Tenant

To enable IdentityIQ to connect securely to Agentic Fabric, generate API credentials in your Agentic Fabric tenant.

To generate credentials:

  1. Sign in to your tenant as an admin.
  2. Follow the steps as specified in Managing API Keys to create API credentials.

  3. Specify the options as follows:

    Option Description
    Description Enter a description to help identify the key later. For example, IdentityIQ-SAF integration key.
    Grant Type Select Client Credentials.
    Scopes Select the following scopes:
    • idn:sources:read
    • idn:sources:manage
    • sp:connector:push
    • idn:identity-profile:read
    • idn:identity-profile:manage
    • idn:identity-profile-lifecycle-state:manage
    Vendor Integrations Select Other / No associated vendor integration.

Installing and Configuring the Plugin

Install and configure the SailPoint Agentic Fabric Integration plugin in IdentityIQ to establish the connection to Agentic Fabric.

Before you install the plugin, ensure that plugins are enabled in IdentityIQ. In identityiq_home/WEB-INF/classes/iiq.properties, confirm that plugins.enabled is set to true.

To install the plugin:

  1. Download the following files from the SailPoint Compass:

    File Name Description
    saf-iga-integration-plugin-config.zip The plugin ZIP
    saf-iga-integration-plugin-iiq85.jar The plugin classes JAR for IdentityIQ 8.5
    saf-iga-integration-plugin-iiq9.jar The plugin classes JAR for IdentityIQ 9.0 and later

  2. In your IdentityIQ installation folder, place the plugin classes JAR at identityiq_home/WEB-INF/lib/ and restart the server.

  3. Install the plugin in IdentityIQ. For more information, see Plugin Installation and Removal.

    After the plugin is installed, a new card appears for it on the Plugins page.

To configure the plugin:

  1. On the plugin card, select Configure and specify the following connection details:

    • API Host URL - The API host URL of your Agentic Fabric tenant: https://<tenant>.api.identitynow.com.
    • Client ID and Client Secret - A pair of unique credentials issued by the tenant to authenticate and authorize IdentityIQ when it connects to the Agentic Fabric API. For more information, see Generating API Credentials in your Tenant.

    • Owner Identity ID - The ID of an admin identity that already exists in Agentic Fabric.

      This identity will own the source and identity profile created in Agentic Fabric for the IdentityIQ connection.

  2. Select Connect.

    After successful connection,

    • The following objects are created for the IdentityIQ connection in Agentic Fabric:

      • Source: SailPoint IdentityIQ Source

        The source is created with the Configuration Incomplete status by default. This status does not require any action.

      • Identity Profile: SailPoint IdentityIQ Identity Profile

      Important

      SailPoint recommends that you do not modify the source or identity profile.

    • Your connection settings are stored in the configuration object named PublishersConfiguration.

Note

For a multi-node architecture,

  • Copy the same version of the JAR file to each node (server) and then restart all nodes.
  • Install the plugin on one node and verify that it appears on the Plugins page on each node.
  • Connect to Agentic Fabric from one node only. The connection settings are saved across the deployment and do not need to be configured on each node.