Overview
SailPoint Identity Security Cloud is an identity governance platform. It keeps the workforce record for each worker. It also keeps the accounts that the worker has on connected systems, and the lifecycle state that controls what their access should be. The record of a worker has their identity attributes, for example name, email, employee number, department, and job title. It also has governance signals, for example if the worker is active, disabled, locked, or terminated.
The Persona SailPoint integration connects these records to your Persona workflows as an API credential. With it, you can find a worker from an employee number or email and read the accounts that are correlated to them. You can also turn an account off, or on again, when a verification outcome tells you to. This keeps identity data current during onboarding, account recovery, and offboarding, and you do not have to leave Persona.
With this integration, organizations can:
- Match verified identity data with workforce records in SailPoint.
- Get employee and account attributes into Persona workflows to add data to verification.
- Automate account actions, for example disable an account during offboarding or enable it again after recovery.
Integration Options
Persona gives one way to integrate with SailPoint: the Marketplace API integration. It uses OAuth 2.0 client credentials to connect to your tenant. The integration uses the base URL of your tenant, for example https://acme.api.identitynow.com. In this example, acme is the tenant name in the SailPoint admin console. At this time, Persona has no built-in OIDC or SSO flow for SailPoint.
Setting up the SailPoint integration
To use the SailPoint integration, you need admin access to your SailPoint Identity Security Cloud account. You also need a set of OAuth 2.0 client credentials. You can create them in the SailPoint admin console. Then configure the credential in Persona:
- In the Persona Dashboard, go to Integrations > Marketplace and select SailPoint.
- Click Add Credential at the top of the page.
- Enter a nickname for your credential in the modal and click Continue.
- Enter your SailPoint tenant name, and the Client ID and Client Secret for your OAuth 2.0 client.
- Save the credential to enable the integration.
Persona calls https://{tenant}.api.identitynow.com/oauth/token to get an access token. Then Persona uses that token to call the SailPoint API on your tenant.
Using the SailPoint integration in a workflow
- Create a new workflow, or open an existing workflow that you want to update.
- Add a new Action Step > Integrations.
- Select the SailPoint integration, and select the endpoint that you want (see operations below).
- Configure the input fields to send the correct information.
- Save and publish the workflow.
Operations
Search records
Search the indexed records of SailPoint and return the matches. Use this operation to find a worker when you have only one value from their record, for example an employee number or an email address. Use employeeNumber:10673 to match the worker with that employee number. Use email:"worker@example.com" to match by email address. Use attributes.cloudLifecycleState:active to match all active workers. A queryResultFilter keeps only the properties that you need, for example attributes.cloudLifecycleState.
List identities
List the workers in the tenant, with the shared details that all SailPoint users can see. If you do not need the full governance record of a worker, use a filter to find the worker from an email address or sign-in name. An example filter is email eq "worker@example.com". The operation sorts by name. It supports a page size of 1 through 250.
List accounts
List the accounts that SailPoint manages on connected systems. Filter by worker to see all accounts that one person can sign in with. Filter by source to review one system. Use identityId eq "2c9180835d2e5168015d32f890ca1581" to see the accounts for one worker. Use sourceId eq "ff8081815d1c4e7f015d1c4ec7ff0002" and disabled eq true to review the accounts that are turned off on one source. Select SLIM for only the core details, or FULL for all properties in SailPoint.
Retrieve account
Return one account that SailPoint manages on a connected system. The result tells if the account is turned off or locked at this time. First, find the account ID with List accounts or Search records.
Disable account
Turn an account off on its connected system. The worker can then not sign in with it. SailPoint makes the change in the background and returns a task ID (HTTP 202). You can monitor the task in the SailPoint admin console. An optional externalVerificationId records the identifier of the external verification that authorized the change. You can then trace the decision later.
Enable account
Turn an account on again on its connected system. The worker can then sign in with it again. As with disable, this starts a background change and returns a task ID (HTTP 202). It also has an optional externalVerificationId for tracing.
Plans Explained
SailPoint Integration by plan
| Startup Program | Essential Plan | Growth Plan | Enterprise Plan | |
|---|---|---|---|---|
| SailPoint Integration | Not Available | Not Available | Limited | Available |