Skip to main content

​
Capabilities

The SailPoint IdentityIQ connector syncs accounts and entitlements from a configured application managed by IIQ. It does not sync IIQ-native objects (IIQ users, IIQ roles) — those are internal to SailPoint and out of scope. Notes:
  • Accounts are application-specific accounts scoped to the configured application name. Each account is enriched with identity data (email, department, manager) fetched from GET /Users/{id}. Account status reflects the active and locked fields from the SCIM API.
  • Entitlements are application entitlements (LDAP groups, permissions, etc.) filtered by application name. Grants are discovered via the entitlement assignments on each identity.

​
Prerequisites

Before configuring the connector:
  1. SailPoint IdentityIQ with SCIM v2 API enabled.
  2. The C1 integration rule library and workflows loaded into IIQ (required for grant/revoke provisioning — see SailPoint IIQ Setup).
  3. An OAuth2 service account or HTTP Basic Auth credentials with SCIM API access.

​
Gather SailPoint IIQ credentials

To configure the SailPoint IdentityIQ connector, you need IIQ System Administrator access to import the service account and workflows. OAuth2 credential generation also requires System Administrator access.
1
Import the service account and workflows into SailPoint IIQ.In the IIQ console or via Gear → Import from File, import the following files from the sailpoint/ directory:
2
Choose an authentication method and gather the credentials.
IIQ SCIM v8.3 declares HTTP Basic Auth as the standard authentication method. Use the username and password of the service account created in step 1 (or any IIQ account with SCIM API access).Copy the username and password.
3
Find your application name.In the IIQ UI, navigate to Applications and note the display name of the application whose accounts and entitlements you want to sync (e.g. LDAP, Active Directory). The value is case-sensitive and must match exactly.

​
Configure the connector in C1

SailPoint IdentityIQ is an on-premises product. The connector must be able to reach your IIQ instance over the network. If your IIQ instance is not publicly accessible, use the self-hosted option and run the connector on a machine inside your network.
1
In the C1 Admin UI, navigate to Connectors and click Add connector.
2
Search for SailPoint IdentityIQ and select it. When prompted for hosting, choose Self-hosted.
3
Copy the connector token displayed — you will need it to register the running connector with C1.
4
On a host with network access to your IIQ instance, run the connector using Docker or the binary:
Replace --sailpoint-username / --sailpoint-password with --sailpoint-token-url, --sailpoint-client-id, and --sailpoint-client-secret if using OAuth2.
5
Return to the C1 UI. Once the connector registers and completes its first sync, the status changes to Connected.

​
SailPoint IIQ Setup

The following steps must be completed in SailPoint IIQ before running the connector. XML files are in the sailpoint/ directory.

​
1. Load the Rule Library and Workflows

Load the four XML files listed in step 1 above via Gear → Import from File or the IIQ console.

​
2. Create a Service Account

Load C1IntegrationSvcAccount.xml to create a dedicated service account.
You may change the account name and password, but the capabilities must remain unchanged — the account requires SCIM API access and permission to launch workflows.

​
3. Configure Authentication

HTTP Basic Auth (default): Use the username and password of the service account created above (or any IIQ account with SCIM API access). Set BATON_SAILPOINT_USERNAME and BATON_SAILPOINT_PASSWORD. OAuth2 (optional): If your IIQ instance has OAuth2 enabled, follow the official SailPoint guide to generate a Client ID and Secret for the service account. Set BATON_SAILPOINT_TOKEN_URL, BATON_SAILPOINT_CLIENT_ID, and BATON_SAILPOINT_CLIENT_SECRET.

​
What gets synced