지금 지원 담당자와 채팅
지원 담당자와 채팅

Starling Connect Hosted - One Identity Manager Administration Guide

About this guide One Identity Starling Connect overview One Identity Starling Supported cloud applications Working with connectors Connector versions Salesforce Facebook Workplace SAP Cloud Platform JIRA Server RSA Archer SuccessFactors AWS IAM ServiceNow Dropbox Crowd Atlassian JIRA Confluence Trello Box Pipedrive SuccessFactors HR NutShell Insightly Egnyte SugarCRM Oracle IDCS Statuspage Zendesk Sell Workbooks DocuSign Citrix ShareFile Zendesk Azure AD Google Workspace Concur Tableau GoToMeeting Coupa AWS Cognito Okta DataDog Hideez Opsgenie Informatica Cloud Services AppDynamics Marketo Workday HR OneLogin PingOne Aha! SAP Litmos HackerRank Slack ActiveCampaign Webex Apigee Databricks Hive PagerDuty Dayforce Smartsheet Pingboard SAP Cloud for Customer Azure Infrastructure Oracle Fusion Cloud Majesco LuccaHR OpenText JFrog Artifactory xMatters Discourse Testrail ChipSoft PingOne Platform Azure DevOps UKG PRO Atlassian Cloud Appendix: Creating a service account in Google Workspace Appendix: Setting a trial account on Salesforce Registering the application, providing necessary permissions, retrieving Client Id and Client Secret from the Azure AD tenant Generating a private key for service account in GoToMeeting Configuring AWS IAM connector to support entitlements for User and Group Configuring Box connector to support additional email IDs for users One Identity Manager E2E integration needs for Hideez connector Configuring custom attributes for ServiceNow v.1.0 Configuring custom attributes for Coupa v.1.0 Configuring custom attributes in connectors Disabling attributes Configuring a connector that uses the consent feature Synchronization and integration of Roles object type with One Identity Manager Synchronization and integration of Workspaces object type with One Identity Manager Synchronization and integration of Products object type with One Identity Manager User centric membership Creating multi-valued custom fields in One Identity Manager Synchronization and assignment of PermissionSets to Users with One Identity Manager Connectors that support password attribute in User object Connectors that do not support special characters in the object ID Creating an app for using SCIM on Slack Enterprise Grid Organization Creating a Webex integration application, providing necessary scopes, retrieving Client Id and Client Secret Retrieving the API key from Facebook Workplace Outbound IP addresses Values for customer-specific configuration parameters in Workday HR connector Initiate an OAuth connection to SuccessFactors Creating custom editable/upsertable attributes in Successfactors employee central Custom Foundation Objects in Successfactors HR connector Configuring additional datetime offset in connectors How to Create custom attribute for Users in SuccessFactors portal SAP Cloud for Customer - Steps to add custom fields at One Identity Manager attributes Creating a Service Principal for the Azure Infrastructure Connector Workday permissions needed to integrate via the Starling Connector Configuring integration application in DocuSign Creating integration Connect Client in Coupa Retrieving Azure DevOps Personal Access Token (PAT) Setup integration system and field override service in Workday Retrieving Atlassian Cloud API Key and Directory ID

Connector versions and features

SuccessFactors is an integrated human-resources platform. It offers users tools for onboarding, social business, and collaboration along with tools for learning management, performance management, recruiting, applicant tracking, succession planning, talent management, and HR analytics. It is also cloud-based.

Supervisor configuration parameters

To configure the connector, following parameters are required:

Supported objects and operations

Users

Table 35: Supported operations for Users

Operation

VERB

Create User

POST

Update User

PUT

Delete (only till v3.0)

DELETE

Get User (Id)

GET

Get All Users

GET

Get All Users with pagination

GET

Groups

Table 36: Supported operations for Groups

Operation

VERB

Update Group PUT
Get All Groups GET

Get Groups (Id)

GET

Get All Groups with pagination GET

Mandatory fields

Users (v1.0-v3.0)

  • User Name
  • Employee Number
  • Status

Users v4.0

  • UserName

  • UserId

  • Status

User and Group mapping

The user and group mappings are listed in the tables below.

Table 37: User mapping
SCIM parameter SuccessFactors parameter
Id userId
UserName username
Name.GivenName firstName
Name.FamilyName lastName

Name.MiddleName

mi

Name.HonorificSuffix

suffix

Name.Formatted

defaultFullName

DisplayName defaultFullName
Emails.Value email
Addresses.StreetAddress addressLine1
Addresses.Locality city
Addresses.Region state

Addresses.PostalCode

zipCode

Addresses.Country

country

PhoneNumbers.Value

businessPhone

Groups.value

groupId

Groups.display

groupName

Roles.value

user.role.id

Roles.display

user.role.name

UserType

jobTitle

Title

title

Active

status

Locale

defaultLocale

Timezone

timeZone

userExtension.EmployeeNumber

empId

userExtension.Division

division

userExtension.Department

department

userExtension.Gender

gender

userExtension.HireDate

hireDate

userExtension.DateOfBirth

dateOfBirth

Meta.Created

hireDate

Meta.LastModified

lastModified

Table 38: Additional mapping from v4.0 onwards
SCIM parameter SuccessFactors parameter
Location location
UserExtension.UserId userId
userExtension.JobCode jobCode
userExtension.Custom01 custom01
userExtension.Custom02 custom02
userExtension.Custom03 custom03
userExtension.Custom04 custom04
userExtension.Custom05 custom05
userExtension.Custom06 custom06
userExtension.Custom07 custom07
userExtension.Custom08 custom08
userExtension.Custom09 custom09
userExtension.Custom10 custom10
userExtension.Custom11 custom11
userExtension.Custom12 custom12
userExtension.Custom13 custom13
userExtension.Custom14 custom14
userExtension.Custom15 custom15
userExtension.Hr.UserId hr.userId
userExtension.Hr.Email hr.email
userExtension.Hr.Username hr.username
userExtension.Hr.Active hr.status
userExtension.Manager.UserId manager.userId
userExtension.Manager.Email manager.email
userExtension.Manager.Username manager.username
userExtension.Manager.Active manager.status
Table 39: Group mapping
SCIM parameter SuccessFactors parameter
Id groupID
displayName groupName

members.value

userId

members.display

userName

groupExtension.groupType groupType
groupExtension.staticGroup staticGroup
Meta.LastModified lastModifiedDate

Connector limitations

  • Create and Delete group operations are not supported due to cloud application limitations.
  • When the active status is updated to false while performing the PUT operation for a user, the following error appears: user not found. This error occurs because a user is considered as a deleted user when the active status is false. (applicable for version V1 to V3)

  • User update does not support addition and removal of Groups or Roles for a particular user. It is done using group update. This is not applicable for role update.

  • Due to the API limitation of the target system, only the groups with type "permission" and "ectworkflow" are supported by version 3.0 of the connector.

  • User employee number cannot be updated because the cloud application considers employee number as a user Id. (applicable from version V1 till V3)

  • The UPDATE of Static Group supports the change of name and memberships. However, the UPDATE of Dynamic Group supports only the change of name but not the memberships. This is due to the target system behavior.

  • The manager/hr attribute gets added under user only if manager/hr in the request has the status as active.

  • Non-existing users should not be assigned as manager/hr while creating/updating user.

Disable attributes

The Disable attribute feature can be used when you want to skip an attribute that exists in the target system.

For the SuccessFactors connector, the attributes of the User object, including those of Enterprise User, can be disabled or enabled while configuring the connector based on your requirements.

NOTE:

  • Mandatory attributes cannot be disabled.
  • For more information about how to disable attributes in Starling Connect, see Disabling attributes in the Appendix section.

The following subsections describe the different connector version(s) and features available with them.

Features available exclusively in SuccessFactors v.1.0

Following are the features that are available exclusively in SuccessFactorsv.1.0:

  • Update of basic attributes on Static and Dynamic Groups are supported.

  • Update of Group membership on Static and Dynamic Groups are supported.

  • Update of Dynamic Groups will remove the associated Dynamic Clauses.

  • Supported insert / update / upsert on inactive users using extended permissions.

Features available exclusively in SuccessFactors v.2.0

Following are the features that are available exclusively in SuccessFactors v.2.0:

  • Update of basic attributes on Dynamic Groups are supported.

  • Update of Group membership on Static Groups are supported.

  • Dynamic Group supports group basic attributes update, but not group memberships.

  • Supported insert / update / upsert on inactive users using extended permissions.

  • Static Group Update (supports only Add and Remove operations for Group Members)
  • Dynamic Group Update (supports Group Update without removing the existing dynamic clauses)

    NOTE:

    • These features are available from version 2.0 onwards.
    • In version 1.0, only Dynamic Group Update is supported. Static Group Update is not supported in version 1.0.
    • Version 2.0 is enhanced to allow you to use the Dynamic Group Update operation to update the attributes of a Dynamic Group without removing the dynamic clause that you have added for that Dynamic Group.

      This feature is available from version 2.0 onwards. In version 1.0 of the connector, the Dynamic Group Update function removes the existing dynamic clause that was added for the Dynamic Group.

Features available exclusively in SuccessFactors v.3.0

Following are the features that are available exclusively in SuccessFactorsv.3.0:

  • Supports all the features from v2.0.

  • Synchronization has been improved by limiting the groups type to ‘Permission’ and ‘ectworkflow’.

  • Supports insert / update / upsert on inactive users using extended permissions.

Features available exclusively in SuccessFactors v.4.0

Following are the features that are available exclusively in SuccessFactorsv.4.0:

  • Supported insert / update / upsert on inactive users using extended permissions.

  • Additional attributes ( userId, jobCode, location, All available "CustomXX", hr(complex), manager(complex) ) supported under users.

  • Setting up a custom unique UserID on CREATE is supported.

  • DELETE operation not supported in Users endpoint.

  • Supported Custom Attributes for Users. Refer How to create custom attributes for users in Successfactors portal

Features available exclusively in SuccessFactors v.5.0

Following are the features that are available exclusively in SuccessFactorsv.5.0:

  • v.5.0 has no feature change only addition is that it supports OAuth Authentication.
  • For detailed explanation on setting up OAuth Authentication, refer SetUp OAuth.

Support for filter condition

SuccessFactors connector supports filter condition for User objects. Filter condition can be applied, and the Users can be retrieved selectively. Based on the supported operators and values provided at the filter the User objects are returned in the response from the connector.

To configure changes to One Identity Manager to support filter conditions

  1. Open the Synchronization Editor tool.

  2. Select SCIM connector.

  3. Select the Target system and navigate to Schema Classes.

    For example - id ne '10056' AND (locale eq 'Cleveland (1000-2011)')

  4. Add a new schema class for the user.

  5. Add the System filter and Select Object condition.

    Click Commit to Database.

  6. In User mappings, create or edit the Target system schema class with the recently created schema and click Commit to Database.

  7. Run the synchronization.

  8. Filter conditions are created.

Supported attributes for filter

  • id
  • userName
  • lastModified
  • meta.lastModified
  • givenName
  • familyName
  • division
  • urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.division
  • department
  • urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.department

NOTE:

  • The connector supports filter condition in all versions but only for User objects.

  • Supports only AND and OR logical operators.

  • Supports only parenthesis () for grouping the condition.

  • Unsupported attributes in the filter request will be ignored, no error will be thrown.

  • Only the sub-attributes of a complex attribute are supported in filter condition. For example, givenName or familyName

Table 40: Supported operators to filter values
S. No

Operators

OneIM System Filters

OneIM Select Objects

1

eq → equal to

lastModified eq 2020-08-27T15:22:52

lastModified = 2020-08-27T15:22:52

2

ne → not equal to

lastModified ne 2020-08-27T15:22:52

lastModified <> 2020-08-27T15:22:52

3

gt → greater than

lastModified gt 2020-08-27T15:22:52

lastModified > 2020-08-27T15:22:52

4

lt → less than

lastModified lt 2020-08-27T15:22:52

lastModified < 2020-08-27T15:22:52

5

ge → greater than or equal to

lastModified ge 2020-08-27T15:22:52

lastModified >= 2020-08-27T15:22:52

6

le → less than or equal to

lastModified le 2020-08-27T15:22:52

lastModified <= 2020-08-27T15:22:52

Support for filter condition

SuccessFactors is an integrated human-resources platform. It offers users tools for onboarding, social business, and collaboration along with tools for learning management, performance management, recruiting, applicant tracking, succession planning, talent management, and HR analytics. It is also cloud-based.

Supervisor configuration parameters

To configure the connector, following parameters are required:

Supported objects and operations

Users

Table 35: Supported operations for Users

Operation

VERB

Create User

POST

Update User

PUT

Delete (only till v3.0)

DELETE

Get User (Id)

GET

Get All Users

GET

Get All Users with pagination

GET

Groups

Table 36: Supported operations for Groups

Operation

VERB

Update Group PUT
Get All Groups GET

Get Groups (Id)

GET

Get All Groups with pagination GET

Mandatory fields

Users (v1.0-v3.0)

  • User Name
  • Employee Number
  • Status

Users v4.0

  • UserName

  • UserId

  • Status

User and Group mapping

The user and group mappings are listed in the tables below.

Table 37: User mapping
SCIM parameter SuccessFactors parameter
Id userId
UserName username
Name.GivenName firstName
Name.FamilyName lastName

Name.MiddleName

mi

Name.HonorificSuffix

suffix

Name.Formatted

defaultFullName

DisplayName defaultFullName
Emails.Value email
Addresses.StreetAddress addressLine1
Addresses.Locality city
Addresses.Region state

Addresses.PostalCode

zipCode

Addresses.Country

country

PhoneNumbers.Value

businessPhone

Groups.value

groupId

Groups.display

groupName

Roles.value

user.role.id

Roles.display

user.role.name

UserType

jobTitle

Title

title

Active

status

Locale

defaultLocale

Timezone

timeZone

userExtension.EmployeeNumber

empId

userExtension.Division

division

userExtension.Department

department

userExtension.Gender

gender

userExtension.HireDate

hireDate

userExtension.DateOfBirth

dateOfBirth

Meta.Created

hireDate

Meta.LastModified

lastModified

Table 38: Additional mapping from v4.0 onwards
SCIM parameter SuccessFactors parameter
Location location
UserExtension.UserId userId
userExtension.JobCode jobCode
userExtension.Custom01 custom01
userExtension.Custom02 custom02
userExtension.Custom03 custom03
userExtension.Custom04 custom04
userExtension.Custom05 custom05
userExtension.Custom06 custom06
userExtension.Custom07 custom07
userExtension.Custom08 custom08
userExtension.Custom09 custom09
userExtension.Custom10 custom10
userExtension.Custom11 custom11
userExtension.Custom12 custom12
userExtension.Custom13 custom13
userExtension.Custom14 custom14
userExtension.Custom15 custom15
userExtension.Hr.UserId hr.userId
userExtension.Hr.Email hr.email
userExtension.Hr.Username hr.username
userExtension.Hr.Active hr.status
userExtension.Manager.UserId manager.userId
userExtension.Manager.Email manager.email
userExtension.Manager.Username manager.username
userExtension.Manager.Active manager.status
Table 39: Group mapping
SCIM parameter SuccessFactors parameter
Id groupID
displayName groupName

members.value

userId

members.display

userName

groupExtension.groupType groupType
groupExtension.staticGroup staticGroup
Meta.LastModified lastModifiedDate

Connector limitations

  • Create and Delete group operations are not supported due to cloud application limitations.
  • When the active status is updated to false while performing the PUT operation for a user, the following error appears: user not found. This error occurs because a user is considered as a deleted user when the active status is false. (applicable for version V1 to V3)

  • User update does not support addition and removal of Groups or Roles for a particular user. It is done using group update. This is not applicable for role update.

  • Due to the API limitation of the target system, only the groups with type "permission" and "ectworkflow" are supported by version 3.0 of the connector.

  • User employee number cannot be updated because the cloud application considers employee number as a user Id. (applicable from version V1 till V3)

  • The UPDATE of Static Group supports the change of name and memberships. However, the UPDATE of Dynamic Group supports only the change of name but not the memberships. This is due to the target system behavior.

  • The manager/hr attribute gets added under user only if manager/hr in the request has the status as active.

  • Non-existing users should not be assigned as manager/hr while creating/updating user.

Disable attributes

The Disable attribute feature can be used when you want to skip an attribute that exists in the target system.

For the SuccessFactors connector, the attributes of the User object, including those of Enterprise User, can be disabled or enabled while configuring the connector based on your requirements.

NOTE:

  • Mandatory attributes cannot be disabled.
  • For more information about how to disable attributes in Starling Connect, see Disabling attributes in the Appendix section.

Connector versions and features

The following subsections describe the different connector version(s) and features available with them.

Features available exclusively in SuccessFactors v.1.0

Following are the features that are available exclusively in SuccessFactorsv.1.0:

  • Update of basic attributes on Static and Dynamic Groups are supported.

  • Update of Group membership on Static and Dynamic Groups are supported.

  • Update of Dynamic Groups will remove the associated Dynamic Clauses.

  • Supported insert / update / upsert on inactive users using extended permissions.

Features available exclusively in SuccessFactors v.2.0

Following are the features that are available exclusively in SuccessFactors v.2.0:

  • Update of basic attributes on Dynamic Groups are supported.

  • Update of Group membership on Static Groups are supported.

  • Dynamic Group supports group basic attributes update, but not group memberships.

  • Supported insert / update / upsert on inactive users using extended permissions.

  • Static Group Update (supports only Add and Remove operations for Group Members)
  • Dynamic Group Update (supports Group Update without removing the existing dynamic clauses)

    NOTE:

    • These features are available from version 2.0 onwards.
    • In version 1.0, only Dynamic Group Update is supported. Static Group Update is not supported in version 1.0.
    • Version 2.0 is enhanced to allow you to use the Dynamic Group Update operation to update the attributes of a Dynamic Group without removing the dynamic clause that you have added for that Dynamic Group.

      This feature is available from version 2.0 onwards. In version 1.0 of the connector, the Dynamic Group Update function removes the existing dynamic clause that was added for the Dynamic Group.

Features available exclusively in SuccessFactors v.3.0

Following are the features that are available exclusively in SuccessFactorsv.3.0:

  • Supports all the features from v2.0.

  • Synchronization has been improved by limiting the groups type to ‘Permission’ and ‘ectworkflow’.

  • Supports insert / update / upsert on inactive users using extended permissions.

Features available exclusively in SuccessFactors v.4.0

Following are the features that are available exclusively in SuccessFactorsv.4.0:

  • Supported insert / update / upsert on inactive users using extended permissions.

  • Additional attributes ( userId, jobCode, location, All available "CustomXX", hr(complex), manager(complex) ) supported under users.

  • Setting up a custom unique UserID on CREATE is supported.

  • DELETE operation not supported in Users endpoint.

  • Supported Custom Attributes for Users. Refer How to create custom attributes for users in Successfactors portal

Features available exclusively in SuccessFactors v.5.0

Following are the features that are available exclusively in SuccessFactorsv.5.0:

  • v.5.0 has no feature change only addition is that it supports OAuth Authentication.
  • For detailed explanation on setting up OAuth Authentication, refer SetUp OAuth.

SuccessFactors connector supports filter condition for User objects. Filter condition can be applied, and the Users can be retrieved selectively. Based on the supported operators and values provided at the filter the User objects are returned in the response from the connector.

To configure changes to One Identity Manager to support filter conditions

  1. Open the Synchronization Editor tool.

  2. Select SCIM connector.

  3. Select the Target system and navigate to Schema Classes.

    For example - id ne '10056' AND (locale eq 'Cleveland (1000-2011)')

  4. Add a new schema class for the user.

  5. Add the System filter and Select Object condition.

    Click Commit to Database.

  6. In User mappings, create or edit the Target system schema class with the recently created schema and click Commit to Database.

  7. Run the synchronization.

  8. Filter conditions are created.

Supported attributes for filter

  • id
  • userName
  • lastModified
  • meta.lastModified
  • givenName
  • familyName
  • division
  • urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.division
  • department
  • urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.department

NOTE:

  • The connector supports filter condition in all versions but only for User objects.

  • Supports only AND and OR logical operators.

  • Supports only parenthesis () for grouping the condition.

  • Unsupported attributes in the filter request will be ignored, no error will be thrown.

  • Only the sub-attributes of a complex attribute are supported in filter condition. For example, givenName or familyName

Table 40: Supported operators to filter values
S. No

Operators

OneIM System Filters

OneIM Select Objects

1

eq → equal to

lastModified eq 2020-08-27T15:22:52

lastModified = 2020-08-27T15:22:52

2

ne → not equal to

lastModified ne 2020-08-27T15:22:52

lastModified <> 2020-08-27T15:22:52

3

gt → greater than

lastModified gt 2020-08-27T15:22:52

lastModified > 2020-08-27T15:22:52

4

lt → less than

lastModified lt 2020-08-27T15:22:52

lastModified < 2020-08-27T15:22:52

5

ge → greater than or equal to

lastModified ge 2020-08-27T15:22:52

lastModified >= 2020-08-27T15:22:52

6

le → less than or equal to

lastModified le 2020-08-27T15:22:52

lastModified <= 2020-08-27T15:22:52

Supported attributes for filter

SuccessFactors is an integrated human-resources platform. It offers users tools for onboarding, social business, and collaboration along with tools for learning management, performance management, recruiting, applicant tracking, succession planning, talent management, and HR analytics. It is also cloud-based.

Supervisor configuration parameters

To configure the connector, following parameters are required:

Supported objects and operations

Users

Table 35: Supported operations for Users

Operation

VERB

Create User

POST

Update User

PUT

Delete (only till v3.0)

DELETE

Get User (Id)

GET

Get All Users

GET

Get All Users with pagination

GET

Groups

Table 36: Supported operations for Groups

Operation

VERB

Update Group PUT
Get All Groups GET

Get Groups (Id)

GET

Get All Groups with pagination GET

Mandatory fields

Users (v1.0-v3.0)

  • User Name
  • Employee Number
  • Status

Users v4.0

  • UserName

  • UserId

  • Status

User and Group mapping

The user and group mappings are listed in the tables below.

Table 37: User mapping
SCIM parameter SuccessFactors parameter
Id userId
UserName username
Name.GivenName firstName
Name.FamilyName lastName

Name.MiddleName

mi

Name.HonorificSuffix

suffix

Name.Formatted

defaultFullName

DisplayName defaultFullName
Emails.Value email
Addresses.StreetAddress addressLine1
Addresses.Locality city
Addresses.Region state

Addresses.PostalCode

zipCode

Addresses.Country

country

PhoneNumbers.Value

businessPhone

Groups.value

groupId

Groups.display

groupName

Roles.value

user.role.id

Roles.display

user.role.name

UserType

jobTitle

Title

title

Active

status

Locale

defaultLocale

Timezone

timeZone

userExtension.EmployeeNumber

empId

userExtension.Division

division

userExtension.Department

department

userExtension.Gender

gender

userExtension.HireDate

hireDate

userExtension.DateOfBirth

dateOfBirth

Meta.Created

hireDate

Meta.LastModified

lastModified

Table 38: Additional mapping from v4.0 onwards
SCIM parameter SuccessFactors parameter
Location location
UserExtension.UserId userId
userExtension.JobCode jobCode
userExtension.Custom01 custom01
userExtension.Custom02 custom02
userExtension.Custom03 custom03
userExtension.Custom04 custom04
userExtension.Custom05 custom05
userExtension.Custom06 custom06
userExtension.Custom07 custom07
userExtension.Custom08 custom08
userExtension.Custom09 custom09
userExtension.Custom10 custom10
userExtension.Custom11 custom11
userExtension.Custom12 custom12
userExtension.Custom13 custom13
userExtension.Custom14 custom14
userExtension.Custom15 custom15
userExtension.Hr.UserId hr.userId
userExtension.Hr.Email hr.email
userExtension.Hr.Username hr.username
userExtension.Hr.Active hr.status
userExtension.Manager.UserId manager.userId
userExtension.Manager.Email manager.email
userExtension.Manager.Username manager.username
userExtension.Manager.Active manager.status
Table 39: Group mapping
SCIM parameter SuccessFactors parameter
Id groupID
displayName groupName

members.value

userId

members.display

userName

groupExtension.groupType groupType
groupExtension.staticGroup staticGroup
Meta.LastModified lastModifiedDate

Connector limitations

  • Create and Delete group operations are not supported due to cloud application limitations.
  • When the active status is updated to false while performing the PUT operation for a user, the following error appears: user not found. This error occurs because a user is considered as a deleted user when the active status is false. (applicable for version V1 to V3)

  • User update does not support addition and removal of Groups or Roles for a particular user. It is done using group update. This is not applicable for role update.

  • Due to the API limitation of the target system, only the groups with type "permission" and "ectworkflow" are supported by version 3.0 of the connector.

  • User employee number cannot be updated because the cloud application considers employee number as a user Id. (applicable from version V1 till V3)

  • The UPDATE of Static Group supports the change of name and memberships. However, the UPDATE of Dynamic Group supports only the change of name but not the memberships. This is due to the target system behavior.

  • The manager/hr attribute gets added under user only if manager/hr in the request has the status as active.

  • Non-existing users should not be assigned as manager/hr while creating/updating user.

Disable attributes

The Disable attribute feature can be used when you want to skip an attribute that exists in the target system.

For the SuccessFactors connector, the attributes of the User object, including those of Enterprise User, can be disabled or enabled while configuring the connector based on your requirements.

NOTE:

  • Mandatory attributes cannot be disabled.
  • For more information about how to disable attributes in Starling Connect, see Disabling attributes in the Appendix section.

Connector versions and features

The following subsections describe the different connector version(s) and features available with them.

Features available exclusively in SuccessFactors v.1.0

Following are the features that are available exclusively in SuccessFactorsv.1.0:

  • Update of basic attributes on Static and Dynamic Groups are supported.

  • Update of Group membership on Static and Dynamic Groups are supported.

  • Update of Dynamic Groups will remove the associated Dynamic Clauses.

  • Supported insert / update / upsert on inactive users using extended permissions.

Features available exclusively in SuccessFactors v.2.0

Following are the features that are available exclusively in SuccessFactors v.2.0:

  • Update of basic attributes on Dynamic Groups are supported.

  • Update of Group membership on Static Groups are supported.

  • Dynamic Group supports group basic attributes update, but not group memberships.

  • Supported insert / update / upsert on inactive users using extended permissions.

  • Static Group Update (supports only Add and Remove operations for Group Members)
  • Dynamic Group Update (supports Group Update without removing the existing dynamic clauses)

    NOTE:

    • These features are available from version 2.0 onwards.
    • In version 1.0, only Dynamic Group Update is supported. Static Group Update is not supported in version 1.0.
    • Version 2.0 is enhanced to allow you to use the Dynamic Group Update operation to update the attributes of a Dynamic Group without removing the dynamic clause that you have added for that Dynamic Group.

      This feature is available from version 2.0 onwards. In version 1.0 of the connector, the Dynamic Group Update function removes the existing dynamic clause that was added for the Dynamic Group.

Features available exclusively in SuccessFactors v.3.0

Following are the features that are available exclusively in SuccessFactorsv.3.0:

  • Supports all the features from v2.0.

  • Synchronization has been improved by limiting the groups type to ‘Permission’ and ‘ectworkflow’.

  • Supports insert / update / upsert on inactive users using extended permissions.

Features available exclusively in SuccessFactors v.4.0

Following are the features that are available exclusively in SuccessFactorsv.4.0:

  • Supported insert / update / upsert on inactive users using extended permissions.

  • Additional attributes ( userId, jobCode, location, All available "CustomXX", hr(complex), manager(complex) ) supported under users.

  • Setting up a custom unique UserID on CREATE is supported.

  • DELETE operation not supported in Users endpoint.

  • Supported Custom Attributes for Users. Refer How to create custom attributes for users in Successfactors portal

Features available exclusively in SuccessFactors v.5.0

Following are the features that are available exclusively in SuccessFactorsv.5.0:

  • v.5.0 has no feature change only addition is that it supports OAuth Authentication.
  • For detailed explanation on setting up OAuth Authentication, refer SetUp OAuth.

Support for filter condition

SuccessFactors connector supports filter condition for User objects. Filter condition can be applied, and the Users can be retrieved selectively. Based on the supported operators and values provided at the filter the User objects are returned in the response from the connector.

To configure changes to One Identity Manager to support filter conditions

  1. Open the Synchronization Editor tool.

  2. Select SCIM connector.

  3. Select the Target system and navigate to Schema Classes.

    For example - id ne '10056' AND (locale eq 'Cleveland (1000-2011)')

  4. Add a new schema class for the user.

  5. Add the System filter and Select Object condition.

    Click Commit to Database.

  6. In User mappings, create or edit the Target system schema class with the recently created schema and click Commit to Database.

  7. Run the synchronization.

  8. Filter conditions are created.

  • id
  • userName
  • lastModified
  • meta.lastModified
  • givenName
  • familyName
  • division
  • urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.division
  • department
  • urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.department

NOTE:

  • The connector supports filter condition in all versions but only for User objects.

  • Supports only AND and OR logical operators.

  • Supports only parenthesis () for grouping the condition.

  • Unsupported attributes in the filter request will be ignored, no error will be thrown.

  • Only the sub-attributes of a complex attribute are supported in filter condition. For example, givenName or familyName

Table 40: Supported operators to filter values
S. No

Operators

OneIM System Filters

OneIM Select Objects

1

eq → equal to

lastModified eq 2020-08-27T15:22:52

lastModified = 2020-08-27T15:22:52

2

ne → not equal to

lastModified ne 2020-08-27T15:22:52

lastModified <> 2020-08-27T15:22:52

3

gt → greater than

lastModified gt 2020-08-27T15:22:52

lastModified > 2020-08-27T15:22:52

4

lt → less than

lastModified lt 2020-08-27T15:22:52

lastModified < 2020-08-27T15:22:52

5

ge → greater than or equal to

lastModified ge 2020-08-27T15:22:52

lastModified >= 2020-08-27T15:22:52

6

le → less than or equal to

lastModified le 2020-08-27T15:22:52

lastModified <= 2020-08-27T15:22:52

AWS IAM

AWS IAM (formerly AWS IAM S3) offers a suite of cloud-computing services that make up an on-demand computing platform. The most central and best-known of these are Amazon Elastic Compute Cloud (EC2) and Amazon Simple Storage Service (S3). AWS offers more than 70 services, including computing, storage, networking, database, analytics, application services, deployment, management, mobile, developer tools, and tools for the Internet of Things.

AWS IAM connectors are available for use with One Identity Safeguard for Privileged Passwords.

For more information about configuring AWS IAM connector with One Identity Manager, see Configuring AWS IAM connector to support entitlements for User and Group.

Supervisor configuration parameters

To configure the connector, following parameters are required:

  • Connector Name

  • Client Id of the cloud account
  • Client Secret of the cloud account

  • Region of the cloud account

  • SCIM URL (Cloud application's REST API's base URL)

  • Instance DateTime Offset (refer Configuring additional datetime offset in connectors for more details).

Supported objects and operations

Users

Table 41: Supported operations and objects for Users

Operation

VERB

Create

POST

Update

PUT

Delete DELETE
Get all users GET
Get (Id) GET
Pagination GET

Groups

Table 42: Supported operations and objects for Groups

Operation

VERB

Create POST
Update PUT
Delete DELETE
Get all groups GET
Get (Id) GET

NOTE: Currently, addition or removal of entitlements for Groups is not supported by One Identity Manager.

Profiles

Table 43: Supported operations for Profiles

Operation

VERB

Get All Profiles

GET

Get Profile

GET

Roles

Table 44: Supported operations for Roles

Operation

VERB

Get Role

GET

Get All Roles

GET

Mandatory fields

Users

  • User Name
  • Password - This is applicable only for the Create operation.

Groups

  • Group Name

Mappings

The user and group mappings are listed in the tables below.

Table 45: User mapping
SCIM parameter AWS IAM parameter
Id UserName
UserName UserName
Password password
DisplayName Arn

Active

(true)

Groups

(ListGroupsForUserResult)Group

Entitlements

(ListAttachedUserPoliciesResult)AttachedPolicies

Created CreateDate
LastModified PasswordLastUsed

 

Table 46: Group mapping
SCIM parameter AWS IAM parameter
Id GroupName
displayName UserName
Entitlements (ListAttachedGroupPoliciesResult)AttachedPolicies
Members (GetGroupResult)Users
Created CreateDate
LastModified PasswordLastUsed
Table 47: Profile mapping
SCIM parameter AWS IAM parameter
Id Arn
displayName PolicyName
Created CreateDate
LastModified UpdateDate
Table 48: Roles mapping
SCIM parameter AWS IAM parameter
Id RoleName
Name RoleName
Entitlements (ListAttachedGroupPoliciesResult)AttachedPolicies
description Description
Created CreateDate
Table 49: Mappings for v2.0
SCIM parameter AWS IAM parameter
Id Base64encoded(id)
targetId id

NOTE:Applicable for all object types.

Connector limitations

  • Signature generation is embedded within a data process. Hence, the performance of the application is affected.

  • The Last Modified date is not available. Hence, the field contains the value of the recently used Password.

  • While performing Delete User or Delete Group operation, users or groups that are part of the deleted users or groups get detached from the below mentioned services. However, some services must be detached manually.

    • AccessKey
    • Roles
    • Groups
  • The task of assigning entitlements to groups is available with the connector. For successful working, certain changes must be made in One Identity Manager.

  • Roles has no assignment relations with Users and Groups object types. Entitlements is the only object type associated with Roles.

Connector versions and features

The following subsections describe the different connector version(s) and features available with them.

Features available exclusively in AWS IAM v.2.0

Following are the features that are available exclusively in AWS IAM v.2.0:

  • All the endpoints return one new attribute “targetId”.
  • The "id" in the SCIM response will be base64 encoded in all the endpoints.

AWS IAM connector for Safeguard for Privileged Passwords

  • The service account must have the following minimum IAM permissions:

    • GetUser

    • GetGroup

    • ListAttachedUserPolicies

    • ListEntitiesForPolicy

    • ListGroups

    • ListGroupsForUser

    • ListUsers

    • ListUserPolicies

    • SimulatePrincipalPolicy

    • UpdateLoginProfile

  • If manually adding an account to an AWS asset, the username to enter is the simple account username (not the ARN).

  • Users must have a manually set password in AWS prior to management by Safeguard for Privileged Passwords. You cannot call "ChangePassword" on an account that has never had a password set.

  • Safeguard for Privileged Password "Roles" are used for account discovery map to AWS Policies (not AWS "Roles").

  • When a "Roles" filter is used in account discovery it only captures accounts for which a matching policy is directly assigned to the user (not policies it inherits through a group).

관련 문서

The document was helpful.

평가 결과 선택

I easily found the information I needed.

평가 결과 선택