Starling Connect Identity Manager Integrated - Administration Guide

Azure AD

Azure AD is a connector that gives users a cloud-based platform for their on-premises resources. Using single sign-on, companies have access to any number of network or web-based applications along with hosting access and identity management resources.

For more information on registering the application, providing permissions, retrieving client ID or client secret, see Working with Azure AD.

Supervisor configuration parameters

To configure the connector, following parameters are required:

• Connector name

• Client Id for the app

• Client Secret of the app

• Directory Id of the Active Directory

• Target URL (Cloud application's instance URL used as target URI in payload - For example, https://graph.microsoft.com/v1.0).

Supported objects and operations

Users

Groups

Mandatory fields

Users

• email.value

• nickName

• displayName

• password

• active

Groups

• displayName

• mailEnabled (value needs to be 'false')

• mailNickname

• securityEnabled (value needs to be 'true')

User and group mapping

The user and group mappings are listed in the tables below.

Groups

Connector limitations

• lastModified is not provided along with the Users and Groups.

• Groups are of two types: Security groups and Office 365 groups. Azure AD supports users and groups as the members of groups. Security groups can have users and other Security groups as members. However, only users can be added as members for Office 365 groups.

• With the trial Azure AD account, it is possible to create only Security groups through APIs. For information on mapping the appropriate properties, see User and Group section.

• Azure AD resource Id's follow GUID formats. When trying to edit, retrieve, or delete a group by Id with an invalid GUID format, the connector displays 400 as the response code. However with invalid id and a proper GUID format, connector displays 404 as the response code.

• Email value for the user should have only those domains which are verified in the selected Active Directory. To find out the verified domain, go to the Azure Active Directory in the Azure portal and in the Overview page above the directory name, the verified domain names are displayed.

• You can create multiple groups with the same name.

• For more information on password policy settings applied to user accounts that are created and managed in Azure AD, see, Password policies that only apply to cloud user accounts.

GSuite

GSuite is a cloud computing, productivity, and collaboration tool. It includes the Google web applications Gmail, Drive, Hangouts, Calendar, and Docs. It also includes an interactive whiteboard. The enterprise version offers custom-domain email addresses, additional storage, and 24/7 phone and email support.

You must create a service account to access the G Suite services. For information on creating a service account, see Creating a service account in GSuite.

Supervisor configuration parameters

To configure the connector, following parameters are required:

• Connector name

• UserName

• Private_Key (Whole JSON content of private key file created for service account)

• Target URL (Cloud application's instance URL used as targetURI in payload)

Supported objects and operations

Users

Groups

Mandatory fields

Users

• FirstName

• LastName

• Password

Groups

Email

User and Group mapping

The user and group mappings are listed in the tables below.

Groups

Connector limitations

• Connector supports cursor based pagination even with any change at count in subsequent requests.

• Created date is displayed for Users. Created date and Modified date are not displayed for Groups.

• Group information of user is not displayed in user details.

• The Email ID of Users and Groups to be created should be provided along with the domain name of target instance.

Concur

Concur offers two on-demand Software as a Service (SaaS) products to help manage travel. Concur Travel & Expense gives you web and mobile solutions for travel and expense management, and TripIt is a mobile travel organizer for individuals.

Supervisor configuration parameters

To configure the connector, following parameters are required:

• Connector name

• Client Id

• Client Secret

• Username

• Password

• Geolocation

• Target URL (Cloud application's instance URL used as targetURI in payload)

Supported objects and operations

Users

Groups

NA

Mandatory fields

Users

• userName

• name.givenName

• name.familyName

• enterpriseUserExtension.empId

• emails.value

• password

• scimUser.locale

• enterpriseUserExtension.ctryCode

• enterpriseUserExtension.crnKey

• enterpriseUserExtension.ledgerKey

• enterpriseUserExtension.custom21

Groups

NA

User and Group mapping

The user and group mappings are listed in the tables below.

Groups

NA

Connector limitations

• Only user end-points are supported in Concur connector.

• Inactive user's information is not displayed when Get All Users operation is performed.

• The search result status for inactive user is NotFound .

• While Get Users by Pagination with StartIndex and count specified, next nearest multiple of 100 records to the count value are fetched.

• Invalid Geolocation url returns BadRequest status.

• Created and LastModified dates are not supported.

• API does not return the details of groups to which a user is associated.

• POST user with the details similar to that of existing user's id, email and EmpId will update existing user's information. In such case, status code 201 is returned.

• Inactive user cannot be created or edited.

• GivenName and FamilyName are not updated in PUT user operation.

• Custom21 value accepts only the Expense list code. For example, a valid Custom21 value are IN - 890, IN - 562, AU - 510, NL - 842, NO - 432, and so on.

• Currently, an authentication related issue is observed while Get User by Id for a user "cteadmin@quest.com". This issue causes integration failure. To fix this, two keys are introduced in AppSettings of function host named ShouldExcludeUsers and ExcludeUserIds.

• ShouldExcludeUsers key accepts either true or false as value, and ExcludeUserIds takes comma separated user's ids.

• If value for ShouldExcludeUsers is true, the user ids mentioned in ExcludeUserIds will not appear in GetAll Users response.

Tableau

Tableau offers data visualization software to let users upload files to a server or the cloud. You can create custom dashboards to analyze business intelligence and data.

Supervisor configuration parameters

To configure the connector, following parameters are required:

• Connector name

• Username

• Password

• Site name (Example: https://online.tableau.com/#/site/MarketingTeam/users)

• Target URL (Cloud application's instance URL used as target URI in payload - Example: https://{instance-name}.online.tableau.com/api/{api-version})

Supported objects and operations

Users

Groups

Mandatory fields

Users

Email

Groups

displayName

User and Group mapping

The user and group mappings are listed in the tables below.

Groups

Connector limitations

• User update is supported for User role only.

• Created and last modified dates are not available.

• Group deletion is not supported.

• Adding or removing a member from a renamed group is possible only after a full synchronization .