SailPoint IdentityNow-Engineer - SailPoint Certified IdentityNow Engineer

Yes, search-based certification campaigns can be leveraged to target specific access held by users. This allows administrators to create highly focused certification campaigns by searching for specific attributes, entitlements, or roles within the system. These campaigns enable targeted access reviews, ensuring that particular access rights, such as high-risk entitlements, are regularly reviewed and certified by the appropriate stakeholders.

References:

SailPoint IdentityNow Search-Based Certification Campaign Documentation.

SailPoint IdentityNow Access Review and Targeted Certification Guides.

The Web Services connector in IdentityNow does not exclusively support JSON content-types; it also supports XML as a content type for communication. JSON (JavaScript Object Notation) is widely used, but the connector is flexible and can be configured to handle XML-based APIs as well, depending on the requirements of the target system. Thus, it does not only support JSON.

References:

SailPoint IdentityNow Web Services Connector Documentation.

SailPoint IdentityNow Web Services Connector Content-Type Configuration Guide.

No, the OpenLDAP Connector is not suitable for this use case. OpenLDAP is designed for integrating with LDAP-based directories, and the system described is a cloud-based web application that uses a SCIM 2.0 interface with OAuth 2.0 for authentication. Since the system supports SCIM, the correct connector would be the SCIM 2.0 Connector, which is tailored for cloud-based systems with SCIM interfaces.

References:

SailPoint IdentityNow OpenLDAP Connector Guide.

SailPoint IdentityNow SCIM 2.0 Connector Documentation.

Yes, reviewing the /home/sailpoint/log/relay.log file can help diagnose issues related to the secure tunnel in SailPoint IdentityNow. The relay.log file captures information about the communication between the IdentityNow Virtual Appliance (VA) and the SailPoint cloud. This secure tunnel is responsible for ensuring encrypted communication, and any issues with establishing or maintaining the connection can often be found in this log.

Key Reference from SailPoint Documentation:

Relay Log for Troubleshooting: The relay.log is the primary log file to review for communication issues between the Virtual Appliance and SailPoint IdentityNow cloud, including secure tunnel failures.

Yes, search-based certification campaigns can be used to review access for non-correlated accounts. Non-correlated accounts are accounts that do not have a direct link to any identity in the system, which means they may represent orphaned or unmanaged accounts. Search-based certifications allow administrators to create campaigns based on specific criteria, including targeting these non-correlated accounts to ensure they are properly reviewed and addressed within the organization.

References:

SailPoint IdentityNow Search-Based Certification Campaign Guide.

SailPoint IdentityNow Non-Correlated Account Management Documentation.

No, the search syntax @accounts( source.name:"AD" AND disabled:true ) is incorrect for SailPoint IdentityNow because the attribute disabled may not be universally recognized or applicable for all sources in the system. Using the state:"disabled" condition (as in previous correct answers) is a more reliable and system-compliant approach to find disabled accounts.

Key Reference from SailPoint Documentation:

Standard Account State Search: The correct search syntax involves using state:"disabled" instead of disabled:true for querying disabled accounts.

No, an SoD (Separation of Duties) policy does not require a control matrix to be defined. While a control matrix can be a useful tool for organizations to visualize and enforce SoD policies by mapping roles to potential conflicting access rights, it is not a mandatory component of an SoD policy. An SoD policy primarily focuses on preventing conflicts of interest by ensuring that no individual has access to perform conflicting tasks within a business process (e.g., approving and processing payments). The control matrix is a recommended method for managing SoD but not a requirement.

Key Reference from SailPoint Documentation:

SoD Policy Overview: SailPoint recommends structuring SoD policies to focus on preventing conflicting access but does not mandate the use of a control matrix, which is an optional best practice for visualizing these controls.

Yes, loading entitlement descriptions is considered a best practice before generating the campaign preview for a manager certification campaign. Providing clear and concise entitlement descriptions ensures that managers reviewing access during the certification process have a full understanding of what each entitlement or role entails. This helps in making informed decisions regarding whether an individual’s access should be approved or revoked.

Without proper descriptions, the campaign participants might have difficulty evaluating access, which can lead to inefficiencies or errors in the certification process.

References:

SailPoint IdentityNow Certification Campaign Best Practices.

SailPoint IdentityNow Campaign Preparation Guidelines.

The Web Services connector in SailPoint IdentityNow does not support SAML authentication. SAML is primarily used for Single Sign-On (SSO) authentication for web applications, whereas the Web Services connector in IdentityNow typically supports Basic Authentication, OAuth, or custom header-based authentication for API-based integrations. SAML authentication is generally used for federated identity management rather than for API-based interactions.

References:

SailPoint IdentityNow Web Services Connector Configuration Guide.

SailPoint IdentityNow Authentication Methods for Connectors.