Documentation

Introduction

Use this guide to connect SailPoint IdentityIQ to SecureAuth IdP in order to enable User Risk Adaptive Authentication analysis.

For more information on configuring Adaptive Authentication, see Adaptive Authentication Tab Configuration.

SailPoint IdentityIQ is an identity governance solution that analyzes user risk based on the level of access a user has, and can detect when a user's access controls may be violating policy or misconfigured to provide excessive access. IdentityIQ then quantifies this information into a user reputation risk score.

For example, an HR manager's user account would naturally be assigned a high user risk score since that account has access to confidential data and systems, while an intern's user account with limited network access would have a low user risk score. However, if the intern's user account was inadvertantly given access to the HR database, IdentityIQ would assign a high user risk score, alerting information managers to a potential misconfiguration and security risk.

Connect to SailPoint in one of the following ways:

SecureAuth IdP version 9.1SecureAuth IdP version 9.2
  • REST API
  • REST API v2
  • SQL
 
  • Oracle
 
  • MySQL
 

In SecureAuth IdP version 9.2, a new offering is available from SecureAuth's Prevent Threat Service package. Advanced adaptive capability powered by machine learning tracks and analyzes the login behavior patterns of authorized users for a period of time to identify their normal patterns, and then assigns each user a personal risk score. Bad actors' attempts to impersonate authorized users in order to gain access to the targeted site fail, since a login behavior pattern and risk score are unique to each user. See Machine learning User Risk Score calculations in Adaptive Authentication (version 9.2) and SecureAuth IdP 9.2.0-19 hotfix for machine learning deployment for more information.

Prerequisites

1. Ensure SecureAuth IdP v9.1+ is running

2. Have an existing on-premises installation of SailPoint IdentityIQ

3. Have a Trusted Certificate installed on the SailPoint server

Configuration Steps
For SecureAuth IdP v9.1...

REST API is only supported in SailPoint v7.0p2+

For pre-7.0p2 versions of SailPoint, use SQL, Oracle, or MySQL

SecureAuth IdP Configuration Steps
Data
Profile Connection Settings

 

1. In the Profile Connection Settings section, configure the following settings:

a. Select REST API (read only) from the Data Server dropdown

b. Provide the root URL of the SailPoint instance in the Base URL field

c. Enter /identityiq/scim/v2/Users/{username} in the Get Profile Relative URL field

d. Select Basic from the Authentication Method dropdown

e. Provide the Username of a SailPoint service account that has access to retrieve user profile information

f. Provide the Password associated with the Username

Profile Fields

 

2. In the Profile Fields section, map the riskScore JSON path to a chosen Property (e.g. Phone 4) as follows:

a. Click the Source link next to the selected Property (usually "Default Provider")

b. In the dropdown that appears, select REST

 

c. In the Field text box, enter the riskScore JSON path: {urn:ietf:params:scim:schemas:sailpoint:1.0:User}{riskScore}

Click Save once the configurations have been completed and before leaving the Data page to avoid losing changes

SecureAuth IdP Configuration Steps
Data

 

1. In the Profile Connection Settings section, set the Data Server dropdown to SQL Server

2. Configure the remaining Datastore Type fields with the correct settings to connect to the datastore

See SQL Server as Additional Profile Provider Configuration Guide for more information on configuring the Profile Connection settings

Click Save once the configuration has been completed and before leaving the Data page to avoid losing changes

Adaptive Authentication

 

3. Check Enable User Risk

4. In the From field of each risk level (High, Medium, Low), enter the User Risk score that will trigger the action for that level

5. From the Action dropdown for each risk level (High, Medium, Low), configure the action to be taken when the User Risk score of an end-user falls within the specified range

6. In the No Score Returned field, configure the action to take when the Adaptive Authentication engine is unable to retrieve an end-user's risk score

This can occur if the user is not found in the data source or does not have a score assigned in the data source

See the KB article Unable to Communicate with the User Risk Adaptive Authentication Data Provider for more information if SecureAuth IdP is unable to communicate with the data source

7. From the Profile Field dropdown, select the Property (configured on the Data tab) to which the Profile Field containing the User Risk score is mapped

Click Save once the configuration has been completed and before leaving the Adaptive Authentication page to avoid losing changes

SQL Server Configuration Steps

 

8. On SQL Server, ensure that the userRisk score is mapped to the same Profile field chosen in Step 7

SecureAuth IdP Configuration Steps
Data

 

1. In the Profile Connection Settings section, set the Data Server dropdown to Oracle

2. Configure the remaining Datastore Type fields with the correct settings to connect to the datastore

See Oracle Database as Additional Profile Provider Configuration Guide for more information on configuring the Profile Connection settings

Click Save once the configuration has been completed and before leaving the Data page to avoid losing changes

Adaptive Authentication

 

3. Check Enable User Risk

4. In the From field of each risk level (High, Medium, Low), enter the User Risk score that will trigger the action for that level

5. From the Action dropdown for each risk level (High, Medium, Low), configure the action to be taken when the User Risk score of an end-user falls within the specified range

6. In the No Score Returned field, configure the action to take when the Adaptive Authentication engine is unable to retrieve an end-user's risk score

This can occur if the user is not found in the data source or does not have a score assigned in the data source

See the KB article Unable to Communicate with the User Risk Adaptive Authentication Data Provider for more information if SecureAuth IdP is unable to communicate with the data source

7. From the Profile Field dropdown, select the Property (configured on the Data tab) to which the Profile Field containing the User Risk score is mapped

Click Save once the configuration has been completed and before leaving the Adaptive Authentication page to avoid losing changes

Oracle Database Configuration Steps

 

8. On Oracle, ensure that the userRisk score is mapped to the same Profile field chosen in Step 7

SecureAuth IdP Configuration Steps
Data

 

1. In the Profile Connection Settings section, configure the following settings:

a. Select ODBC from the Data Store dropdown

b. For the Connection String, enter Data Source=[ServerName];Initial Catalog=[DatabaseName];User ID=[UserName];Password=[Password]

c. (OPTIONAL) If using a non-default stored procedure name, enter it in the Get Profile SP field; otherwise, leave blank

 Default Stored Procedure for GetUserProfile

Note: Replace <ProfileField> below with the Profile Field being used to contain the Risk Score (e.g. Phone4).

sp_GetUserProfile

CREATE DEFINER=`root`@`%` PROCEDURE `sp_GetUserProfile`(username varchar(250))
BEGIN
SELECT spt_scorecard.composite_score as <ProfileField>
FROM spt_identity INNER JOIN
spt_scorecard ON spt_identity.scorecard = spt_scorecard.id
WHERE (spt_identity.name = username);

d. (OPTIONAL) if using a non-default stored procedure name, enter it in the Update Profile SP field; otherwise, leave blank

Click Save once the configuration has been completed and before leaving the Data page to avoid losing changes

Adaptive Authentication

 

3. Check Enable User Risk

4. In the From field of each risk level (High, Medium, Low), enter the User Risk score that will trigger the action for that level

5. From the Action dropdown for each risk level (High, Medium, Low), configure the action to be taken when the User Risk score of an end-user falls within the specified range

6. In the No Score Returned field, configure the action to take when the Adaptive Authentication engine is unable to retrieve an end-user's risk score

This can occur if the user is not found in the data source or does not have a score assigned in the data source

See the KB article Unable to Communicate with the User Risk Adaptive Authentication Data Provider for more information if SecureAuth IdP is unable to communicate with the data source

7. From the Profile Field dropdown, select the Property (configured on the Data page) to which the Profile Field containing the User Risk score is mapped

Click Save once the configuration has been completed and before leaving the Adaptive Authentication page to avoid losing changes

ODBC Data Source Administrator Configuration Steps

 

7. Start the ODBC Data Source Administrator

a. In Windows, click the Start button or icon
b. Type ODBC
c. Select Data Sources (ODBC)

The ODBC Data Source Administrator opens

8. Select the System DSN tab

9. Click Add

The Create New Data Source window opens

 

10. Select the MySQL ODBC 5.3 ANSI Driver

If this driver is not installed, it can be obtained from https://dev.MySQL.com/downloads/connector/odbc/

11. Click Finish

 

12. Follow the prompts to finish configuring the ODBC connector on the server

SailPoint MySQL Database Configuration Steps

 

13. Create the sp_GetUserProfile stored procedure (as shown below) on the SailPoint MySQL database

Replace <ProfileField> below with the Profile Field being used to map the Risk Score (e.g. Phone4)

DELIMITER $$
CREATE DEFINER=`root`@`%` PROCEDURE `GetScore`(username varchar(250))
BEGIN
SELECT  spt_scorecard.composite_score as <ProfileField>
FROM    spt_identity INNER JOIN
        spt_scorecard ON spt_identity.scorecard = spt_scorecard.id
WHERE   (spt_identity.name = username);
END$$
DELIMITER ;
For SecureAuth IdP v9.2...

REST API v2 is supported in SailPoint v7.0p2+

SecureAuth IdP Configuration Steps
User Risk (without Machine Learning)
Adaptive Authentication
User Risk

1. In the User Risk section, toggle the switch to Enabled to enable this analysis feature

2. Click Add User Risk Score Provider

Add New Risk Provider

3. Configure the Risk Ranges for Minimum, Medium, High, and Maximum risk scores

4. Under Connection Settings, enter the Risk Score Provider Name

5. Enter the Base URL of the SailPoint instance in the format https://services.company.com:59

6. Enter /identityiq/scim/v2/Users/{username} in the Get Profile Relative URL field

7. Select Basic from the Authentication Method dropdown

8. Enter a Username from the SailPoint service account that has access to retrieve user profile information

9. Provide the Password associated with the Username

10. From the Risk Score User Identifier dropdown, select the field to store the user risk score – which is the directory Profile Field mapped to the Property configured on the Data page

NOTE: The default setting is User Authenticated ID which is usually used by SecureAuth User Risk

11. Enter {urn:ietf:params:scim:schemas:sailpoint:1.0:User}{riskScore} as the Risk Score JSON Path of the Risk Score User Identifier

12. Click Save to save the SailPoint user risk configuration

13. Under User Risk Score Actions, specify the action SecureAuth IdP will take if the user risk score falls within the specified range by making a selection from the dropdown (see Definitions for more information on actions)

a. High Risk - SecureAuth IdP will execute this action if the user risk score falls within the upper range

b. Medium Risk - SecureAuth IdP will execute this action if the user risk score falls within the middle range

c. Low Risk - SecureAuth IdP will execute this action if the user risk score falls within the lower range

d. Score Unavailable - SecureAuth IdP will execute this action if the user risk score cannot be retrieved

This action can occur if the user is not found in the data source or does not have a score assigned in the data source

See the KB article Unable to Communicate with the User Risk Adaptive Authentication Data Provider for more information if SecureAuth IdP is unable to communicate with the data source

User Risk with Machine Learning Feature
Data
Profile Fields

 

1. In the Profile Fields section, map the riskScore JSON path to a chosen Property (e.g. Phone 4) as follows:

a. Click the Source link to the right of the selected Property (usually labeled "Default Provider")

b. Select REST from the dropdown 

c. In the Field text box, enter {urn:ietf:params:scim:schemas:sailpoint:1.0:User}{riskScore} as the riskScore JSON path

Click Save once the configuration has been completed and before leaving the Data page to avoid losing changes

Adaptive Authentication
User Risk

2. In the User Risk section, toggle the switch to Enabled to enable this analysis feature

3. Click Add User Risk Score Provider

Add New Risk Provider

4. Configure the Risk Ranges for Minimum, Medium, High, and Maximum risk scores

5. Under Connection Settings, enter the Risk Score Provider Name

6. Enter the Base URL of the SailPoint instance in the format https://services.company.com:59

7. Enter /identityiq/scim/v2/Users/{username} in the Get Profile Relative URL field

8. Select Basic from the Authentication Method dropdown

9. Enter a Username from the SailPoint service account that has access to retrieve user profile information

10. Provide the Password associated with the Username

11. From the Risk Score User Identifier dropdown, select the field to store the user risk score – which is the directory Profile Field mapped to the Property configured on the Data page

NOTE: The default setting is User Authenticated ID which is usually used by SecureAuth User Risk

12. Enter {urn:ietf:params:scim:schemas:sailpoint:1.0:User}{riskScore} as the Risk Score JSON Path of the Risk Score User Identifier

13. Click Save to save the SailPoint user risk configuration

14. Under User Risk Score Actions, specify the action SecureAuth IdP will take if the user risk score falls within the specified range by making a selection from the dropdown (see Definitions for more information on actions)

a. High Risk - SecureAuth IdP will execute this action if the user risk score falls within the upper range

b. Medium Risk - SecureAuth IdP will execute this action if the user risk score falls within the middle range

c. Low Risk - SecureAuth IdP will execute this action if the user risk score falls within the lower range

d. Score Unavailable - SecureAuth IdP will execute this action if the user risk score cannot be retrieved

This action can occur if the user is not found in the data source or does not have a score assigned in the data source

See the KB article Unable to Communicate with the User Risk Adaptive Authentication Data Provider for more information if SecureAuth IdP is unable to communicate with the data source

Click Save once the configuration has been completed and before leaving the Adaptive Authentication page to avoid losing changes

  • No labels