Authentication using EntraID as IDP and the "behalf-of" feature

SailPoint Human Fabric (SHF) SHF Discussion and Questions
1

Hello, In our scenario we have an application that is calling Sailpoint APIs to perform some actions on it. The point is that between Sailpoint and this application there is an ESB that acts like a proxy for these APIs. This means that the application must authenticate to the ESB to call the ESB’s APIs and than ESB will proxy these application API to Sailpoint. We are using EntraID as ID Provider to be authenticated to ESB and to be authenticated to Sailpoint. We have some difficulties in implementing the authentication part and we need assistance for that, we found a possible solution for the implementation but we have to know if are feasible: We want use OAuth 2.0 with on-behalf-of feature: which the application firstly authenticates to the ESB (because to call the ESB API the application must be authenticated), than ESB authenticates the user that is using the application to Sailpoint using the behalf-of feature of Entra to Sailpoint. In the end Entra will generate an access token that can be used from the application user to be authenticated to Sailpoint and to call all the API that require a token. Anyone experienced with this type of interaction can help me to know if this scenario is feasible? Thanks

2

yes, your OBO-based architecture is feasible with Azure Entra ID + SailPoint if:

  • You configure SailPoint to accept Entra-issued tokens (or wrap this via proxy logic at the ESB).
  • You implement correct Entra app registrations, permissions, and consent.
  • You correctly handle the token exchange at the ESB using Entra’s /token endpoint.
3

Thanks for your response, regarding your first response, how it is possible to configure Sailpoint to accept Entra-issued tokens? Because I need to call Sailpoint APIs with the EntraID issued token (so I need something equivalent to the personal access token of Sailpoint)