Best Approach for Integrating Salesforce UI with SailPoint IIQ for Identity & Access Requests

IdentityIQ (IIQ) IIQ Discussion and Questions
, , , ,
1

Which IIQ version are you inquiring about?

8.3p4

Share all details about your problem, including any error messages you may have received.

Hi everyone,

I’m exploring an integration pattern where Salesforce will act as the front-end UI for managing access requests for a specific type of Identity in SailPoint IIQ. The business wants Salesforce users to:

  1. Search for identities

  2. Search and display only applicable roles/access items (filtered based on identity type)

  3. Submit access requests from within Salesforce

Once the request is submitted in Salesforce, it needs to be sent to SailPoint so IIQ can:

  • Receive the request

  • Trigger the appropriate workflows

  • Perform provisioning as usual

I’m trying to determine the best-practice approach for exposing IIQ data and services to Salesforce. Some questions I’m considering:

  • What’s the recommended way for Salesforce to retrieve identity and role data from IIQ?
    Would exposing selected SailPoint REST APIs be the right approach, and how should I securely limit role visibility?

  • What is the cleanest method for IIQ to receive submitted request data from Salesforce?
    Should Salesforce call an IIQ REST API endpoint, do we use workflow triggers, or is there a preferred integration pattern for this type of request orchestration?

  • Any guidance or lessons learned from anyone who has implemented Salesforce → SailPoint IIQ access request integrations would be greatly appreciated.

Open to best practices, architectural suggestions, or alternative approaches. Thanks in advance!

2

@karangulati IIQ already has integration with ServiceNow for similar use case. However for salesforce, it is not there. It’s an interesting use case :slight_smile: .

To achieve this, you need to leverage IIQ REST API module, either OOTB or you can build your set of APIs which you will need in Salesforce to load the user details, account details, entitlement details, to generate access request in IIQ, to manage the approvals and finally to provision the access to applications. And you may need additional endpoints like query historical request, query the request status, etc. But with strong API architecture you can achieve this.

Note: Found a fix? Help the community by marking the comment as solution. Feel free to react(:heart:, :+1:, etc.) with an emoji to show your appreciation or message me directly if your problem requires a deeper dive.