Enterprise file servers often require authentication beyond a username and password. The SailPoint Delimited File Connector now supports Secure Shell (SSH) keys for SSH File Transfer Protocol (SFTP) and Transport Layer Security (TLS) client certificates for File Transfer Protocol Secure (FTPS). These methods are in addition to Basic authentication, which was introduced with Virtual Appliance (VA)-based connectivity.
Description
We are pleased to announce that the SailPoint Delimited File Connector (VA-based) now supports SSH key authentication for SFTP and TLS client certificate authentication for FTPS, in addition to existing Basic (username/password) authentication.
This enhancement helps you connect to hardened file servers that require key- or certificate-based transport authentication, supports IdentityIQ to Identity Security Cloud migration scenarios, and aligns with security policies that restrict password-only access to SFTP and FTPS endpoints.
Existing Delimited File sources configured with Basic authentication continue to work without any changes.
SFTP ā SSH Key Authentication
When File Transport = SFTP, a new Authentication Type dropdown lets you choose Basic or Public Key.
For Public Key authentication, configure:
-
Host and Port for your SFTP server
-
Username ā the SSH account on the server
-
SSH Private Key ā paste your SSH private key (PEM, OpenSSH, or OpenSSH v1 format)
-
SSH Private Key Passphrase (optional) ā required only if your private key is encrypted
On Identity Security Cloud, the private key is stored inline in source configuration and encrypted at rest ā you do not need to upload key files to the Virtual Appliance filesystem.
Use Test Connection to validate authentication before scheduling aggregation. The connector returns clear success or failure messages for invalid keys, wrong passphrases, and network errors.
By supporting SSH key authentication, the Delimited File Connector meets the security requirements of hardened SFTP environments without compromising ease of configuration.
FTPS ā TLS Client Certificate Authentication
When File Transport = FTPS, a new Authentication Type dropdown lets you choose Basic or Client Certificate.
For Client Certificate authentication, configure:
-
Host and Port for your FTPS server
-
Username ā the FTP account on the server
-
Password ā the FTP account password
-
FTPS Client Certificate ā Base64-encoded PKCS12 (
.p12) certificate content -
FTPS Client Certificate Passphrase (optional) ā required only if your certificate keystore is protected
On Identity Security Cloud, paste the Base64-encoded certificate content directly into source configuration.
Note: FTPS client certificate authentication uses a hybrid model. The client certificate authenticates the TLS layer, and the username and password authenticate the FTP protocol layer. Both the certificate and FTP credentials are required when using Client Certificate authentication.
Use Test Connection to validate the TLS handshake, certificate, and FTP login before scheduling aggregation.
Secure Credential Storage
SSH private keys, client certificates, passphrases, and passwords are stored as encrypted attributes in Identity Security Cloud source configuration. Existing Basic authentication credentials continue to use the same secure storage model.
Note: You can continue to use Basic (username/password) authentication for SFTP and FTPS. SSH key and client certificate authentication are optional enhancements.
Documentation:
Release Details
- Identity Security Cloud (VA-based Delimited File Connector) ā Available.