Group and group membership sync across sources

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi,

Is IDN able to synchronise groups and their membership across multiple sources? Like keep all the onprem AD groups in sync with the groups in other sources such as: Google Workspace, DUO…etc etc

Some of those tools implemente RBAC based on groups and having them replicated from AD via IDN allows to consolidate the support model.

I’m assuming a lot of the Sailpoint connectors use SCIM under the hood, and SCIM allows CRUD operations for groups, but is not clear to me if we can do this in SP the same way we do in AzureAD (where any SCIM integration offers you the possibility to sync group out of the box)

Thanks.

2

If I understood your requirement correctly,

If user is part of one AD Group, user should be synced to respective Groups in other sources like Google, DUO or any other source.

If yes, then we cannot have conditions/criteria in an Entitlement/Group.

  1. Instead you can make use of RBAC modeling.
  • Create a Role which has Access Profiles
  • Criteria: If user is member of a specific AD Group
  • Access Profile contains Group in respective source.
  1. Workflows

You can create workflow, which can add users to respective Groups in other sources.

2 Likes
3

Hi Krishna,

Let’s remove RBAC from the picture. We have thousands of user groups that must be synchronised across different sources some are for RBAC but some others are just for organizational purposes or DLs: so we don’t want to create Roles/Access profiles (apart from being overkill for thousands of groups) …for instance: between Azure AD and Google…using an Azure AD SCIM connector this is a simple as selecting “sync all users and groups”…as far as i recall, Okta also has something very similar on their SCIM connected apps…Can SP do the same?

having to use a licensed option like workflows for something other providers offer OOB would be a bit disappointing…also not sure what would be the scalability of workflows (we don’t have workflows) for thousands of users being sync’d to thousands of groups.

Thanks!

4

I’m assuming the comparison between Okta/AAD and Sailpoiint IDN is not totally fair as the formers are Directory services and SailPoint is not…but since the SCIM protocol allows to sync groups as far as I know and Sailpoint uses SCIM…i think it can be a legit question.

5

I hear you David. Keeping RBAC aside and Workflow license concerns, Yes we can look for some other solutions including SCIM. Let me replicate your scenario and keep you posted.

1 Like
6

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.