IDN, API, SP-Config Import - passwords issue

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

There is issue with import from sp-config. when I export configuration and then import (to the same tenant), without change anythink it cause to lost password at some sources. Especially AD source and domainsettings section of connectorAttributes.
Could you fix this issue. Password should be kept and VA. But VA lost them. This is problem, because I can not make change through sp-config to tenant.

2

Hey @ptraczynski,

Thank you for posting!

Passwords are not exported as part of the SP-Config call.

Additionally, following an import the passwords need to be changed.

OR you can put plaintext in the JSON and it will be encrypted on import
(same as calling the v3 sources endpoint)

SP-Config is not intended for smaller source alterations, those would typically be performed using the UI or Source API.

3

Hi.
I do not agree. You suggest to use pipeline CI/CD to maintain changes (docs at compass). It is the only way to execute full import - sp-config, workflow, etc.
The LDAP source and JDB source is work ok. After import it do not lost password. AD source lost password (Domain Settings), do not lost password for IIQService.

4

Hi

what about this issue?

5

There are also issue with putting password for example at json (domansettings). This password are exported at plain text. Only adding password by UI is ok.

6

Agreed with Piotr and we hit the same issue and would like advices from SailPont

7

@ronaldchuiASB can you please describe the issue in detail? What did you expect to happen, and what actually happened.

8

There is two issues:

  • issue when putting password at domainsettings - after export password is at plain text. When we put password by UI it is correctly send to VA and there is no password at export json
  • issue with loast password for AD source after import. I tested JDBC source / WEB service source. In that cases export and import do not have impact on configuration. In case of AD source export and then import provide to lost password. So ou must put password manually by UI.
9

This is 100% reproducible issue.

10

Thanks for clarifying @ptraczynski . Can you please submit a support ticket for this issue? Our support team is better equipped to track down the root cause and work with the engineering teams to resolve them.

11

Exactly the same as what Piotr described.

One workaround from us is to export and import the AD source as we did, then use the PATCH source API to update the password in the domainSettings

12

Yes, I know. But this complicate pipline. I create support ticket.