LDAP Connector Onboarding

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Hi Everyone,

sailpoint iiq 8.4 version

I am learning the LDAP Connector in SailPoint IdentityIQ from scratch.

Currently:

  • I installed Oracle VirtualBox

  • I configured Active Directory in the VM

  • I created an LDAP/AD connector in SailPoint IIQ

Now I want to understand the complete LDAP connector development and implementation process in detail.

I have a few questions:

  1. What is the exact architecture of the LDAP connector in IdentityIQ?

  2. What is the difference between LDAP Connector and Active Directory Connector?

  3. Which files/configurations are important during LDAP integration?

  4. How does aggregation work internally?

  5. How can we debug LDAP connector issues in IIQ?

  6. Which logs should we monitor for connector-related problems?

  7. How can we test provisioning and reconciliation properly?

  8. What are the common mistakes beginners make while configuring LDAP/AD connectors?

  9. How can we map LDAP attributes to IdentityIQ identities?

  10. How do password policies and account enable/disable operations work?

  11. What is the best way to learn advanced LDAP connector customization?

  12. Are there any sample projects, tutorials, or GitHub repositories available for practice?

  13. How does IdentityIQ communicate with Active Directory internally?

  14. What are the important concepts I should learn next after basic LDAP integration?

I would appreciate:

  • Beginner-to-advanced guidance

  • Best practices

  • Real-time examples

  • Documentation links

  • Troubleshooting tips

Thank you!

2

Hello Ramesh,

Good that you are learning this hands on with a VM and AD setup. Your questions are too broad to answer inline, so here is where each is covered. Plz go through these:

Architecture, schema, aggregation, provisioning, attribute mapping, password and enable/disable LDAP connector docs AD connector docs

IQService (required for AD provisioning, password sync, enable/disable, Exchange) IQService Administrator’s Guide

Supported use cases, directory flavors, versions LDAP Connector page on Compass

Identity mapping, application config, identity attributes, correlation, provisioning policies 8.4 Application Configuration Guide

Debugging, logs, Debug pages, task results, host management 8.4 System Administration Guide

Set these to DEBUG in WEB-INF/classes/log4j2.properties, then watch iiq.log and task results:

  • sailpoint.connector.LDAPConnector

  • sailpoint.connector.ADLDAPConnector

Patch-specific connector behavior 8.4 connector landing page.

Structured learning path, tutorials, hands-on training Identity University has free & paid IIQ training tracks.

Real-world issues people actually hit, and examples Developer Community and Compass. Searching past threads will save you a lot of time once you start running into specific errors.

The LDAP connector is generic for any RFC-compliant directory. The AD connector is AD-specific & needs IQService for password sync, enable/disable via UAC, Exchange, & group ops. Don’t use the LDAP connector against AD.

3

Hi,

That’s a great way to learn SailPoint IdentityIQ hands-on. Since you already have a lab setup, focus first on understanding the flow rather than connector customization immediately.

A few key concepts:

  • LDAP vs AD Connector

    • LDAP connector = generic LDAP protocol-based integration

    • AD connector = optimized for Microsoft Active Directory with AD-specific operations/features

  • Architecture
    IIQ communicates with AD using connector classes + LDAP/LDAPS over ports 389/636. Aggregation pulls accounts/entitlements into IIQ, provisioning pushes changes back.

  • Important areas to learn

    • Application configuration XML

    • Schema mapping

    • Correlation & identity mapping

    • Provisioning policies

    • Aggregation tasks

    • IQService (for AD provisioning features)

  • Logs to monitor

    • ccg.log

    • sailpoint.log

    • stdout.log

    • IQService logs (for AD provisioning/debugging)

  • Common beginner mistakes

    • Wrong base DN/filter

    • Bad correlation logic

    • Missing permissions

    • Using LDAP instead of LDAPS in secured environments

    • Incorrect schema mappings

  • Best way to learn

    1. Account aggregation

    2. Entitlement aggregation

    3. Correlation

    4. Provisioning

    5. Lifecycle events

    6. Rules/customization

  • Advanced topics

    • Before/After provisioning rules

    • Custom correlation

    • IQService operations

    • Role-based provisioning

    • Connector debugging

Recommended resources

  • Official SailPoint documentation

  • SailPoint Developer Community

  • IIQ virtual appliance/lab exercises

  • GitHub examples from community contributors

4

Hi @Rameshv Would recommend getting access to Compass. You’ll get all the necessary white papers there and there are training materials available. You’ll have connector docs available as well explaining different type of connectors. This’ll help you learn better.