@colin_mckibben suggested I post this question on here. One thing I’ve been thinking about is recommendations to clients around the leaver process when an IDNow admin leaves the company. As you likely know the VAs get their own API Key. It’s not unreasonable to assume, especially with this hot job…

The current solution for this scenario is to create a new VA object in the cluster, create a new VA instance and use it, and delete the old.

@pmartinezclango - Ideally SailPoint would know this API key is specific to the VA’s and as such would only accept it’s use directly from the VA to mitigate any misuse. Without this it’s literally uncontrollable and the only mitigation is as you noted - to change it which requires new config.yaml f…

This is really interesting @pmartinezclango , of course we need to implement Zero Trust. I agree with @edmarks . I would like take this discussion in a negative use cases, I did implement IDN from scratch for a client, it’s been 8+ months since I left them I really don’t remember VA keys, even if…

@KRM7 You hit both of the important “keys”. I agree that your personal PAT should be disabled upon leaving the organization (employee OR contractor) by disabling your IDN account/identity. The trickier keys are anything related to the VA which are in clear text during the setup process and anyone …

The example of deleting a source is something you can do after leaving a client if you had the VA keys. The scope for the token is sp:scopes:all sp:scopes:default. I haven’t gone through all the APIs, but ideas that come to mind is creating a new identity and requesting access, extracting identity d…

Another thing beyond the conversation of this thread is you could use a service to crawl all the IDNow tenants (you can see every customer who is on IDNow that’s not on vanity URLs quite easily) and then use NMap to scan for VAs or using Shodan and see if any of the VAs are using the default passwor…

I really never though about this, just wanted to learn about this. Thanks for bringing this use case @pmartinezclango

No problem. Now that @colin_mckibben confirmed this is the recommended practice we’ll just be adding it as part of our offboarding process for IDNow admins going forward. I love how @colin_mckibben 's built a community where everyone can learn from each other.

Securing VA API Keys

Identity Security Cloud (ISC) ISC Discussion and Questions

system (system) Closed January 16, 2024, 9:25pm 10

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
PAT and API keys validity ISC Discussion and Questions apis , identity-security-cloud	3	125	November 26, 2024
IdentityNow VA Configuration Feedback General Feedback identity-security-cloud	5	529	December 7, 2023
VA Connectivity ISC Discussion and Questions identity-security-cloud	5	586	December 12, 2023
Recover Sailpoint VA user ISC Discussion and Questions identity-security-cloud	2	302	December 19, 2023
VA Setup UI Suggestion Idea Discussions identity-security-cloud	1	244	April 27, 2024

Securing VA API Keys

Related topics