I’m connecting our Entra ID tenant to SailPoint and although I already have a rotation script to overcome the need for either client secret of a certificate exchange between both systems, I was wondering if there are any plans to support SPIFFE given that rotation operations require plain text credentials traveling through the internet to get them renewed.
Hello Elisa. Yes, none of the connector’s current auth options (Client Credentials, Refresh Token, JWT Certificate Credentials on ISC, plus SAML Bearer Assertion on IdentityIQ) accept an external OIDC token like a SPIFFE JWT-SVID as the client assertion. So the missing piece is on the SailPoint side.
On the roadmap, I could not find anything public, and the forum is unlikely to get you a PM commitment. The SailPoint Ideas Portal is the channel that actually gets tracked. I would file it there as support for Entra Workload Identity Federation using an external OIDC/SPIFFE assertion, framed around removing the long-lived credential rather than one specific implementation.
Although Product Managers keep saying that they track ideas in that portal, I know it may take years until they’re actually picked up, and given that most cutting-edge Identity platforms are already supporting the standard I thought I would find some insights on SailPoint’s roadmap regarding this strategic investment.
Given that it’s been a week and you’re the only one that provided an answer, I’ll mark yours as the “solution” and I’ll keep waiting for some Connectors PM to show up with future announcements.
Thanks Elisa, and thanks for sharing the idea as well.
That makes sense. At this point, the roadmap part is really something only the Connectors/Product team can clarify. Hopefully someone from that team can add some context on whether SPIFFE or workload identity federation is already being considered.
I will keep an eye on the idea too in case anything gets updated there.