Using SailPoint as the username and passwrod in the Identity Profile and then automatically pushing it to AD

Identity Security Cloud (ISC) ISC Discussion and Questions
1

I cannot find any clear documentation on how to push the changed SailPoint ISC password to AD. identitynow is not considered a sync group. I have AD set up as a sync group. Everything I read indicated you need two sources in a sync group. If I make AD the password store it saves the password to AD which I can verifty in ADUC and by actully using the updated password in a different application. The other issue I am seeing is that when testing, as we reset identities and reinvite them it just takes them to an empty login page. Is ISC to AD password sync allowed or should I go with AD as the login store?

Please consider addressing the following when creating your topic:

  • What have you tried?
  • What errors did you face (share screenshots)?
  • Share the details of your efforts (code / search query, workflow json etc.)?
  • What is the result you are getting and what were you expecting?
2

Please go through below sailpoint documentation link:

3

I have gone through it several times. Not it shows two sources in the Sync Group and states that is a requirement. identitynow is not an option to select as a sync group. So my question is if in an identity profile I choose SailPoint username and password how can I push that to AD when the users changes their passord in the ISC UI? Is it even possible? This is not a typical use case but the requirement is to use ISC as the source for password resets and have it push the changes to AD.

4

If you intend to update only AD password then select AD as Signin method under Identity Profile settings. This will push new password from ISC to AD.

image
image1884×827 40.3 KB

If you want to sync the ISC password to AD as well as other sources, then in addition to what is described above you will also need to create a sync group and make AD part of it.

5

Yes I have done it that way. To do that requires to make the user id the samaccountname in the identity profile because that is the AD login attribute. Otherwise after they change their password they cannot log in. And I don’t see a way to specify what attribute ISC picks up when it logs into AD. Not a show stopper but I was trying this as a work around. I will go back to the AD as the login store.

6

That is correct. Hope you have found the info you were looking for