Configure the BeyondTrust Source Type in IdentityNow

BeyondTrust provides an access data source supported by default with IdentityNow. Once IdentityNow has visibility into a data source, it can manage information at the source location.

Users must have the appropriate credentials to log in to IdentityNow.

Configure a Source Type for BeyondTrust

1. In the IdentityNow console, go to Admin > Connections > Sources.
2. Click the New button in the top right corner.
3. Under Source Type select BeyondTrustPassword Safe - Cloud.
4. Include a Source Name, Description, Source Owner, and Connection Type.
5. Click Continue.

 

6. On the next screen, under Base Configuration, select a Virtual Appliance Cluster.
7. Click Save.

 

Update Connection Settings

1. In the IdentityNow console, go to Admin > Connections > Sources. Select the test source.
2. On the next screen, click the Edit Configuration button in the top right corner.
3. On the next screen, select Connection Settings on the left hand side.
4. For a production environment, select the API Token option. For a test environment, select the OAuth 2.0 option.
5. Fill out the rest of the form as required with information saved earlier when configuring an OAuth service account in BeyondInsight for SailPoint IdentityNow.
6. Click Save.

 

7. Once connection settings have been saved, test the connection:
   1. Select Review and Test on the right hand side of the screen.
   2. Click Test Connection on the upper left hand side of the screen.

 

Aggregate Accounts and Entitlements

1. In the IdentityNow console, go to Admin > Connections > Sources. Select the test source.
2. On the next screen, select the Import Data tab.
3. Select Account Aggregation and enter the necessary information.
4. Click Save.
5. Select Entitlement Aggregation and enter the necessary information.
6. Click Save.

 

Smart Group Permissions

Within Password Safe, permissions are granted via groups. A Smart Group is a filtered list of managed accounts. All managed accounts are granted the read only permission.

1. In the Password Safe console, go to Configuration > Role Based Access > User Management > Groups. Select the group and then click on the corresponding ellipsis to right of the group.
2. Select View Group Details.
3. Select Smart Groups under Group Details.
4. Select a managed account and then Assign Permissions.
5. Assign permissions as read only.
6. Select the managed account again and then click on the corresponding ellipsis to right of the account.
7. Select Edit Password Safe Roles.
8. Assign role as Requestor.
9. Select Access Policy for Requestor from the drop down.
10. Click Save Roles.

 

View User Entitlements

To view user entitlements and Password Safe groups assigned to the user:

1. In the IdentityNow console, go to Admin > Connections > Sources. Select the test source.
2. Select Accounts.
3. Select the user.
4. Select Accounts.
5. Select the Source Name.
6. Scroll to the bottom of the screen to view entitlements.

 

7. To view Entitlement Details and Permissions, expand the appropriate user group.
8. Select either the Details tab or Permissions tab to view information. Here you can find the target (Smart Group/Rule All Managed Accounts), Smart Group Permissions (Read or Write), and the Password Safe Role (Requestor).

 

Create Profile

BeyondTrust source types come with a preconfigured Create Profile.

1. In the IdentityNow console, go to Admin > Connections > Sources. Select the test source.
2. Select Accounts.
3. Select Create Profile.

 

Correlation

BeyondTrust source types come with a preconfigured Correlation.

1. In the IdentityNow console, go to Admin > Connections > Sources. Select the test source.
2. Select Import Data.
3. Select Correlation.

 

Schema

BeyondTrust source types come with a preconfigured Schema.

1. In the IdentityNow console, go to Admin > Connections > Sources. Select the test source.
2. Select Import Data.
3. Select Correlation.

 

Once the BeyondTrust source is in place, you have access to IdentityNow business processes including Access Request, Access Certification, automated provisioning for Joiner, Mover, Leaver, Search and Analytics, and more.

It is possible to create Access Profiles that consume Password Safe Groups and then assign the Access Profiles to Roles or Applications.

For more information on assigning Access Profiles to Roles or Applications, see SaaS Product Documentation / IdentityNow at https://documentation.sailpoint.com.