Custom connector
Writing a custom connector when no standard one fits.
When no standard connector fits, you build a custom connector implementing the SailPoint connector interface in Java.
- Custom connector connector type: a custom-built connector
- Onboarding: aggregate then correlate
- Your code implements iterate (aggregation) and provision methods to read and write the target.
- Common issues covered in troubleshooting
Sometimes a target system has no standard connector and cannot be handled by the REST or JDBC connectors, an unusual protocol, a proprietary API, a complex handshake. In those cases you build a custom connector in Java that implements SailPoint’s connector contract.
Connector type and how it connects
The custom integration is a custom-built connector. It implements the SailPoint connector interface in Java (for example extending the abstract connector base) when no standard or configurable connector fits. As with every connector, the flow is the same: authenticate to custom, read accounts and entitlements during aggregation, and write changes during provisioning.
Onboarding the source
- 1. Configure the connection and credentials for custom.
- 2. Map the account schema, implementing the schema discovery and mapping in code so SailPoint understands the target’s accounts and entitlements.
- 3. Set the correlation logic so custom accounts attach to the right identities (typically on a stable key such as employee ID or email).
- 4. Run account aggregation and confirm accounts and entitlements load.
- 5. Verify correlation, watching for uncorrelated/orphan accounts.
Provisioning capabilities
Your code implements the iterate method (for aggregation) and the provision method (for changes), translating between SailPoint’s model and the target’s native operations. Treat it like any production software: version-controlled, tested, and documented.
Entitlements and what to govern
Define entitlements in code to reflect the target’s access model, exposing them so they can be requested, certified and provisioned like any other.
Troubleshooting
When custom aggregation or provisioning fails, work through the usual causes in order:
- Test the connector against the target outside IdentityIQ where possible.
- Add thorough logging so failures are diagnosable.
- Handle errors and partial failures explicitly.
- Validate schema discovery and provisioning round-trips.
Common pitfalls
- Credential expiry (tokens/secrets/certs) silently breaking the connector.
- Insufficient rights on the custom service account for the operations you need.
- Schema or correlation misconfiguration leaving accounts uncorrelated.