Custom connector
Quick answer
When no standard connector fits, you build a custom connector implementing the SailPoint connector interface in Java.
Key takeaways
- Custom connector connector type: a custom-built connector
- Onboarding: aggregate then correlate
- Your code implements iterate (aggregation) and provision methods to read and write the target.
- Common issues covered in troubleshooting
Sometimes a target system has no standard connector and cannot be handled by the REST or JDBC connectors, an unusual protocol, a proprietary API, a complex handshake. In those cases you build a custom connector in Java that implements SailPoint’s connector contract.
Connector type and how it connects
The custom integration is a custom-built connector. It implements the SailPoint connector interface in Java (for example extending the abstract connector base) when no standard or configurable connector fits. As with every connector, the flow is the same: authenticate to custom, read accounts and entitlements during aggregation, and write changes during provisioning.
Onboarding the source
- 1. Configure the connection and credentials for custom.
- 2. Map the account schema, implementing the schema discovery and mapping in code so SailPoint understands the target’s accounts and entitlements.
- 3. Set the correlation logic so custom accounts attach to the right identities (typically on a stable key such as employee ID or email).
- 4. Run account aggregation and confirm accounts and entitlements load.
- 5. Verify correlation, watching for uncorrelated/orphan accounts.
Provisioning capabilities
Your code implements the iterate method (for aggregation) and the provision method (for changes), translating between SailPoint’s model and the target’s native operations. Treat it like any production software: version-controlled, tested, and documented.
Entitlements and what to govern
Define entitlements in code to reflect the target’s access model, exposing them so they can be requested, certified and provisioned like any other.
Troubleshooting
When custom aggregation or provisioning fails, work through the usual causes in order:
- Test the connector against the target outside IdentityIQ where possible.
- Add thorough logging so failures are diagnosable.
- Handle errors and partial failures explicitly.
- Validate schema discovery and provisioning round-trips.
Common pitfalls
- Credential expiry (tokens/secrets/certs) silently breaking the connector.
- Insufficient rights on the custom service account for the operations you need.
- Schema or correlation misconfiguration leaving accounts uncorrelated.
Want to learn this properly?
Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.
Check your understanding
What type of connector is Custom connector?
- A. a custom-built connector. It implements the connector interface (e.g. extending AbstractConnector) in Java.
- B. Configure the connection and credentials, then aggregate accounts and correlate them to identities.
- C. Credentials, network/firewall access and schema mapping.
Show answer
A. a custom-built connector. It implements the connector interface (e.g. extending AbstractConnector) in Java.
a custom-built connector. It implements the connector interface (e.g. extending AbstractConnector) in Java.
What is the first onboarding step for Custom connector?
- A. Configure the connection and credentials, then aggregate accounts and correlate them to identities.
- B. Credentials, network/firewall access and schema mapping.
- C. a custom-built connector. It implements the connector interface (e.g. extending AbstractConnector) in Java.
Show answer
A. Configure the connection and credentials, then aggregate accounts and correlate them to identities.
Configure the connection and credentials, then aggregate accounts and correlate them to identities.
Where do most Custom connector connector issues come from?
- A. a custom-built connector. It implements the connector interface (e.g. extending AbstractConnector) in Java.
- B. Credentials, network/firewall access and schema mapping.
- C. Configure the connection and credentials, then aggregate accounts and correlate them to identities.
Show answer
B. Credentials, network/firewall access and schema mapping.
Credentials, network/firewall access and schema mapping.