Day 11

How would you describe, in plain language, what a connector actually does and why SailPoint needs one?

A connector is a bridge-and-translator piece of software that lets SailPoint read and manage accounts inside another system, since SailPoint doesn't store company data permanently and has no way to reach other systems without it.

What is the "universal travel adapter" analogy meant to illustrate about connectors?

Just as one travel adapter lets the same phone charger plug into any country's wall socket, a single connector gives SailPoint one consistent way to plug into many different target systems, each with its own different "socket shape."

What real-world problems existed before connectors and automated provisioning, and why did they matter?

IT staff had to manually create or remove accounts one system at a time, which was slow, error-prone, and often left forgotten active accounts behind after someone left, creating both lost productivity and security risk.

What is the difference between a source system and a target system?

A source system, almost always the HR system, is where the "truth" about a person comes from, while a target system is any application, like email or Active Directory, where an account actually needs to be created, changed, or removed.

How do identity, application, and account relate to one another?

An identity is the digital record of one real person; an application is a system SailPoint connects to; and an account is the specific login that identity holds inside one particular application, so one identity can have many accounts across many applications.

What are the three building blocks involved in every connector conversation?

The SailPoint platform (which decides what needs to happen), the connector itself (which translates and carries the message), and the target application (which actually holds the account).

Why does SailPoint never talk directly to a target system?

SailPoint's role is to decide what should happen, while the connector's role is to carry out and translate that decision, so the connector always stands between SailPoint and the target application.

What is the difference between the Direct Connect and Virtual Appliance connection patterns?

Direct Connect has the connector talk straight to the target system over the network, which works well for internet-reachable cloud/SaaS systems, while a Virtual Appliance is a gateway installed inside a company's own network to relay messages to on-premises systems that aren't directly reachable from the internet.

What's the difference between an agent-based and an agentless connector?

An agent-based connector installs a small helper program on or near the target system to pass messages back and forth, needed when a system has no easy direct connection method, while an agentless connector talks directly using the system's own built-in connection method with nothing extra installed.

Why are connector credentials considered a core security responsibility rather than an afterthought?

Connectors often hold powerful credentials capable of creating or changing accounts, so those credentials must always be stored encrypted and the connection itself is typically encrypted in transit to prevent them from being exposed.

What are the four broad families of connector types, and what distinguishes them?

Direct/Native connectors are pre-built for one specific well-known system; Generic connectors follow a shared standard like JDBC or LDAP; Cloud/SaaS connectors are built for internet-hosted business applications; and Custom connectors are built from scratch for a unique or homegrown system with no other option.

What do JDBC and LDAP connectors have in common, and how do they differ from a Direct/Native connector?

Both JDBC (for databases) and LDAP (for directory-style systems) are "generic" because they follow a shared communication standard usable across many different products, unlike a Direct/Native connector, which is purpose-built for just one specific system.

When would a company use a Flat File connector instead of a Web Services/API connector?

A Flat File connector is used when a system has no modern interface at all and simply drops a plain text file, often a CSV, into a shared folder on a schedule, while a Web Services connector is used for modern systems reachable over the internet through a standard request-and-response API.

When is a Custom connector the right choice, and why is it usually a last resort?

A Custom connector is written specifically for a unique or legacy system with no existing connector option; it's a last resort because it takes far more time and effort to build and maintain than the other three connector families.

What are the two directions every connector conversation runs in?

Aggregation, which reads data in from the target system, and provisioning, which sends changes out to the target system.

Can you walk through what happens during the aggregation step?

SailPoint asks the connector for every account it currently has, the connector fetches that data from the target system, and sends it back translated into a format SailPoint understands, usually on a regular schedule like nightly.

What is an orphan account, and why does it matter during correlation?

An orphan account is one that couldn't be matched to any known identity during correlation, and it's a common, serious security risk since it may belong to someone who has already left the company or was never properly tracked.

When would a company use real-time communication instead of scheduled communication, and why?

Real-time communication is used for urgent changes, like granting new-hire day-one access or revoking access immediately after a termination, while scheduled communication is used for routine tasks like nightly aggregation where instant speed isn't critical.

How does a well-configured connector handle a failed action, such as a target system being temporarily unreachable?

It logs the failure clearly, automatically retries the action a set number of times, and alerts an administrator if the failures continue, since a silent failure to remove access is far more dangerous than a silent failure to grant it.

What is the difference between provisioning and deprovisioning, and why should deprovisioning get equal urgency?

Provisioning creates or updates access, while deprovisioning removes it when someone changes roles or leaves the company; deprovisioning deserves equal urgency because a forgotten, still-active account is a common and easy target for attackers