<style>p { margin: 0; }span.fr-emoticon.fr-emoticon-img { background-repeat: no-repeat !important; font-size: inherit; height: 1em; width: 1em; min-height: 20px; min-width: 20px; display: inline-block; margin: -0.1em 0.1em 0.1em; line-height: 1; vertical-align: middle; } span.fr-emoticon { font-weight: normal; font-family: "Apple Color Emoji", "Segoe UI Emoji", "NotoColorEmoji", "Segoe UI Symbol", "Android Emoji", "EmojiSymbols"; display: inline; line-height: 0; } blockquote { border-left: solid 2px #5e35b1; color: #5e35b1; margin-left:0; padding-left:5px;}blockquote blockquote{ border-color: #00bcd4; color: #00bcd4;}blockquote blockquote blockquote{ border-color: #43a047; color: #43a047;} table.grid{ border-collapse: collapse;} table.grid td, table.grid th { border: 1px solid #ddd;} .fr-fic.fr-dib{ display: block; margin: 5px auto;}.fr-fic.fr-dib.fr-fir{ text-align: right; margin: 5px 0 5px auto;}.fr-fic.fr-dib.fr-fil{ text-align: left; margin: 5px auto 5px 0;}.fr-fic.fr-dii{ float: none; margin: 5px auto;}.fr-fic.fr-dii.fr-fil{ float: left; margin: 5px auto;}.fr-fic.fr-dii.fr-fir{ float: right; margin: 5px auto;}img.fr-dib.fr-fir { margin-right: 0; text-align: right;}img.fr-dib.fr-fil { margin-left: 0; text-align: left;}img.fr-dib { margin: 5px auto; display: block; float: none;}img.fr-bordered { box-sizing: content-box; border: solid 5px #CCC;}img.fr-shadow { box-shadow: 10px 10px 5px 0px #cccccc;}img.fr-rounded { border-radius: 10px; -moz-border-radius: 10px; -webkit-border-radius: 10px; -moz-background-clip: padding; -webkit-background-clip: padding-box; background-clip: padding-box;}</style><p><strong>In this guide we will cover:</strong></p><p data-pasted="true"><strong>- What is the SailPoint Identity Now Integration?</strong></p><p><strong>- Enabling the SailPoint Module</strong></p><p><strong>- Connecting to SailPoint </strong></p><p><strong>- Role Mappings</strong></p><p><strong>- User Mappings</strong></p><p><strong>- Map User and Agent Fields</strong></p><p><strong>- Import Users/Agents</strong></p><p><strong>- Import Users/Agents on a Schedule</strong></p><p><br></p><p><em>This integration is available as of v2.234+.</em></p><p><br></p><p data-pasted="true"><strong><span style="font-size: 14pt;">What is the SailPoint Identity Now Integration?</span></strong></p><p>The SailPoint Identity Now integration allows you to import users and agents into Halo from SailPoint Identity Now. Once imported users and agent can be imported into Halo on a daily sync. Multiple SailPoint instances can be connected to Halo. If you have multiple Halo instances, you will also be able to choose which Halo instance each SailPoint Identity Now instance you are connecting is linked to. Allowing you to integrate a sandbox SailPoint Identity Now instance with a Sandbox Halo instance. This integration supports a one way sync only. </p><p><br></p><p>If you using SailPoint IIQ we have a separate integration guide available for this <a href="https://usehalo.com/haloitsm/guides/2696" target="_blank" rel="noopener noreferrer">here</a>. </p><p><br></p><p><strong><span style="font-size: 14pt;">Enabling the SailPoint Module</span></strong></p><p>In Configuration > Integrations > Identity Management, you will find the SailPoint module. Hover over it, and click the plus (+) icon to enable it.</p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjQ5N2I1NjBiLTJkOTctNDlhNS05OTBhLTBhNmYzZmJkNDI3ZCJ9.bEHmy5hybMDnku8Y1YmwzYgZ4BBLcOhkXXprDwaoCT4" class="fr-fic fr-fil fr-dib" width="106" height="122"></p><p><strong><span style="font-size: 10pt;">Fig 1. Enabling the SailPoint module</span></strong></p><p><br></p><p>Once enabled, click into the integration module to begin configuration. </p><p><br></p><p><strong><span style="font-size: 14pt;">Connecting to SailPoint </span></strong></p><p>Start by giving the connection a name and choose the "Instance Type" to be "SailPoint Identity Now". </p><p><br></p><p><strong><em>Note: If you have multiple Halo instances, at this point you will also need to choose the instance this SailPoint connection is linked to using the "Instance" field. </em></strong></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImRlOTFmYzU2LTc4ZWEtNGFkNS1iM2UzLTE3ZDkyZTI3MmM2NCJ9.OB91x5I9bHzqgyFWSoNOj7dkSqOBLj-rD3hlXEScq7g" class="fr-fic fr-fil fr-dib" width="1787" style="width: 1789px; height: 620.262px;" height="620"></p><p><strong><span style="font-size: 10pt;">Fig 2. Set name and instance type for SailPoint connection</span></strong></p><p><br></p><p>Once set you will need to enter the URL of your SailPoint Identity Now instance, along with a client ID and secret. The client ID and secret will need to be generated in SailPoint Identity Now.</p><p><br></p><p>Once you have entered the connection credentials you can test the connection using the "Connect to SailPoint" button. Once this returns a successful test the additional tabs of integration setup will be available to you. </p><p><br></p><p><strong><span style="font-size: 14pt;">Role Mappings</span></strong></p><p>Role mappings can be created under the "Role Mappings" tab, these allow you to automatically assign users and agents roles in Halo based on fields in SailPoint Identity Now.</p><p><br></p><p>Create a new role mapping by adding an entry to the "Role Mappings" table.</p><p><br></p><p>When adding a mapping use the "HaloPSA Entity" field to choose if this mapping should apply to agents or users then give it a description and sequence. The sequence will determine the order in which the mapping is checked. When users and agents are imported they will be assigned a role in line with the first mapping they match. Mappings with lower sequence values will be checked first. </p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjU1YWNkMWMxLWRhOTMtNDEwNC1iMzNhLTU2NGEwNjZhYWYyZiJ9.s6D8HwkyjYS8WFvFW-xZyddYR1dEkjWIxLpTkm1lACk" class="fr-fic fr-fil fr-dib" width="639" style="width: 641px; height: 590.442px;" height="590"></p><p><strong><span style="font-size: 10pt;">Fig 3. Role mapping</span></strong></p><p><br></p><p>Then, add filters to the mapping to set criteria for who should have this role. </p><p><br></p><p>When creating a filter you will need to choose whether this is based on a core or custom SailPoint Identity Now field, then choose the field and set the filter type and value. When entering the field name ensure you enter the API field name, as it is returned by SailPoint's API, similarly the filter value should be the value as it is returned by SailPoint's API. </p><p><br></p><p><span style="color: rgb(0, 0, 0);">In the below example a filter is set so users that have the Department "HR Management" will be assigned this role.</span></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjFhNTY2YTk1LTZlZTQtNGQxOC04YTNhLTZiM2E4ZGMyNTYwZCJ9.6xJtLt9Tru3Y_ezdKibicFS-Ah1IUU8iGbu3NRFUSvc" class="fr-fic fr-fil fr-dib" width="622" style="width: 624px; height: 422.118px;" height="422"></p><p><strong><span style="font-size: 10pt;">Fig 4. Example filter</span></strong></p><p><br></p><p>Once you have added any required role mappings you will need to configure User Mappings. </p><p><br></p><p><strong><span style="font-size: 14pt;">User Mappings</span></strong></p><p>Under the "User Mappings" tab you can configure mappings to control which agents and users are imported into Halo and how they are imported. Each mapping will contain filters to control which users in SailPoint Identity Now will be imported using this mapping.</p><p><br></p><p>To create a new mapping add an entry to the user mappings table. </p><p><br></p><p>When adding a mapping you will need to use the "HaloPSA Entity" field to choose whether the users who meet the filter criteria in this mapping will be imported as agents or users in Halo. Then give it a description and sequence. The sequence will determine the order in which the mapping is checked. When users and agents are imported they will be imported in line with the first mapping they match. Mappings with lower sequence values will be checked first. </p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImVhZTUzYTNiLWQ5OTEtNGFhNy1iZDJkLTFkOTI2YjRlYWZhNCJ9.4R4flC25WsYaovYbgByIu6BaXDLHdPpxf0ETsTKO4Po" class="fr-fic fr-fil fr-dib" width="607" style="width: 609px; height: 1017px;" height="1017"></p><p><strong><span style="font-size: 10pt;">Fig 5. New User mapping</span></strong></p><p><br></p><p>Then you will need to set filter criteria for this mapping, based on user properties. Only users that meet the criteria in the filters will be imported with the attributes outlined in this mapping. </p><p><br></p><p data-pasted="true">When creating a filter you will need to choose whether this is based on a core or custom SailPoint Identity Now field, then choose the field and set the filter type and value. When entering the field name ensure you enter the API field name, as it is returned by SailPoint's API. Similarly the filter value should be the value as it is returned by SailPoint's API. </p><p><br></p><p data-pasted="true"><span style="color: rgb(0, 0, 0);">In the Figure 6 example a filter is set so users that have the manager.name "Joe DaSilva" will be imported with this mapping.</span></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImNjNDI2YWEzLTFlY2ItNGEyMy1iY2MzLWU3MDFjNWUxN2E0YyJ9.EC7bWbSOj4ZOwu-23yKSvf4Ht-b8kd2kAvpg0XHzNPA" class="fr-fic fr-fil fr-dib" width="710" height="577"><strong><span style="font-size: 10pt;">Fig 6. Example filter for user import mapping</span></strong></p><p><br></p><p><strong>Apply filer after retrieving data -</strong> Check this if you would like to filter users using SailPoint Identity Now fields that are not filterable in the SailPoint Identity Now API. This will filter users after user data has been retrieved (client side filtering).</p><p><br></p><p><strong><span style="font-size: 12pt;">Determine the Customer and Site Users are Created Under</span></strong></p><p>When creating a mapping for importing users, you will have a section called "Customer/Site Matching". Here you will need to configure the customer and site the users imported using this mapping are created under.</p><p><br></p><p><span style="color: rgb(0, 0, 0);">This option is not available when creating agent mappings as agents will have a linked user created for them automatically upon creation. The linked user created will be imported under the main site of the customer linked with the organisation the agent is under. If you would like to control the sites agents' linked users are under you will need to configure a separate user mapping for this. </span></p><p><span style="color: rgb(0, 0, 0);"><br></span></p><p><span style="color: rgb(0, 0, 0);"><em><strong>Note: If using multi tenancy (so you have multiple Halo Organisations), users will not be created for agents until the agent is assigned a department. </strong></em></span><strong><em><br></em></strong></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImRmYjI2NWU4LTBjZjgtNGM5NC1iOTZjLTJkODg5ODg0ZTM0ZCJ9.eyb6apJcJ3jc8JWmPcbXBh-spBrADqO26jeab57VnhM" class="fr-fic fr-fil fr-dib" width="578" style="width: 580px; height: 677.486px;" height="677"></p><p><strong><span style="font-size: 10pt;">Fig 7. Customer/Site Matching Configuration</span></strong></p><p><br></p><p>There are three methods you can use to determine which customer/site users are created under:</p><p><strong>Assign all Users to the same Site - </strong>Use this when you would like all users matching this mapping to be created under the same customer/site. Simply choose a customer and site users should be created under.</p><p><strong>Use a field to identify the correct Customer -</strong> Use this when you have a field in SailPoint Identity Now that contains the customer the user is under and you would like all users to be created under the main site of this customer. You will need to select the SailPoint Identity Now field that contains this information. You will also need to choose a Halo Customer custom field to map this to. Users will be created under the Halo customer that shares the same value in the Halo custom field as the chosen SailPoint field. </p><p><strong>Use a field to identify the correct Site -</strong> Use this when you have a field in SailPoint Identity Now that contains the site the user is under. You will need to select the SailPoint field that contains this information. You will also need to choose a Halo site custom field to map this to. Users will be created under the Halo site that shares the same value in the Halo custom field as the chosen SailPoint field. </p><p><br></p><p><strong><span style="font-size: 12pt;">Assign Roles to Users on Import</span></strong></p><p>When setting up agent/user mappings you can also choose a role to assign all the users/agents that are imported using this mapping. Choose a role in the "Default Role" field. </p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImMwMjM0NTYzLTk5Y2UtNDViNy1hNjc4LWI2YWIyM2U2MjRkOSJ9.x_lWA5F6KX7DtNM18mggw0DPbwGmi2AUCrrbKNgS6Bo" class="fr-fic fr-fil fr-dib" width="579" style="width: 581px; height: 450.212px;" height="450"></p><p><strong><span style="font-size: 10pt;">Fig 8. Default role field</span></strong></p><p><br></p><p><span style="color: rgb(0, 0, 0);">Agents/users will be assigned this role in addition the any roles setup in the "Role Mappings" tab. </span></p><p><br></p><p><strong><span style="font-size: 12pt;">Set the Type of Halo Licence Agents have</span></strong></p><p>When creating a mapping for importing agents, you can set which type of Halo licence agents imported with this mapping are assigned. The type of Halo licence chosen will impact the type of licence they use to login to Halo. </p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6Ijg3YjUyYmFkLTRhMTQtNDgxNy1iY2UyLWFlNDUzMWUyZGFlYyJ9.g44ou-Itrp8B3HMD0aDHJi9EdYgZJj8eQ1Seg-3jTk4" class="fr-fic fr-fil fr-dib" width="674" style="width: 676px; height: 396.494px;" height="396"></p><p><strong><span style="font-size: 10pt;">Fig 8. Set Licence type</span></strong></p><p><br></p><p><strong><em>Note: For information on the different licence types, reach out to your account manager or our support team. </em></strong></p><p><br></p><p><strong><span style="font-size: 12pt;">Import User manager Information </span></strong></p><p>When creating a mapping for importing agents/users, you can choose whether manager information about the user is also imported from SailPoint Identity Now. </p><p><br></p><p>Users will have the email of their manager imported into the AD manager field in Halo. </p><p><br></p><p><span style="color: rgb(0, 0, 0);">When importing agents, this will populate the "Manager" field for the agent. The agent set here will be matched to an agent in Halo using the email of the manager in SailPoint Identity Now. </span></p><p><span style="color: rgb(226, 80, 65);"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImVlMGFmZWJkLWRmYjgtNDkzZC05ZGMxLWE5OTI2MGY5ZjQyYSJ9.5D1C144-NsqQBKepL6DSTrA5L8G8AboxEKWOk8uIF5U" class="fr-fic fr-fil fr-dib" width="746" style="width: 748px; height: 386.873px;" height="387"></span></p><p><strong><span style="font-size: 10pt;">Fig 9. Import User manager information</span></strong></p><p><br></p><p>Save the mapping once you have completed the setup. </p><p><br></p><p>Ensure you create mappings for each group of agents and users you would like to import. Only users in SailPoint Identity Now that meet the criteria of at least one of the mappings will be imported into Halo. </p><p><br></p><p><strong><em>Note: If you would like to ensure all users from SailPoint are imported you could create a catchall mapping, with no filters and the highest sequence. </em></strong></p><p><br></p><p><strong><span style="font-size: 14pt;">Map User and Agent Fields</span></strong></p><p>Once a user mapping for users has been created a new "Users" tab will appear. Once an agent mapping for agents has been created a new "Agents" tab will appear. Here you can map fields in SailPoint Identity Now to Halo fields to control where data is imported, fields mapping are setup in the tabs for the respective entity. You can also create 'static field mappings' to automatically set values in fields for all users/agents imported from SailPoint Identity Now.</p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjVmNTU1OTIwLTQ5ODUtNDYzNi05YTkzLTllZjZmZGIwYmExZiJ9.ZDGY4M2vcRIsnfnyXBljo1o5NPASqcks2zF-jmZFbrc" class="fr-fic fr-fil fr-dib" width="973" style="width: 975px; height: 589.267px;" height="589"></p><p><strong><span style="font-size: 10pt;">Fig 10. Users Tab</span></strong></p><p><br></p><p>Create a new field mapping by adding an entry to the "Field Mappings" table. When creating a mapping simply choose the type of SailPoint Identity Now field to map, choose the field and the Halo field to map it to. </p><p><br></p><p><strong><span style="font-size: 12pt;">Static Field Mappings</span></strong></p><p>Create a new static field mapping by adding an entry to the "Static Field Mappings" table. When adding you will need to specify which Halo field to update and the value you would like to update it with. You will need to specify the API field name of the field. Similarly, when entering the value this should be the value as returned by the API. To find the API name of a field in Halo check our API documentation, this can be found in your Halo instance under Configuration > Integrations > HaloAPI > API Documentation. </p><p><br></p><p>In the Figure 11 example a static field mapping has been setup so that all imported users have their web access level set to 0 (this users tickets).</p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjdkODQxODEyLWJkNTktNDZlOC05OGE5LTRmZWFjMDdlZmNiOSJ9.JzHcztuzb6DDtXcamgXoCiibDoTpQ8q7Y1oSWmAlDTg" class="fr-fic fr-fil fr-dib" width="1017" style="width: 1019px; height: 435.45px;" height="435"></p><p><strong><span style="font-size: 10pt;">Fig 11. Example Field Mappings</span></strong></p><p><br></p><p><strong>Use email address for User/Agent matching -</strong> Enable this when you would like users in SailPoint Identity Now to be matched to users in Halo using their email address. This only applies if they cannot be matched using their SailPointID. Each user will be assigned a SailPoint ID after being imported from SailPoint Identity Now. </p><p><br></p><p><strong><span style="font-size: 14pt;">Import Users/Agents</span></strong></p><p>Once you have completed the import mappings and field mappings for agents and users you can run an import manually. </p><p><br></p><p>Do this using the "Import Agents/Users" button found in the Agents/Users tabs (respectively). </p><p><br></p><p><strong><span style="font-size: 14pt;">Import Users/Agents on a Schedule</span></strong></p><p>Once all your import setup is complete and you have carried out an initial manual import, you can enable the Halo Integrator to have agent and user information imported from SailPoint Identity Now automatically on a schedule. This ensures when users/agents are created or updated in SailPoint Identity Now, changes will reflect in Halo. </p><p><br></p><p>To enable the Halo Integrator simply check "Enable the Halo Integrator for the SailPoint integration" and choose which entities to import in the "Entities to Import" field.</p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjZiY2FkODRjLTgwYmItNDZmMC05YjRiLWFjMmM5OTQ5OGRjMCJ9.XcmTca2BU_0wwYM3HypyI7kL8iJGPSBe5YSMtnkNrLM" class="fr-fic fr-fil fr-dib" width="962" style="width: 964px; height: 381.619px;" height="382"></p><p><strong><span style="font-size: 10pt;">Fig 12. Enable the Halo Integrator for SailPoint</span></strong></p><p><br></p><p><strong><span style="font-size: 12pt;">Change how Imports are Processed</span></strong></p><p>The "User Processing Method" will change how imports are processed. Methods for processing are as follows:</p><p><strong>Process All Users returned from User Mappings -</strong> Each time an import is run every field against all users returned will be checked for updates. This typically results in slower processing.</p><p><strong>Only process recently updated Users based on a custom calculated delta -</strong> Each time an import is run, only the specified fields against each user will be checked for updates. When chosen you will need to specify which fields to check for updates in the "Delta Fields" table. This typically improves processing time. </p><p><br></p><p data-pasted="true"><strong><em>Note: Adding or removing a field from the Delta Fields table will cause all Users to be processed on the next sync.</em></strong></p><p><br></p><p><strong><span style="font-size: 12pt;">Deactivate Users/Agents when they are Removed from SailPoint Identity Now</span></strong></p><p>To have users/agents in Halo deactivate automatically when the matched user/agent is no longer found in SailPoint Identity Now enable "Deactivate Users/Agents in Halo when they are no longer found in SailPoint" accordingly. </p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjNkMWYzNWZiLWE4OTMtNDNiNi04NWM3LTkwMWEyMzg3OTg4ZCJ9.1AfVCnVG7zlJXOcDWmiL8EuuYU9709Q4DKLW7Zj9Z_Q" class="fr-fic fr-fil fr-dib" width="1722" style="width: 1724px; height: 528.323px;" height="528"></p><p><strong><span style="font-size: 10pt;">Fig 13. Deactivate Users/Agents in Halo when they are no longer found in SailPoint</span></strong></p><p><br></p>
