I am currently working on setting up SNC for SAP S/4HANA with SailPoint IdentityIQ. As per the technical paper, one of the steps requires creating a client PSE.
I would like to clarify whether the certificate used in the client PSE should be self-signed or signed by a trusted Certificate Authority (CA) in a typical SailPoint–SAP SNC setup.
Has anyone implemented this integration and can confirm which approach is recommended or commonly used in production environments?
@nitinbibm While self-signed certificates useful for proof-of-concept (PoC), they create significant technical debt and security risks in a mature architecture. In a production SailPoint IIQ to SAP S/4HANA integration, you should use a CA-signed certificate to be compliant and to maintain a trust chain management.
Note: Found a fix? Mark it as a solution! Want to say thanks? Give Kudos to anyone who helped you understand or solve the problem. Thanks..!!!
In technical paper, there are no steps for CA singed steps. If you are known, can you please help to understand how can i get the cert the signed by CA.
@nitinbibm I am not exactly sure about the steps. But i believe you need to work with your PKI/Certificate team who can help you generate the certificate files and get it signed.
Note: Found a fix? Mark it as a solution! Want to say thanks? Give Kudos to anyone who helped you understand or solve the problem. Thanks..!!!
The reason there are no steps in the whitepaper is that it depends on the Certificate Authority and is well outside the scope of IIQ. Have you communicated with your SOC, NOC or SECOPs in your organization? There are a large number of CAs out there you can work with, but I imagine that if your organization has made the investment in IIQ, there are those in the organization that can help you out with a CA signed certificate.