> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/reference/connector-catalogue.md). # Connector catalogue Connectors are how SECUREpass reaches the rest of your estate. They discover identities and entitlements, provision and deprovision accounts, and broker access — and they are what feeds the converged identity access graph. Availability varies by release and by licensed module. Confirm the connectors you need against your installed version before you plan around them, and contact eMudhra if a system you need is not listed. ## How a connector works Every connector follows the same lifecycle. Learn it once and each individual connector only adds its own details. 1. **Connect** — give the target's endpoint or instance URL, and make sure it is reachable through the network and firewall. 2. **Authenticate** — supply the credential the connector uses: an API token, an OAuth client, a service account or a bind account, with the permissions and scopes it needs. 3. **Map attributes** — map the target's user, group and role attributes to SECUREpass fields. 4. **Choose sync scope and direction** — users, groups, roles, entitlements; inbound, outbound or both; and what happens on create, update and disable. 5. **Schedule** — set the sync frequency and how conflicts are handled. 6. **Monitor** — review sync runs, record counts and errors, and reconcile where needed. Where a target system exposes it, a connector syncs over **SCIM 2.0** — the standard provisioning protocol — rather than that vendor's own API. This is handled by the connector itself: there is no SCIM option to choose and nothing extra to configure. ## Directory services Directories are the primary source of workforce identities. SECUREpass reads users and groups, writes back where supported, and can use the directory for authentication. | Connector | What it needs | What it brings | | -------------------------- | -------------------------------------------------------------------------------------- | ----------------------------------------------------------- | | LDAP / OpenLDAP | Bind account DN and password, base DN, host and port — LDAPS recommended | Users and groups, with attribute mapping and scheduled sync | | Microsoft Active Directory | Service account with read access, domain or OU scope, LDAPS connectivity | Users, groups and OUs, with optional write-back | | Azure AD / Entra ID | App registration with consented Microsoft Graph permissions; tenant, client and secret | Users and groups via Graph | | Kerberos | Realm, KDC and a service keytab | Seamless desktop SSO rather than object sync | Standard attributes — first name, last name, email, department, manager — map to the equivalent SECUREpass profile fields. ## Cloud IAM Cloud IAM connectors bring identities and entitlements from identity providers and cloud platforms into the access graph, and manage assignments where the target supports it. | Connector | What it needs | What it brings | | ------------------- | ------------------------------------------------------------------- | --------------------------------------------------------------- | | Okta | Org URL and an API token or OAuth app with read scopes | Users, groups and app assignments | | Azure AD / Entra ID | App registration with Graph permissions | Users, groups, app role assignments, conditional-access context | | AWS IAM | An IAM principal or role, accessed by role assumption | IAM users, roles and policies, and MFA posture | | GCP IAM | Service account with the appropriate IAM roles, scoped to a project | Project-level bindings and service accounts | | Oracle Cloud (OCI) | API signing key for a user with the needed policy | OCI IAM users, groups and compartment access | | Oracle IAM | A read account on the Oracle identity directory | Enterprise directory users and groups | | Ping Identity | Admin or API credential for PingOne or PingFederate | Users and directory data | | OneLogin | API client ID and secret with read scope | Users, roles and app assignments | ## Enterprise applications | Connector | What it needs | What it brings | | ---------------- | ---------------------------------------------------------------- | ---------------------------------------------------------- | | ServiceNow | Instance URL and an integration user with the needed roles | Users; can raise tickets on access events | | Salesforce | A Connected App with API access, and an admin user | Users, profiles and permission sets | | Google Workspace | Service account with domain-wide delegation and Admin SDK scopes | Users, groups and OU membership | | SAP | An RFC, SOAP or OData connection with an integration user | Users and role assignments | | Jira | Atlassian API token or OAuth with admin scope | Users, groups and project roles | | GitHub | A GitHub App or organisation PAT with `admin:org` | Organisation and team membership | | HubSpot | Private app token or OAuth with CRM scopes | Users and contact data | | Dropbox Business | API app token with team admin scope | Team members and group membership | | Splunk | Admin credential, and an HEC token for forwarding | User sync, and SECUREpass audit events forwarded to Splunk | ## Databases Database connectors integrate database users and access. Combined with the PAM database proxy, they give governed and audited database access. | Connector | What it needs | What it brings | | -------------------- | -------------------------------------------------------------------- | ------------------------------------------------------------- | | PostgreSQL | JDBC connection string and an account with the needed privileges | Users, roles and schema access; query audit through the proxy | | Microsoft SQL Server | JDBC connection and a login able to read and manage logins and roles | Logins, database users and roles | | MongoDB | Connection URI and a user with `userAdmin` on the target databases | Database and collection users and roles | ## Network devices and RADIUS The RADIUS service authenticates VPNs, Wi-Fi and network devices, and can enforce MFA through a challenge-response flow. Configuration is a shared secret, the allowed client IP addresses and ports, and the attributes returned for authorisation — VLAN assignment and group-based attributes among them. Clients are then configured on the devices themselves, and on VPN concentrators. ## Secrets managers | Connector | What it needs | What it brings | | ------------------- | -------------------------------------------------------------- | ------------------------------------------------------------------ | | HashiCorp Vault | AppRole or token auth, with a policy granting the needed paths | Reads and writes secrets per policy; supports credential injection | | AWS Secrets Manager | An IAM principal with Secrets Manager permissions | Secret sync, rotation and access policies | | Azure Key Vault | Managed identity or app registration with Key Vault access | Secret read and write | Automated rotation on checkout and on a schedule keeps stored credentials fresh.