Saviynt for Enterprise Identity Governance: Architecture, Implementation, and Hardening Guide

Overview

Saviynt is an Identity Governance and Administration (IGA) platform that helps enterprises manage joiner-mover-leaver processes, access requests, birthright provisioning, certification campaigns, segregation of duties, and application onboarding across cloud and on-premises systems. Organizations adopt Saviynt to centralize identity controls, reduce manual provisioning effort, improve audit readiness, and enforce policy-driven access across HR, directories, ERP, SaaS, and infrastructure platforms.

Saviynt is commonly selected when enterprises need a SaaS-delivered governance platform with broad connector coverage, analytics, and strong support for business-friendly access reviews. It is especially effective in hybrid environments where identities originate in systems such as Workday, SAP SuccessFactors, or Active Directory and must be provisioned consistently into applications like SAP, ServiceNow, Microsoft 365, AWS, and Salesforce.

Architecture

Saviynt typically operates as a SaaS control plane with customer-managed integrations to enterprise systems. Core components include:

• Identity repository for users, accounts, entitlements, roles, and access history
• Job engine for imports, correlation, provisioning, certifications, and analytics
• Connector framework supporting REST, JDBC, SAP, LDAP, SCIM, and file-based integrations
• Access request and approval workflows for policy-driven provisioning
• Analytics and SoD engine for toxic combination detection and governance reporting

Deployment models

• SaaS-first: Saviynt hosts the application; customers connect source and target systems securely
• Hybrid integration: On-prem systems are reached through secure network paths, APIs, VPN, or approved middleware
• Enterprise federation: Saviynt integrates with SSO providers such as Microsoft Entra ID, Okta, or PingFederate for admin and user authentication

Data flow

1. HR or directory sources import identities.
2. Correlation links identities to target accounts.
3. Role and rule evaluation calculates birthright and requestable access.
4. Provisioning jobs push changes to target systems.
5. Certifications and analytics validate ongoing compliance.

Implementation Guide

1. Prepare connectivity and source systems

Validate DNS, firewall rules, API endpoints, and service accounts. For example, test a REST target and LDAPS source:

curl -sS -X GET "https://example.my.salesforce.com/services/data/v59.0/" -H "Authorization: Bearer $SF_TOKEN"
openssl s_client -connect ad01.corp.example.com:636 -showcerts
ldapsearch -x -H ldaps://ad01.corp.example.com:636 -D "CN=saviynt-bind,OU=Svc,DC=corp,DC=example,DC=com" -W -b "DC=corp,DC=example,DC=com" "(sAMAccountName=jdoe)"

2. Define source onboarding and correlation

Create import definitions for HR and directory sources, then map authoritative attributes such as employeeId, email, manager, and department. Use a deterministic correlation rule, for example employeeId first and email second.

3. Configure target application connection

For REST-based applications, store endpoint URLs, OAuth credentials, retry settings, and entitlement discovery mappings. For JDBC targets, restrict DB accounts to read-only for imports and separate write accounts for provisioning where supported.

4. Schedule jobs

Run jobs in this order:

1. User import from HR
2. Account import from target systems
3. Account correlation
4. Entitlement import
5. Role refresh
6. Provisioning and certification jobs

5. Validate provisioning and approvals

Submit a test access request, verify approval routing, and confirm downstream account creation or entitlement assignment. Check Saviynt task status and target-side audit logs.

Code Examples

Example 1: Connectivity validation script

#!/usr/bin/env bash
set -euo pipefail
API="https://graph.microsoft.com/v1.0/users?$top=1"
TOKEN="${GRAPH_TOKEN}"
curl -f -sS "$API" -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" | jq '.value[0].userPrincipalName'

Example 2: SCIM target configuration

application:
  name: github-enterprise-scim
  baseUrl: https://api.github.example.com/scim/v2
  auth:
    type: bearer
    tokenEnv: GITHUB_SCIM_TOKEN
  import:
    usersEndpoint: /Users
    groupsEndpoint: /Groups
  provisioning:
    createUser: true
    disableUser: true
    patchGroups: true
  correlation:
    primaryField: externalId
    secondaryField: userName

Example 3: Account correlation helper

import csv
with open('accounts.csv') as f:
    for row in csv.DictReader(f):
        if row.get('employeeId'):
            print(f"CORRELATE {row['accountName']} -> employeeId={row['employeeId']}")
        elif row.get('email'):
            print(f"CORRELATE {row['accountName']} -> email={row['email'].lower()}")

Security Hardening

• Enforce SSO with MFA for all Saviynt administrators through Entra ID, Okta, or Ping
• Restrict admin access using least privilege and separate platform admin, application owner, and auditor roles
• Use TLS 1.2+ for all inbound and outbound integrations; reject weak ciphers on proxies and middleware
• Encrypt secrets in approved vaults such as CyberArk, HashiCorp Vault, or cloud-native KMS-backed secret stores
• Rotate API keys and service account passwords on a defined cadence, ideally every 60-90 days
• Limit connector accounts to minimum required scopes, especially for Microsoft Graph, AWS IAM, and Salesforce APIs
• Enable detailed audit logging for access requests, approvals, role changes, and connector failures

Comparison

Troubleshooting

1. REST connector authentication failure

Log sample:

2025-02-14 10:22:41,908 ERROR [qtp184756321-91] c.s.connector.rest.RestClient - HTTP 401 Unauthorized calling /scim/v2/Users
2025-02-14 10:22:41,909 WARN  [qtp184756321-91] c.s.jobs.ProvisionJob - Provisioning failed for account jdoe on app GitHub-Enterprise

Fix: Validate token scope, expiration, and audience. Reissue the OAuth token and confirm the Authorization: Bearer header format.

2. LDAP import TLS error

Log sample:

javax.naming.CommunicationException: simple bind failed: ad01.corp.example.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: PKIX path building failed]

Fix: Import the issuing CA chain into the trust store used by the integration runtime and verify hostname matching on the LDAPS certificate.

3. Correlation mismatch creating duplicates

Log sample:

2025-02-14 11:03:12,117 INFO  c.s.identity.CorrelationService - No match found for account=jsmith email=jsmith@subsidiary.example.com employeeId=
2025-02-14 11:03:12,118 INFO  c.s.identity.IdentityService - Created new identity for account jsmith

Fix: Normalize email domains, prioritize immutable HR identifiers, and run a pre-correlation quality report before production imports.

Best Practices

Do

• Use HR as authoritative source for workforce identities
• Implement role-based birthright access for common entitlements such as email, VPN, and collaboration tools
• Start with high-value applications like SAP, Microsoft 365, AWS, and ServiceNow
• Define clear ownership for applications, entitlements, and certification decisions

Don't

• Do not correlate on display name alone; use immutable identifiers like employeeId
• Do not grant connector accounts global admin unless technically required
• Do not run large import and provisioning jobs simultaneously without performance testing
• Do not launch certification campaigns before entitlement descriptions and owners are cleaned up