> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/secrets-manager/integrations/sailpoint-iiq-connector.md).
# SailPoint IIQ Connector
Manage identity and access to Keeper vaults with the SailPoint IdentityIQ connector.
***
## Overview
The Keeper Security connector provides identity governance for your Keeper enterprise through SailPoint IdentityIQ (IIQ).
The connector aggregates accounts and refreshes individual accounts. It also aggregates node, team, role, folder, and record entitlements. You can create, update, enable, disable, and delete Keeper accounts.
The connector supports IdentityIQ 8.4, 8.5, and 9.0, including their patch releases.
## Features
| SailPoint Connector Features | Description |
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Test Connection |
Verify the connection between IdentityIQ and Keeper Commander Service Mode.
|
| Entitlement Aggregation |
List roles available in your Keeper organization.
List teams available in your Keeper organization.
List nodes available in your Keeper organization.
List records and their permissions.
List folders and their permissions.
Apply names changed in Keeper to existing entitlements, and remove entitlements that no longer exist in Keeper.
|
| Account Aggregation |
List users from your Keeper organization in IdentityIQ.
Map users to their existing Keeper Vault entitlements.
Refresh a single account.
Remove accounts of users that no longer exist in Keeper.
|
| Account Update |
Invite users from IdentityIQ and provision a Keeper Vault for each invited user.
Update the user's name, job title, and email in IdentityIQ.
Assign available roles, teams, and nodes through IdentityIQ entitlement assignments.
Share records and folders through IdentityIQ record and folder entitlement provisioning.
Enable or disable access to the Keeper Vault through IdentityIQ.
Delete an account. This transfers its Keeper Vault to the target user configured in sailpoint-app-setup, then removes the departing Keeper account.
|
## Example use case
### Invite User to Keeper Vault and share record
{% stepper %}
{% step %}
#### Select identity in IdentityIQ
Select the identity in IdentityIQ. The identity email must match the user's Keeper email address.
Request a Keeper account for the identity through **Manage User Access** or **Manage Accounts**. The connector creates a Keeper invitation.
{% endstep %}
{% step %}
#### Complete Keeper account setup
The user accepts the Keeper invitation from their email. They then complete their vault setup.
The user's vault must be active before you share records directly with them. For invitation details, see Creating and Inviting Users.
{% endstep %}
{% step %}
#### Assign the record entitlement
In IdentityIQ, request the required **Record** entitlement for the identity. Select the permission level that matches the user's access requirements.
The connector provisions the record share to the user's Keeper account.
{% endstep %}
{% step %}
#### Verify access
Open the identity in IdentityIQ and check the **Entitlements** tab. Confirm that the record entitlement appears for the identity.
{% endstep %}
{% endstepper %}
## Prerequisites
1. **Keeper enterprise** with administrative access to manage users, teams, roles, and sharing.
2. **Keeper Commander Service Mode** **API v2** running and reachable over HTTPS from every IdentityIQ server, with a valid Service Mode API key.
3. **SailPoint IdentityIQ** 8.4, 8.5, or 9.0 (any patch level), with access to the server files (or container) and the **System Administrator** capability in the IdentityIQ UI.
4. **Java 11** or later, plus the application server and database versions your IdentityIQ release supports. IdentityIQ 9.0 requires Tomcat 10.1 or 11 and MySQL 8.4.
5. **Lifecycle Manager** (optional) for access requests and the **Manage Accounts** page.
> The connector has no third-party dependencies. It uses only the JDK and the libraries that ship with IdentityIQ.
## Commander Service Mode Setup
To keep zero-knowledge and end-to-end encryption, **Commander Service Mode** runs on your infrastructure and is the only path the IdentityIQ connector uses to talk to Keeper.
Use `sailpoint-app-setup` to create the Docker-based Service Mode deployment and SailPoint-specific settings in one flow.
#### Before you start
1. [Install Keeper Commander](https://docs.keeper.io/keeperpam/commander-cli/commander-installation-setup) on a workstation.
2. Prefer a dedicated Keeper **service account** with rights to manage enterprise users and to share the folders/records you will govern from IdentityIQ.
3. Log in to Commander with that account:
```
keeper shell
login serviceuser@company.com
```
4. Ensure Docker is available on the host where Service Mode will run.
#### Run SailPoint setup
```
My Vault> sailpoint-app-setup
```
The command runs in two phases and writes a `docker-compose.yml` with a **Commander-only** service.
**Phase 1 — Service Mode / Docker**
Creates the shared folder, Docker config record, KSM application, and client config, then prompts for:
| Prompt | Description |
| ---------------------------- | ------------------------------------------------------------------------ |
| **Port** | Local port for Commander Service Mode. Default: `8900`. |
| **Enable ngrok?** | Optional public URL via ngrok. Default: No. |
| **Ngrok Auth Token** | Required if ngrok is enabled. |
| **Ngrok Custom Domain** | Optional (for example `myapp.ngrok.io`). Press Enter to skip. |
| **Enable Cloudflare?** | Asked only if ngrok is disabled. Default: No. |
| **Cloudflare Tunnel Token** | Required if Cloudflare is enabled. |
| **Cloudflare Custom Domain** | Required if Cloudflare is enabled (for example `commander.company.com`). |
> **Ngrok and Cloudflare are mutually exclusive.** IdentityIQ runs in your own network, so a tunnel is usually not needed: use a Service Mode URL that every IdentityIQ server can reach over HTTPS. Enable **ngrok** or **Cloudflare Tunnel** only if Service Mode runs on a network that IdentityIQ cannot reach directly.
Queue mode (API v2) is enabled automatically. The command allowlist is limited to SailPoint-safe operations (user lifecycle and sharing). Secret-bearing commands such as `get`, `export`, and `find-password` are excluded.
**Phase 2 — SailPoint options**
| Prompt | Description |
| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| **Allow folder shares?** | Whether IdentityIQ may manage folder share entitlements (`share-folder` / `nsf-share-folder`). Default: Yes. |
| **Allow record shares?** | Whether IdentityIQ may manage record share entitlements (`share-record` / `nsf-share-record`). Default: Yes. |
| **Allow role assignment?** | Whether IdentityIQ may assign roles via `enterprise-user` / `enterprise-role`. Default: Yes. |
| **Allow team assignment?** | Whether IdentityIQ may assign teams via `enterprise-user`. Default: Yes. |
| **Transfer target email** | Active user that receives vault data when IdentityIQ deletes an account via `transfer-user`. (required) |
| **Interval seconds** | How often Commander re-checks invited users and applies queued entitlements after they become **Active**. Default: `60`. Minimum: `15`. |
> Disabled capabilities are rejected by Service Mode (HTTP 403). Nodes are never gated — `--node` remains available for invites and moves.
Resources created (defaults):
| Resource | Default name |
| -------------------------- | -------------------------------------------------- |
| Shared folder | `Commander Service Mode - SailPoint` |
| KSM application | `Commander Service Mode - KSM App` |
| Docker config record | `Commander Service Mode Docker Config` |
| SailPoint config record | `Commander Service Mode SailPoint Config` |
| Docker service / container | `commander-sailpoint` / `keeper-service-sailpoint` |
> Re-running setup rewrites `docker-compose.yml` (manual edits are lost) but preserves queued pending entitlements on the SailPoint config record.
> **Important:** Start Service Mode through `sailpoint-app-setup`, not with `service-create` alone. A Service Mode started with `service-create` has no transfer target: deletes are accepted but Keeper keeps the user, and the access request stays **Pending / Verifying**.
#### Deploy
```
My Vault> quit
rm ~/.keeper/config.json
docker compose up -d
docker ps
docker logs keeper-service-sailpoint
curl http://localhost:/health
```
Delete the local `config.json` before starting Docker so the container does not conflict with the same device token. Docker loads its own config through KSM.
#### Values for the IdentityIQ application
After the service is healthy:
1. **Service Mode URL** — base URL **without** `/api/v2` that every IdentityIQ server can reach (tunnel URL if you enabled ngrok/Cloudflare, otherwise your reachable host URL).
2. **API Key** — from the Docker/service config record created during setup (stored in the vault after the container starts Service Mode).
Use those values in Application Configuration.
> Keep the Service Mode service account out of IdentityIQ provisioning. The connector refuses to delete, disable, or update the Keeper account that Service Mode logs in with.
#### Deferred entitlements (Invited users)
Keeper cannot fully apply some entitlements until the user is **Active**. Commander queues role, team, folder, and record grants requested while the user is still **Invited**, then applies them after activation (on the poll interval from Phase 2).
New accounts stay **Invited** (shown as disabled in IdentityIQ) until the user accepts the Keeper invitation. Initial **roles** / **teams** requested on create are applied once the user becomes active.
#### Optional CLI flags
```
My Vault> sailpoint-app-setup \
--folder-name "Commander Service Mode - SailPoint" \
--app-name "Commander Service Mode - KSM App" \
--config-record-name "Commander Service Mode Docker Config" \
--sailpoint-record-name "Commander Service Mode SailPoint Config" \
--skip-device-setup
```
| Flag | Description |
| ------------------------- | ---------------------------------------------- |
| `--folder-name` | Shared folder name |
| `--app-name` | KSM application name |
| `--config-record-name` | Docker/service config record name |
| `--sailpoint-record-name` | SailPoint config record name |
| `--config-path` | Path to Commander `config.json` |
| `--timeout` | Device timeout (default: `30d`) |
| `--skip-device-setup` | Skip device registration if already configured |
***
## Download the Connector ZIP
1. Go to the [Keeper Security SailPoint IdentityIQ Connector Releases](https://github.com/Keeper-Security/sailpoint-iiq-connector/releases) page.
2. Locate the latest release.
3. Download the connector ZIP file and its checksum file, typically named:
```
keeper-iiq-connector-.zip
keeper-iiq-connector-.zip.sha256
```
4. Copy the ZIP file to the IdentityIQ server (or container) and open a terminal in the directory containing it.
The ZIP contains:
| Path | Purpose |
| ---------------------------------------------------- | --------------------------------------------------------------------------- |
| `lib/keeper-iiq-connector-.jar` | Connector |
| `web/define/applications/KeeperAttributesForm.xhtml` | Application settings page |
| `config/Keeper.xml` | Connector registry entry (application type **Keeper Security**) |
| `config/Keeper-Application.xml` | Creates the **Keeper Security** application and its email correlation |
| `config/Keeper-Tasks.xml` | Aggregation tasks for the **Keeper Security** application |
| `config/Keeper-Entitlement-Refresh.xml` | Rule that Entitlement Aggregation uses to apply names changed in Keeper |
| `install.sh` | Installs the connector, application type, application, and tasks in one run |
| `uninstall.sh` | Removes the connector, its applications, tasks, and application type |
***
## Install the Connector in IdentityIQ
Install the connector on **every IdentityIQ server** in the cluster: run the full install on one server, and `install.sh -n` (or Option C, steps 1 to 5) on the others.
> The jar and the settings page must be copied on the server itself. The IdentityIQ UI cannot install files.
### Locate the IdentityIQ directory
In the commands below, `` is the IdentityIQ web application directory, the one that contains `WEB-INF`.
| IdentityIQ runs on | Typical `` |
| ------------------------------- | --------------------------------------------------------------------------- |
| Tomcat on Linux | `/webapps/identityiq`, for example `/opt/tomcat/webapps/identityiq` |
| Tomcat on Windows | `\webapps\identityiq` |
| Official Tomcat container image | `/usr/local/tomcat/webapps/identityiq` (inside the container) |
To find it, locate `iiq.properties` and go up two levels:
```bash
find / -path "*WEB-INF/classes/iiq.properties" 2>/dev/null
# /opt/tomcat/webapps/identityiq/WEB-INF/classes/iiq.properties
# -> is /opt/tomcat/webapps/identityiq
```
### Option A: Install script (Linux / macOS)
Run as the user that owns the IdentityIQ files:
```bash
unzip keeper-iiq-connector-*.zip
cd keeper-iiq-connector-*/
./install.sh -d
```
In one run, the script:
1. Backs up any previous version and copies the jar and the settings page.
2. Registers the **Keeper Security** application type and the **Keeper Entitlement Refresh** rule.
3. Creates the **Keeper Security** application with its email correlation. An existing application with that name is kept with its settings.
4. Creates or updates the three aggregation tasks.
| Option | Description |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| `-d ` | IdentityIQ web application directory (required). |
| `-a "My Keeper App"` | Use another application name. |
| `-n` | Only install the files and the application type; skip the application and tasks. Use it on the other servers of a cluster. |
Restart the application server afterwards, for example:
```bash
sudo systemctl restart tomcat
```
### Option B: IdentityIQ in a container (Docker)
Run the script inside the container that runs Tomcat, so that `iiq console` reaches the IdentityIQ database:
```bash
docker cp keeper-iiq-connector-*.zip :/opt/
docker exec -it bash
cd /opt
jar xf keeper-iiq-connector-*.zip
cd keeper-iiq-connector-*/
sh ./install.sh -d
exit
docker restart
```
> **Note:** If the container has no `unzip`, use the JDK's `jar` tool as shown. It does not keep execute permissions, so start the script with `sh`. If `` is not on a mounted volume, the jar and settings page are lost when the container is re-created.
### Option C: Manual install (Windows or any OS)
1. Stop the application server.
2. Delete any older `keeper-iiq-connector*.jar` from `/WEB-INF/lib`.
3. Copy `lib/keeper-iiq-connector-.jar` to `/WEB-INF/lib/`.
4. Copy `web/define/applications/KeeperAttributesForm.xhtml` to `/define/applications/`.
5. Start the application server.
6. Go to **Gear icon → Global Settings → Import from File** and import these files in order:
1. `config/Keeper.xml`
2. `config/Keeper-Entitlement-Refresh.xml`
3. `config/Keeper-Application.xml`
4. `config/Keeper-Tasks.xml`
You can also import them with `iiq console` (`iiq.bat console` on Windows):
```
cd /WEB-INF/bin
iiq console
> import /full/path/to/config/Keeper.xml
> quit
```
> **Note:** The jar must be in `WEB-INF/lib`. Loading it only through an application's `connector-classpath` is not enough: the application definition pages load the connector class directly and stay blank if they cannot find it.
***
## Application Configuration
1. Log in to IdentityIQ with administrator credentials. Go to **Applications → Application Definition**.
2. Open the **Keeper Security** application created by the installer.
3. Open the settings page: **Configuration → Settings** on IdentityIQ 8.x, or **Settings** on 9.0. Enter the Keeper Commander Service Mode connection settings.
| Setting | Required | Default | Description |
| -------------------- | -------- | ------- | --------------------------------------------------------------------------------- |
| **Service Mode URL** | Yes | | Base URL of Commander Service Mode, without `/api/v2`. |
| **API Key** | Yes | | Service Mode API key. Stored encrypted. |
| **Poll Timeout** | No | `60` | Seconds to wait for a single Commander command. |
| **Sync Cache TTL** | No | `30` | Seconds an enterprise or vault sync stays fresh before the next read syncs again. |
4. Click **Test Connection** to verify the connection between Service Mode and IdentityIQ, then click **Save**.
> **Note:** To create the application manually instead, go to **Applications → Application Definition → Add New Application**, select the **Keeper Security** application type, enter the settings above, and on the **Correlation** tab match the account attribute `email` to the identity attribute `email`. The application includes the account schema, the five entitlement schemas, and a **Create** provisioning policy.
## Entitlement Aggregation
After establishing the connection between Service Mode and IdentityIQ, run entitlement aggregation.
This step collects and lists available nodes, roles, teams, records, and folders with their permissions.
The Keeper Security IdentityIQ Connector supports the following entitlement types.
## Entitlement types
| Type | Description |
| ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Node | An organizational unit in the Keeper enterprise hierarchy. Each user belongs to one node. Shown as the node path, for example `Org\Sales`. |
| Team | A group of Keeper users. Assign this entitlement to add a user to the team. |
| Role | A role in Keeper. Assign this entitlement to grant its permissions. |
| Folder | Access to a shared folder, including its assigned permission level. Shown as `Name [Permission]`. This supports classic and nested shared folders (NSF). |
| Record | A record shared directly with a user, including its assigned permission level. Shown as `Title [Permission]`. This supports classic and nested shared folders (NSF). |
Each permission level is a separate entitlement that can be requested, approved, and certified:
| Kind | Permission codes |
| -------------------------- | ----------------------------------------------------------------------------------------------------- |
| Classic shared folder | `NP` No permissions, `MU` Manage users, `MR` Manage records, `MUR` Manage users & records |
| Nested shared folder (NSF) | `VW` Viewer, `SM` Share manager, `CM` Content manager, `CSM` Content share manager, `FM` Full manager |
| Classic record | `RO` Read-only, `CE` Can edit, `CS` Can share, `OW` Owner |
| NSF record | `VW`, `SM`, `CM`, `CSM`, `FM`, `OW` |
> Only shares granted directly to a user are aggregated as that user's folder and record entitlements. Team folder shares are listed on the team entitlement.
The installer creates three aggregation tasks:
| Task | Description |
| ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| **Keeper Security Entitlement Aggregation** | Aggregates nodes, teams, roles, folders, and records. Applies names changed in Keeper and removes entitlements that no longer exist in Keeper. |
| **Keeper Security Account Aggregation** | Aggregates Keeper users and their entitlements. Removes accounts of users no longer in Keeper. |
| **Keeper Security Full Aggregation** | Runs the two tasks above in order, then **Full Text Index Refresh** and **Perform Identity Request Maintenance**. |
1. Go to **Setup → Tasks**, select **Keeper Security Entitlement Aggregation**, then click **Run Now**.
After entitlement aggregation completes, view the entitlements under **Applications → Entitlement Catalog**, filtered on the Keeper Security application.
> **Note:** If you run Entitlement Aggregation on its own, run **Full Text Index Refresh** afterwards so new entitlements can be found in **Manage User Access**. Full Aggregation does this automatically.
## Account Aggregation
After entitlement aggregation completes, run account aggregation. This imports users from your Keeper enterprise and maps each user to their assigned entitlements and existing access.
1. Go to **Setup → Tasks**, select **Keeper Security Account Aggregation**, then click **Run Now**.
After aggregation completes, view the accounts under **Identities → Identity Warehouse**.
Select a user and open the **Entitlements** tab to view their assigned entitlements.
> **Note:** Schedule **Keeper Security Full Aggregation** (for example, nightly) to keep IdentityIQ in step with Keeper. Only users with status `Active` are enabled in IdentityIQ; `Invited`, `Locked`, and other statuses are shown as disabled.
> **Note:** Keeper accounts that do not correlate to an existing identity create new identities. Their email stays blank unless an identity mapping sets it. To map it from Keeper, go to **Global Settings → Identity Mappings → email → Add Source**, select the **Keeper Security** application and the **email** attribute, then run **Refresh Identity Cube**.
>
>
## Entitlement Assignment
Follow these steps to assign entitlements through an access request.
1. Go to **Manage User Access** and select the identity that needs access.
2. Search for the Keeper entitlement (team, role, node, folder, or record) and add it to the request.
3. Submit the request. After approval, the connector provisions the entitlement to the user's Keeper account.
### Provisioning behavior
| Operation | Behavior in Keeper |
| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Create** | Invites the user with name, node, job title, and any requested roles and teams. The user stays `Invited` until they accept the Keeper invitation. |
| **Update** | Applies node, role, and team changes, then folder shares, record shares, and finally an email change. Each failure is reported on the request; the other changes still run. |
| **Folder permission change** | A user holds one permission level per shared folder. Requesting a new level replaces the current one. |
| **Record rights** | Removing a `CE` or `CS` record entitlement removes only that right and leaves read-only access. Remove the `RO` entitlement to remove the share completely. |
| **Record ownership (`OW`)** | Cannot be granted or removed from IdentityIQ. Change ownership in the Keeper vault. |
| **Email change** | Uses Keeper's alias promotion: the new address becomes the primary email. |
| **Disable / Enable** | Locks or unlocks the Keeper user. |
| **Delete** | Transfers the user's vault to the transfer target configured in `sailpoint-app-setup`, then removes the user. |
***
## Upgrade and Uninstall
**Upgrade:** Install the new ZIP the same way as the original install. The application, its settings, and aggregated data are kept, and `install.sh` updates the tasks. Restart the application server on every IdentityIQ server.
> If an existing Keeper application has a `connector-classpath` entry pointing to an older connector jar, remove that entry and the old jar. Otherwise IdentityIQ keeps loading the old connector.
**Uninstall:** Nothing is changed in Keeper. Run the uninstall script, then restart the application server:
```bash
cd keeper-iiq-connector-*/
./uninstall.sh -d
```
The script removes every **Keeper Security** application with its accounts, entitlements, and tasks, the email correlation, the **Keeper Entitlement Refresh** rule, the application type, and the connector files. On the other servers in the cluster, remove `WEB-INF/lib/keeper-iiq-connector-*.jar` and `define/applications/KeeperAttributesForm.xhtml`. Identities created by aggregation are kept; run **Prune Identity Cubes** to remove those left without accounts.
## Troubleshooting and logging
To review provisioning activity and troubleshoot errors, go to **My Work → Access Requests**, open the request, and click **Details**. Errors from Keeper are also written to the application server log.
To log each aggregation's object count, set the log level of `com.keeper.identityiq` to `info` in `WEB-INF/classes/log4j2.properties`.
| Symptom | Cause and fix |
| ---------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Test Connection: `status 401` | Wrong API key. Copy it again from the Service Mode config record. |
| Test Connection: `status 403` | `whoami` is not allowed. Set up Service Mode with `sailpoint-app-setup`. |
| `ClassNotFoundException: com.keeper.identityiq.KeeperConnector`, or the Schema page is blank | The jar is missing from `WEB-INF/lib` on this server. |
| IdentityIQ 9.0: the Settings page shows no fields | The jar is missing or outdated, or the application was created from another application type. Install the current ZIP, restart, and check that the application type is **Keeper Security**. |
| `Keeper API poll timed out` | Commander is slow or busy. Increase **Poll Timeout**. |
| A delete succeeds but the user still exists in Keeper, and the request stays **Pending / Verifying** | Service Mode has no transfer target. Set it up with `sailpoint-app-setup` (with a transfer target email), check that Account Transfer is enabled for the user's role, then delete again. |
| An entitlement renamed in Keeper keeps its old name | Tasks created by an older version do not use the **Keeper Entitlement Refresh** rule. Run `install.sh` again, then run Full Aggregation. |
| Roles or teams missing right after create | Keeper applies them once the user accepts the invitation. |
| An access request stays **Verifying** | Expected until **Perform Identity Request Maintenance** runs. |
| A user cannot log in to the vault after a node change | The new node uses SSO and the user is not set up in that identity provider. |
| Entitlements not found in **Manage User Access** | Run **Full Text Index Refresh**, and check that the entitlements are **Requestable** in the Entitlement Catalog. |
| **Remove Access** shows no current entitlements | The Account Aggregation task must have **Refresh assigned, detected roles and promote additional entitlements** checked (the shipped task does). For existing identities, run **Refresh Identity Cube** with the same option. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.keeper.io/keeperpam/secrets-manager/integrations/sailpoint-iiq-connector.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
## Entitlement Assignment
Follow these steps to assign entitlements through an access request.
1. Go to **Manage User Access** and select the identity that needs access.
2. Search for the Keeper entitlement (team, role, node, folder, or record) and add it to the request.
3. Submit the request. After approval, the connector provisions the entitlement to the user's Keeper account.
### Provisioning behavior
| Operation | Behavior in Keeper |
| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Create** | Invites the user with name, node, job title, and any requested roles and teams. The user stays `Invited` until they accept the Keeper invitation. |
| **Update** | Applies node, role, and team changes, then folder shares, record shares, and finally an email change. Each failure is reported on the request; the other changes still run. |
| **Folder permission change** | A user holds one permission level per shared folder. Requesting a new level replaces the current one. |
| **Record rights** | Removing a `CE` or `CS` record entitlement removes only that right and leaves read-only access. Remove the `RO` entitlement to remove the share completely. |
| **Record ownership (`OW`)** | Cannot be granted or removed from IdentityIQ. Change ownership in the Keeper vault. |
| **Email change** | Uses Keeper's alias promotion: the new address becomes the primary email. |
| **Disable / Enable** | Locks or unlocks the Keeper user. |
| **Delete** | Transfers the user's vault to the transfer target configured in `sailpoint-app-setup`, then removes the user. |
***
## Upgrade and Uninstall
**Upgrade:** Install the new ZIP the same way as the original install. The application, its settings, and aggregated data are kept, and `install.sh` updates the tasks. Restart the application server on every IdentityIQ server.
> If an existing Keeper application has a `connector-classpath` entry pointing to an older connector jar, remove that entry and the old jar. Otherwise IdentityIQ keeps loading the old connector.
**Uninstall:** Nothing is changed in Keeper. Run the uninstall script, then restart the application server:
```bash
cd keeper-iiq-connector-*/
./uninstall.sh -d