> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/connector-configuration/thales.md).

# Thales connector

Configure the Thales connector to provision users to the Thales (SafeNet Trusted Access) platform over its REST API.

The **Thales connector** (`thales-connector-rabbitmq`) provisions users to the **Thales SafeNet Trusted Access** identity and authentication platform over its REST API, using the endpoint and credentials from the managed-system configuration.

| Operation                   | Supported                                  |
| --------------------------- | ------------------------------------------ |
| Create / update user (Save) | ✅                                          |
| Delete user                 | ✅                                          |
| Suspend / resume user       | ✅                                          |
| Reset password              | ✅                                          |
| Search users                | ✅                                          |
| Login                       | ✅                                          |
| Search groups               | ✅                                          |
| Test connection             | ✅                                          |
| Group create/delete         | ❌ Not implemented in the current connector |

{% hint style="info" %}
OpenIAM ships two Thales connectors: this **REST** connector and the [Thales WSDL connector](/connector-configuration/thales-wsdl.md), which talks to the SOAP (BSIDCA) web service of SafeNet Authentication Service deployments. Choose based on which API your Thales environment exposes — and note that only the WSDL connector supports **group provisioning**.
{% endhint %}

## Use cases

* Full **user-lifecycle provisioning** to Thales SafeNet Trusted Access — create, update, suspend/resume, password reset, removal.
* **Importing Thales users and groups** into OpenIAM via synchronization.
* If you must **create or delete Thales groups** from OpenIAM, use the [Thales WSDL connector](/connector-configuration/thales-wsdl.md) instead.

## Versions and compatibility

The end application is **Thales SafeNet Trusted Access**, reached over its REST API. Every endpoint is scoped to a tenant, so the tenant identifier is part of the path rather than a header.

<table><thead><tr><th width="178">Property</th><th>Value</th></tr></thead><tbody><tr><td><strong>Platform</strong></td><td>Thales SafeNet Trusted Access</td></tr><tr><td><strong>Interface</strong></td><td>REST API <strong>v1</strong>, over HTTPS</td></tr><tr><td><strong>Host</strong></td><td>The managed system's URL</td></tr><tr><td><strong>Path shape</strong></td><td><code>/api/v1/tenants/{tenant}/...</code> — users, groups and applications</td></tr><tr><td><strong>Test connection</strong></td><td><code>/api/v1/tenants/{tenant}/authorized</code></td></tr></tbody></table>

{% hint style="info" %}
This is the REST connector for SafeNet Trusted Access. For the older Thales (CRYPTOCard) BlackShield service, which speaks SOAP, use the [Thales WSDL connector](/connector-configuration/thales-wsdl.md) instead.
{% endhint %}

## Prerequisites

* A Thales service account with API credentials for your tenant.
* Network access from the connector host to the Thales API base URL (HTTPS).

## Installing the connector

### Kubernetes

In Kubernetes deployments, the connector is deployed as part of OpenIAM — enable it in your deployment configuration; no separate installation is required.

### RPM

Run the connector JAR directly:

{% code overflow="wrap" %}

```bash
java -Dlogging.level.root=INFO -Dconfpath=/data/openiam/ -jar thales-connector-rabbitmq.jar > thales.out &
```

{% endcode %}

Or, when managed by systemd, use the connector service unit (`openiam-connector@thales-connector-rabbitmq`). To deploy on a separate host, see [Connectors via RPM](/installation/rpm/rpm-single-node/add-a-connector.md).

## Starting, stopping, and restarting

<table><thead><tr><th width="156">Deployment</th><th>Commands</th></tr></thead><tbody><tr><td>RPM (systemd)</td><td><code>systemctl start|stop|restart openiam-connector@thales-connector-rabbitmq</code></td></tr><tr><td>RPM (manual)</td><td>Start with the <code>java -jar</code> command above; stop by killing the process.</td></tr><tr><td>Kubernetes</td><td><code>kubectl rollout restart</code> the connector deployment.</td></tr></tbody></table>

## Command-line parameters and properties

The connector is a Spring Boot application. Its defaults ship inside the jar, and you override them in either of two places:

* **An external property file**, read at `${confpath}/conf/properties/thales-connector-rabbitmq.properties`. The file is optional, and `confpath` is itself a system property, set with `-Dconfpath=/data/openiam/`.
* **Directly on the command line**, as `-D` arguments, which win over the file.

{% code overflow="wrap" %}

```bash
java -Dconfpath=/data/openiam/ -Dlogging.level.root=INFO -Dorg.openiam.connector.queue=THALES_Connector_1_Request -jar thales-connector-rabbitmq.jar
```

{% endcode %}

| Property                                  | Default                       | Purpose                                                               |
| ----------------------------------------- | ----------------------------- | --------------------------------------------------------------------- |
| `org.openiam.connector.queue`             | `THALES_Connector_1_Request`  | Must match the connector record exactly.                              |
| `org.openiam.connector.queueResponseName` | `THALES_Connector_1_Response` |                                                                       |
| `org.openiam.connector.name` / `.type`    | `THALES` / `THALES Connector` |                                                                       |
| `org.openiam.update.site.role`            | `false`                       | Controls whether the user's site role is updated during provisioning. |

The connection details themselves are **not** set here — they are managed system parameters, covered under [Configuring the managed system](#configuring-the-managed-system).

## Verifying the connector is running

{% stepper %}
{% step %}
In the Webconsole, open the managed system — the **Running connector status** indicator must be green.
{% endstep %}

{% step %}
Click **Test Connection** — it must return success.
{% endstep %}

{% step %}
In the RabbitMQ management console, confirm the `THALES_Connector_1_Request` queue exists and has a consumer.
{% endstep %}

{% step %}
Check the connector log for startup errors.
{% endstep %}
{% endstepper %}

## Troubleshooting

| Symptom                                     | Likely cause                                                      | Resolution                                                                                       |
| ------------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| Connector never receives messages           | Queue-name mismatch                                               | The connector record's queue must equal `THALES_Connector_1_Request` exactly.                    |
| API calls rejected by Thales                | Wrong URL or service-account credentials                          | Verify the managed system's URL/Login/Password.                                                  |
| Site role not updating on provisioned users | `org.openiam.update.site.role` is `false` (default)               | Set the property to `true` and restart the connector.                                            |
| Group create/delete does nothing            | Group-object operations are not implemented in the REST connector | Use the [Thales WSDL connector](/connector-configuration/thales-wsdl.md) for group provisioning. |

See also: [general connector troubleshooting](/connector-configuration/4-troubleshootingconnector.md) and the [connector error-code reference](/connector-configuration/4-troubleshootingconnector.md#connector-error-codes).

## Registering the connector in OpenIAM

Register the connector under **Provisioning → Connectors** and attach it to the managed system — see [Registering the connector](/administration-guide/lifecycle/connectors-and-managed-systems.md).

## Configuring the managed system

<table><thead><tr><th width="200">Managed-system field</th><th>Value</th></tr></thead><tbody><tr><td><strong>URL</strong></td><td>The Thales API base URL for your tenant.</td></tr><tr><td><strong>Login</strong> / <strong>Password</strong></td><td>The API credentials for the Thales service account.</td></tr></tbody></table>

## Attribute mapping and policy map

Map OpenIAM user attributes to the Thales user fields in the managed system's [policy map](/administration-guide/lifecycle/policy-map.md).

## Reconciliation and synchronization

The user and group searches supply Thales records as source data. Configure a sync against the managed system as described in [Configuring synchronization](/administration-guide/lifecycle/synchronize-and-import-data.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/connector-configuration/thales.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.