Control CoreDocs

Connect your first PIP

A Policy Information Point (PIP) feeds real-time attributes into controls — roles, department, clearance, employment status, and more. This guide connects your first data source end-to-end.

Choose a starter source

SourceBest first PIPTypical attributes
OktaYes — fast OIDC/API setupuser.roles, user.department, user.manager
Microsoft Entra IDYesuser.groups, user.job_title
WorkdayHR enrichmentuser.employment_status, user.clearance
PostgreSQL / RESTCustom metadataresource.owner, resource.classification

How to use (~20 min)

Step 1 — Open data sources (~2 min)

  1. Control Plane → Settings → Data Sources
  2. Click Add connection
  3. Select Okta (or your IdP)

Step 2 — Configure credentials (~5 min)

  • Store client ID/secret via secrets manager integration — never in plain text
  • Set sync interval (default 15 min for snapshot tier)
  • Click Test connection — expect HTTP 200 and sample user count

Step 3 — Map attributes (~8 min)

  1. Mappings tab → Add mapping
  2. Source field: profile.department → Control Core attribute: user.department
  3. Repeat for groups → user.roles
  4. Set runtime tier: snapshot for Day-1 (see PIP getting started for tier guide)

Step 4 — Verify Policy Bridge distribution (~3 min)

curl -s -H "Authorization: Bearer <token>" \
  "$PAP_API_URL/policy-bridge/pip-data/<connection_id>" | jq 'keys'

Bouncers receive PIP data on next Policy Bridge sync (~30–90s).

Step 5 — Use in a control (~5 min)

  1. Controls → Create → Visual Builder
  2. Add condition: user.department equals Finance
  3. Deploy to sandbox; send test request with matching JWT

How to review / audit

  • Settings → Data Sources — last sync time, error count
  • Audit Logs — decisions should include enriched user.* attributes in payload
  • Policy Bridge sync events: OPAL_SYNC_COMPLETED after PIP schema change

Monthly review:

  • Credentials rotation within policy window
  • No PIP sync failures > 24h
  • Mapped attributes still match IdP schema changes

Troubleshooting

Troubleshooting: Test connection fails?

  • Verify outbound HTTPS from Control Plane API to IdP
  • Check token scopes — Okta needs okta.users.read
  • See Admin troubleshooting

Troubleshooting: Control does not see new attribute?

  • Confirm mapping saved and Policy Bridge sync completed
  • Attribute tier snapshot may lag — switch to decision_time for critical controls only
  • Inspect bundle: curl $PAP_API_URL/policy-bridge/pip-data/<connection_id>

Troubleshooting: PII in logs?

  • Control Core must not log raw PIP payloads — enable diagnostic level warn only for support tickets

Next steps: PIP admin guide · PIP developer guide · Auto-generate controls