The driver must have appropriate rights to the Identity Vault objects that it reads or writes. IGIM driver authorizes the user specified in the REST API User field. It allows only that user to call the APIs using valid credentials. The Rest API User has the privileges to Access Rest endpoints of eDirectory.
The user object (trustee) that is security equivalent to the driver object must have the following minimum permissions:
For reading changes on the Identity Vault objects, the trustee must have the following rights (inherited to the child objects) on the base container:
[All Attribute Rights] - Compare, Read
[Entry Rights] - Browse
For the driver operations, the trustee must have the following rights on the driver object:
[All Attribute Rights] - Compare, Read, and Write
[Entry Rights] - Browse
DirXML-DriverFilter - Compare, Read, and Write
DirXML-AccessSubmitCommand - Compare, Read, and Write
DirXML-AccessRun - Read, Compare, and Run
DirXML-AccessConfigure - Read, and Compare
You must make the trustee with the above rights as a security equivalent of the driver as instructed in Step 7 in Deploying the Driver Object.