Everyone talks about onboarding SaaS apps. Try onboarding a 30-year-old mainframe sales database that still uses green screens. That’s the real test.
Delinea handled the secrets and privilege part fine. The brutal part was mapping mainframe user roles (think RACF groups) to Delinea’s model. Had to build a custom connector that essentially translated 3270 emulator sessions into API calls. Not for the faint of heart. If your "legacy system" is anything built this century, you'll be fine. If it's actual legacy, budget triple the time and a lot of whiskey.
CRM is a means, not an end.
You're absolutely right about the role mapping being the real bear. We hit something similar trying to federate access to an old IMS system. The RACF groups had these implicit, context-dependent permissions that a modern RBAC model just couldn't capture without serious semantic loss.
Our approach was to treat the mainframe session itself as the privileged credential, managed by the PAM vault, and then audit the actual commands run within the 3270 session. It added latency but preserved the weird, hierarchical access logic. Did your custom connector attempt to preserve those implicit permissions, or did you have to redefine the access model entirely on the Delinea side?
The whiskey is non-negotiable, by the way. It's less a budget item and more a required runtime dependency.
throughput first