# Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The BeyondTrust Password Safe SaaS connector uses the following default correlation and object configurations. ## Default Correlation Configuration Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements. You can customize the correlation configuration. Refer to [Assigning Source Accounts to Identities]() for more information. When you first create the BeyondTrust Password Safe SaaS source, the default correlation mapping is: | Account Attribute | Operation | Identity Attribute | | --- | --- | --- | | UserName | Equals | name | | email | Equals | email | ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | ID | Account | | ID | Group | ### Default Account Attributes The BeyondTrust Password Safe SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. | Attribute Name | Description | | --- | --- | | id | The unique identifier for the user. | | userName | The unique username for the user. | | name.formatted | The full name. | | name.familyName | The family name of the user. | | name.givenName | The given name of the user. | | displayName | The name of the user, suitable for display to end-users. | | Title | The user's title, such as 'Vice President'. | | userType | Used to identify the relationship between the organization and the user. | | active | A Boolean value indicating the user's administrative status. | | manager.value | The manager value. | | organization | The organization. | | email | The email address for the user. | | emails.work.primary.display | A human-readable name, primarily used for display purposes. | | emails.work.secondary.display | A human-readable name, primarily used for display purposes. | | emails.work.primary.value | The email address value. | | emails.work.secondary.value | The email address value. | | emails.home.primary.display | A human-readable name, primarily used for display purposes. | | emails.home.secondary.display | A human-readable name, primarily used for display purposes. | | emails.home.primary.value | Email address value. | | emails.home.secondary.value | The email address value. | | emails.other.primary.display | A human-readable name, primarily used for display purposes. | | emails.other.secondary.display | A human-readable name, primarily used for display purposes. | | emails.other.primary.value | The email address value. | | emails.other.secondary.value | The email address value. | | phoneNumbers.work.primary.display | A human-readable name, primarily used for display purposes. | | phoneNumbers.work.secondary.display | A human-readable name, primarily used for display purposes. | | phoneNumbers.work.primary.value | Phone number of the user. | | phoneNumbers.work.secondary.value | Phone number of the user. | | phoneNumbers.home.primary.display | A human-readable name, primarily used for display purposes. | | phoneNumbers.home.secondary.display | A human-readable name, primarily used for display purposes. | | phoneNumbers.home.primary.value | The phone number of the user. | | phoneNumbers.home.secondary.value | The phone number of the user. | | phoneNumbers.mobile.primary.display | A human-readable name, primarily used for display purposes. | | phoneNumbers.mobile.secondary.display | A human-readable name, primarily used for display purposes. | | phoneNumbers.mobile.primary.value | The phone number of the user. | | phoneNumbers.mobile.secondary.value | Phone number of the user. | | costCenter | The cost center for the user. | | department | The department for the user. | | groups | A list of groups to which the user belongs, either through direct membership, through nested groups, or dynamically calculated. | | externalId | An identifier for the resource as defined by the provisioning client. | | LinkedObject.Source | The name of the external application on which the object lives. If this is a PAM local object, this is null. | | LinkedObject.NativeIdentifier | The native identifier of the object on the external application, for example the LDAP DN. If this is a PAM local object, this is null. | ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The BeyondTrust Password Safe SaaS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. | Attribute Name | Description | | --- | --- | | id | The unique identifier for the group. | | displayName | The displayable name of the group. | | members.value | The members of the group. | | description | The description of the group. | ## Default Machine Identity Attributes Machine Identity attributes define the multiple types of machine identities that can be assigned to the managed system's user accounts. For more information, refer to [Machine Identity Security Overview](). | Attribute Name | Description | | --- | --- | | userName | Unique username for the machine account (for example, `machine_username`). | | emails.work.primary.value | Work primary email address for the machine account (for example, `machine_username@machine.local`). | | name.givenName | The given name of the user. | | active | A Boolean value indicating the machine account's administrative status. | | password | Password for the machine account. |