# Provisioning

The Cerner Healthcare connector supports provisioning, allowing you to create and manage accounts and entitlements in Cerner Healthcare directly from SailPoint.

**Prerequisite:** Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

> [!IMPORTANT]
>
> This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

> [!NOTE]
>
> The `confidentialityLevel` attribute must be configured in the new application provisioning policy with the following details:
>
> - Type as String
> - Review required
>
> For better governance, ensure that the value of the `confidentialityLevel` attribute is the same as the managed system.

## Default Create Account Attributes

The following table lists the provisioning policy attributes for Create Account:

| Account Attribute | Description |
| --- | --- |
| username | The user name associated with the account. The value of the user name field must be unique within the target Cerner Millennium domain `[1-48 characters]`. |
| password | The password for the user account. Any value, assuming that value meets all criteria defined in the Cerner Millennium password policy maintained in AuthView. The password is only required when the user being provisioned is a non-LDAP user (when the user will authenticate against the Cerner Millennium user directory). |
| first name | Given (first) name for the personnel. |
| lastname | Surname (last name) for the personnel. |
| confidentialityLevel | The confidentiality level set for organization or organization groups. |

## Update Account Attributes

The following table lists the provisioning policy attributes for Update Account:

| Account Attribute | Description |
| --- | --- |
| confidentialityLevel | The confidentiality level set for organization or organization groups. |

## Dormant Account Support

If you want to remove the user name and not disassociate an account, clear the **Disassociate Account** checkbox on the [Advanced Settings](<https://documentation.sailpoint.com/connectors/cerner_healthcare/va/help/connecting.html#advanced-settings>) page.

To remove the user name, configure the following attribute in the provisioning policy:

`<entry key="disassociateAccount" value="true"/>`

If you set the attribute to `true`, the source removes the user name and disassociates the account from personnel. This disassociated user name can then be assigned to any other account.

## Additional Provisioning Attributes

The following are additional provisioning attributes:

| Account Attribute | Description |
| --- | --- |
| personnelAlias | To provision `personnelAlias` through the update account provisioning policy, enter the input format for the attribute as follows: `beginEffectiveDateTime=2021/10/01#~#endEffectiveDateTime=2100/12/30#~#alias=677001#~#type=DOCDEA#~#aliasPool=DEA` |
| credential | To provision `credential` through the update account provisioning policy, enter the input format for the attribute as shown in the following example: `name=BLS#~#type=Certificate#~#renewalDateTime=2035/01/01#~#state=NY#~#beginEffectiveDateTime=2021/10/01#~#endEffectiveDateTime=2100/12/30#~#addToNameIndicator=true` |
| address | To provision `address` through the update account provisioning policy, enter the input format for the attribute as shown in the following example: `streetAddr=1200 Northside Forsyth Dr#~#streetAddr2=Times Square#~#addressTypeCd=Business#~#state=NY#~#city=Cumming#~#zipCode=30041#~#beginEffectiveDateTime=2021/10/01#~#endEffectiveDateTime=2100/12/30` |
| phone | To provision `phone` through the update account provisioning policy, enter the input format for the attribute as shown in the following example: `phoneNumber=0001112222#~#phoneType=Business#~#phoneFormat=FreeText#~#extension=09#~#description=A phone number#~#beginEffectiveDateTime=2021/10/01#~#endEffectiveDateTime=2100/12/30` |
| roleProfile | To provision `roleProfile` through the update account provisioning policy, enter the input format for the attribute as shown in the following example: `position=0001112222#~#display=Displayname#~#beginEffectiveDateTime=2021/10/01#~#endEffectiveDateTime=2100/12/30` |