Schema Reference

The application schema is used to configure the objects returned from a connector.

Note

The Account Schema tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as Entitlement or Multi-Valued. Refer to Managing Source Account Schemas for more information.
The schema attributes that are not present by default must be defined as strings if not specified.

The Google Workspace SaaS connector uses the following default correlation and object configurations.

This connector currently supports the following types of objects:

Account - Account objects are used when building identity Link objects.
Group - Used to build AccountGroup objects that hold entitlements shared across identities.
Role - Used to build Account-Role objects that hold entitlements shared across identities.
IAM Role - Used to represent GCP IAM roles.
IAM Resource Permission - Used to represent GCP permissions over resources.
Folder - Used to represent GCP folders.
Project - Used to represent GCP projects.

Default Correlation Configuration

Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements.

You can customize the correlation configuration. Refer to Assigning Source Accounts to Identities for more information.

When you first create the Google Workspace SaaS source, the default correlation mapping is:

Identity Attribute	Operation	Account Attribute
Work Email	Equals	primaryEmail

You can modify the correlation configuration in accordance with your requirements.

Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.

Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as account IDs.

Caution

Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.

To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

Account ID	Schema Object Type
objectID	`Account`
objectID	`Group`
objectID	`Role`
name	`iamRole`
objectID	`iamresourcePermission`
objectID	`folder`
objectID	`project`

Default Account Attributes

The Google Workspace SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

Note

To aggregate the Delegated Administrators, add the delegatedadmins attribute (supported with Service Account Authorization only) to the account schema manually.

Attribute Name	Description
objectID	Unique ID of the user. This is an Account ID which must not be changed.
primaryEmail	User's primary email ID. The email ID domain must be a valid domain accessible to the service account provided in application configuration.
name	User's full name.
isAdmin	Indicates if a user is an administrator.
isDelegatedAdmin	Indicates if a users is a delegated administrator.
lastLoginTime	User's last login time.
suspended	User's suspension status.
suspensionReason	Reason for suspension.
changePasswordAtNextLogin	Indicates if the user is required to change their password the next time they log in.
ipWhiteListed	Indicate if user's IP address is whitelisted.
ims	The user's Instant Messenger (IM) accounts.
emails	A list of the user's email addresses.
externalIds	A list of external IDs for the user, such as an employee or network ID.
relations	A list of the user's relationships to other users.
addresses	A list of the user's addresses.
organizations	A list of organizations the user belongs to.
phones	A list of the user's phone numbers.
aliases	A list of the user's alias email addresses.
nonEditableAliases	A list of the user's non-editable alias email addresses.
customerId	The customer ID to retrieve all account users.
orgUnitPath	The full path of the parent organization associated with the user.
isMailboxSetup	Indicates if the user's Google mailbox is created.
includeInGlobalAddressList	Indicates if the user's profile is visible in the Global Address List when the contact sharing feature is enabled for the domain.
thumbnailPhotoUrl	URL used to set the user's thumbnail photo.
contacts	A list of the user's contacts.
givenName	User's first name.
familyName	User's last name.
delegatedAdmins	Delegated administrators of a user.
Groups	Groups connected to the user.
customSchemas	Aggregates custom schema attributes.
Roles	Roles connected to the user.
objectType	Object type of the account.
domainName	The domain name of the customer.
domainAliases	A list of domain alias.
isPrimary	Indicates if the domain is a primary domain.
verified	Indicates the verification state of a domain.
projectId	The ID of the project that owns the service account.
uniqueId	The unique and stable numeric ID for the service account.
displayName	Name for the service account.
description	Description for the service account.
serviceAccountId	Account ID of service account.
resourcePermissions	IAM resource permissions assigned to the user.
archived	Indicates if a user is archived. Enable to archive the user. Important: If you are updating from a connector created prior to August 25, 2022, you must manually add this attribute to your schema attribute list.

Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.

Caution

Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

Default Group Attributes

The Google Workspace SaaS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

Note

To aggregate the MANAGERS and OWNERS attributes, add them to the group schema manually.

Attribute Name	Description
objectID	The group's unique ID. This is an Account ID which must not be changed.
name	Name of the group.
nonEditableAliases	List of the group's non-editable alias email addresses that are outside of the account's primary domain or sub domains. These are functioning email addresses used by the group. This is a read-only property.
description	Description of the group.
adminCreated	Whether it is created by administrator.
aliases	Group aliases.
email	Group email address.
directMembersCount	Number of group members.
whoCanJoin	Permissions to join the group. Available values: `ALL_IN_DOMAIN_CAN_JOIN` - Anyone in the account can join; `ANYONE_CAN_JOIN` - Anyone outside your domain can join; `CAN_REQUEST_TO_JOIN` - Non group members can request an invitation to join; `INVITED_CAN_JOIN` - Candidates for membership can be invited to join.
whoCanViewMembership	Permissions to view membership. Available values: `ALL_IN_DOMAIN_CAN_VIEW` - Anyone in the account can view the group members list; `ALL_MANAGERS_CAN_VIEW` - The group managers can view group members list; `ALL_MEMBERS_CAN_VIEW` - Group members can view the group members list.
whoCanViewGroup	Permissions to view group. Available values: `ALL_IN_DOMAIN_CAN_VIEW` - Anyone in your account can view this group's messages; `ALL_MANAGERS_CAN_VIEW` - Any group manager can view this group's messages; `ALL_MEMBERS_CAN_VIEW` - All group members can view the group's messages; `ANYONE_CAN_VIEW` - Any Google Workspace user can view the group's messages.
whoCanInvite	Permissions to invite members. Available values: `ALL_MANAGERS_CAN_INVITE` - Only managers can invite a new member. This includes the group's owner; `ALL_MEMBERS_CAN_INVITE` - Managers and members can invite a new member candidate.
allowExternalMembers	A Boolean indicating if Google Workspace users external to your account can view or become members of this group.
MANAGERS	Managers of a group.
OWNERS	Owners of a group.
whoCanPostMessage	Permissions to post messages to the group. Available values: `ALL_IN_DOMAIN_CAN_POST` - Anyone in the account can post a message; `ALL_MANAGERS_CAN_POST` - Managers, including group owners, can post messages; `ALL_MEMBERS_CAN_POST` - Any group member can post a message; `ANYONE_CAN_POST` - Any Google Workspace user outside the account can access the Google Groups service and post a message; `NONE_CAN_POST` - The group is disabled and archived. No one can post a message to this group.
allowWebPosting	A Boolean indicating if any member is allowed to post to the group web forum.
primaryLanguage	Language tag for a group's primary language.
maxMessageBytes	The maximum size of a message.
isArchived	A Boolean indicating if the contents of the group to be archived.
archiveOnly	A Boolean indicating if the group is to be only archived.
messageModerationLevel	Moderation level for messages. Available values: `MODERATE_ALL_MESSAGES` - All messages are approved by the owner before they are sent to the group; `MODERATE_NEW_MEMBERS` - All messages from new members are approved by the owner before they are sent to the group; `MODERATE_NONE` - No moderator approval is required; `MODERATE_NON_MEMBERS` - All messages from non-group members are approved by the owner before they are sent to the group.
spamModerationLevel	Moderation levels for detecting messages as spam. Available values: `ALLOW` - Post the message to the group; `MODERATE` - Send the message to the moderation queue; `SILENTLY_MODERATE` - Send the message to the moderation queue, but do not send notification to moderators; `REJECT` - Immediately reject the message.
replyTo	The default reply to a message is sent here. Available values: `REPLY_TO_CUSTOM` - For replies to messages, use the group's custom email address; `REPLY_TO_IGNORE` - Group users individually decide where the message reply is sent; `REPLY_TO_LIST` - Reply message is sent to the group; `REPLY_TO_MANAGERS` - Reply message is sent to the group's managers; `REPLY_TO_OWNER` - Reply is sent to the owner(s) of the group; `REPLY_TO_SENDER` - Reply is sent to the author of message.
customReplyTo	An email address used when replying to a message.
sendMessageDenyNotification	A Boolean indicating if the members are notified if a message is denied by owner.
defaultMessageDenyNotificationText	Text sent to the message's author as part of rejection notification.
showInGroupDirectory	A Boolean indicating if group is listed in the Groups directory.
allowGoogleCommunication	A Boolean allowing Google to contact group administrators.
membersCanPostAsTheGroup	A Boolean indicating if members can post using the group email address.
messageDisplayFont	Default message's display font. Available values: `DEFAULT_FONT` - Uses the account's default font; `FIXED_WIDTH_FONT` - Uses fixed width font.
includeInGlobalAddressList	A Boolean indicating if the group is included in the Global Address List.
resourcePermissions	IAM resource permissions assigned to the group.

Default Role Attributes

The Google Workspace SaaS connector supports roles. The following attributes must be configured on the managed system and in the SailPoint source schema to manage roles.

Attribute Name	Description
objectID	The role's unique ID. This is an Account ID which must not be changed.
roleName	Name of the role.
roleDescription	Description of the role.
rolePrivileges	Privileges of the role, a multivalued attribute. Available values: `GROUPS_ALL`; `APP_ADMIN`.
isSystemRole	Indicates if the role is a system role.
isSuperAdminRole	Indicates if the role is a Super Admin role.

IAM Role Attributes

The following lists the IAM role attributes:

Attribute Name	Description
name	Name of the IAM role. This is an Account ID which must not be changed.
description	A description for the IAM role.
title	A title for the role.
includedPermissions	The names of the permissions this IAM role grants when bound in an IAM policy.
stage	The current launch stage of the IAM role.
deleted	The current deleted state of the IAM role.

GCP Vertex Agent Attributes

The following table lists the GCP Vertex agent attributes:

Parent Attribute Name	Child Attribute Name	Description
identity		Unique identifier for the agent.
name		Name assigned to the agent.
datasetId		Internal SailPoint dataset for the agent.
description		Descriptive text explaining the agent's purpose.
attributes	projectId	The ID of the project under which the agent resides.
	locationId	The GCP region in which the agent resides.
	createTime	The timestamp when the agent was created.
	updateTime	The timestamp when the agent was last updated.

IAM Resource Permission Attributes

The following lists the IAM resource permission attributes:

Attribute Name	Description
objectID	ID of the resource permission. This is an Account ID which must not be changed.
displayName	Display name of the resource permission. This is a combination of the role display name and the resource display name.
description	Description of the role associated with the resource permission.
includedPermissions	Permissions over the resource included in the role.
stage	Stage of the role associated with the resource permission.
resourceName	Resource name associated with the resource permission.
roleName	Role name associated with the resource permission.
resourceType	Type of resource associated with the resource permission.

Default Folder Attributes

The following lists the folder attributes:

Attribute Name	Description
objectID	ID of the folder in the format `folders/{numeric folder ID}`. This is an Account ID which must not be changed.
name	The full resource name of the folder.
assetType	Asset type of the GCP resource.
displayName	Display name of the folder.
location	Location of the folder.
state	State of the folder.

Project Attributes

The following lists the project attributes:

Attribute Name	Description
objectID	ID of the project in the format `projects/{alpha numeric project ID}`. This is an Account ID which must not be changed.
name	The full resource name of the project.
assetType	Asset type of the GCP resource.
displayName	Display name of the project.
labels	Labels used by the project. This attribute is multi-valued and must be manually added to the project schema in existing sources.
location	Location of the project.
state	State of the project.
tags	Tags used by the project. This attribute is multi-valued and must be manually added to the project schema in existing sources.

Custom Schema Attributes

The Google Workspace SaaS connector supports aggregation of custom schema attributes by adding the schema attributes in the following format:

customSchemas.SCHEMANAME.FIELDNAME

For example, if the custom schemas are as follows:

customSchemas = {SSO {"ADID":"101", "SAPID":"102"}, Address {"Postal_Code":"411018"}}

To display the attributes of the above custom schemas, you must add the following attributes in account schema:

customSchemas.SSO.ADID
customSchemas.SSO.SAPID
customSchemas.Address.Postal_Code

Note

A schema cannot contain another schema within a managed system as follows:

customSchemas= {SSO{Address{"Postal_Code":"411018"}}}

The connector does not support managing multi-level custom attributes defined in Google Workspace. Multi-level custom attributes are used if you have a schema defined inside a custom schema.

The name of the custom schema attribute must be the same as defined in the account schema.

To add a custom schema attribute to the provisioning policy, it must also be present in the account schema.

To support custom attribute provisioning, add the custom attribute names to the provisioning policy as described below:

customSchemas.<SCHEMANAME>.<FIELDNAME>

For more information on adding an attribute to schema, refer to Adding Attributes to a Source Schema.

For the Custom Schema attributes the Google Workspace source supports single valued and multi-valued attribute only. Provisioning of multilevel custom schema attributes is not supported.

Account ID Default Account Attributes Default Correlation Configuration Default Entitlement Attributes Default Group Attributes Default Role Attributes Google Workspace SaaS SaaS Schema Reference

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.