# Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The Google Workspace connector uses the following default correlation and object configurations. This connector currently supports the following types of objects: - Account - Account objects are used when building identity Link objects. - Group - Used to build AccountGroup objects that hold entitlements shared across identities. - Role - Used to build Account-Role objects that hold entitlements shared across identities. - IAM Role - Used to represent GCP IAM roles. - IAM Resource Permission - Used to represent GCP permissions over resources. - Folder - Used to represent GCP folders. - Project - Used to represent GCP projects. ## Default Correlation Configuration Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements. You can customize the correlation configuration. Refer to [Assigning Source Accounts to Identities]() for more information. When you first create the Google Workspace source, the default correlation mapping is: | Identity Attribute | Operation | Account Attribute | | --- | --- | --- | | Work Email | Equals | primaryEmail | You can modify the correlation configuration in accordance with your requirements. ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | objectID | `Account` | | objectID | `Group` | | objectID | `Role` | | name | `iamRole` | | objectID | `iamresourcePermission` | | objectID | `folder` | | objectID | `project` | ### Default Account Attributes The Google Workspace connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. > [!NOTE] > > To aggregate the Delegated Administrators, add the `delegatedadmins` attribute (supported with Service Account Authorization only) to the account schema manually. | Attribute Name | Description | | --- | --- | | objectID | Unique ID of the user. This is an Account ID which must not be changed. | | primaryEmail | User's primary email ID. The email ID domain must be a valid domain accessible to the service account provided in application configuration. | | name | User's full name. | | isAdmin | Indicates if a user is an administrator. | | isDelegatedAdmin | Indicates if a users is a delegated administrator. | | lastLoginTime | User's last login time. | | suspended | User's suspension status. | | suspensionReason | Reason for suspension. | | changePasswordAtNextLogin | Indicates if the user is required to change their password the next time they log in. | | ipWhiteListed | Indicate if user's IP address is whitelisted. | | ims | The user's Instant Messenger (IM) accounts. | | emails | A list of the user's email addresses. | | externalIds | A list of external IDs for the user, such as an employee or network ID. | | relations | A list of the user's relationships to other users. | | addresses | A list of the user's addresses. | | organizations | A list of organizations the user belongs to. | | phones | A list of the user's phone numbers. | | aliases | A list of the user's alias email addresses. | | nonEditableAliases | A list of the user's non-editable alias email addresses. | | customerId | The customer ID to retrieve all account users. | | orgUnitPath | The full path of the parent organization associated with the user. | | isMailboxSetup | Indicates if the user's Google mailbox is created. | | includeInGlobalAddressList | Indicates if the user's profile is visible in the Global Address List when the contact sharing feature is enabled for the domain. | | thumbnailPhotoUrl | URL used to set the user's thumbnail photo. | | contacts | A list of the user's contacts. | | givenName | User's first name. | | familyName | User's last name. | | delegatedAdmins | Delegated administrators of a user. | | Groups | Groups connected to the user. | | customSchemas | Aggregates custom schema attributes. | | Roles | Roles connected to the user. | | objectType | Object type of the account. | | domainName | The domain name of the customer. | | domainAliases | A list of domain alias. | | isPrimary | Indicates if the domain is a primary domain. | | verified | Indicates the verification state of a domain. | | projectId | The ID of the project that owns the service account. | | uniqueId | The unique and stable numeric ID for the service account. | | displayName | Name for the service account. | | description | Description for the service account. | | serviceAccountId | Account ID of service account. | | resourcePermissions | IAM resource permissions assigned to the user. | | archived | Indicates if a user is archived. Enable to archive the user.

**Important:** If you are updating from a version prior to SailPoint version SC 109.0, you must manually add this attribute to your schema attribute list. | ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The Google Workspace connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. > [!NOTE] > > To aggregate the `MANAGERS` and `OWNERS` attributes, add them to the group schema manually. | Attribute Name | Description | | --- | --- | | objectID | The group's unique ID. This is an Account ID which must not be changed. | | name | Name of the group. | | nonEditableAliases | List of the group's non-editable alias email addresses that are outside of the account's primary domain or sub domains. These are functioning email addresses used by the group. This is a read-only property. | | description | Description of the group. | | adminCreated | Whether it is created by administrator. | | aliases | Group aliases. | | email | Group email address. | | directMembersCount | Number of group members. | | whoCanJoin | Permissions to join the group. Available values: `ALL_IN_DOMAIN_CAN_JOIN` - Anyone in the account can join; `ANYONE_CAN_JOIN` - Anyone outside your domain can join; `CAN_REQUEST_TO_JOIN` - Non group members can request an invitation to join; `INVITED_CAN_JOIN` - Candidates for membership can be invited to join. | | whoCanViewMembership | Permissions to view membership. Available values: `ALL_IN_DOMAIN_CAN_VIEW` - Anyone in the account can view the group members list; `ALL_MANAGERS_CAN_VIEW` - The group managers can view group members list; `ALL_MEMBERS_CAN_VIEW` - Group members can view the group members list. | | whoCanViewGroup | Permissions to view group. Available values: `ALL_IN_DOMAIN_CAN_VIEW` - Anyone in your account can view this group's messages; `ALL_MANAGERS_CAN_VIEW` - Any group manager can view this group's messages; `ALL_MEMBERS_CAN_VIEW` - All group members can view the group's messages; `ANYONE_CAN_VIEW` - Any Google Workspace user can view the group's messages. | | whoCanInvite | Permissions to invite members. Available values: `ALL_MANAGERS_CAN_INVITE` - Only managers can invite a new member. This includes the group's owner; `ALL_MEMBERS_CAN_INVITE` - Managers and members can invite a new member candidate. | | allowExternalMembers | A Boolean indicating if Google Workspace users external to your account can view or become members of this group. | | MANAGERS | Managers of a group. | | OWNERS | Owners of a group. | | whoCanPostMessage | Permissions to post messages to the group. Available values: `ALL_IN_DOMAIN_CAN_POST` - Anyone in the account can post a message; `ALL_MANAGERS_CAN_POST` - Managers, including group owners, can post messages; `ALL_MEMBERS_CAN_POST` - Any group member can post a message; `ANYONE_CAN_POST` - Any Google Workspace user outside the account can access the Google Groups service and post a message; `NONE_CAN_POST` - The group is disabled and archived. No one can post a message to this group. | | allowWebPosting | A Boolean indicating if any member is allowed to post to the group web forum. | | primaryLanguage | Language tag for a group's primary language. | | maxMessageBytes | The maximum size of a message. | | isArchived | A Boolean indicating if the contents of the group to be archived. | | archiveOnly | A Boolean indicating if the group is to be only archived. | | messageModerationLevel | Moderation level for messages. Available values: `MODERATE_ALL_MESSAGES` - All messages are approved by the owner before they are sent to the group; `MODERATE_NEW_MEMBERS` - All messages from new members are approved by the owner before they are sent to the group; `MODERATE_NONE` - No moderator approval is required; `MODERATE_NON_MEMBERS` - All messages from non-group members are approved by the owner before they are sent to the group. | | spamModerationLevel | Moderation levels for detecting messages as spam. Available values: `ALLOW` - Post the message to the group; `MODERATE` - Send the message to the moderation queue; `SILENTLY_MODERATE` - Send the message to the moderation queue, but do not send notification to moderators; `REJECT` - Immediately reject the message. | | replyTo | The default reply to a message is sent here. Available values: `REPLY_TO_CUSTOM` - For replies to messages, use the group's custom email address; `REPLY_TO_IGNORE` - Group users individually decide where the message reply is sent; `REPLY_TO_LIST` - Reply message is sent to the group; `REPLY_TO_MANAGERS` - Reply message is sent to the group's managers; `REPLY_TO_OWNER` - Reply is sent to the owner(s) of the group; `REPLY_TO_SENDER` - Reply is sent to the author of message. | | customReplyTo | An email address used when replying to a message. | | sendMessageDenyNotification | A Boolean indicating if the members are notified if a message is denied by owner. | | defaultMessageDenyNotificationText | Text sent to the message's author as part of rejection notification. | | showInGroupDirectory | A Boolean indicating if group is listed in the Groups directory. | | allowGoogleCommunication | A Boolean allowing Google to contact group administrators. | | membersCanPostAsTheGroup | A Boolean indicating if members can post using the group email address. | | messageDisplayFont | Default message's display font. Available values: `DEFAULT_FONT` - Uses the account's default font; `FIXED_WIDTH_FONT` - Uses fixed width font. | | includeInGlobalAddressList | A Boolean indicating if the group is included in the [Global Address List](). | | resourcePermissions | IAM resource permissions assigned to the group. | ### Default Role Attributes The Google Workspace connector supports roles. The following attributes must be configured on the managed system and in the SailPoint source schema to manage roles. | Attribute Name | Description | | --- | --- | | objectID | The role's unique ID. This is an Account ID which must not be changed. | | roleName | Name of the role. | | roleDescription | Description of the role. | | rolePrivileges | Privileges of the role, a multivalued attribute. Available values: `GROUPS_ALL`; `APP_ADMIN`. | | isSystemRole | Indicates if the role is a system role. | | isSuperAdminRole | Indicates if the role is a Super Admin role. | ### IAM Role Attributes The following lists the IAM role attributes: | Attribute Name | Description | | --- | --- | | name | Name of the IAM role. This is an Account ID which must not be changed. | | description | A description for the IAM role. | | title | A title for the role. | | includedPermissions | The names of the permissions this IAM role grants when bound in an IAM policy. | | stage | The current launch stage of the IAM role. | | deleted | The current deleted state of the IAM role. | ### IAM Resource Permission Attributes The following lists the IAM resource permission attributes: | Attribute Name | Description | | --- | --- | | objectID | ID of the resource permission. This is an Account ID which must not be changed. | | displayName | Display name of the resource permission. This is a combination of the role display name and the resource display name. | | description | Description of the role associated with the resource permission. | | includedPermissions | Permissions over the resource included in the role. | | stage | Stage of the role associated with the resource permission. | | resourceName | Resource name associated with the resource permission. | | roleName | Role name associated with the resource permission. | | resourceType | Type of resource associated with the resource permission. | ### Default Folder Attributes The following lists the folder attributes: | Attribute Name | Description | | --- | --- | | objectID | ID of the folder in the format `folders/{numeric folder ID}`. This is an Account ID which must not be changed. | | name | The full resource name of the folder. | | assetType | Asset type of the GCP resource. | | displayName | Display name of the folder. | | location | Location of the folder. | | state | State of the folder. | ### Project Attributes The following lists the project attributes: | Attribute Name | Description | | --- | --- | | objectID | ID of the project in the format `projects/{alpha numeric project ID}`. This is an Account ID which must not be changed. | | name | The full resource name of the project. | | assetType | Asset type of the GCP resource. | | displayName | Display name of the project. | | labels | Labels used by the project. This attribute is multi-valued and must be manually added to the project schema in existing sources. | | location | Location of the project. | | state | State of the project. | | tags | Tags used by the project. This attribute is multi-valued and must be manually added to the project schema in existing sources. | ## Custom Schema Attributes The Google Workspace connector supports aggregation of custom schema attributes by adding the schema attributes in the following format: ```text customSchemas.SCHEMANAME.FIELDNAME ``` For example, if the custom schemas are as follows: ```text customSchemas = {SSO {"ADID":"101", "SAPID":"102"}, Address {"Postal_Code":"411018"}} ``` To display the attributes of the above custom schemas, you must add the following attributes in account schema: ```text customSchemas.SSO.ADID customSchemas.SSO.SAPID customSchemas.Address.Postal_Code ``` > [!NOTE] > > A schema cannot contain another schema within a managed system as follows: > > ```text > customSchemas= {SSO{Address{"Postal_Code":"411018"}}} > ``` > > The connector does not support managing multi-level custom attributes defined in Google Workspace. Multi-level custom attributes are used if you have a schema defined inside a custom schema. The name of the custom schema attribute must be the same as defined in the account schema. To add a custom schema attribute to the provisioning policy, it must also be present in the account schema. To support custom attribute provisioning, add the custom attribute names to the provisioning policy as described below: ```text customSchemas.. ``` For more information on adding an attribute to schema, refer to [Adding Attributes to a Source Schema](). For the Custom Schema attributes the Google Workspace source supports single valued and multi-valued attribute only. Provisioning of multilevel custom schema attributes is not supported. ## Using Multiple Group Entitlements with a Preexisting Connector To start using Multiple Group Entitlements with preexisting Google Workspace connectors, complete the following steps: 1. Use the `createSchema` API to create new group schema for your source. For more information refer to [Create Schema on a Source](). The following is an example of API body content used to add Project Roles to an existing source. ```text Example ------------------------ iamResourcePermission START ------------------------ { "nativeObjectType": "iamResourcePermission", "identityAttribute": "objectID", "displayAttribute": "displayName", "hierarchyAttribute": null, "includePermissions": false, "features": \[\], "configuration": {}, "attributes": \[ { "name": "objectID", "type": "STRING", "schema": null, "description": "Id of resource permission.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "displayName", "type": "STRING", "schema": null, "description": "Display name of resource permission is combination of role dispaly name and resource display name.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "description", "type": "STRING", "schema": null, "description": "Description of role associated with reource permission.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "includedPermissions", "type": "STRING", "schema": null, "description": "Permission over the resource include in role.", "isMulti": true, "isEntitlement": false, "isGroup": false }, { "name": "stage", "type": "STRING", "schema": null, "description": "Stage of the role associated with resource permission.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "resourceName", "type": "STRING", "schema": null, "description": "Resource name associated with the resource permission.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "roleName", "type": "STRING", "schema": null, "description": "Role name associated with the resource permission.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "resourceType", "type": "STRING", "schema": null, "description": "Type of the resource associated with the resource permission.", "isMulti": false, "isEntitlement": false, "isGroup": false } \], "name": "iamResourcePermission" } ------------------------ iamResourcePermission END ------------------------ ------------------------ iamRole START ------------------------ { "nativeObjectType": "iamRole", "identityAttribute": "name", "displayAttribute": "title", "hierarchyAttribute": null, "includePermissions": false, "features": \[\], "configuration": {}, "attributes": \[ { "name": "name", "type": "STRING", "schema": null, "description": "Name of the IAM role.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "description", "type": "STRING", "schema": null, "description": "A human-readable description for the IAM role.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "title", "type": "STRING", "schema": null, "description": "A human-readable title for the role.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "includedPermissions", "type": "STRING", "schema": null, "description": "The names of the permissions this IAM role grants when bound in an IAM policy.", "isMulti": true, "isEntitlement": false, "isGroup": false }, { "name": "stage", "type": "STRING", "schema": null, "description": "The current launch stage of the IAM role.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "deleted", "type": "BOOLEAN", "schema": null, "description": "The current deleted state of the IAM role.", "isMulti": false, "isEntitlement": false, "isGroup": false } \], "name": "iamRole" } ------------------------ iamRole END ------------------------ ------------------------ folder START ------------------------ { "nativeObjectType": "folder", "identityAttribute": "objectID", "displayAttribute": "displayName", "hierarchyAttribute": null, "includePermissions": false, "features": \[\], "configuration": {}, "attributes": \[ { "name": "objectID", "type": "STRING", "schema": null, "description": "Id of the folder in the format folders/{numeric folder id}.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "name", "type": "STRING", "schema": null, "description": "The full resource name of folder.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "assetType", "type": "STRING", "schema": null, "description": "Asset Type of the GCP resource.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "displayName", "type": "STRING", "schema": null, "description": "Display name of the folder.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "location", "type": "STRING", "schema": null, "description": "Location of the folder.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "state", "type": "STRING", "schema": null, "description": "State of the folder.", "isMulti": false, "isEntitlement": false, "isGroup": false } \], "name": "folder" } ------------------------ folder END ------------------------ ------------------------ Project START ------------------------ { "nativeObjectType": "project", "identityAttribute": "objectID", "displayAttribute": "displayName", "hierarchyAttribute": null, "includePermissions": false, "features": \[\], "configuration": {}, "attributes": \[ { "name": "objectID", "type": "STRING", "schema": null, "description": "Id of the project in the format projects/{alpha numeric project id}.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "name", "type": "STRING", "schema": null, "description": "The full resource name of project.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "assetType", "type": "STRING", "schema": null, "description": "Asset Type of the GCP resource.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "displayName", "type": "STRING", "schema": null, "description": "Display name of the project.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "location", "type": "STRING", "schema": null, "description": "Location of the project.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "state", "type": "STRING", "schema": null, "description": "State of the project.", "isMulti": false, "isEntitlement": false, "isGroup": false } \], "name": "project" } ------------------------ Project End ------------------------ ------------------------ Role Start ------------------------ { "nativeObjectType": "Role", "identityAttribute": "objectID", "displayAttribute": "roleName", "hierarchyAttribute": null, "includePermissions": false, "features": \[\], "configuration": {}, "attributes": \[ { "name": "objectID", "type": "STRING", "schema": null, "description": "Role Id of role.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "roleName", "type": "STRING", "schema": null, "description": "Name of the role.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "roleDescription", "type": "STRING", "schema": null, "description": "Description of role.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "rolePrivileges", "type": "STRING", "schema": null, "description": "Privileges of the role.", "isMulti": true, "isEntitlement": false, "isGroup": false }, { "name": "isSystemRole", "type": "STRING", "schema": null, "description": "Is System Role.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "isSuperAdminRole", "type": "STRING", "schema": null, "description": "Is Super Admin Role.", "isMulti": false, "isEntitlement": false, "isGroup": false } \], "name": "Role" } ------------------------ Role END ------------------------ ``` 2. Update the account schema using the following steps: 1. Get account schema using the `getSchema` API. For more information, refer to [Get Source Schema by ID.]() 2. Copy the schema to a file and search for the attribute corresponding to the group schema added in step 1. 3. Add/ Update the following two properties for the attribute you find: ```text "isGroup": true, ``` ```text "schema": {"type": "CONNECTOR_SCHEMA","id": "\","name": "\"} ``` 4. Add the modified schema to the payload to update account schema in source using the `replaceSchema` API. For more information, refer to [Update Source Schema (Full)]().