Provisioning
The IBM AIX connector supports provisioning, allowing you to create and manage accounts and entitlements in AIX directly from SailPoint.
Prerequisite: Your system is configured for provisioning.
When SailPoint provisions new accounts to the source, it uses the attributes on the Create Account page as instructions or a template for what to include in the account. This page is also referred to as the provisioning policy.
When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.
For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.
Important
This section describes the default Create Account configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.
Default Create Account Attributes
| Account Attributes | Generator | Description |
|---|---|---|
| username | Create Unique Account ID | This generator uses the value in the Pattern Used field to generate a unique user name for the new account. |
| password | Create Password | This generator creates an initial password for the new account that matches the password policy assigned to the associated AIX source in SailPoint. |
| id | Disable | The identity of the user |
| pgrp | Disable | The primary group of the user |
| home | Disable | The home directory of the user |
| shell | Disable | The default shell of the user |
| gecos | Disable | The General Electric Comprehensive Operating System (GECOS) information for the user. The user's name, phone numbers, and other generic personal information are stored here. |
| login | Disable | Indicates whether the user can log in to the system with the login command. Possible values are: - true (default) - The user can log in to the system. - false - The user cannot log in to the system. |
| rlogin | Disable | Permits access to the account from a remote location with the telnet or rlogin commands. Possible values are:- true (default) - The user account can be accessed remotely. - false - The user account cannot be accessed remotely. |
| su | Disable | Indicates whether another user can switch to the specified user account with the su command. Possible values are:- true (default) - Another user can switch to the specified account. - false - Another user cannot switch to the specified account. |
| admin | Disable | Defines the administrative status of the user. Possible values are: - true - The user is an administrator. Only the root user can change the attributes of users defined as administrators. - false (default) - The user is not an administrator. |
| sugroups | Disable | Lists the groups that can use the su command to switch to the specified user account. The Value parameter is a comma-separated list of group names, or a value of ALL to indicate all groups. An ! (exclamation point) in front of a group name excludes that group. If this attribute is not specified, all groups can switch to this user account with the su command. |
| admgroups | Disable | Lists the groups the user administrates. The Value parameter is a comma-separated list of group names. |
| umask | Disable | Determines file permissions. This value, along with the permissions of the creating process, determines a file's permissions when the file is created. The default is 022. |
| default_roles | Disable | Specifies the default roles for the user. The Value parameter, a comma-separated list of valid role names, can only contain roles assigned to the user in the roles attribute. You can use the ALL keyword to signify that the default roles for the user are all their assigned roles. |
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.