Schema Reference
The application schema is used to configure the objects returned from a connector.
Note
-
The Account Schema tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as Entitlement or Multi-Valued. Refer to Managing Source Account Schemas for more information.
-
The schema attributes that are not present by default must be defined as strings if not specified.
The IBM Tivoli Directory Server connector uses the following default correlation and object configurations.
Default Account Schema
Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.
The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.
Default Account ID
SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as account IDs.
Caution
Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
To resolve issues caused by changing account IDs, reconfigure them to their default values.
The following table lists the default account IDs for this connector:
| Account ID | Schema Object Type |
|---|---|
| dn | Account |
| dn | Group |
| dn | nisNetgroup |
| dn | posixgroup |
Default Account Attributes
The IBM Tivoli Directory Server connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.
Account objects are used when building an identity's link objects.
Note
The schema attributes not present in the default schema must be defined as string if not specified.
| Attribute Name | Description |
|---|---|
| businessCategory | Types of business performed by an organization. Each type is one value of this multi-valued attribute. For example: engineering, finance, sales |
| carLicense | License plate or vehicle registration number associated with the user |
| cn | Common name(s) for which the entity is known Each name is one value of this multi-valued attribute. If the object corresponds to a person, it is typically the person's full name. For example: Martin K Smith, Marty Smith, printer12 |
| dn | Distinguished name by which the entity is known. This is an Account ID which must not be changed. |
| departmentNumber | Numerical designation for a department within the organization |
| description | Human-readable descriptive phrases about the object Each description is one value of this multi-valued attribute. For example: Updates are done every Saturday at 1am., distribution list for sales |
| destinationIndicator | Country and city strings associated with the object (the addressee) required to provide the Public Telegram Service. The strings are composed in accordance with CCITT recommendations F.1 [F.1] and F.31 [F.31]. Each string is one value of this multi-valued attribute.For example: AASD as a destination indicator for Sydney, Australia; GBLD as a destination indicator for London, United KingdomNote: The directory will not ensure that values of this attribute conform to the F.1 and F.31 CCITT recommendations. It is the application's responsibility to ensure destination indicators that it stores in this attribute are appropriately constructed. |
| displayName | Preferred name used when displaying entries |
| employeeNumber | Numerical identification key for an employee within an organization |
| employeeType | Descriptive type of employment for a user For example: contractor, full time, part time |
| facsimileTelephoneNumber | Telephone numbers and any required parameters for facsimile terminals Each telephone number is one value of this multi-valued attribute. |
| givenName | Name strings that are the part of a person's name that is not their surname Each string is one value of this multi-valued attribute. For example: John, Sue, David |
| groups | List of groups a user is a member of For example: Sales, Engineering |
| homePhone | Employee's home telephone number |
| homePostalAddress | Employee's mailing address |
| initials | Strings of initials of some or all of an individual's names, except the surname(s) Each string is one value of this multi-valued attribute. For example: J. A., J |
| internationalISDNNumber | Integrated Services Digital Network (ISDN) addresses, as defined in the International Telecommunication Union (ITU) recommendation E.164 [E.164]Each address is one value of this multi-valued attribute. |
| l | Names of a locality or place, such as a city, county, or other geographic region Each name is one value of this multi-valued attribute. For example: Austin, Chicago, Brisbane |
| RFC822 mailbox for the user | |
| manager | Distinguished name of the manager to whom this person reports |
| mobile | Mobile telephone number of this person |
| o | Names of an organization Each name is one value of this multi-valued attribute For example: xyz, xyz Technologies, Inc., xyz, Incorporated. |
| ou | Names of an organizational unit Each name is one value of this multi-valued attribute. For example: Sales, Human Resources, Information Technologies |
| pager | The employee's pager number |
| physicalDeliveryOfficeName | Names that a Postal Service uses to identify a specific post office For example: Austin, Downtown Austin, Chicago, Finance Station E |
| postOfficeBox | Postal box identifiers used by a postal service to locate a box on the premises of the Postal Service instead of a physical street address Each postal box identifier is a single value of this multi-valued attribute. For example: Box 27 |
| postalAddress | Addresses used by a Postal Service to perform services for the object Each address is one value of this multi-valued attribute. For example: 1111 Elm St.$Austin$Texas$USA |
| postalCode | Codes used by a Postal Service to identify postal service zones Each code is one value of this multi-valued attribute. For example: 78664 to identify Pflugerville, TX, USA |
| preferredDeliveryMethod | Indication of the preferred method of getting a message to the object For example, if the mhs-delivery Delivery Method is preferred over telephone-delivery, which is preferred over all other methods, the value would be: mhs $ telephone. |
| preferredLanguage | Preferred written or spoken language |
| pwdReset* | Indicates whether the password has been reset by the administrator Must be added manually to support password reset |
| registeredAddress | Postal addresses to be used for deliveries that must be signed for or require a physical recipient Each address is one value of this multi-valued attribute. For example: Receptionist$xyz Technologies$6034 Courtyard Dr. $Austin, TX$USA |
| roomNumber | Room or office number of the account's normal work location |
| secretary | Distinguished name of this person's secretary |
| seeAlso | Distinguished names of objects that are related to the subject object Each related object name is one value of this multi-valued attribute. For example, the person object cn=Elvis Presley,ou=employee,o=xyz\, Inc. is related to the role objects cn=Bowling Team Captain,ou=sponsored activities,o=xyz\, Inc. and cn=Dart Team,ou=sponsored activities,o=xyz\, Inc.. Since the role objects are related to the person object, the seeAlso attribute will contain the distinguished name of each role object as separate values. |
| sn | Name strings for surnames, or family names Each string is one value of this multi-valued attribute. For example: Smith |
| st | Full names of states or provinces Each name is one value of this multi-valued attribute. For example: Texas |
| street | Site information from a postal address (i.e., the street name, place, avenue, and the house number). Each street is one value of this multi-valued attribute. For example: 15 Main St. |
| telephoneNumber | Telephone numbers that comply with the ITU Recommendation E.123 [E.123]Each number is one value of this multi-valued attribute. |
| teletexTerminalIdentifier | The withdrawal of recommendation F.200 has resulted in the withdrawal of this attribute |
| telexNumber | Sets of strings that are a telex number, country code, and answerback code of a telex terminal Each set is one value of this multi-valued attribute. |
| title | Employee's job title Each title is one value of this multi-valued attribute. For example: Vice President, Software Engineer, CEO |
| uid | Computer system login names associated with the object Each name is one value of this multi-valued attribute. For example: s9709015, admin, Administrator |
| objectClass | The values of the objectClass attribute describe the kind of object which an entry represents. The objectClass attribute is present in every entry, with at least two values. One of the values is either top or alias. |
Default Entitlement Attributes
Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.
Caution
Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.
Default Group Attributes
The IBM Tivoli Directory Server connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.
The group schema is used when building Account-Group objects which are used to hold entitlements shared across identities.
| Attribute Name | Description |
|---|---|
| cn | Common name(s) for which the entity is known Each name is one value of this multi-valued attribute. If the object corresponds to a person, it is typically the person's full name. For example: Martin K Smith, Marty Smith, printer12 |
| uniqueMember | Identifies the group's unique member |
| dn | Directory path to the object. This is an Account ID which must not be changed. |
| o | Names of the organization Each name is one value of this multi-valued attribute. For example: xyz, xyz Technologies, Inc., xyz, Incorporated |
| ou | Names of the organizational unit Each name is one value of this multi-valued attribute. For example: Sales, Human Resources, Information Technologies |
| owner | Distinguished names of objects that have ownership responsibility for the owned objects Each owner's name is one value of this multi-valued attribute. For example, the mailing list object, whose DN is cn=All Employees, ou=Mailing List,o=xyz, Inc., is owned by the Human Resources Director.Therefore, the value of the owner attribute within the mailing list object is the DN of the director (role): cn=Human Resources Director,ou=employee,o=xyz, Inc.. |
| description | Human-readable descriptive phrases about the object Each description is one value of this multi-valued attribute. For example: Updates are done every Saturday, at 1am., distribution list for sales |
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.