Additional Configuration Attributes

Configure this attribute with a value of true if the unlock operation requires changing the user password with the existing password used to unlock the user account.

The entitlement attribute name in the account schema should always be groups. If you need to change it to some other name, make sure that the groupEntitlementAttr value from the source is updated to reflect the modified account entitlement attribute name.

For example, if the account entitlement attribute name is posixgroups, then add the following entry in the source XML using the REST APIs:

[
  {
    "op": "add",
    "path": "/connectorAttributes/groupEntitlementAttr",
    "value": posixgroups
  }
]

Set the disableDefaultGroupClassFilter attribute to true to remove the default objectClass requirement (such as objectClass=groupOfNames) from LDAP search queries during group membership aggregation. This allows the connector to search for membership without filtering by a specific group class.

For example,

A default query looks like below:

(&(objectclass=groupOfNames)(member=cn=anabab,ou=Users,ou=Active,o=Corp))

Query with disableDefaultGroupClassFilter enabled:

(member=cn=anabab,ou=Users,ou=Active,o=Corp)

To apply this change, add the following to your source configuration using the SailPoint REST API:

{
  "op": "add",
  "path": "/connectorAttributes/disableDefaultGroupClassFilter",
  "value": "true"
}

To support multiple entitlement types using a single account search DN, you can define different groupMembershipSearchScope values based on the group objectType.

Use the following PATCH request to update the connectorAttributes for your source:

Endpoint: PATCH /v3/sources/:id

Body:

[
    {
        "op": "replace",
        "path": "/connectorAttributes/searchDNs",
        "value": [
            {
                "searchDN": "ou=OP2,dc=maxcrc,dc=com",
                "searchScope": "SUBTREE",
                "groupMembershipSearchScope": [
                    {
                        "groupMembershipSearchDN": [
                            "ou=OP1,dc=maxcrc,dc=com"
                        ],
                        "groupMemberFilterString": null,
                        "objectType": "posixgroup"
                    },
                    {
                        "groupMembershipSearchDN": [
                            "ou=OP1,dc=maxcrc,dc=com"
                        ],
                        "groupMemberFilterString": null,
                        "objectType": "sudoRole"
                    },
                    {
                        "groupMembershipSearchDN": [
                            "ou=OP1,dc=maxcrc,dc=com"
                        ],
                        "groupMemberFilterString": null,
                        "objectType": "group"
                    }
                ],
                "iterateSearchFilter": null
            }
        ]
    }
]

This specifies which LDAP attributes should be fetched in binary format.

To handle attributes for non-AD LDAP/ADAM/EDirectory servers (such as OpenLDAP or Tivoli), add the multi-valued attributesInBinaryFormat attribute to the source configuration.

1. Update the PATCH request payload by adding the following attributes:

   [
       {
           "op": "add",
           "path": "/connectorAttributes/attributesInBinaryFormat",
           "value": [<binaryAttribute_1>, <binaryAttribute_2>, <uuid_Attribute>]
       }
   ]
   

2. Perform the PATCH request to the source endpoint.

   PATCH /v3/sources/:id

This boolean attribute determines how binary attributes are converted to strings for processing. The format can be either little-endian (such as in Microsoft AD, ADAM) or big-endian (such as in Novell eDirectory).

Add the uuidInLittleEndianFormat attribute to specify the correct conversion method.

• false : Attributes are converted to strings in big-endian format. This is a default value.

• true: Attributes are converted to strings in little-endian format.

• Update the PATCH request payload by adding the following attributes:

  [
      {
          "op": "add",
          "path": "/connectorAttributes/uuidInLittleEndianFormat",
          "value": true
      }
  ]
  

• Perform the PATCH request to the source endpoint.

  PATCH /v3/sources/:id