# Additional Configuration Attributes

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

Use the following attributes to configure additional features available in the connector.

> [!NOTE]
>
> **unlockWithSamePassword**
>
> Configure this attribute with a value of `true` if the unlock operation requires changing the user password with the existing password used to unlock the user account.

> [!NOTE]
>
> **groupEntitlementAttr**
>
> The entitlement attribute name in the account schema should always be `groups`. If you need to change it to some other name, make sure that the `groupEntitlementAttr` value from the source is updated to reflect the modified account entitlement attribute name.
>
> For example, if the account entitlement attribute name is **posixgroups**, then add the following entry in the source XML using the REST APIs:
>
> ```json
> [
>   {
>     "op": "add",
>     "path": "/connectorAttributes/groupEntitlementAttr",
>     "value": posixgroups
>   }
> ]
> ```
>
> > **Note**
> >
> > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

> [!NOTE]
>
> **disableDefaultGroupClassFilter**
>
> Set the `disableDefaultGroupClassFilter` attribute to true to remove the default objectClass requirement (such as `objectClass=groupOfNames`) from LDAP search queries during group membership aggregation. This allows the connector to search for membership without filtering by a specific group class.
>
> For example,
>
> A default query looks like below:
>
> `(&(objectclass=groupOfNames)(member=cn=anabab,ou=Users,ou=Active,o=Corp))`
>
> Query with disableDefaultGroupClassFilter enabled:
>
> `(member=cn=anabab,ou=Users,ou=Active,o=Corp)`
>
> To apply this change, add the following to your source configuration using the SailPoint REST API:
>
> ```json
> {
>   "op": "add",
>   "path": "/connectorAttributes/disableDefaultGroupClassFilter",
>   "value": "true"
> }
> ```

> [!NOTE]
>
> **groupMembershipSearchScope**
>
> To support multiple entitlement types using a single account search DN, you can define different `groupMembershipSearchScope` values based on the group objectType.
>
> > **Note**
> >
> > This configuration must be performed using SailPoint REST APIs. It cannot be configured using the LDAP Source user-interface.
>
> Use the following PATCH request to update the `connectorAttributes` for your source:
>
> **Endpoint**: PATCH /v3/sources/:id
>
> **Body**:
>
> ```json
> [
>     {
>         "op": "replace",
>         "path": "/connectorAttributes/searchDNs",
>         "value": [
>             {
>                 "searchDN": "ou=OP2,dc=maxcrc,dc=com",
>                 "searchScope": "SUBTREE",
>                 "groupMembershipSearchScope": [
>                     {
>                         "groupMembershipSearchDN": [
>                             "ou=OP1,dc=maxcrc,dc=com"
>                         ],
>                         "groupMemberFilterString": null,
>                         "objectType": "posixgroup"
>                     },
>                     {
>                         "groupMembershipSearchDN": [
>                             "ou=OP1,dc=maxcrc,dc=com"
>                         ],
>                         "groupMemberFilterString": null,
>                         "objectType": "sudoRole"
>                     },
>                     {
>                         "groupMembershipSearchDN": [
>                             "ou=OP1,dc=maxcrc,dc=com"
>                         ],
>                         "groupMemberFilterString": null,
>                         "objectType": "group"
>                     }
>                 ],
>                 "iterateSearchFilter": null
>             }
>         ]
>     }
> ]
> ```

## Configuration for Binary Type Attributes

If the attributes value in the LDAP server is stored in binary format, ensure to add the following attributes to the source configuration:

> [!NOTE]
>
> **attributesInBinaryFormat**
>
> This specifies which LDAP attributes should be fetched in binary format.
>
> > **Important**
> >
> > This is an optional attribute. If the unique account attribute (like a UUID) is binary, you must include it in this list to ensure move and rename operations work correctly.
>
> To handle attributes for non-AD LDAP/ADAM/EDirectory servers (such as OpenLDAP or Tivoli), add the multi-valued `attributesInBinaryFormat` attribute to the source configuration.
>
> 1. Update the PATCH request payload by adding the following attributes:
>
>    ```json
>    [
>        {
>            "op": "add",
>            "path": "/connectorAttributes/attributesInBinaryFormat",
>            "value": [<binaryAttribute_1>, <binaryAttribute_2>, <uuid_Attribute>]
>        }
>    ]
>    ```
> 2. Perform the PATCH request to the source endpoint.
>
>    `PATCH /v3/sources/:id`

> [!NOTE]
>
> **uuidInLittleEndianFormat**
>
> This boolean attribute determines how binary attributes are converted to strings for processing. The format can be either little-endian (such as in Microsoft AD, ADAM) or big-endian (such as in Novell eDirectory).
>
> Add the `uuidInLittleEndianFormat` attribute to specify the correct conversion method.
>
> - `false` : Attributes are converted to strings in big-endian format. This is a default value.
> - `true`: Attributes are converted to strings in little-endian format.
> - Update the PATCH request payload by adding the following attributes:
>
>   ```json
>   [
>       {
>           "op": "add",
>           "path": "/connectorAttributes/uuidInLittleEndianFormat",
>           "value": true
>       }
>   ]
>   ```
> - Perform the PATCH request to the source endpoint.
>
>   `PATCH /v3/sources/:id`