Schema Reference

The application schema is used to configure the objects returned from a connector.

Note

The Account Schema tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as Entitlement or Multi-Valued. Refer to Managing Source Account Schemas for more information.
The schema attributes that are not present by default must be defined as strings if not specified.

The LDAP connector uses the following default correlation and object configurations.

This connector supports two types of objects: account and group. The default schema is provided for both accounts and groups, and can be modified per the connection requirements of your LDAP server. The application only supports a single group object. The schema for a group object can be modified to support other native group types such as posixgroup and nisNetgroup, depending on your LDAP server.

Note

The name of the objectType must be the same as the name of the objectType of the respective group schema for which the scope is defined.

Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.

Default Account Attributes

The LDAP connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

Attribute Name	Description	Type
businessCategory	The business category.
carLicense	The vehicle license or registration plate.
cn	The common name(s) for which the entity is known by.
dn	The distinguished name for which the entity is known by.
departmentNumber	The identifies a department within an organization.
description	The descriptive information.
destinationIndicator	The destination indicator.
displayName	The preferred name to be used when displaying entries.
employeeNumber	The numerically identifies an employee within an organization.
employeeType	The type of employment for a person.
facsimileTelephoneNumber	The Facsimile (Fax) Telephone Number.	Multi-Valued
givenName	The first name(s) for which the entity is known by.
groups	List of groups a user is a member. Schema Object Type: group	Entitlement, Multi-Valued
homePhone	The home telephone number.
homePostalAddress	The home postal address.
initials	The initials of some or all of names, but not the surname(s).
internationaliSDNNumber	The international ISDN number.
l	The city.
mail	The RFC822 Mailbox.
manager	The DN of manager.
mobile	The mobile telephone number.
o	The organization this object belongs to.
ou	The organizational unit this object belongs to.
pager	The pager telephone number.
physicalDeliveryOfficeName	The name of physical delivery office.
postOfficeBox	The post office box.
postalAddress	The postal address.
postalCode	The postal code.
preferredDeliveryMethod	The preferred delivery method.
preferredLanguage	The preferred written or spoken language for a person.
pwdReset	The specifies whether the password has been reset by admin.
registeredAddress	The registered postal address.
roomNumber	The room number.
secretary	The DN of secretary.
seeAlso	The DN of related object.
sn	The last (family) name(s) for which the entity is known by.
st	The state or province which this object resides in.
street	The street address of this object.
telephoneNumber	The telephone number.
teletexTerminalIdentifier	The teletex terminal identifier.
telexNumber	The telex number.
title	The title associated with the entity.
uid	The user identifier.
objectClass	The object classes of the entity.	Multi-Valued
posixgroups	List of posix groups a user is a member. Schema Object Type: posixgroup	Entitlement, Multi-Valued
nisNetgroups	List of nisnet groups a user is a member. Schema Object Type: nisNetgroup	Entitlement, Multi-Valued

Important

Group membership filters are not applied if the LDAP source schema entitlement attribute name is identical to the attribute name on the target system. To ensure filtering works correctly, use a unique attribute name in the schema. For example, if the target system uses sudoRoleMemberOf, define the schema attribute as sudoRoleMemberOfGroup to ensure filtering works correctly during account aggregation.

Adding Schema to the Source

Note

If you want to add sudoRoles and groupOfNames schema to the source, you need to add the respective account attributes in the Account Schema.

The following example shows how to add the sudoRoles and groupOfNames schema to the source XML:

{
  "AttributeDefinition": [
    {
      "entitlement": "true",
      "managed": "true",
      "multi": "true",
      "name": "sudoRoles",
      "schemaObjectType": "sudoRole",
      "type": "string",
      "Description": "List of sudo roles a user is a member"
    },
    {
      "entitlement": "true",
      "managed": "true",
      "multi": "true",
      "name": "groupOfNames",
      "schemaObjectType": "groupOfNames",
      "type": "string",
      "Description": "List of groupOfNames a user is a member"
    }
  ]
}

For more information on the attribute lists of sudoRole and groupOfNames, refer to Sudo Role Attributes and groupOfNames Attributes.

Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.

Caution

Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

Default Group Attributes

The following lists the group of unique names attributes:

Attribute Name	Description
cn	The common name(s) for which the entity is known by.
dn	The directory path.
description	The descriptive information.
o	The organization this object belongs to.
ou	The organizational unit this object belongs to.
owner	The owner (of the object).

The LDAP connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

Schema Example

The following example shows how to add the group schema to the source XML:

{
  "Schema": {
    "displayAttribute": "cn",
    "featuresString": "PROVISIONING",
    "identityAttribute": "dn",
    "nativeObjectType": "groupOfUniqueNames",
    "objectType": "group",
    "AttributeDefinition": [
      {
        "name": "cn",
        "type": "string",
        "Description": "common name(s) for which the entity is known by"
      },
      {
        "name": "dn",
        "type": "string",
        "Description": "Directory Path"
      },
      {
        "name": "o",
        "type": "string",
        "Description": "organization this object belongs to"
      },
      {
        "name": "ou",
        "type": "string",
        "Description": "organizational unit this object belongs to"
      },
      {
        "name": "owner",
        "type": "string",
        "Description": "owner (of the object)"
      },
      {
        "name": "description",
        "type": "string",
        "Description": "descriptive information"
      }
    ],
    "Attributes": {
      "Map": {
        "entry": [
          {
            "key": "groupMemberAttribute",
            "value": "uniqueMember"
          },
          {
            "key": "memberAttribute",
            "value": "dn"
          }
        ]
      }
    }
  }
}

NisNet Group Attributes

The following lists the nisNetgroup attributes:

Attribute Name	Description
cn	The common name(s) for which the entity is known by.
dn	The directory path.
description	The descriptive information.
nisNetgroupTriple	The unique member of a nisNetgroup.

Schema Example

The following example shows how to add the nisNetgroup schema to the source XML:

  {
        "nativeObjectType": "nisNetgroup",
        "identityAttribute": "dn",
        "displayAttribute": "cn",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [
            "PROVISIONING"
        ],
        "configuration": {
            "memberPrefix": "{,",
            "memberAttribute": [
                "cn",
                "uid"
            ],
            "memberSuffix": ",}",
            "groupMemberAttribute": "nisNetgroupTriple"
        },
        "attributes": [
            {
                "name": "cn",
                "type": "STRING",
                "schema": null,
                "description": "common name(s) for which the entity is known by",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "nisNetgroupTriple",
                "type": "STRING",
                "schema": null,
                "description": "unique member of a nisNetgroup",
                "isMulti": true,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "dn",
                "type": "STRING",
                "schema": null,
                "description": "Directory Path",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "description",
                "type": "STRING",
                "schema": null,
                "description": "descriptive information",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            }
        ],
        "id": "ada0ca21da9d450aa80addd68bd2102d",
        "name": "nisNetgroup",
        "created": "2024-10-08T12:05:50.004Z",
        "modified": "2024-10-08T12:05:50.004Z"
    },

Posix Group Attributes

The following lists the posixgroup attributes:

Attribute Name	Description	Type
cn	The common name(s) for which the entity is known by.
dn	The directory path.
description	The descriptive information.
gidNumber	The group ID.
memberUid	The unique member of a posixGroup.	Multi-Valued

Schema Example

The following example shows how to add the posixgroup schema to the source XML:

{
  "nativeObjectType": "posixgroup",
  "identityAttribute": "dn",
  "displayAttribute": "cn",
  "hierarchyAttribute": null,
  "includePermissions": false,
  "features": [
    "PROVISIONING"
  ],
  "configuration": {
    "memberAttribute": [
      "cn",
      "uid"
    ],
    "groupMemberAttribute": "memberUid"
  },
  "attributes": [
    {
      "name": "cn",
      "type": "STRING",
      "description": "common name(s) for which the entity is known by",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "memberUid",
      "type": "STRING",
      "description": "unique member of a posixGroup",
      "isMulti": true,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "dn",
      "type": "STRING",
      "description": "Directory Path",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "gidNumber",
      "type": "STRING",
      "description": "Group ID",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "description",
      "type": "STRING",
      "description": "descriptive information",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    }
  ]
}

Sudo Role Attributes

The following lists the sudoRole attributes:

Attribute Name	Description	Type
cn	The common name(s) for which the entity is known by.
dn	The directory name.
description	The descriptive information.
sudoUser	The unique member of a sudoRole.	Multi-Valued

Schema Example

The following example shows how to add the sudoRole schema to the source XML:

{
  "nativeObjectType": "sudoRole",
  "identityAttribute": "dn",
  "displayAttribute": "cn",
  "hierarchyAttribute": null,
  "includePermissions": false,
  "features": [
    "PROVISIONING"
  ],
  "configuration": {
    "memberAttribute": [
      "cn"
    ],
    "groupMemberAttribute": "sudoUser"
  },
  "attributes": [
    {
      "name": "dn",
      "type": "STRING",
      "description": "Directory Path",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "cn",
      "type": "STRING",
      "description": "common name(s) for which the entity is known by",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "sudoUser",
      "type": "STRING",
      "description": "unique member of a posixGroup",
      "isMulti": true,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "description",
      "type": "STRING",
      "description": "descriptive information",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    }
  ]
}

groupOfNames Attributes

The following lists the groupOfNames attributes:

Attribute Name	Description
cn	The common name(s) for which the entity is known by.
dn	The directory path.
description	The descriptive information.
o	The organization this object belongs to.
ou	The organizational unit this object belongs to.
owner	The owner (of the object).

Schema Example

The following example shows how to add the groupOfNames schema to the source XML:

{
  "nativeObjectType": "groupOfNames",
  "identityAttribute": "dn",
  "displayAttribute": "cn",
  "hierarchyAttribute": null,
  "includePermissions": false,
  "features": [
    "PROVISIONING",
    "GROUPS_HAVE_MEMBERS"
  ],
  "configuration": {
    "memberAttribute": [
      "dn"
    ],
    "groupMemberAttribute": "member"
  },
  "attributes": [
    {
      "name": "cn",
      "type": "STRING",
      "description": "common name(s) for which the entity is known by",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "dn",
      "type": "STRING",
      "description": "Directory Path",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "o",
      "type": "STRING",
      "description": "organization this object belongs to",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "ou",
      "type": "STRING",
      "description": "organizational unit this object belongs to",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "owner",
      "type": "STRING",
      "description": "owner (of the object)",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "description",
      "type": "STRING",
      "description": "descriptive information",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    }
  ]
}

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.