# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The LDAP connector uses the following default correlation and object configurations.

This connector supports two types of objects: account and group. The default schema is provided for both accounts and groups, and can be modified per the connection requirements of your LDAP server. The application only supports a single group object. The schema for a group object can be modified to support other native group types such as `posixgroup` and `nisNetgroup`, depending on your LDAP server.

> [!NOTE]
>
> The name of the `objectType` must be the same as the name of the `objectType` of the respective group schema for which the scope is defined.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account Attributes

The LDAP connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description | Type |
| --- | --- | --- |
| businessCategory | The business category. |  |
| carLicense | The vehicle license or registration plate. |  |
| cn | The common name(s) for which the entity is known by. |  |
| dn | The distinguished name for which the entity is known by. |  |
| departmentNumber | The identifies a department within an organization. |  |
| description | The descriptive information. |  |
| destinationIndicator | The destination indicator. |  |
| displayName | The preferred name to be used when displaying entries. |  |
| employeeNumber | The numerically identifies an employee within an organization. |  |
| employeeType | The type of employment for a person. |  |
| facsimileTelephoneNumber | The Facsimile (Fax) Telephone Number. | Multi-Valued |
| givenName | The first name(s) for which the entity is known by. |  |
| groups | List of groups a user is a member. Schema Object Type: group | Entitlement, Multi-Valued |
| homePhone | The home telephone number. |  |
| homePostalAddress | The home postal address. |  |
| initials | The initials of some or all of names, but not the surname(s). |  |
| internationaliSDNNumber | The international ISDN number. |  |
| l | The city. |  |
| mail | The RFC822 Mailbox. |  |
| manager | The DN of manager. |  |
| mobile | The mobile telephone number. |  |
| o | The organization this object belongs to. |  |
| ou | The organizational unit this object belongs to. |  |
| pager | The pager telephone number. |  |
| physicalDeliveryOfficeName | The name of physical delivery office. |  |
| postOfficeBox | The post office box. |  |
| postalAddress | The postal address. |  |
| postalCode | The postal code. |  |
| preferredDeliveryMethod | The preferred delivery method. |  |
| preferredLanguage | The preferred written or spoken language for a person. |  |
| pwdReset | The specifies whether the password has been reset by admin. |  |
| registeredAddress | The registered postal address. |  |
| roomNumber | The room number. |  |
| secretary | The DN of secretary. |  |
| seeAlso | The DN of related object. |  |
| sn | The last (family) name(s) for which the entity is known by. |  |
| st | The state or province which this object resides in. |  |
| street | The street address of this object. |  |
| telephoneNumber | The telephone number. |  |
| teletexTerminalIdentifier | The teletex terminal identifier. |  |
| telexNumber | The telex number. |  |
| title | The title associated with the entity. |  |
| uid | The user identifier. |  |
| objectClass | The object classes of the entity. | Multi-Valued |
| posixgroups | List of posix groups a user is a member. Schema Object Type: posixgroup | Entitlement, Multi-Valued |
| nisNetgroups | List of nisnet groups a user is a member. Schema Object Type: nisNetgroup | Entitlement, Multi-Valued |

> [!IMPORTANT]
>
> Group membership filters are not applied if the LDAP source schema entitlement attribute name is identical to the attribute name on the target system. To ensure filtering works correctly, use a unique attribute name in the schema. For example, if the target system uses `sudoRoleMemberOf`, define the schema attribute as `sudoRoleMemberOfGroup` to ensure filtering works correctly during account aggregation.

### Adding Schema to the Source

> [!NOTE]
>
> If you want to add `sudoRoles` and `groupOfNames` schema to the source, you need to add the respective account attributes in the **Account Schema**.

The following example shows how to add the `sudoRoles` and `groupOfNames` schema to the source XML:

```json
{
  "AttributeDefinition": [
    {
      "entitlement": "true",
      "managed": "true",
      "multi": "true",
      "name": "sudoRoles",
      "schemaObjectType": "sudoRole",
      "type": "string",
      "Description": "List of sudo roles a user is a member"
    },
    {
      "entitlement": "true",
      "managed": "true",
      "multi": "true",
      "name": "groupOfNames",
      "schemaObjectType": "groupOfNames",
      "type": "string",
      "Description": "List of groupOfNames a user is a member"
    }
  ]
}
```

For more information on the attribute lists of `sudoRole` and `groupOfNames`, refer to [Sudo Role Attributes](<#sudo-role-attributes>) and [groupOfNames Attributes](<#groupofnames-attributes>).

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Group Attributes

The following lists the group of unique names attributes:

| Attribute Name | Description |
| --- | --- |
| cn | The common name(s) for which the entity is known by. |
| dn | The directory path. |
| description | The descriptive information. |
| o | The organization this object belongs to. |
| ou | The organizational unit this object belongs to. |
| owner | The owner (of the object). |

The LDAP connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

#### Schema Example

The following example shows how to add the `group` schema to the source XML:

```json
{
  "Schema": {
    "displayAttribute": "cn",
    "featuresString": "PROVISIONING",
    "identityAttribute": "dn",
    "nativeObjectType": "groupOfUniqueNames",
    "objectType": "group",
    "AttributeDefinition": [
      {
        "name": "cn",
        "type": "string",
        "Description": "common name(s) for which the entity is known by"
      },
      {
        "name": "dn",
        "type": "string",
        "Description": "Directory Path"
      },
      {
        "name": "o",
        "type": "string",
        "Description": "organization this object belongs to"
      },
      {
        "name": "ou",
        "type": "string",
        "Description": "organizational unit this object belongs to"
      },
      {
        "name": "owner",
        "type": "string",
        "Description": "owner (of the object)"
      },
      {
        "name": "description",
        "type": "string",
        "Description": "descriptive information"
      }
    ],
    "Attributes": {
      "Map": {
        "entry": [
          {
            "key": "groupMemberAttribute",
            "value": "uniqueMember"
          },
          {
            "key": "memberAttribute",
            "value": "dn"
          }
        ]
      }
    }
  }
}
```

### NisNet Group Attributes

The following lists the `nisNetgroup` attributes:

| Attribute Name | Description |
| --- | --- |
| cn | The common name(s) for which the entity is known by. |
| dn | The directory path. |
| description | The descriptive information. |
| nisNetgroupTriple | The unique member of a nisNetgroup. |

#### Schema Example

The following example shows how to add the `nisNetgroup` schema to the source XML:

```json
  {
        "nativeObjectType": "nisNetgroup",
        "identityAttribute": "dn",
        "displayAttribute": "cn",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [
            "PROVISIONING"
        ],
        "configuration": {
            "memberPrefix": "{,",
            "memberAttribute": [
                "cn",
                "uid"
            ],
            "memberSuffix": ",}",
            "groupMemberAttribute": "nisNetgroupTriple"
        },
        "attributes": [
            {
                "name": "cn",
                "type": "STRING",
                "schema": null,
                "description": "common name(s) for which the entity is known by",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "nisNetgroupTriple",
                "type": "STRING",
                "schema": null,
                "description": "unique member of a nisNetgroup",
                "isMulti": true,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "dn",
                "type": "STRING",
                "schema": null,
                "description": "Directory Path",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "description",
                "type": "STRING",
                "schema": null,
                "description": "descriptive information",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            }
        ],
        "id": "ada0ca21da9d450aa80addd68bd2102d",
        "name": "nisNetgroup",
        "created": "2024-10-08T12:05:50.004Z",
        "modified": "2024-10-08T12:05:50.004Z"
    },
```

### Posix Group Attributes

The following lists the `posixgroup` attributes:

| Attribute Name | Description | Type |
| --- | --- | --- |
| cn | The common name(s) for which the entity is known by. |  |
| dn | The directory path. |  |
| description | The descriptive information. |  |
| gidNumber | The group ID. |  |
| memberUid | The unique member of a posixGroup. | Multi-Valued |

#### Schema Example

The following example shows how to add the `posixgroup` schema to the source XML:

```json
{
  "nativeObjectType": "posixgroup",
  "identityAttribute": "dn",
  "displayAttribute": "cn",
  "hierarchyAttribute": null,
  "includePermissions": false,
  "features": [
    "PROVISIONING"
  ],
  "configuration": {
    "memberAttribute": [
      "cn",
      "uid"
    ],
    "groupMemberAttribute": "memberUid"
  },
  "attributes": [
    {
      "name": "cn",
      "type": "STRING",
      "description": "common name(s) for which the entity is known by",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "memberUid",
      "type": "STRING",
      "description": "unique member of a posixGroup",
      "isMulti": true,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "dn",
      "type": "STRING",
      "description": "Directory Path",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "gidNumber",
      "type": "STRING",
      "description": "Group ID",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "description",
      "type": "STRING",
      "description": "descriptive information",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    }
  ]
}
```

### Sudo Role Attributes

The following lists the `sudoRole` attributes:

| Attribute Name | Description | Type |
| --- | --- | --- |
| cn | The common name(s) for which the entity is known by. |  |
| dn | The directory name. |  |
| description | The descriptive information. |  |
| sudoUser | The unique member of a sudoRole. | Multi-Valued |

#### Schema Example

The following example shows how to add the `sudoRole` schema to the source XML:

```json
{
  "nativeObjectType": "sudoRole",
  "identityAttribute": "dn",
  "displayAttribute": "cn",
  "hierarchyAttribute": null,
  "includePermissions": false,
  "features": [
    "PROVISIONING"
  ],
  "configuration": {
    "memberAttribute": [
      "cn"
    ],
    "groupMemberAttribute": "sudoUser"
  },
  "attributes": [
    {
      "name": "dn",
      "type": "STRING",
      "description": "Directory Path",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "cn",
      "type": "STRING",
      "description": "common name(s) for which the entity is known by",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "sudoUser",
      "type": "STRING",
      "description": "unique member of a posixGroup",
      "isMulti": true,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "description",
      "type": "STRING",
      "description": "descriptive information",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    }
  ]
}
```

### groupOfNames Attributes

The following lists the `groupOfNames` attributes:

| Attribute Name | Description |
| --- | --- |
| cn | The common name(s) for which the entity is known by. |
| dn | The directory path. |
| description | The descriptive information. |
| o | The organization this object belongs to. |
| ou | The organizational unit this object belongs to. |
| owner | The owner (of the object). |

#### Schema Example

The following example shows how to add the `groupOfNames` schema to the source XML:

```json
{
  "nativeObjectType": "groupOfNames",
  "identityAttribute": "dn",
  "displayAttribute": "cn",
  "hierarchyAttribute": null,
  "includePermissions": false,
  "features": [
    "PROVISIONING",
    "GROUPS_HAVE_MEMBERS"
  ],
  "configuration": {
    "memberAttribute": [
      "dn"
    ],
    "groupMemberAttribute": "member"
  },
  "attributes": [
    {
      "name": "cn",
      "type": "STRING",
      "description": "common name(s) for which the entity is known by",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "dn",
      "type": "STRING",
      "description": "Directory Path",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "o",
      "type": "STRING",
      "description": "organization this object belongs to",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "ou",
      "type": "STRING",
      "description": "organizational unit this object belongs to",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "owner",
      "type": "STRING",
      "description": "owner (of the object)",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    },
    {
      "name": "description",
      "type": "STRING",
      "description": "descriptive information",
      "isMulti": false,
      "isEntitlement": false,
      "isGroup": false
    }
  ]
}
```