Support for X-ROL and X-SGP as Additional Entitlements
The connector supports X-ROL and X-SGP as additional entitlements for ACF2 under certain conditions.
Prerequisites
-
Mainframe Connector E-Fixes:
- FSD0136, FSD0137, FSD0138
- For provisioning of X-ROL and X-SGP as an Entitlement: FSD0153
For more information on the Mainframe E-Fixes and PTF's, refer to Mainframe E-Fixes.
-
ACF2 Version: ACF2 R16
Supported Features
The following features are supported:
- Account aggregation fetches the following entities:
- Roles (X-ROL) and Sources (X-SGP) connections
- Direct and indirect role permissions
- RoleGroups and SourceGroups
- Request new roles and sources for an account
- Remove existing roles and sources from an account
Implementing X-ROL and X-SGP
To begin using X-ROL and X-SGP, you need to modify your account schema and provisioning policies. The degree of modification depends if you are implementing X-ROL and X-SGP into a new or existing source.
- If you have an existing source, you will need to manually add all the attributes listed in Existing Sources to your account schema.
- If you created a new source, you need to add the Source Schema listed in Existing Sources to your account schema and to your provisioning policy.
The Source and Role attributes are required to aggregate other Source and Role attributes. They are also required to populate data for the following read-only attributes:
- AccountRoleDirectPermissions
- AccountRoleIndirectPermissions
- RoleGroups
- SourceGroup
Existing Sources
For existing ACF2 sources, you must add the splConnectionAttributes attribute using the REST API:
PATCH <url>/beta/sources/<id>
where:
<url>is the URL for the customer's SailPoint instance<id>is the ID of the source. For example, 2c9180835d191a86015d28455b4a2329
This can be obtained by calling List Sources.
The body of the PATCH consisting of JSON Patch syntax, representing changes to the source JSON object is as follows:
[{"op" : "add",
"path" : "/connectorAttributes/splConnectionAttributes",
"value" : {
"REFRESH":"false",
"TYPE":"false"
}}]
Content-Type: application/json-patch+json
Managing Roles
Account Schema Attributes
| Attributes | Description | Entitlement |
|---|---|---|
| Roles | List of Roles to which this user belongs. | true, managed="true", multi="true" |
| RoleGroups | List of Role groups to which this user belongs. | false, multi="true" |
| AccountRoleDirectPermissions | The direct permissions for account obtained from ROLESET rules. | false, multi="true" |
| AccountRoleIndirectPermissions | The indirect permissions for account obtained through role membership. | false, multi="true" |
| isIncomplete | Indicates that the obtained object data is incomplete. | false |
Role Schema Attributes
| Attributes | Description | Entitlement |
|---|---|---|
| RoleName | The name of the Role. | nativeObjectType="role", objectType="role" |
| Description | Description of Role. | |
| isIncomplete | Indicates that the obtained object data is incomplete. | |
| IncludeList | List of users included in the Role. | multi="true" |
| ExcludeList | List of users excluded from the Role. This is subset of values from IncludeList. | multi="true" |
| RoleDirectPermissions | The direct permissions of the Role. | multi="true" |
Managing Sources
Account Schema Attributes
| Attributes | Description | Entitlement |
|---|---|---|
| Sources | List of Sources to which this user belongs. | true |
| SourceGroups | List of source groups to which this user belongs. | false |
| isIncomplete | Indicates that the obtained object data is incomplete. | false |
Source Schema Attributes
| Attributes | Description | Entitlement |
|---|---|---|
| SourceName | The name of the Source. | nativeObjectType="source", objectType="source" |
| isIncomplete | Indicates that the obtained object data is incomplete. | |
| IncludeList | List of users included in the Source. | multi="true" |
| ExcludeList | List of users excluded from the Source. This is subset of values from IncludeList. | multi="true" |
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.