# Support for X-ROL and X-SGP as Additional Entitlements

The connector supports X-ROL and X-SGP as additional entitlements for ACF2 under certain conditions.

## Prerequisites

- Mainframe Connector E-Fixes:

  - FSD0136, FSD0137, FSD0138
  - For provisioning of X-ROL and X-SGP as an Entitlement: FSD0153

  For more information on the Mainframe E-Fixes and PTF's, refer to [Mainframe E-Fixes](<https://community.sailpoint.com/docs/DOC-10344>).
- ACF2 Version: ACF2 R16

## Supported Features

The following features are supported:

- Account aggregation fetches the following entities:

  - Roles (X-ROL) and Sources (X-SGP) connections
  - Direct and indirect role permissions
  - RoleGroups and SourceGroups
- Request new roles and sources for an account
- Remove existing roles and sources from an account

## Implementing X-ROL and X-SGP

To begin using X-ROL and X-SGP, you need to modify your account schema and provisioning policies. The degree of modification depends if you are implementing X-ROL and X-SGP into a new or existing source.

- If you have an existing source, you will need to manually add all the attributes listed in [Existing Sources](<#existing-sources>) to your account schema.
- If you created a new source, you need to add the Source Schema listed in [Existing Sources](<#existing-sources>) to your account schema and to your provisioning policy.

The Source and Role attributes are required to aggregate other Source and Role attributes. They are also required to populate data for the following read-only attributes:

- AccountRoleDirectPermissions
- AccountRoleIndirectPermissions
- RoleGroups
- SourceGroup

## Existing Sources

For existing ACF2 sources, you must add the `splConnectionAttributes` attribute using the REST API:

`PATCH <url>/beta/sources/<id>`

where:

- `<url>` is the URL for the customer's SailPoint instance
- `<id>` is the ID of the source. For example, 2c9180835d191a86015d28455b4a2329

This can be obtained by calling List Sources.

The body of the PATCH consisting of JSON Patch syntax, representing changes to the source JSON object is as follows:

```json
[{"op" : "add",
"path" : "/connectorAttributes/splConnectionAttributes",
"value" : {
"REFRESH":"false",
"TYPE":"false"
}}]
Content-Type: application/json-patch+json
```

### Managing Roles

#### Account Schema Attributes

| Attributes | Description | Entitlement |
| --- | --- | --- |
| Roles | List of Roles to which this user belongs. | true, managed="true", multi="true" |
| RoleGroups | List of Role groups to which this user belongs. | false, multi="true" |
| AccountRoleDirectPermissions | The direct permissions for account obtained from ROLESET rules. | false, multi="true" |
| AccountRoleIndirectPermissions | The indirect permissions for account obtained through role membership. | false, multi="true" |
| isIncomplete | Indicates that the obtained object data is incomplete. | false |

#### Role Schema Attributes

| Attributes | Description | Entitlement |
| --- | --- | --- |
| RoleName | The name of the Role. | nativeObjectType="role", objectType="role" |
| Description | Description of Role. |  |
| isIncomplete | Indicates that the obtained object data is incomplete. |  |
| IncludeList | List of users included in the Role. | multi="true" |
| ExcludeList | List of users excluded from the Role. This is subset of values from IncludeList. | multi="true" |
| RoleDirectPermissions | The direct permissions of the Role. | multi="true" |

### Managing Sources

#### Account Schema Attributes

| Attributes | Description | Entitlement |
| --- | --- | --- |
| Sources | List of Sources to which this user belongs. | true |
| SourceGroups | List of source groups to which this user belongs. | false |
| isIncomplete | Indicates that the obtained object data is incomplete. | false |

#### Source Schema Attributes

| Attributes | Description | Entitlement |
| --- | --- | --- |
| SourceName | The name of the Source. | nativeObjectType="source", objectType="source" |
| isIncomplete | Indicates that the obtained object data is incomplete. |  |
| IncludeList | List of users included in the Source. | multi="true" |
| ExcludeList | List of users excluded from the Source. This is subset of values from IncludeList. | multi="true" |