Schema Reference
The application schema is used to configure the objects returned from a connector.
Note
-
The Account Schema tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as Entitlement or Multi-Valued. Refer to Managing Source Account Schemas for more information.
-
The schema attributes that are not present by default must be defined as strings if not specified.
The ACF2 connector uses the following default correlation and object configurations.
Default Account Schema
Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.
The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.
Default Account ID
SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as account IDs.
Caution
Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
To resolve issues caused by changing account IDs, reconfigure them to their default values.
The following table lists the default account IDs for this connector:
| Account ID | Schema Object Type |
|---|---|
| USER_ID | Account |
| GROUP_ID | Group |
| RoleName | Roles |
| SourceName | Sources |
Default Account Attributes
The ACF2 connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.
| Attribute Name | Description |
|---|---|
| USER_ID | ACF2 ID of the user |
| OMVS.ASSIZE | Max address space size - OMVS user profile |
| OMVS.CPUTIME | Max cputime for a dubbed process - OMVS user profile |
| OMVS.FILEPROC | Max files per process - OMVS user profile |
| OMVS.HOME | Defines the pathname of the initial directory |
| OMVS.MMAPAREA | Max-data-space pages-for-HFS-mappings - OMVS user profile |
| OMVS.OMVSPGM | OMVS shell program started when the OMVS command is entered |
| OMVS.PROCUSER | Max number of processes - OMVS user profile |
| OMVS.THREADS | Max number of pthread created threads - OMVS user profile |
| OMVS.UID | User identification - OMVS user profile |
| CICS.OPIDENT | Operator ID - CICS user profile |
| CICS.OPPRTY | Operator priority - CICS user profile |
| CICS.TIMEOUT | Idle time value - CICS user profile |
| CICS.FORCE | Indicates whether the user is signed off (FORCE) or not signed off (NOFORCE) when an XRF takeover occurs. - CICS user profile |
| CICS.OPCLASS | Operator class values - CICS user profile |
| DCE.HOMEUUID | Home cell UUID - DCE user profile |
| REVOKE_TYPE | Revoke type (SUSPEND, CANCEL, Both) of the user |
| NAME | Name of the user |
| UID | UID pseudo field, concatenation of selected logonid fields |
| UIDX | Multiple values UID |
| SEC_VIO | Number of cumulative security violations for a user |
| EXPIRE | When the privileges for this logonid will expire |
| SECURITY | User is a security administrator |
| ACCOUNT | User can insert, list, change, and delete logonid records |
| LEADER | User can display and alter certain fields of logonid records for other users |
| AUDIT | User can display the records and parameters of the ACF2 system |
| CONSULT | User can display other logonid records |
| REFRESH | User can issue the /F ACF2,REFRESH operator command to update GSO |
| READALL | User has read and execute access to all data sets at the site |
| TSO | User can log on to TSO |
| STC | Logonid is for use by started tasks only |
| CICS | User can sign on to CICS |
| IMS | User can sign on to IMS |
| MAINT | A logonid can access data sets without CA ACF2 rule validation or logs by means of a specified program executed from a specified library |
| NON_CNCL | A user with the NON-CNCL privilege defined in their logonid record has full access to any data set or resource despite any security violations that can occur during the access attempt |
| ACC_DATE | The date of the last system access by this user |
| ACC_TIME | Time of the last system access by this user (read only) |
| PSWD_EXP | Password has been manually expired |
| PSWD_TOD | Date and time when a password was last changed |
| PSWD_DAT | Date of the last invalid password or password phrase attempt (read only) |
| PSWD_TIM | Last time a user entered an invalid password (read only) |
| PSWD_VIO | Number of password violations that occurred on PSWD_DAT |
| TSOACCT | Default TSO logon account |
| TSOCMDS | TSO command list module name that contains the list of commands that this user is authorized to use |
| TSOFSCRN | User can use the full-screen logon display |
| TSOPERF | Default TSO performance group |
| TSORBA | Mail Index Record Pointer (MIRP) for this user |
| TSORGN | Default TSO region size in kilobytes |
| TSOSIZE | Maximum TSO region size |
| TSOTIME | Default TSO time parameter, which is the CPU time limit (in minutes) associated with the TSO session |
| TSOUNIT | Default TSO unit name |
| TSOPROC | Default TSO procedure name |
| JCL | Indicates the ability to submit batch jobs from TSO and to use SUBMIT, STATUS, CANCEL, and OUTPUT commands |
| ACF2CICS | CA ACF2 CICS security is to be initialized in any CICS region running with this address space logonid |
| CICSCL | CICS operator class |
| CICSID | CICS operator ID |
| CICSPRI | CICS operator priority |
| CICSRSL | CICS resource access key |
| PSWD_MIX | Current password is case-sensitive |
| NOMAXVIO | Prevents the user violation counter from incrementing and MAXVIO processing from occurring |
Default Entitlement Attributes
Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.
Caution
Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.
Default Group Attributes
The ACF2 connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.
| Attribute Name | Description |
|---|---|
| GROUP_ID | ACF2 ID of the group |
| DESCRIPTION | Description of Group (free text) |
| UIDMASKS | UID mask which defines this Group. All users matching this UID mask belong to this group. |
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.