# Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The RACF (Read-Only) connector uses the following default correlation and object configurations. > [!NOTE] > > This connector currently supports two types of objects, account and group. ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account Attributes The RACF (Read-Only) connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. Account objects are used when building identities Link objects. #### CLASSES | Attribute Name | Description | | --- | --- | | CATEGORIES | Defines the categories associated with a general resource. There is one record per general resource/category combination. | | KERB\_NAME | RACF user name as taken from the profile. | | KERB\_MAXLIFE | Maximum ticket life. | | KERB\_KEY\_VER | Current key version. | | KERB\_ENCRYPT\_DES | Is key encryption using DES enabled? | | KERB\_ENCRYPT\_DES3 | Is key encryption using DES3 enabled? | | KERB\_ENCRYPT\_DESD | Is key encryption using DES with derivation enabled? | | KERB\_ENCRYPT\_A128 | Is key encryption using AES128 enabled? | | KERB\_ENCRYPT\_A256 | Is key encryption using AES256 enabled? | | KERB\_KEY\_FROM | Key source. Valid values are PASSWORD or PHRASE. | | NAME | User ID as taken from the profile name. | | CREATE\_DATE | The date that the profile was created. | | OWNER\_ID | The user ID or group name that owns the profile. | | ADSP | Does the user have the ADSP attribute? | | SPECIAL | Does the user have the SPECIAL attribute? | | OPER | Does the user have the OPERATIONS attribute? | | REVOKE | Is the user REVOKEd? | | GRPACC | Does the user have the GRPACC attribute? | | PWD\_INTERVAL | The number of days that the user’s password can be used. | | PWD\_DATE | The date that the password was last changed. | | PROGRAMMER | The name associated with the user ID. | | DEFGRP\_ID | The default group associated with the user. | | LASTJOB\_TIME | The time that the user last entered the system. | | LASTJOB\_DATE | The date that the user last entered the system. | | INSTALL\_DATA | Installation-defined data. | | UAUDIT | Do all RACHECK and RACDEF SVCs cause logging? | | AUDITOR | Specifies if the user has the auditor attribute. | | NOPWD | `YES` - indicates that this user ID can logon without a password using OID card. `NO` - indicates that this user must specify a password. `PRO` - indicates a protected user ID. `PHR` - indicates that the user has a password phrase. | | OIDCARD | Specifies if this user has the OIDCARD data. | | PWD\_GEN | The current password generation number. | | REVOKE\_CNT | The number of unsuccessful logon attempts. | | MODEL | The data set model profile name. | | SECLEVEL | The user’s security level. | | REVOKE\_DATE | The date that the user will be revoked. | | RESUME\_DATE | The date that the user will be resumed. | | ACCESS\_SUN | Can the user access the system on Sunday? | | ACCESS\_MON | Can the user access the system on Monday? | | ACCESS\_TUE | Can the user access the system on Tuesday? | | ACCESS\_WED | Can the user access the system on Wednesday? | | ACCESS\_THU | Can the user access the system on Thursday? | | ACCESS\_FRI | Can the user access the system on Friday? | | ACCESS\_SAT | Can the user access the system on Saturday? | | START\_TIME | After what time can the user logon? | | END\_TIME | After what time can the user not logon? | | SEC\_LABELS | The user’s default security label. | | ATTRIBS | Other user attributes (RSTD for users with RESTRICTED attribute). | | PWDENV\_EXISTS | Has a PKCS\#7 envelope been created for the user’s current password? | | PWD\_ASIS | Should the password be evaluated in the case entered? | | PHR\_DATE | The date the password phrase was last changed. | | PHR\_GEN | The current password phrase generation number. | | CERT\_SEQN | Sequence number that is incremented whenever a certificate for the user is added, deleted, or altered. | | PPHENV\_EXISTS | Has the user's current password phrase been PKCS\#7 enveloped for possible retrieval? | | ASSOCIATED\_MAPPING | Defines the certificate name filter in the DIGTNMAP class associated with this user ID. | | CSDATA\_CUSTOM | Record type of the User CICS Data record | | LNOTES\_SHORTNAME | User ID as taken from the profile name. | | CICS\_OP\_CLASSES | The class associated with the CICS operator. | #### GROUPS | Attribute Name | Description | | --- | --- | | OVM\_UID | User identifier (UID) associated with the user name from the profile. | | OVM\_HOME\_PATH | Home path associated with the user identifier (UID). | | OVM\_PROGRAM | Default program associated with the user identifier (UID). | | OVM\_FSROOT | File system root for this user. | | PRIMARY\_LANGUAGE | The primary language for the user. | | SECONDARY\_LANGUAGE | The secondary language for the user. | | CICS\_RSL\_KEY | Defines the resource security level (RSL) keys associated with a CICS user. There is one record per combination of user and CICS RSL key. | | LDAP\_HOST | LDAP server URL. | | LDAP\_BIND\_DN | LDAP BIND distinguished name. | | NETVIEW\_IC | Command list processed at logon. | | NETVIEW\_CONSOLE\_NAME | Default console name. | | NETVIEW\_CTL | CTL value: GENERAL, GLOBAL, or SPECIFIC. | | NETVIEW\_MSGRECVR | Eligible to receive unsolicited messages? | | NETVIEW\_NGMFADMN | Authorized to NetView graphic monitoring facility? | | NETVIEW\_NGMFVSPN | Value of view span options. | | NDS\_UNAME | NDS user name associated with the user ID. | | CICS\_OPIDENT | The CICS operator identifier. | | CICS\_OPPRTY | The CICS operator priority. | | CICS\_NOFORCE | Is the extended recovery facility (XRF) NOFORCE option in effect? | | CICS\_TIMEOUT | The terminal time-out value. Expressed in hh:mm. | | DCE\_UUID | DCE UUID associated with the user name from the profile. | | DCE\_NAME | DCE principal name associated with this user. | | DCE\_HOMECELL | Home cell name. | | DCE\_HOMEUUID | Home cell UUID. | | DCE\_AUTOLOGIN | Is this user eligible for an automatic DCE login? | | CERTIFICATE | Defines the names of the certificate profiles in the DIGTCERT class that are associated with this user ID. | | CICS\_TSL\_KEY | Defines the transaction security level (TSL) keys for a CICS user. There is one record per combination of user and CICS TSL key. | | TSO\_ACCOUNT\_NAME | User ID as taken from the profile name. | | TSO\_COMMAND | The command issued at LOGON. | | TSO\_DEST | The default destination identifier. | | TSO\_HOLD\_CLASS | The default hold class. | | TSO\_JOB\_CLASS | The default job class. | | TSO\_LOGIN\_PROC | The default logon procedure. | | TSO\_LOGIN\_SIZE | The default logon region size. | | TSO\_MSG\_CLASS | The default message class. | | TSO\_LOGON\_MAX | The maximum logon region size. | | TSO\_PERF\_GROUP | The performance group associated with the user. | | TSO\_SYSOUT\_CLASS | The default sysout class. | | TSO\_USER\_DATA | The TSO user data, in hexadecimal in the form `X`. | | TSO\_UNIT\_NAME | The default SYSDA device. | | TSO\_SECLABEL | The default logon security label. | | DFP\_DATA\_RECORDS | Defines the information required by the System Managed Storage facility of the Data Facility Product (DFP). | | AREA\_NAME | Area for delivery for the user. | | BUILDING | Building for delivery. | | DEPARTMENT | Department for delivery. | | ROOM | Room for delivery. | | ADDRESS1 | Address line 1 | | ADDRESS2 | Address line 2 | | ADDRESS3 | Address line 3 | | ADDRESS4 | Address line 4 | | ACCOUNT\_NUMBER | User account number for delivery. | | MVS\_UID | z/OS UNIX user identifier (UID) associated with the user name from the profile. | | MVS\_HOME\_PATH | HOME PATH associated with the z/OS UNIX user identifier (UID). | | MVS\_PROGRAM | Default Program associated with the z/OS UNIX user identifier (UID). | | MVS\_MAX\_CPUTIME | Maximum CPU time associated with the UID. | | MVS\_MAX\_ASSSIZE | Maximum address space size associated with the UID. | | MVS\_MAX\_FILEPROC | Maximum active or open files associated with the UID. | | MVS\_MAX\_PROC | Maximum number of processes associated with the UID. | | MVS\_MAX\_THREADS | Maximum number of threads associated with the UID. | | MVS\_MAX\_MAP\_STORAGE | Maximum mappable storage amount associated with the UID. | | MVS\_MEM\_LIMIT | Maximum size of non-shared memory. | | MVS\_SHMEM\_LIMIT | Maximum size of shared memory. | | NETVIEW\_OPCLASS | OPCLASS value from 1 to 2040. | | EIM\_LDAPPROFFILE | EIM LDAPBIND profile name. | ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The RACF (Read-Only) connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. | Attribute Name | Description | | --- | --- | | SUBGROUPNAME | The name of a subgroup within the group. | | MVS\_GID | OMVS z/OS UNIX group identifier (GID) associated with the group name from the profile. | | CSDATA\_CUSTOM | Defines the custom fields associated with a group. There is one record per combination of group and CSDATA custom fields. | | MEMBERS | A user ID within the group. | | NAME | Group name as taken from the profile name. | | SUPERIOR\_GROUP | Name of the superior group to this group. | | CREATE\_DATE | Date that the group was defined. | | OWNER\_ID | The user ID or group name which owns the profile. | | UACC | The default universal access. Valid values are NONE for all groups other than the IBM-defined VSAMDSET group which has CREATE. | | NOTERMUACC | Indicates if the group must be specifically authorized to use a particular terminal through the use of the PERMIT command. | | INSTALL\_DATA | Installation-defined data. | | GROUP\_MODEL | Data set profile that is used as a model for this group. | | UNIVERSAL | Indicates if the group has the UNIVERSAL attribute. | | OVM\_GID | OMVS z/OS UNIX group identifier (GID) associated with the group name from the profile. | | TME\_ROLE | Role profile name. |