# Provisioning

The Mainframe Top Secret LDAP connector supports provisioning, allowing you to create and manage accounts and entitlements in Top Secret LDAP directly from SailPoint.

**Prerequisite:** Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

> [!IMPORTANT]
>
> This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

## Default Create Account Attributes

The following table lists the Create Profile provisioning policy attributes:

| Account Attribute | Description |
| --- | --- |
| dn | Create Unique Account ID. This generator uses the value in the **Pattern Used** field to generate a unique DN for the new account. |
| Password | Create Password generator. The password of the user to be created. |
| NAME | Display name. The display name of the user to be created. |
| DEPT | The department identity for the users. Static value. |
| Facilities | The facilities to which a user has access. Static value. |
| TSOLPROC | Used to provide a default procedure to be used for TSO logon. The one- to eight-character logon procedure name. Procedure names are also TSO-related resources and the user must be permitted to any procedure name with which they attempt to log on. Static value. |
| CONSOLE | Used to grant or remove an ACID's ability to modify control options. For VM, options are modified through the TSS MODIFY command only. With VSE and OS/390, options are modified at the O/S console or through the TSS MODIFY command function. Static value. |