Schema Reference

The application schema is used to configure the objects returned from a connector.

Note

The Account Schema tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as Entitlement or Multi-Valued. Refer to Managing Source Account Schemas for more information.
The schema attributes that are not present by default must be defined as strings if not specified.

The Mainframe Top Secret LDAP connector uses the following default correlation and object configurations.

This Integration Module supports three types of objects: Account, TopSecretProfile, and TopSecretGroup.

Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.

Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as account IDs.

Caution

Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.

To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

Account ID	Schema Object Type
dn	Account
dn	TopSecretProfile
dn	TopSecretGroup

Default Account Attributes

The Mainframe Top Secret LDAP connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

The following table lists the account attributes:

Attribute Name	Description
dn	Distinguished name of the Top Secret User.
ACCESSORID	Top Secret User ID.
objectClass	Top Secret User Object Classes.
AACID	Authority levels at which ACID can manage ACIDs within scope.
AdminListData	Authority to list Security File information.
Misc1	Authority to perform one or more administrative functions (LCF, INSTDATA, USER, LTIME, SUSPEND, NOATS, RDT, TSSSIM, ALL).
Misc2	Authority to perform one or more administrative functions (ALL, SMS, TSO, NDT, DLF, APPCLU, WORKATTR, TARGET).
Misc3	Authority to perform one or more administrative functions (ALL, SDT, PTOK).
Misc8	Authority to list the contents of the RDT, FDT or STC or to use the ASUSPEND administrative function (LISTRDT, LISTSTC, LISTAPLU, LISTSDT, MCS, NOMVSDF, PWMAINT, REMASUSP, ALL).
Misc9	Authority to perform one or more high-level administrative functions (BYPASS, TRACE, CONSOLE, MASTFAC, MODE, STC, GLOBAL, GENERIC, ALL).
ASUSPEND	Account is suspended due to administrator action.
NODSNCHK	CA Top Secret bypasses all data set access security checks for this ACID.
SITRAN	CICS transaction CA Top Secret automatically executes after an ACID successfully signs on to a facility.
OPCLASS	CICS operator classes.
OPIDENT	CICS operator identification value equal to the ACID OPIDENT entry in the CICS SNT (Signon Table).
OPPRTY	CICS operator priority of associated ACID.
SCTYKEY	CICS security keys an ACID may use.
CONSOLE	Ability to modify control options by ACID.
CREATED	Date ACID was created.
DEPT	Department ACID.
DIVISION	Division ACID.
EXPIRE	Expiration date of ACID.
GROUPS	List of groups a TSS user is a member.
XSUSPEND	Account is suspended due to Top Secret Installation exit.
LAST-COUNT	Number of times the ACID has been used (logon times since user was defined).
MASTFAC	Multi-user facility name.
MCSAUTH	Authorize the operator commands that can be entered from the console.
PROFILES	List of profiles a Top Secret user is a member.
MODIFIED	Last date and time when ACID was updated.
NAME	Name of ACID.
NOPWCHG	Prevent ACID from changing passwords at signon or initiation.
OIDCARD	Prompt ACID to insert identification cards into a batch reader whenever signing on to TSO.
DFLTGRP	Default group to an ACID operating under OpenEdition MVS.
HOME	Subdirectory of ACID under OMVS.
UID	Numeric UID value for security within USS.
PSUSPEND	Account is suspended due to password violation.
PHYSKEY	Physical security key to support external authentication devices.
TSOHCLASS	Default hold class for TSO-generated JCL for TSO users.
TSOJCLASS	Job class for TSO generated job cards from TSO users.
TSOLACCT	TSO default account number.
TSOCOMMAND	Default command issued at TSO logon.
TSOLPROC	Default procedure used for TSO logon.
TSOMSIZE	Maximum region size (in kilobytes) that a TSO user may specify at logon.
TSOMCLASS	Default message class for TSO generated JCL for TSO users.
TSOMPW	Support multiple TSO UADS passwords, on a user-by-user basis.
TSOOPT	Default options that a TSO user may specify at logon.
TSODEST	Default destination identifier for TSO generated JCL for TSO users.
TSODEFPRFG	Default TSO performance group.
TSOLSIZE	Default region size (in kilobytes) for TSO.
TSOSCLASS	Default SYSOUT class for TSO generated JCL for TSO users.
TSOUNIT	Default unit name for dynamic allocations under TSO.
TSOUDATA	Site-defined data field to a TSO user.
USER	User defined classes and resources.
PASSEXPD	Expiration date of password.
PASSINTV	Number of days during which password remains valid.
TYPE	ACID type (MSCA, LSCA, SCA, ZCA, VCA, MCA, USER).
VSUSPEND	Account is suspended due to access violation.
ZONE	Zone ACID.

Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.

Caution

Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

TopSecretProfile Attributes

Object Type: TopSecretProfile

The following table lists the profile attributes:

Attribute Name	Description
dn	Distinguished name of Top Secret Profile.
ACCESSORID	Top Secret Profile ID.
objectClass	Top Secret Profile Object Classes.
AUDIT	Allow an audit of ACID activity.
CREATED	Date ACID was created.
DEPT	DEPT ACID.
DIVISION	Division ACID.
GAP	Globally administered profile.
MODIFIED	Last date and time when ACID was updated.
NAME	Name of ACID.
NOPWCHG	Prevent ACID from changing passwords at signon or initiation.
OIDCARD	Prompt ACID to insert identification cards into a batch reader whenever signing on to TSO.
GID	Group identification for OMVS.
SOURCE	Source reader or terminal prefixes through which the associated ACID may enter the system.
LTIME	How long (in minutes) until terminal of ACID locks if CA Top Secret does not detect activity at that terminal.
TYPE	ACID type.
ZONE	Zone ACID.

TopSecretGroup Attributes

Object Type: TopSecretGroup

The following table lists the group attributes:

Attribute Name	Description
dn	Distinguished name of Top Secret Profile.
ACCESSORID	Top Secret Group ID.
objectClass	Top Secret Group Object Classes.
AUDIT	Allow an audit of ACID activity.
CREATED	Date ACID was created.
DEPT	DEPT ACID.
DIVISION	Division ACID.
GAP	Globally administered profile.
MODIFIED	Last date and time when ACID was updated.
NAME	Name of ACID.
NOPWCHG	Prevent ACID from changing passwords at signon or initiation.
OIDCARD	Prompt ACID to insert identification cards into a batch reader whenever signing on to TSO.
GID	Group identification for OMVS.
SOURCE	Source reader or terminal prefixes through which the associated ACID may enter the system.
LTIME	How long (in minutes) until terminal of ACID locks if CA Top Secret does not detect activity at that terminal.
TYPE	ACID type.
ZONE	Zone ACID.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.