# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The Mainframe Top Secret LDAP connector uses the following default correlation and object configurations.

This Integration Module supports three types of objects: Account, TopSecretProfile, and TopSecretGroup.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| dn | Account |
| dn | TopSecretProfile |
| dn | TopSecretGroup |

### Default Account Attributes

The Mainframe Top Secret LDAP connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

The following table lists the account attributes:

| Attribute Name | Description |
| --- | --- |
| dn | Distinguished name of the Top Secret User. |
| ACCESSORID | Top Secret User ID. |
| objectClass | Top Secret User Object Classes. |
| AACID | Authority levels at which ACID can manage ACIDs within scope. |
| AdminListData | Authority to list Security File information. |
| Misc1 | Authority to perform one or more administrative functions (LCF, INSTDATA, USER, LTIME, SUSPEND, NOATS, RDT, TSSSIM, ALL). |
| Misc2 | Authority to perform one or more administrative functions (ALL, SMS, TSO, NDT, DLF, APPCLU, WORKATTR, TARGET). |
| Misc3 | Authority to perform one or more administrative functions (ALL, SDT, PTOK). |
| Misc8 | Authority to list the contents of the RDT, FDT or STC or to use the ASUSPEND administrative function (LISTRDT, LISTSTC, LISTAPLU, LISTSDT, MCS, NOMVSDF, PWMAINT, REMASUSP, ALL). |
| Misc9 | Authority to perform one or more high-level administrative functions (BYPASS, TRACE, CONSOLE, MASTFAC, MODE, STC, GLOBAL, GENERIC, ALL). |
| ASUSPEND | Account is suspended due to administrator action. |
| NODSNCHK | CA Top Secret bypasses all data set access security checks for this ACID. |
| SITRAN | CICS transaction CA Top Secret automatically executes after an ACID successfully signs on to a facility. |
| OPCLASS | CICS operator classes. |
| OPIDENT | CICS operator identification value equal to the ACID OPIDENT entry in the CICS SNT (Signon Table). |
| OPPRTY | CICS operator priority of associated ACID. |
| SCTYKEY | CICS security keys an ACID may use. |
| CONSOLE | Ability to modify control options by ACID. |
| CREATED | Date ACID was created. |
| DEPT | Department ACID. |
| DIVISION | Division ACID. |
| EXPIRE | Expiration date of ACID. |
| GROUPS | List of groups a TSS user is a member. |
| XSUSPEND | Account is suspended due to Top Secret Installation exit. |
| LAST-COUNT | Number of times the ACID has been used (logon times since user was defined). |
| MASTFAC | Multi-user facility name. |
| MCSAUTH | Authorize the operator commands that can be entered from the console. |
| PROFILES | List of profiles a Top Secret user is a member. |
| MODIFIED | Last date and time when ACID was updated. |
| NAME | Name of ACID. |
| NOPWCHG | Prevent ACID from changing passwords at signon or initiation. |
| OIDCARD | Prompt ACID to insert identification cards into a batch reader whenever signing on to TSO. |
| DFLTGRP | Default group to an ACID operating under OpenEdition MVS. |
| HOME | Subdirectory of ACID under OMVS. |
| UID | Numeric UID value for security within USS. |
| PSUSPEND | Account is suspended due to password violation. |
| PHYSKEY | Physical security key to support external authentication devices. |
| TSOHCLASS | Default hold class for TSO-generated JCL for TSO users. |
| TSOJCLASS | Job class for TSO generated job cards from TSO users. |
| TSOLACCT | TSO default account number. |
| TSOCOMMAND | Default command issued at TSO logon. |
| TSOLPROC | Default procedure used for TSO logon. |
| TSOMSIZE | Maximum region size (in kilobytes) that a TSO user may specify at logon. |
| TSOMCLASS | Default message class for TSO generated JCL for TSO users. |
| TSOMPW | Support multiple TSO UADS passwords, on a user-by-user basis. |
| TSOOPT | Default options that a TSO user may specify at logon. |
| TSODEST | Default destination identifier for TSO generated JCL for TSO users. |
| TSODEFPRFG | Default TSO performance group. |
| TSOLSIZE | Default region size (in kilobytes) for TSO. |
| TSOSCLASS | Default SYSOUT class for TSO generated JCL for TSO users. |
| TSOUNIT | Default unit name for dynamic allocations under TSO. |
| TSOUDATA | Site-defined data field to a TSO user. |
| USER | User defined classes and resources. |
| PASSEXPD | Expiration date of password. |
| PASSINTV | Number of days during which password remains valid. |
| TYPE | ACID type (MSCA, LSCA, SCA, ZCA, VCA, MCA, USER). |
| VSUSPEND | Account is suspended due to access violation. |
| ZONE | Zone ACID. |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### TopSecretProfile Attributes

Object Type: TopSecretProfile

The following table lists the profile attributes:

| Attribute Name | Description |
| --- | --- |
| dn | Distinguished name of Top Secret Profile. |
| ACCESSORID | Top Secret Profile ID. |
| objectClass | Top Secret Profile Object Classes. |
| AUDIT | Allow an audit of ACID activity. |
| CREATED | Date ACID was created. |
| DEPT | DEPT ACID. |
| DIVISION | Division ACID. |
| GAP | Globally administered profile. |
| MODIFIED | Last date and time when ACID was updated. |
| NAME | Name of ACID. |
| NOPWCHG | Prevent ACID from changing passwords at signon or initiation. |
| OIDCARD | Prompt ACID to insert identification cards into a batch reader whenever signing on to TSO. |
| GID | Group identification for OMVS. |
| SOURCE | Source reader or terminal prefixes through which the associated ACID may enter the system. |
| LTIME | How long (in minutes) until terminal of ACID locks if CA Top Secret does not detect activity at that terminal. |
| TYPE | ACID type. |
| ZONE | Zone ACID. |

### TopSecretGroup Attributes

Object Type: TopSecretGroup

The following table lists the group attributes:

| Attribute Name | Description |
| --- | --- |
| dn | Distinguished name of Top Secret Profile. |
| ACCESSORID | Top Secret Group ID. |
| objectClass | Top Secret Group Object Classes. |
| AUDIT | Allow an audit of ACID activity. |
| CREATED | Date ACID was created. |
| DEPT | DEPT ACID. |
| DIVISION | Division ACID. |
| GAP | Globally administered profile. |
| MODIFIED | Last date and time when ACID was updated. |
| NAME | Name of ACID. |
| NOPWCHG | Prevent ACID from changing passwords at signon or initiation. |
| OIDCARD | Prompt ACID to insert identification cards into a batch reader whenever signing on to TSO. |
| GID | Group identification for OMVS. |
| SOURCE | Source reader or terminal prefixes through which the associated ACID may enter the system. |
| LTIME | How long (in minutes) until terminal of ACID locks if CA Top Secret does not detect activity at that terminal. |
| TYPE | ACID type. |
| ZONE | Zone ACID. |