Resource Forest Specific Configuration Attributes

Use these attributes to configure resource forest domains, applications, and Microsoft Exchange schemas.

Resource Forest Specific Domain Configuration Attributes

This section lists additional Resource Forest specific configuration parameters:

`disableShadowAccountMembership`

By default, the connector considers the memberships of Shadow Account as Master Account's memberships.

To discard membership of the shadow account, set this Boolean (or String) attribute to true under domainSettings of the respective Resource Forest domain, using the SailPoint REST API. Update the value of disableShadowAccountMembership that is present under connector_domainSettings (map) of the Resource Forest domain. For example:

<entry key="disableShadowAccountMembership" value="true"/>

Note

For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

`shadowAccountMembershipFilter`

By default, the connector retrieves all memberships of the Shadow Account, but these memberships can be filtered based on an LDAP filter.

Update the value of shadowAccountMembershipFilter that is present under connector_domainSettings (map) of the Resource Forest domain using the SailPoint REST API. For example, if only the distribution group of the Shadow Account is considered, you can use the shadowAccountMembershipFilter attribute with a value such as (!groupType:1.2.840.113556.1.4.803:=2147483648)).

Note

For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

`provisionGroupToShadowAccount`

By default, the connector supports assigning only Universal and Global Distribution List groups from the Resource Forest Domain to the Shadow Account. To override this and support all other types of group provisioning to the Shadow Account, pass this attribute in the metadata of the AttributeRequest for the memberOf attribute as given in the following example:

<AttributeRequest op="Add" name="memberOf" value="<group-nativeIdentity>">
  <Attributes>
    <Map>
      <entry key="provisionGroupToShadowAccount" value="true" />
    </Map>
  </Attributes>
</AttributeRequest>

Resource Forest Specific Application Configuration Attributes

This section lists additional Resource Forest Application configuration parameters:

`supportFSPsFromResourceForest`

Set this Boolean attribute to true to enable aggregating and provisioning FSPs from the Resource Forest Domains for the Master Account. By default, the value is false.

Microsoft Exchange Schema Attributes

In addition to the existing Microsoft Exchange account schema attributes, the following new attributes are added in the schema for new applications. For existing Active Directory applications, the following schema attributes must be added manually if required:

Attribute	Description
`msExchRecipientTypeDetails`	Type of the Microsoft Exchange recipient object. Value 2 indicates that the mailbox type is a Linked Mailbox.
`shadowAccountDN`	The distinguished name of the Linked Mailbox Shadow Account (disabled account which was created while creating the Linked Mailbox).
`shadowAccountGuid`	The `objectGuid` of the Linked Mailbox Shadow Account.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.