# Resource Forest Specific Configuration Attributes

Use these attributes to configure resource forest domains, applications, and Microsoft Exchange schemas.

## Resource Forest Specific Domain Configuration Attributes

This section lists additional Resource Forest specific configuration parameters:

### `disableShadowAccountMembership`

By default, the connector considers the memberships of Shadow Account as Master Account's memberships.

To discard membership of the shadow account, set this Boolean (or String) attribute to `true` under `domainSettings` of the respective Resource Forest domain, using the SailPoint REST API. Update the value of `disableShadowAccountMembership` that is present under `connector_domainSettings` (map) of the Resource Forest domain. For example:

```xml
<entry key="disableShadowAccountMembership" value="true"/>
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

### `shadowAccountMembershipFilter`

By default, the connector retrieves all memberships of the Shadow Account, but these memberships can be filtered based on an LDAP filter.

Update the value of `shadowAccountMembershipFilter` that is present under `connector_domainSettings` (map) of the Resource Forest domain using the SailPoint REST API. For example, if only the distribution group of the Shadow Account is considered, you can use the `shadowAccountMembershipFilter` attribute with a value such as `(!groupType:1.2.840.113556.1.4.803:=2147483648))`.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

### `provisionGroupToShadowAccount`

By default, the connector supports assigning only Universal and Global Distribution List groups from the Resource Forest Domain to the Shadow Account. To override this and support all other types of group provisioning to the Shadow Account, pass this attribute in the metadata of the AttributeRequest for the `memberOf` attribute as given in the following example:

```xml
<AttributeRequest op="Add" name="memberOf" value="<group-nativeIdentity>">
  <Attributes>
    <Map>
      <entry key="provisionGroupToShadowAccount" value="true" />
    </Map>
  </Attributes>
</AttributeRequest>
```

## Resource Forest Specific Application Configuration Attributes

This section lists additional Resource Forest Application configuration parameters:

### `supportFSPsFromResourceForest`

Set this Boolean attribute to `true` to enable aggregating and provisioning FSPs from the Resource Forest Domains for the Master Account. By default, the value is `false`.

## Microsoft Exchange Schema Attributes

In addition to the existing Microsoft Exchange account schema attributes, the following new attributes are added in the schema for new applications. For existing Active Directory applications, the following schema attributes must be added manually if required:

| Attribute | Description |
| --- | --- |
| `msExchRecipientTypeDetails` | Type of the Microsoft Exchange recipient object. Value 2 indicates that the mailbox type is a Linked Mailbox. |
| `shadowAccountDN` | The distinguished name of the Linked Mailbox Shadow Account (disabled account which was created while creating the Linked Mailbox). |
| `shadowAccountGuid` | The `objectGuid` of the Linked Mailbox Shadow Account. |