Schema Reference
The application schema is used to configure the objects returned from a connector.
Note
-
The Account Schema tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as Entitlement or Multi-Valued. Refer to Managing Source Account Schemas for more information.
-
The schema attributes that are not present by default must be defined as strings if not specified.
The Okta connector uses the following default correlation and object configurations.
Identity Profile Mapping
The Okta connector supports the following attributes in Identity Profile Mapping by default:
| Identity Attribute | Schema Attribute |
|---|---|
| uid | id |
| displayName | login |
| firstname | firstName |
| lastname | lastName |
| manager | manager |
| personalEmail | secondEmail |
| workPhone | mobilePhone |
| phone | primaryPhone |
| title | title |
| department | department |
Default Account Schema
Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.
The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.
Default Account ID
SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as account IDs.
Caution
Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
To resolve issues caused by changing account IDs, reconfigure them to their default values.
The following table lists the default account IDs for this connector:
| Account ID | Schema Object Type |
|---|---|
| id | Account |
| groupId | Group |
Default Account Attributes
The Okta connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.
| Attribute Name | Description |
|---|---|
| id | The unique key for the user. This is an Account ID which must not be changed. |
| login | The unique ID (username) used as the login |
| The primary email of the user | |
| firstName | The first name of the user |
| lastName | The last name of the user |
| password | The login password for the user |
| middleName | The middle name(s) of the user |
| secondEmail | The secondary email address of the user that is used for account recovery |
| displayName | The display name for the user |
| nickName | The casual way to address the user in real life |
| title | The user's title. For example, Sr. General Manager |
| honorificPrefix | The honorific prefix(es) of the user. For example, Dr., Mrs., Mr. |
| honorificSuffix | The honorific suffix(es) of the user. For example, MD, PhD, MSCSW |
| profileUrl | The URL of the user's online profile |
| primaryPhone | The primary phone number of the user |
| mobilePhone | The mobile phone number of the user |
| streetAddress | The full street address component of user's address |
| city | The city or locality component of the user's address |
| state | The state or region component of the user's address |
| zipCode | The zip code or postal code component of the user's address. |
| countryCode | The country name component of the user's address |
| postalAddress | The mailing address component of the user's address |
| preferredLanguage | The user's preferred written or spoken language |
| locale | The user's default location for purposes of localizing items such as currency, date/time format, numerical representations, etc. |
| timezone | The user's timezone |
| userType | Used to identify the type of the user, such as Employee or Contractor |
| employeeNumber | The unique identifier for the user that is assigned by the organization or company |
| costCenter | The name of the cost center assigned to the user |
| organization | The name of the user's organization |
| division | The name of the user's division |
| department | The name of the user's department |
| manager | The name of the user's manager |
| managerId | The ID of the user's manager |
| status | The status of the user. For example, Active, Provisioned, or Deprovisioned |
| created | The time stamp for when the user was originally created. |
| statusChanged | The time stamp for when the status was last changed |
| lastUpdated | The time stamp for when the user was last updated |
| lastLogin | The time stamp of last login session |
| passwordChanged | The time stamp for when the user's password was last changed |
| providerName | The name of the credential provider |
| providerType | The credential provider type |
| roles | The standard roles assigned to the user |
Default Entitlement Attributes
Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.
Caution
Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.
Default Group Attributes
The Okta connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.
| Attribute Name | Description |
|---|---|
| groupId | The unique key for the group. This is an Account ID which must not be changed. |
| name | The name of the group. |
| created | The timestamp for when the group was created. |
| description | The description of the group. |
| lastMembershipUpdated | The timestamp for when the group's memberships were last updated. |
| type | Indicates how a group's profile and memberships are managed. |
| lastUpdated | The time stamp for when the group's profile was last updated. |
| objectClass | The group's class, which determines the group's profile. |
| applications | Applications assigned to group. To add this attribute to an existing schema, refer to Adding Attributes to a Source Schema. Use the createSchema API to create a new group schema for your source. |
Default Application Attributes
By default, the applications attribute is not a part of the account schema. The applications attribute is a multi-valued, entitlement attribute associated with application group schema object type, and it aggregates the applications assigned to a user.
Note
applications is an account schema attribute and application is an entitlement schema object type.
The following is a list of application attributes.
| Attribute Name | Description |
|---|---|
| applicationId | Unique key for the application. |
| name | Unique key for the application definition. |
| label | Unique user-defined display name for the application. |
| created | Timestamp for when the application was created. |
| status | Status of the application. |
| signOnMode | Authentication mode of the application. |
| features | Enabled application features. |
| lastUpdated | Timestamp for when the application was last updated. |
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.