Schema Reference

The application schema is used to configure the objects returned from a connector.

Note

The Account Schema tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as Entitlement or Multi-Valued. Refer to Managing Source Account Schemas for more information.
The schema attributes that are not present by default must be defined as strings if not specified.

The Oracle Access Governance connector uses the following default correlation and object configurations.

Default Correlation Configuration

Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements.

You can customize the correlation configuration. Refer to Assigning Source Accounts to Identities for more information.

When you first create the Oracle Access Governance source, the default correlation mapping is:

Account Attribute	Operation	Identity Attribute
`email`	Equals, ignoring case	Email

Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.

Default Account Attributes

The Oracle Access Governance connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

The account schema represents Oracle Access Governance identities. The identity attribute is id, and the display attribute is displayName.

Attribute Name	Description
`id`	Unique Oracle Access Governance identity ID.
`displayName`	Display name of the identity. When no display name is available, the connector uses the sign-in name.
`email`	Email address of the identity. This is the default correlation attribute.
`status`	Status of the identity in title case, such as `Active`.
`connectedApplications`	Orchestrated systems where the identity has access.
`roles`	Native IDs of the roles assigned to the identity.
`accessBundles`	Native IDs of the access bundles assigned directly to the identity. The connector omits bundles granted through a role because Oracle Access Governance does not allow them to be revoked individually.
`expiringSoonAccess`	Access that Oracle Access Governance identifies as expiring soon. Each value uses the format `name :: expiry :: status`. The attribute is empty when access is indefinite or has not entered its configured notification window.

Direct Permissions

The connector displays permissions assigned directly to an identity in the read-only Direct Permissions view. Each entry identifies the orchestrated system as the target and the permission title as the right. Direct permissions are not entitlements and cannot be requested or revoked from SailPoint.

Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.

Caution

Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

Default Role Attributes

The Oracle Access Governance connector supports roles. The following attributes must be configured on the managed system and in the SailPoint source schema to manage roles.

The role entitlement represents an Oracle Access Governance role. The identity attribute is id, and the display attribute is name.

Attribute Name	Description
`id`	Native ID of the role.
`name`	Name of the role. Role names are unique within Oracle Access Governance.
`description`	Description of the role. The connector provides a generated description when Oracle Access Governance does not return one.
`applications`	Distinct applications associated with the role's access bundles.
`includedAccessBundles`	Access bundles included in the role. Each value uses the format `BundleName (ApplicationName)`.
`includedPermissions`	Permissions granted by the role. Each value uses the format `Application / Bundle :: Permission`.

Access Bundle Attributes

The access bundle entitlement represents an Oracle Access Governance access bundle. The identity attribute is id, and the display attribute is displayName.

Attribute Name	Description
`id`	Native ID of the access bundle.
`name`	Name of the access bundle. The name might not be unique across applications.
`displayName`	Qualified display name in the format `BundleName (ApplicationName)`.
`description`	Description of the access bundle. The connector provides a generated description when Oracle Access Governance does not return one.
`applications`	Application that owns the access bundle.
`includedPermissions`	Permissions included in the access bundle. Each value uses the format `Application / Permission :: Context=Value`.
`accessTimeLimit`	Length of time the access bundle grants access, such as `365 days` or `1 hour`. The value is `Indefinite` when no time limit is configured.
`expiryNotification`	How long before expiration Oracle Access Governance identifies the access as expiring soon. The value is `None` when no notification window is configured.
`accessExtension`	Whether access can be extended beyond its time limit, such as `Up to 90 days`. The value is `None` when extensions are not available.

Access Bundle Attributes Default Account Attributes Default Correlation Configuration Default Entitlement Attributes Oracle Access Governance SaaS Schema Reference

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.