# Provisioning

The Oracle Solaris connector supports provisioning, allowing you to create and manage accounts and entitlements in Oracle Solaris directly from SailPoint.

**Prerequisite:** Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

> [!IMPORTANT]
>
> This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

## Default Create Account Attributes

| Account Attribute | Generator | Description |
| --- | --- | --- |
| username | Create Unique Account ID | This generator uses the value in the **Pattern Used** field to generate a unique user name for the new account. |
| password | Create Password | This generator creates an initial password for the new account that matches the password policy assigned to the associated Solaris source in SailPoint. |
| uid | Disable | The numeric identity of a user. |
| dupuid | Static | The duplicate identity of a user. |
| primgrp | Disable | An existing group integer ID or character-string name. Without the `-D` option, it defines the new user primary group membership and defaults to the default group. You can reset this default value by invoking `useradd -D -g group`. GIDs 0-99 are reserved for allocation by the Solaris Operating System. |
| home | Disable | The home directory of a user. |
| shell | Disable | The default shell of a user. |
| create\_home\_dir | Static | The creation of the home directory of a user. |
| expire | Disable | Specifies the expiration date for a login. After this date, no user is able to access this login. The expire option argument is a date entered using one of the date formats included in the template `/etc/datemsk` file. If the date format that you choose includes spaces, the space must be quoted (" "). |
| inactive | Disable | The maximum number of days allowed between uses of a login ID before that ID is declared invalid. Normal values are positive integers. A value of *0* defeats the status. |
| lock\_after\_retries | Disable | Specifies whether an account is locked after a number of failed logins as defined by `RETRIES` in `/etc/default/login`. Possible values are *yes* or *no*. The default is *no*. Account locking is only applicable to local accounts and accounts in the LDAP name service repository, if configured with an `enableShadowUpdate` of `true` as specified in `ldapclient(1M)`. |
| profile | Disable | An ordered, comma-separated list of profile names selected from `prof_attr`. Profiles are enforced by the profile shells `pfcsh`, `pfksh`, and `pfsh`. If no profiles are assigned, the profile shells do not allow the user to execute any commands. |
| auths | Disable | One or more comma separated authorizations defined in `auth_attr`. Only a user or role that has grant rights to the authorization can assign it to an account. |
| pwdwarn | Disable | The number of days, relative to max, before the password expires and the system issues a password expiration warning. |
| pwdminage | Disable | The minimum number of days required between password changes for the user. `MINWEEKS` is found in `/etc/default/passwd` and is set to NULL. |
| pwdmaxage | Disable | The maximum number of days the password is valid for the user. `MAXWEEKS` is found in `/etc/default/passwd` and is set to `NULL`. |
| forcepwdchange | Static | Use this attribute to force the user to change their password on next logon. |
| project | Disable | The name of the project that the added user is associated. |
| comment | Disable | Any text string. It is generally a short description of the login, and is currently used as the field for the user's full name. This information is stored in the user's `/etc/passwd` entry. |