# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The Oracle Solaris connector uses the following default correlation and object configurations.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| username | Account |
| groupname | Group |

### Default Account Attributes

The Oracle Solaris connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description |
| --- | --- |
| username | The name of the user. This is an Account ID which must not be changed. |
| uid | The Numeric ID for the user. |
| primgrp | An existing group integer ID or character-string name. Without the `-D` option it defines the new user primary group membership and defaults to the default group. You can reset this default value by invoking `useradd -D -g group`. GIDs 0-99 are reserved for allocation by the Solaris Operating System. |
| groups | Secondary groups of the user. The list of groups assigned to the user. |
| roles | Contains the list of roles for each user. |
| home | The home directory of the user. |
| shell | The default shell of the user. |
| comment | Any text string. It is generally a short description of the login and is currently used as the field for the user's full name. This information is stored in the user's `/etc/passwd` entry. |
| auths | One or more comma separated authorizations defined in auth\_attr(4). Only a user or role who has grant rights to the authorization can assign it to an account. |
| project | The name of the project with which the added user is associated. See the projname field as defined in project(4). |
| expire | Specify the expiration date for a login. After this date, no user will be able to access this login. The expire option argument is a date entered using one of the date formats included in the template file `/etc/datemsk`. See getdate(3C). If the date format that you choose includes spaces, it must be quoted. For example, you can enter 10/6/90 or October 6, 1990. A null value (" ") defeats the status of the expired date. This option is useful for creating temporary logins. |
| inactive | The maximum number of days allowed between uses of a login ID before that ID is declared invalid. Normal values are positive integers. A value of 0 defeats the status. |
| lock\_after\_retries | Specifies whether an account is locked after the count of failed logins for a user equals or exceeds the allowed number of retries as defined by `RETRIES` in `/etc/default/login`. Possible values are *yes* or *no*. The default is no. Account locking is applicable only to local accounts and accounts in the LDAP name service repository if configured with an `enableShadowUpdate` of `true` as specified in `ldapclient(1M)`. |
| limitpriv | The maximum set of privileges a user or any process started by the user, whether through su(1M) or any other means, can obtain. The system administrator must take ensure that when deleting the privileges from the limit set. Deleting any basic privilege has the ability of crippling all applications; deleting any other privilege can cause many or all applications requiring privileges to malfunction. |
| defaultpriv | The default set of privileges assigned to a user's inheritable set upon login. |
| profiles | Contains an ordered, comma-separated list of profile names selected from prof\_attr(4). Profiles are enforced by the profile shells, pfcsh, pfksh, and pfsh. See pfsh(1). A default profile is assigned in `/etc/security/policy.conf` (see policy.conf(4)). If no profiles are assigned, the profile shells do not allow the user to execute any commands. |
| failedretries | Indicates if the user account is locked. Possible values include: **true**: The user account is locked. The values "yes", "true", and "always" are equivalent. The user is denied access to the system. **false**: The user account is not locked. The values "no", "false", and "never" are equivalent. The user is allowed access to the system. Default value. |
| pwdminage | The minimum number of days required between password changes for user. MINWEEKS is found in `/etc/default/passwd` and is set to NULL. |
| pwdmaxage | The maximum number of days the password is valid for user. MAXWEEKS is found in `/etc/default/passwd` and is set to NULL. |
| pwdwarn | The number of days relative to max before the password expires and the name are warned. |
| pwdlastchg | The date the password was last changed for the name. All password aging dates are determined using Greenwich Mean Time (Universal Time) and therefore can differ by as much as a day in other time zones. |
| lastLogin | The last login time of the user on the Solaris computer. |
| audit\_flags | Specifies per-user Audit pre selection flags as colon-separated **always-audit-flags** and **never-audit-flags**. For example, `audit_flags=always-audit-flags:never-audit-flags`. |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Group Attributes

The Oracle Solaris connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

| Attribute Name | Description |
| --- | --- |
| groupname | The name of the account group. This is an Account ID which must not be changed. |
| groupid | The Numeric ID of the account group. |