Provisioning
The PingOne connector supports provisioning, allowing you to create and manage accounts and entitlements in PingOne directly from SailPoint.
Prerequisite: Your system is configured for provisioning.
When SailPoint provisions new accounts to the source, it uses the attributes on the Create Account page as instructions or a template for what to include in the account. This page is also referred to as the provisioning policy.
When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.
For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.
Important
This section describes the default Create Account configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.
Default Create Account Attributes
| Account Attribute | Generator | Description |
|---|---|---|
| username | Identity Attribute - Work Email | The user's UserName. |
| Identity Attribute - Work Email | The user's email. | |
| name.given | Identity Attribute - First Name (firstname) | The user's first name. |
| name.family | Identity Attribute - Last Name (lastname) | The user's last name. |
| name.middle | Disable | The user's middle name. |
| name.honorificPrefix | Disable | The user's honorific prefix. |
| name.honorificSuffix | Disable | The user's honorific suffix. |
| nickname | Disable | The user's nickname. |
| enable | Static true | Active status of the user. This attribute is set to 'true' by default when the user is created. Set the value to 'false' to create the user in a disabled state. |
| mfaEnabled | Disable | Indicates if the user requires multifactor authentication (MFA). This attribute is set to 'false' by default when the user is created. |
| identityProvider.id | Disable | The user's identityProvider id. |
| locale | Disable | The user's default location. For example, en-US, es-419, az-Arab, x-pig-latin, man-Nkoo-GN. |
| password | Disable | The password of the user. The password should meet the password policy set in the PingOne system. |
| address.streetAddress | Disable | The user's street address. |
| address.locality | Disable | The user's locality. |
| address.region | Disable | The user's region. |
| address.postalCode | Disable | The user's ZIP or postal code. |
| address.countryCode | Disable | The user's country code. The country name component. When specified, the value MUST be in ISO 3166-1 \"alpha-2\". |
| lifecycle.status | Disable | The user's lifecycle status. This attribute is set to 'ACCOUNT_OK' by default when the user is created. It can be set as 'VERIFICATION_REQUIRED' if email verification is required after creation of the new account. |
| lifecycle.suppressVerificationCode | Disable | The user will receive a verification email automatically. This attribute is set to 'false' by default when the user is created. It can be set as 'true' for the user to receive a verification email automatically. |
| title | Disable | The user's title. |
| type | Disable | The user's type. |
| primaryPhone | Disable | The user's primary phone number. It must consist of at least one digit and must not contain more than 32 characters. |
| mobilePhone | Disable | The user's mobile phone number. It must consist of at least one digit and must not contain more than 32 characters. |
| preferredLanguage | Disable | The user's preferred written or spoken languages. |
| timezone | Disable | The user's local timezone. It must conform with the IANA Time Zone database format [RFC6557], also known as the \"Olson\" time zone database format [Olson-TZ]. For example, America/Los_Angeles. |
| accountId | Disable | The user's account ID. This attribute is organization-specific and has no special meaning within the platform. |
| population.id | Disable | The user's population ID. |
Managing Population
During Account Creation
The population is set using the population.id attribute. If a default population is configured in PingOne, new accounts are automatically assigned to it. To use a different population, you can either:
Add the population.id attribute to the Create Profile with the desired population ID, or
Assign the population as an entitlement.
After Account Creation
You can only modify the population when it is added as an entitlement.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.