Schema Reference

The application schema is used to configure the objects returned from a connector.

Note

The Account Schema tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as Entitlement or Multi-Valued. Refer to Managing Source Account Schemas for more information.
The schema attributes that are not present by default must be defined as strings if not specified.

The PingOne connector uses the following default correlation and object configurations.

Default Correlation Configuration

Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements.

You can customize the correlation configuration. Refer to Assigning Source Accounts to Identities for more information.

When you first create the PingOne source, the default correlation mapping is:

Account Attribute	Operation	Identity Attribute
username	Equals	SailPoint Username (uid)
email	Equals	Work email (email)

Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.

Default Account Attributes

The PingOne connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

Attribute Name	Description
id	The user's unique ID.
username	The user's unique name.
email	The user's email address.
name.honorificPrefix	The user's honorific prefix.
name.given	The user's first name.
name.middle	The user's middle name.
name.family	The user's last name.
name.honorificSuffix	The user's honorific suffix.
name.formatted	The user's full name.
nickname	The user's nickname.
enabled	The user's active status.
mfaEnabled	Indicates if the user requires multifactor authentication (MFA).
createdAt	Time and date when the user was originally created.
updatedAt	Time and date when the user was most recently modified.
verifyStatus	Indicates if the user requires ID Validation authentication.
environment.id	The user's environment ID.
account.canAuthenticate	Indicates if the user has authenticated and can log in to the system.
account.status	The user's account status.
emailVerified	The user's email verification status.
address.streetAddress	The user's street address.
address.locality	The user's locality.
address.region	The user's region.
address.postalCode	The user's ZIP or postal code.
address.countryCode	The user's country code.
identityProvider.type	The user's identity provider type.
identityProvider.id	The user's identity provider ID.
lastSignOn.at	Date and time for the user's last remote sign-in sessions.
lastSignOn.remoteIp	The IP address used during the user's last remote sign-in session.
lifecycle.status	The user's lifecycle status.
locale	The user's default location.
type	The user's type.
title	The user's title.
primaryPhone	The user's primary phone number.
mobilePhone	The user's mobile phone number.
preferredLanguage	The user's preferred written or spoken languages.
timezone	The user's local timezone.
groups	The groups assigned to the user.
roles	The roles assigned to the user.
population	The user's population.

Note

The PingOne connector supports aggregation of custom attributes. For more information, refer to Custom Attributes.

Custom Attributes

Following are the two types of Custom attributes supported in PingOne:

Configuring Custom Attributes in Account schema and Create Account

Declared

For example:
```
{

CustomAttribute : "Value",

CustomMultiValuedAtts : ["Value1", "Value2"]

}
```
Declared attributes can be added directly in Account schema by attribute name.

Note

While configuring multivalued attribute in Account schema Ensure to mark that attribute as multivalued.
JSON

The following example outlines how to add the JSON attributes in Account schema
```
{

CustomJSONAttribute : {

"id" : "01",

"name" : "Test"

}

}
```
Below ID and Name should be added as complex attributes:
- CustomJSONAttribute.id
- CustomJSONAttribute.name

Note

Provisioning of custom multi-valued JSON attribute is not supported in PingOne connector.

Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.

Caution

Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

The PingOne connector supports three types of entitlements: group, role, and population.

Default Group Attributes

The PingOne connector also supports groups. The following attributes must be configured on your source and within SailPoint in order to manage groups.

Attribute Name	Description
id	The group's unique ID.
name	The group's display name.
description	The group's description.
environment.id	The group's environment ID.
population.id	The group's population ID.
directMemberCounts.users	Total number of users which belong to the group.
directMemberCounts.groups	Total number of groups which belong to the group.
createdAt	Time and date when the group was originally created.
updatedAt	Time and date that the group was most recently modified.
checkSum	The group's checkSum.

Default Role Attributes

The PingOne connector supports roles. The following attributes must be configured on your source and within SailPoint in order to manage roles. Refer to Managing Roles for more information.

Attribute Name	Description
id	The role's unique identifier.
name	The role's display name.
description	The role's description.
type	The role's type.

Default Population Attributes

The PingOne connector also supports population. The following attributes must be configured on your source and within SailPoint in order to manage population.

Attribute Name	Description
id	The population's unique ID.
name	The population's display name.
environment.id	The population's environment ID.
description	The population's description.
userCount	Total number of users that belong to the population.
default	The default status of the population.
createdAt	Date and time the population was created.
updatedAt	Date and time that the population was most recently modified.
passwordPolicy.id	The population's passwordPolicy ID.

Account Attributes Correlation Configuration Custom Attributes Entitlement Attributes PingOne PingOne SaaS SaaS Schema Reference

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.