# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The PingOne connector uses the following default correlation and object configurations.

## Default Correlation Configuration

Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements.

You can customize the correlation configuration. Refer to [Assigning Source Accounts to Identities](<https://documentation.sailpoint.com/saas/help/accounts/correlation.html>) for more information.

When you first create the PingOne source, the default correlation mapping is:

| Account Attribute | Operation | Identity Attribute |
| --- | --- | --- |
| username | Equals | SailPoint Username (uid) |
| email | Equals | Work email (email) |

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account Attributes

The PingOne connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description |
| --- | --- |
| id | The user's unique ID. |
| username | The user's unique name. |
| email | The user's email address. |
| name.honorificPrefix | The user's honorific prefix. |
| name.given | The user's first name. |
| name.middle | The user's middle name. |
| name.family | The user's last name. |
| name.honorificSuffix | The user's honorific suffix. |
| name.formatted | The user's full name. |
| nickname | The user's nickname. |
| enabled | The user's active status. |
| mfaEnabled | Indicates if the user requires multifactor authentication (MFA). |
| createdAt | Time and date when the user was originally created. |
| updatedAt | Time and date when the user was most recently modified. |
| verifyStatus | Indicates if the user requires ID Validation authentication. |
| environment.id | The user's environment ID. |
| account.canAuthenticate | Indicates if the user has authenticated and can log in to the system. |
| account.status | The user's account status. |
| emailVerified | The user's email verification status. |
| address.streetAddress | The user's street address. |
| address.locality | The user's locality. |
| address.region | The user's region. |
| address.postalCode | The user's ZIP or postal code. |
| address.countryCode | The user's country code. |
| identityProvider.type | The user's identity provider type. |
| identityProvider.id | The user's identity provider ID. |
| lastSignOn.at | Date and time for the user's last remote sign-in sessions. |
| lastSignOn.remoteIp | The IP address used during the user's last remote sign-in session. |
| lifecycle.status | The user's lifecycle status. |
| locale | The user's default location. |
| type | The user's type. |
| title | The user's title. |
| primaryPhone | The user's primary phone number. |
| mobilePhone | The user's mobile phone number. |
| preferredLanguage | The user's preferred written or spoken languages. |
| timezone | The user's local timezone. |
| groups | The groups assigned to the user. |
| roles | The roles assigned to the user. |
| population | The user's population. |

> [!NOTE]
>
> The PingOne connector supports aggregation of custom attributes. For more information, refer to [Custom Attributes](<#custom-attributes>).

## Custom Attributes

Following are the two types of Custom attributes supported in PingOne:

#### Configuring Custom Attributes in Account schema and Create Account

1. Declared

   For example:

   ```text
   {

   CustomAttribute : "Value",

   CustomMultiValuedAtts : ["Value1", "Value2"]

   }
   ```

   Declared attributes can be added directly in Account schema by attribute name.

   > **Note**
   >
   > While configuring multivalued attribute in Account schema Ensure to mark that attribute as multivalued.
2. JSON

   The following example outlines how to add the JSON attributes in Account schema

   ```text
   {

   CustomJSONAttribute : {

   "id" : "01",

   "name" : "Test"

   }

   }
   ```

   Below ID and Name should be added as complex attributes:

   - `CustomJSONAttribute.id`
   - `CustomJSONAttribute.name`

> [!NOTE]
>
> Provisioning of custom multi-valued JSON attribute is not supported in PingOne connector.

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

The PingOne connector supports three types of entitlements: [group](<#default-group-attributes>), [role](<#default-role-attributes>), and [population](<#default-population-attributes>).

### Default Group Attributes

The PingOne connector also supports groups. The following attributes must be configured on your source and within SailPoint in order to manage groups.

| Attribute Name | Description |
| --- | --- |
| id | The group's unique ID. |
| name | The group's display name. |
| description | The group's description. |
| environment.id | The group's environment ID. |
| population.id | The group's population ID. |
| directMemberCounts.users | Total number of users which belong to the group. |
| directMemberCounts.groups | Total number of groups which belong to the group. |
| createdAt | Time and date when the group was originally created. |
| updatedAt | Time and date that the group was most recently modified. |
| checkSum | The group's checkSum. |

### Default Role Attributes

The PingOne connector supports roles. The following attributes must be configured on your source and within SailPoint in order to manage roles. Refer to [Managing Roles](<https://documentation.sailpoint.com/saas/help/access/roles.html>) for more information.

| Attribute Name | Description |
| --- | --- |
| id | The role's unique identifier. |
| name | The role's display name. |
| description | The role's description. |
| type | The role's type. |

### Default Population Attributes

The PingOne connector also supports population. The following attributes must be configured on your source and within SailPoint in order to manage population.

| Attribute Name | Description |
| --- | --- |
| id | The population's unique ID. |
| name | The population's display name. |
| environment.id | The population's environment ID. |
| description | The population's description. |
| userCount | Total number of users that belong to the population. |
| default | The default status of the population. |
| createdAt | Date and time the population was created. |
| updatedAt | Date and time that the population was most recently modified. |
| passwordPolicy.id | The population's passwordPolicy ID. |