Schema Reference

The application schema is used to configure the objects returned from a connector.

The Salesforce SaaS connector uses the following default correlation and object configurations.

Default Correlation Configuration

Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements.

You can customize the correlation configuration. Refer to Assigning Source Accounts to Identities for more information.

When you first create the Salesforce SaaS source, the default correlation mapping is:

Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.

Updating the Schema

For pre-existing sources, perform the following steps to start using new attributes with your source. Refer to the appropriate attribute section for detailed information about updating the schema.

1. Use the createSchema API to create a new group schema for your source.
2. Update the account schema with the following steps:
   1. Get the account schema using the getSchema API.
   2. Copy the schema to a file and search for the attribute corresponding to the group schema you created earlier.
   3. Add and update the properties for the attribute you found.
   4. Add the modified schema to the payload to update the account schema in the source using the replaceSchema API.

Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as account IDs.

The following table lists the default account IDs for this connector:

Default Account Attributes

The Salesforce SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

Additional Account Attributes for the Salesforce Connector

• (For attributes present on user object only) The Salesforce SaaS connector enables you to aggregate and update custom attributes present on user objects. The custom attributes added in the Salesforce user schema must have __c appended to the attribute names created in Salesforce.

  For example, if you added EMP_DEPARTMENT in the user entity on the Salesforce system, you should also add EMP_DEPARTMENT__c in the Salesforce user schema.

  Note

  Custom attributes can also be updated.

• Support for custom attributes not present in Salesforce system but are required internally in SailPoint, such as for a configured correlation rule can be acknowledged if the attribute is prepended with _#. For example:

  _#Emp_company_history

Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.

User and Group Object Modification

The Salesforce SaaS connector supports user object modification while enabling and disabling accounts. For enable or disable account operations, you can modify other attributes of the account that are part of the user object.

The connector supports multiple group objects and entitlements by having the group object schemas defined and aggregated. The following are the group object schemas:

• PublicGroups
• CollaborationGroup
• Role (includes the role hierarchy)
• PermissionSet
• PermissionSetGroup
• PermissionSetLicense
• ManagedPackage
• DelegateGroup

User and group object modification is supported by default in new Salesforce sources. For pre-existing sources, you must add the following group schemas manually using the createSchema API, as described in Updating the Schema.

{
    "type": "PermissionSet",
    "displayAttribute": "Name",
    "identityAttribute": "Id",
    "nativeObjectType": "PermissionSet",
    "attributes": [
        {
            "name": "Id",
            "type": "string",
            "description": "The permission set's ID"
        },
        {
            "name": "Name",
            "type": "string",
            "description": "The internal id for this profile"
        },
        {
            "name": "Label",
            "type": "string",
            "description": "The friendly name assigned to the profile"
        },
        {
            "name": "Description",
            "type": "string",
            "description": "Description for the profiles"
        }
    ]
}

{
    "type": "PermissionSetGroup",
    "displayAttribute": "MasterLabel",
    "identityAttribute": "Id",
    "nativeObjectType": "PermissionSetGroup",
    "attributes": [
        {
            "name": "Id",
            "type": "string",
            "description": "The permission set group's ID"
        },
        {
            "name": "MasterLabel",
            "type": "string",
            "description": "The permission set group's Name"
        },
        {
            "name": "Description",
            "type": "string",
            "description": "A description of the permission set group"
        }
    ]
}

{
    "type": "CollaborationGroup",
    "displayAttribute": "Name",
    "identityAttribute": "Id",
    "nativeObjectType": "CollaborationGroup",
    "attributes": [
        {
            "name": "Id",
            "type": "string",
            "description": "The collaboration group's ID"
        },
        {
            "name": "Name",
            "type": "string",
            "description": "The collaboration group's name"
        },
        {
            "name": "CollaborationType",
            "type": "string",
            "description": "The collaboration group type"
        }
    ]
}

{
    "type": "ManagedPackage",
    "displayAttribute": "NamespacePrefix",
    "identityAttribute": "Id",
    "nativeObjectType": "ManagedPackage",
    "attributes": [
        {
            "name": "Id",
            "type": "string",
            "description": "The managed package's ID"
        },
        {
            "name": "NamespacePrefix",
            "type": "string",
            "description": "The managed package's namespace prefix"
        }
    ]
}

Add the following attributes to the account schema of pre-existing sources:

• QueueNames - Type: string, multi: true, entitlement: true, managed: true
• PermissionSet - Type: string, multi: true, entitlement: true, managed: true, schemaObjectType: PermissionSet
• ManagedPackage - Type: string, multi: true, entitlement: true, managed: true, schemaObjectType: ManagedPackage
• CollaborationGroup - Type: string, multi: true, entitlement: true, managed: true, schemaObjectType: CollaborationGroup
• PermissionSetLicense - Type: string, multi: true, entitlement: true, managed: true, schemaObjectType: PermissionSetLicense
• PermissionSetGroup - Type: string, multi: true, entitlement: true, managed: true, schemaObjectType: PermissionSetGroup

Default Group Attributes

The Salesforce SaaS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

Profiles are aggregated during account-group aggregation. The following are the attributes returned by the group aggregation process.

Default Role Attributes

When aggregating group attributes as role objects, the following attributes are returned by the role aggregation process:

Aggregating group attributes as role objects enables the connector to delete a role associated with a user provisioning and assign a new role to a user during provisioning.

New sources support the Role object with bidirectional role hierarchy at one level by default. For an existing source, update the Role schema with the hierarchyAttribute set to ParentRoleId and the attributes listed in the table above to get support for the role hierarchy:

{
    "hierarchyAttribute": "ParentRoleId",
    "attributes": [
        {
            "name": "CaseAccessForAccountOwner",
            "type": "STRING",
            "schema": null,
            "description": "The case access level for the account owner",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "ContactAccessForAccountOwner",
            "type": "STRING",
            "schema": null,
            "description": "The contact access level for the account owner",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "OpportunityAccessForAccountOwner",
            "type": "STRING",
            "schema": null,
            "description": "The opportunity access level for the account owner",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "ParentRoleId",
            "type": "STRING",
            "schema": null,
            "description": "Unique identifier for role's parent role",
            "isMulti": true,
            "isEntitlement": false,
            "isGroup": false
        }
    ]
}

Then use the REST API for Entitlement Aggregation and add disableOptimization=true in the payload to trigger a full entitlement aggregation. For example:

https://{tenant}.api.identitynow.com/beta/entitlements/aggregate/sources/:id?disableOptimization=true

Default PublicGroup Attributes

When aggregating PublicGroup attributes as group objects, the following attributes are returned by the group aggregation process:

Aggregating PublicGroup as a group object enables the connector to verify aggregated Public Groups not currently associated with a user, and assign any new Public Group to users during provisioning.

Default PermissionSet Attributes

When aggregating PermissionSet attributes as group objects, the following attributes are returned by the group aggregation process:

Aggregating PermissionSet as a group object enables the connector to verify aggregated PermissionSets not currently associated with a user, and assign any new PermissionSet to users during provisioning.

Default PermissionSetGroup Attributes

When aggregating PermissionSetGroup attributes as group objects, the following attributes are returned by the group aggregation process:

Aggregating PermissionSetGroup as a group object enables the connector to verify aggregated PermissionSetGroups not currently associated with a user, and assign any new PermissionSetGroup to users during provisioning.

Default PermissionSetLicense Attributes

When aggregating PermissionSetLicense attributes as group objects, the following attributes are returned by the group aggregation process:

Aggregating PermissionSetLicense as a group object enables the connector to verify aggregated PermissionSetLicenses not currently associated with a user, and assign any new PermissionSetLicense to users during provisioning.

Default ManagedPackage Attributes

While aggregating ManagedPackage attributes as group objects, the following attributes are returned by the group aggregation process:

Aggregating ManagedPackage as a group object enables the connector to verify aggregated managed packages not currently associated with a user, and assign any new managed package to users during provisioning.

Default CollaborationGroup Attributes

While aggregating CollaborationGroup attributes as group objects, the following attributes are returned by the group aggregation process:

Aggregating CollaborationGroup as a group object enables the connector to verify aggregated collaboration groups not currently associated with a user, and assign any new collaboration group to users during provisioning.

For pre-existing sources, update the Account schema with a CollaborationGroup schema attribute to start managing Collaboration Groups in account aggregation, then add the schema above using the Create a new Schema on the Specified Source process. Refer to Updating the Schema for more information.

Default DelegateGroup Attributes

The Salesforce SaaS connector supports the Salesforce DelegateGroup object.

Aggregating DelegateGroup as a group object enables the connector to verify aggregated Delegate Groups not currently associated with a user, and assign any new Delegate Group to users during provisioning.

New sources have the DelegateGroup account schema attribute by default. For existing sources, add the following attribute to your account schema to manage DelegateGroup objects in account aggregation:

{
    "name": "DelegateGroup",
    "type": "STRING",
    "schema": {
        "type": "CONNECTOR_SCHEMA",
        "id": <Add the Schema ID for the Delegate Group Object>,
        "name": "DelegateGroup"
    },
    "description": "The ID of the Delegate Group assigned to the user",
    "isMulti": true,
    "isEntitlement": true,
    "isGroup": true
}

To aggregate DelegateGroup as a group object, add the following JSON to the group schema via the IDN REST API to add the new schema to an existing source:

{
    "name": "DelegateGroup",
    "nativeObjectType": "DelegateGroup",
    "identityAttribute": "Id",
    "displayAttribute": "Name",
    "hierarchyAttribute": null,
    "includePermissions": false,
    "features": [],
    "configuration": {},
    "attributes": [
        {
            "name": "Id",
            "type": "STRING",
            "schema": null,
            "description": "The Delegate Group's unique identifier",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "Name",
            "type": "STRING",
            "schema": null,
            "description": "The developer group's unique label",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "DeveloperName",
            "type": "STRING",
            "schema": null,
            "description": "The unique developer name for the delegate group",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "IsLoginAccessEnabled",
            "type": "BOOLEAN",
            "schema": null,
            "description": "Indicates if login access is enabled for the developer group",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        }
    ]
}

Default Machine Identity Attributes

Machine Identity attributes define the multiple types of machine identities that can be assigned to the managed system's user accounts.

For more information, refer to Machine Identity Security Overview.

When aggregating Machine Identity Attributes as group objects, the following attributes are returned by the group aggregation process:

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.