Machine Account Attributes

Machine account attributes are used in provisioning configurations for machine accounts.

After you have created the required machine account subtypes, you can use the machine account attributes to provision machine accounts in your SailPoint tenant.

Refer to Machine Identity Security Overview for more information.

Machine Account Provisioning Attributes

Note

The SAP HANA connector does not provide out-of-the-box machine account classification. Configure classification criteria based on your governance standard, such as naming conventions or role assignment.

Use the following table to map each machine account attribute to its display name, data type, requirement status, and usage notes.

Field (name)	Display Name	Type	Required	Notes
`USER_NAME`	User Name	`string`	Yes	Native SAP HANA database user name for the machine account. The connector uppercases the value and rejects whitespace before issuing create SQL.
`password`	Password	`secret`	Yes	Required unless password authentication is disabled and an external authentication method is configured. Use the Create Password generator.
`FORCE_PWD_CHG_ON_NEXT_LOGON`	Force Password Change On Next Logon	`string`	No	Recommended default is `NO`. The connector maps `NO` to `NO FORCE_FIRST_PASSWORD_CHANGE`. Allowed values are `YES` and `NO`.
`IS_RESTRICTED`	Restricted	`string`	No	Recommended default is `TRUE` for restricted application users and `FALSE` for standard technical users. When set to `TRUE`, the connector emits `CREATE RESTRICTED USER`. Restricted users require explicit JDBC/ODBC access and the `RESTRICTED_USER_JDBC_ACCESS` role when they must connect through JDBC/ODBC clients. Allowed values are `TRUE` and `FALSE`.
`DISABLE_PASSWORD`	Disable Password	`boolean`	No	Recommended default is `false`. If set to `true`, the connector creates the user with a generated password and then runs `ALTER USER ... DISABLE PASSWORD`. Use only when another authentication mechanism is intended.
`VALID_FROM`	Valid From	`string`	No	Optional validity start date and time.
`VALID_UNTIL`	Valid Until	`string`	No	Optional validity end date and time.
`SYSTEM_PRIVILEGES`	System Privileges	`string`	No	Assign only the minimum required system privileges at request time.
`APPLICATION_PRIVILEGES`	Application Privileges	`string`	No	Assign only the minimum required application privileges at request time.
`CATALOG_ROLES`	Catalog Roles	`string`	No	Assign catalog roles at request time.
`REPOSITORY_ROLES`	Repository Roles	`string`	No	Assign repository roles at request time. For restricted JDBC access, include `RESTRICTED_USER_JDBC_ACCESS`.
`IS_KERBEROS_ENABLED`	IS_KERBEROS_ENABLED	`boolean`	No	Use only when Kerberos authentication is intended and the external identity is known. Kerberos authentication is not supported when using SAP HANA Cloud database.
`EXTERNAL_IDENTITY_KERBEROS`	External ID for Kerberos	`string`	No	Specifies the external identifier for Kerberos authentication. Use only when Kerberos authentication is intended.
`IS_SAML_ENABLED`	IS_SAML_ENABLED	`boolean`	No	Use only when SAML authentication is intended and identity-provider mapping is configured.
`SAML_PROVIDER`	Identity Provider Name	`string`	No	Specifies the SAML identity provider name. Use only when SAML authentication is intended.
`EXTERNAL_IDENTITY_SAML`	External ID for SAML	`string`	No	Specifies the external identifier for SAML authentication. Use only when SAML authentication is intended.
`SAML_PROVIDERS`	SAML Providers List	`string`	No	Enter SAML provider names and external identifiers in the format `Provider::ExternalIdentifier`. Separate multiple values with a comma. Use only when SAML authentication is intended.
`IS_JWT_ENABLED`	IS_JWT_ENABLED	`boolean`	No	Use only when JWT authentication is intended and provider mapping is configured.
`JWT_PROVIDERS`	JWT_PROVIDERS	`string`	No	Provide JWT providers and external identifiers in the format `<jwt_provider>::<external_identifier>`. Separate multiple providers with a comma. Use only when JWT authentication is intended.

For additional attribute descriptions and provisioning behavior, refer to Default Create Account Attributes.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.