Schema Reference

The application schema is used to configure the objects returned from a connector.

Note

The Account Schema tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as Entitlement or Multi-Valued. Refer to Managing Source Account Schemas for more information.
The schema attributes that are not present by default must be defined as strings if not specified.

The SAP HANA connector uses the following default correlation and object configurations.

Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.

Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as account IDs.

Caution

Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.

To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

Account ID	Schema Object Type
USER_ID	Account
ROLE_ID	Group
ROLE_ID	REPOSITORY_ROLE

Default Account Attributes

The SAP HANA connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

Attribute Name	Description
USER_ID	The ID of the user. This is an Account ID which must not be changed.
USER_NAME	The name of the user.
USER_MODE	The mode of the user: - LOCAL - GLOBAL - EXTERNAL
CREATOR	The creator of the user.
VALID_FROM	Specify a date/time from when the user account is valid.
VALID_UNTIL	Specify a date/time until when the user account is valid.
IS_JWT_ENABLED	Indicates if JWT authentication is enabled for the user
IS_RESTRICTED	Specifies whether the user is a restricted user.
IS_CLIENT_CONNECT_ENABLED	Specifies whether the user is able to connect to the client.
JWT_PROVIDERS	Lists JWT providers with the external identifiers each one uses in the following format: `<jwt_provider>::<external_identifier>` If there are multiple providers, separate each one with a comma (`,`). For example: `MY_JWT_PROVIDER1::Jon,MY_JWT_PROVIDER1::jon`
HAS_REMOTE_USERS	Specifies whether there is a database user in another tenant database as the remote identity of the database user.
SESSION_CLIENT	Specifies the client whose data can be accessed by the user.
EMAIL_ADDRESS	The email address of the user.
TIME_ZONE	The time zone of the user.
AUTHENTICATION_TYPE	The different authentication methods supported by user.
SYSTEM_PRIVILEGES	The system privileges assigned to the user.
APPLICATION_PRIVILEGES	The application privileges assigned to the user.
CATALOG_ROLES	The catalog roles assigned to the user.
REPOSITORY_ROLES	The repository roles assigned to the user.
FORCE_PWD_CHG_ON_NEXT_LOGON	Specifies whether the user must change the password on the next logon in the SAP HANA database.
IS_KERBEROS_ENABLED	Specifies whether Kerberos authentication is enabled for user.
EXTERNAL_IDENTITY_KERBEROS	Specifies the external identifier for Kerberos authentication.
IS_SAML_ENABLED	Specifies whether SAML authentication is enabled for user.
SAML_PROVIDER	Specifies the SAML identity provider name.
SAML_PROVIDERS	Lists all configured SAML Identity Provider names along with their external identifiers in the following format: `Provider::ExternalIdentifier` This field will be populated if the user has multiple SAML providers available in the SAP HANA database. If there is only one SAML provider configuration available for user, this field will not hold any value.
EXTERNAL_IDENTITY_SAML	Specifies the external identifier for SAML authentication.

Custom User Parameters

The connector supports aggregating and provisioning custom parameters associated with a database user, available in the USER_PARAMETERS table in the SAP HANA database.

Custom Parameter Aggregation

In order to aggregate custom parameters for a database user that exists in the USER_PARAMETERS table in the SAP HANA database, you must add the parameter name with the prefix PARAM: (this must be in all capital letters) as an attribute in the account schema.

For example, to aggregate a parameter named ADDRESS, add the PARAM:ADDRESS attribute in the account schema.

Note

Ensure the attribute name (except the prefix PARAM:) matches the case of the parameter name in the database without any unwanted leading or trailing spaces.

Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.

Caution

Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

Group Aggregation Configuration

The SAP HANA source in SailPoint supports the following group and entitlement objects:

Object	Description
REPOSITORY_ROLE as group object	Supported Operation: Read
CATALOG_ROLE as Account Group CATALOG_ROLE	Supported Operation: Read
REPOSITORY_ROLE, SYSTEM_PRIVILEGE, APPLICATION_PRIVILEGE and CATALOG_ROLE as entitlement objects	Supported Operation: Add / Remove entitlement

For the SAP HANA source, only the Repository Roles and Catalog Roles are aggregated after entitlement aggregation. Other supported entitlement types display as Role IDs instead of their display names after the account aggregation.

Note

Some sources may not include Catalog Roles as group entitlements. To support Catalog Roles, you must add the CATALOG_ROLES schema as a group schema.

The following is an example of the JSON payload:

{
    "nativeObjectType": "CATALOG_ROLE",
    "identityAttribute": "ROLE_ID",
    "displayAttribute": "ROLE_NAME",
    "hierarchyAttribute": null,
    "includePermissions": false,
    "features": [],
    "configuration": {},
    "attributes": [
        {
            "name": "ROLE_NAME",
            "type": "STRING",
            "schema": null,
            "description": "Role name",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "ROLE_ID",
            "type": "STRING",
            "schema": null,
            "description": "Role ID",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "ROLE_MODE",
            "type": "STRING",
            "schema": null,
            "description": "Mode of the role: 'LOCAL' ",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "GLOBAL_IDENTITY",
            "type": "STRING",
            "schema": null,
            "description": "Identity specified for role with ROLE_MODE GLOBAL ",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "CREATOR",
            "type": "STRING",
            "schema": null,
            "description": "Name of the user who created the role ",
            "isMulti": false,
            "isEntitlement": false,
            "isGroup": false
        },
        {
            "name": "GRANTED_ROLES",
            "type": "STRING",
            "schema": null,
            "description": "The roles which are assigned to the current role ",
            "isMulti": true,
            "isEntitlement": false,
            "isGroup": false
        }
    ],
    "name": "catalog_roles",
    "modified": null
}

Account Attributes Account ID Entitlement Attributes Group Aggregation Configuration Integration SAP HANA Schema Reference VA-Based

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.