# Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The SAP HANA connector uses the following default correlation and object configurations. ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | USER\_ID | Account | | ROLE\_ID | Group | | ROLE\_ID | REPOSITORY\_ROLE | ### Default Account Attributes The SAP HANA connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. | Attribute Name | Description | | --- | --- | | USER\_ID | The ID of the user. This is an Account ID which must not be changed. | | USER\_NAME | The name of the user. | | USER\_MODE | The mode of the user:
\- LOCAL
\- GLOBAL
\- EXTERNAL | | CREATOR | The creator of the user. | | VALID\_FROM | Specify a date/time from when the user account is valid. | | VALID\_UNTIL | Specify a date/time until when the user account is valid. | | IS\_JWT\_ENABLED | Indicates if JWT authentication is enabled for the user | | IS\_RESTRICTED | Specifies whether the user is a restricted user. | | IS\_CLIENT\_CONNECT\_ENABLED | Specifies whether the user is able to connect to the client. | | JWT\_PROVIDERS | Lists JWT providers with the external identifiers each one uses in the following format:
`::`
If there are multiple providers, separate each one with a comma (`,`).
For example:
`MY_JWT_PROVIDER1::Jon,MY_JWT_PROVIDER1::jon` | | HAS\_REMOTE\_USERS | Specifies whether there is a database user in another tenant database as the remote identity of the database user. | | SESSION\_CLIENT | Specifies the client whose data can be accessed by the user. | | EMAIL\_ADDRESS | The email address of the user. | | TIME\_ZONE | The time zone of the user. | | AUTHENTICATION\_TYPE | The different authentication methods supported by user. | | SYSTEM\_PRIVILEGES | The system privileges assigned to the user. | | APPLICATION\_PRIVILEGES | The application privileges assigned to the user. | | CATALOG\_ROLES | The catalog roles assigned to the user. | | REPOSITORY\_ROLES | The repository roles assigned to the user. | | FORCE\_PWD\_CHG\_ON\_NEXT\_LOGON | Specifies whether the user must change the password on the next logon in the SAP HANA database. | | IS\_KERBEROS\_ENABLED | Specifies whether Kerberos authentication is enabled for user. | | EXTERNAL\_IDENTITY\_KERBEROS | Specifies the external identifier for Kerberos authentication. | | IS\_SAML\_ENABLED | Specifies whether SAML authentication is enabled for user. | | SAML\_PROVIDER | Specifies the SAML identity provider name. | | SAML\_PROVIDERS | Lists all configured SAML Identity Provider names along with their external identifiers in the following format: `Provider::ExternalIdentifier`
This field will be populated if the user has multiple SAML providers available in the SAP HANA database. If there is only one SAML provider configuration available for user, this field will not hold any value. | | EXTERNAL\_IDENTITY\_SAML | Specifies the external identifier for SAML authentication. | ### Custom User Parameters The connector supports aggregating and provisioning custom parameters associated with a database user, available in the `USER_PARAMETERS` table in the SAP HANA database. #### Custom Parameter Aggregation In order to aggregate custom parameters for a database user that exists in the `USER_PARAMETERS` table in the SAP HANA database, you must add the parameter name with the prefix `PARAM:` (this must be in all capital letters) as an attribute in the account schema. For example, to aggregate a parameter named `ADDRESS`, add the `PARAM:ADDRESS` attribute in the account schema. > [!NOTE] > > Ensure the attribute name (except the prefix `PARAM:`) matches the case of the parameter name in the database without any unwanted leading or trailing spaces. ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Group Aggregation Configuration The SAP HANA source in SailPoint supports the following group and entitlement objects: | Object | Description | | --- | --- | | REPOSITORY\_ROLE as group object | Supported Operation: Read | | CATALOG\_ROLE as Account Group CATALOG\_ROLE | Supported Operation: Read | | REPOSITORY\_ROLE, SYSTEM\_PRIVILEGE, APPLICATION\_PRIVILEGE and CATALOG\_ROLE as entitlement objects | Supported Operation: Add / Remove entitlement | For the SAP HANA source, only the Repository Roles and Catalog Roles are aggregated after entitlement aggregation. Other supported entitlement types display as Role IDs instead of their display names after the account aggregation. > [!NOTE] > > Some sources may not include Catalog Roles as group entitlements. To support Catalog Roles, you must add the CATALOG\_ROLES schema as a group schema. The following is an example of the JSON payload: ```json { "nativeObjectType": "CATALOG_ROLE", "identityAttribute": "ROLE_ID", "displayAttribute": "ROLE_NAME", "hierarchyAttribute": null, "includePermissions": false, "features": [], "configuration": {}, "attributes": [ { "name": "ROLE_NAME", "type": "STRING", "schema": null, "description": "Role name", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ROLE_ID", "type": "STRING", "schema": null, "description": "Role ID", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ROLE_MODE", "type": "STRING", "schema": null, "description": "Mode of the role: 'LOCAL' ", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "GLOBAL_IDENTITY", "type": "STRING", "schema": null, "description": "Identity specified for role with ROLE_MODE GLOBAL ", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "CREATOR", "type": "STRING", "schema": null, "description": "Name of the user who created the role ", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "GRANTED_ROLES", "type": "STRING", "schema": null, "description": "The roles which are assigned to the current role ", "isMulti": true, "isEntitlement": false, "isGroup": false } ], "name": "catalog_roles", "modified": null } ```