Schema Reference
The application schema is used to configure the objects returned from a source.
Default Correlation Configuration
Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements.
You can customize the correlation configuration. Refer to Assigning Source Accounts to Identities for more information.
When you first create the ServiceNow Identity Governance SaaS source, the default correlation mapping is:
| Account Attribute | Operation | Identity Attribute |
|---|---|---|
| user_name | Equals | Username |
| Equals | Work email |
Default Account Schema
Default Account ID
SailPoint requires certain attributes remain in your configuration. These attributes are referred to as Identity Attributes, and they must not be updated. If you update these attributes from their default values, the connector may fail. To resolve any issues caused by changing Identity Attributes, reconfigure them to their default values. The following table lists the Identity Attributes for this connector:
| Account ID | Schema Object Type |
|---|---|
| sys_id | Account |
| sys_id | Group |
| sys_id | Role |
Default Account Attributes
The following is a list of account attributes:
| Attribute Name | Description |
|---|---|
| sys_id | The unique ID generated by the system for the user. |
| user_name | The user's name. |
| groups | The list of groups the user belongs to. |
| roles | The list of the user's roles. |
| first_name | The user's first name. |
| last_name | The user's last name. |
| middle_name | The user's middle name. |
| The user's email ID. | |
| department | The user's department name. |
| title | The user's title or designation. |
| phone | The user's phone number. |
| calendar_integration | Indicates if change requests assigned to the user are sent to their Outlook calendar. |
| sys_class_name | The user's class name. |
| company | The user's company. |
| cost_center | The user's cost center. |
| sys_created_on | The date this user was created in ServiceNow. |
| sys_created_by | The administrator who created the user in ServiceNow. |
| active | Indicates if the user account has been staged for use. |
| building | The user's building. |
| city | The user's city. |
| country | The user's country. |
| location | The user's location. |
| manager | The user's manager. |
| manager.id | The user's manager's ID. |
| name | The user's name. |
| password_needs_reset | Indicates if the user will be prompted to change their password at their next login session. |
| default_perspective | The user's default perspective. |
| sys_domain | The user's domain. |
| employee_number | The user's employee number. |
| failed_attempts | A tally of the number of failed attempts. |
| gender | The user's gender. |
| home_phone | The user's home phone number. |
| ldap_server | Identifies which LDAP server authenticates the user if there are multiple LDAP servers. |
| preferred_language | The user's spoken language. |
| last_login | The user's last login date. |
| last_login_time | The user's last login time. |
| locked_out | Indicates if the user account is locked. |
| mobile_phone | The user's mobile number. |
| notification | Indicates if the system should notify the user of any changes made to their account. |
| schedule | The user's schedule. |
| state | The user's state. |
| source | Identifies whether LDAP is used to validate a user. If the Source field starts with ldap, the user is validated through LDAP. Otherwise, the password on the user record is used to validate the user when they sign in. |
| street | The user's street. |
| time_format | The user's selected time format. |
| time_zone | The user's timezone. |
| sys_updated_on | The timestamp for the user account's most recent update. |
| sys_updated_by | The user that made the most recent update to the user account. |
| sys_mod_count | A tally of the number of updates made to the user account. |
| vip | Indicates if the user is a VIP. |
| zip | The user's ZIP or postal code. |
| identity_type | The user's identity type. |
| web_service_access_only | Indicates if the user has web service access only. |
Default Entitlement Attributes
Default Group Attributes
The following is a list of group attributes:
| Attribute Name | Description |
|---|---|
| name | The user group's name. |
| sys_id | The unique ID generated by the system for the user group. |
| The user group's email address. | |
| manager | The user group's manager. |
| parent | The user group's parent group. |
| active | Indicates if the user group has been staged for use. |
| cost_center | The user group's cost center. |
| default_assignee | The user group's default assignee. |
| description | The description of the user group. |
| exclude_manager | Indicates if the manager should be excluded from the user group. |
| sys_created_on | The date the user group was created in ServiceNow. |
| sys_created_by | The administrator who created the user group in ServiceNow. |
| source | The user group's source. |
| type | The user group's type. |
| sys_updated_on | The time stamp for the user group's most recent update. |
| sys_updated_by | The user that made the most recent update to the user group. |
| sys_mod_count | A tally of the number of updates made to the user group. |
| roles | The list of roles associated with the user group. |
Default Role Attributes
The following is a list of role attributes:
| Attribute Name | Description |
|---|---|
| name | The role's name. |
| sys_id | The unique ID generated by the system for the role. |
| sys_replace_on_upgrade | Indicates if the system should replace the default version during the next upgrade. |
| sys_name | The role's system name. |
| sys_updated_on | The time stamp for the most recent update to the role. |
| grantable | Indicates if the role can be granted independently. |
| sys_created_on | The date and time the role was created in ServiceNow. |
| suffix | The role's suffix. |
| sys_created_by | The user that created the role. |
| can_delegate | Indicates if the role can be delegated. |
| sys_policy | Defines how application files are protected when downloaded or installed. |
| sys_updated_by | The user that last updated the role. |
| sys_tags | The role's tags in the system. |
| sys_package | The name of the application the role is associated with. |
| description | The description of the role. |
| sys_class_name | The role's class name. |
| sys_update_name | The role's system updated name. |
| elevated_privilege | Indicates if the role is an elevated privilege. |
| sys_mod_count | A tally of the number of updates made to the role. |
| sys_customer_update | Indicates if the role was added or modified by a customer. |
| sys_scope | The role's scope within the application. |
| includes_roles | Indicates if the role contains other roles. |
| roles | The list of roles contained within the role. |
ServiceNow Dot Walking
The ServiceNow's sys_user table includes columns like manager, department, location, cost_center, company, building, etc. These columns are referenced by or from other tables in ServiceNow. By default, SailPoint aggregates user display names for these references.
Dot walking provides access to fields on related tables. If the current table contains a reference to another table, any field on the referenced table can be accessed using dot walking. For example, to get the user_name of a user's manager use manager.user_name.
If you are interested in aggregating specific fields on a reference table, you can add those attributes in account schema/group schema/role schema. For example:
manager.namemanager.user_namemanager.emailcost_center.namecost_center.codecompany.citybuilding.namelocation.name
The source then aggregates the data for the reference field once available in the respective schema. The fields are useful for attribute sync feature. For example, to sync an attribute if an Identity's manager field has an email, then the target ServiceNow Application should be mapped to manager.email instead of manager.
Custom Attributes
The system tables have additional fields that you need to manage using the source. Use this procedure for adding a field to other tables.
Note
A custom attribute must be added to the account schema. Ensure that the custom attribute name is the same as that on the ServiceNow instance. To configure any custom field the import set and transform map must be updated with the custom field.
New custom fields should be added as strings, not as booleans. When a field is set as a boolean and Attribute Sync is enabled, any updates that don't include changes to that field will flip that field back to false regardless of what the mapped value is.
To add an additional field or custom attribute on the ServiceNow SailPointSysUser import set table, complete the following:
- Go to System Definition > Tables. Search for the User (sys_user) table. Open the table and look for any additional fields in the Table Columns embedded list that are not mapped to the SailPointSysUser import set table. For example, you can add
officeas an additional field. - Go to System Definition > Tables. Search the SailpointSysUser table. Open the table and in the Table Columns embedded list, and then select New. Enter all the required values, and then select Submit.
- Go to SailPoint Identity Governance Connector > Import Set Tables > SailpointSysUser > Transform Maps > SailPointSysUser. Select New in the Field Maps embedded list to create a new field map. Select the Source field as
officeand select the Target field asoffice. Add the additional mapping information, and then select Submit.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.