Schema Reference
The application schema is used to configure the objects returned from a connector.
Note
-
The Account Schema tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as Entitlement or Multi-Valued. Refer to Managing Source Account Schemas for more information.
-
The schema attributes that are not present by default must be defined as strings if not specified.
The Snowflake SaaS connector uses the following default correlation and object configurations.
For Snowflake Cortex agent and capability resource schemas collected through Dataset Management, refer to Supported Resources.
Default Correlation Configuration
Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements.
You can customize the correlation configuration. Refer to Assigning Source Accounts to Identities for more information.
When you first create the Snowflake SaaS source, the default correlation mapping is:
| Account Attribute | Operation | Identity Attribute |
|---|---|---|
| Equals | Work Email | |
| display_name | Equals | Name |
Default Account Schema
Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.
The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.
Default Account ID
SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as account IDs.
Caution
Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
To resolve issues caused by changing account IDs, reconfigure them to their default values.
The following table lists the default account IDs for this connector:
| Account ID | Schema Object Type |
|---|---|
| name | Account |
| name | Group |
Caution
The name attribute is an Account ID / Entitlement ID, don't change the value of name of the user/role from Snowflake system after aggregation, this can lead to issues with your integration.
Default Account Attributes
The Snowflake SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.
| Attribute Name | Description |
|---|---|
| name | Name of the user. |
| type | Specifies the type of user. This property is used to differentiate between human and machine users. |
| login_name | Name that the user enters to log into the system. Login names for users must be unique across your entire account. |
| display_name | Name displayed for the user in the Snowflake web interface. |
| first_name | First name of the user. |
| last_name | First, middle, and last name of the user. |
| Email address of the user. | |
| days_to_expiry | Specifies the number of days after which the user status is set to Expired and the user is no longer allowed to log in. |
| comment | Specifies a comment for the user. |
| disabled | Specifies whether the user is disabled, which prevents the following actions: For new users, the user is locked out of Snowflake and cannot log in. For existing users, setting the property aborts all their currently running queries and does not allow the user to issue any new queries. The user is also immediately locked out of Snowflake and cannot log back in. |
| must_change_password | Specifies whether the user is forced to change their password on next login (including their first/initial login) into the system. |
| snowflake_lock | The user's lock/unlocked status in Snowflake. |
| default_warehouse | Specifies the virtual warehouse that is active by default for the user's session upon login. |
| default_namespace | Specifies the namespace (database only or database and schema) that is active by default for the user's session upon login. |
| default_role | Specifies the primary role that is active by default for the user's session upon login. |
| databaseRoles | List of database roles assigned to the user |
| default_secondary_roles | Specifies the set of secondary roles that are active for the user's session upon login. |
| owner | Owner role of the user's account. |
| roles | All roles directly assigned to the user. |
| has_password | Specifies whether the user has a password set. Type: Boolean |
| has_rsa_public_key | Specifies whether the user has an RSA public key set for key-pair authentication. Type: Boolean |
| has_mfa | Specifies whether the user is enrolled in multi-factor authentication (MFA). Type: Boolean |
| ext_authn_duo | Specifies whether Duo Security is enabled as the second factor of authentication for the user. Type: Boolean |
| authenticationMethod | Specifies how the user can authenticate. This value is derived from has_password, has_rsa_public_key, has_mfa, and ext_authn_duo. The first matching value is used: Type: String KEY_PAIR - The user has an RSA public key. This value is used even if the user also has a password. USER_PASS_DUO_MFA - The user has a password and is enrolled in MFA (has_mfa or ext_authn_duo is true). This value applies when the user is enrolled in MFA, including methods other than Duo. USER_PASS_NO_MFA - The user has a password and is not enrolled in MFA. NONE - The user has neither a password nor an RSA public key. These users, for example service users, might still authenticate through OAuth, a programmatic access token, or workload identity federation. |
Configurable Account Attributes
The following is a list of attributes that are not provided out-of-the-box. You can add them to your schema to view various Snowflake user information.
| Attribute Name | Description |
|---|---|
| locked_until_time | Timestamp indicating the user locked end time. The user remains locked until this time. |
| expires_at_time | Timestamp indicating time when user expires. |
| last_success_login | Timestamp indicating time of user's last successful login on Snowflake. |
| mins_to_unlock | Specifies the number of minutes until the temporary lock on the user login is cleared. |
| created_on | Timestamp indicating time when user was created. |
Default Entitlement Attributes
Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.
Caution
Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.
Default Role Attributes
The Snowflake SaaS connector supports roles. The following attributes must be configured on the managed system and in the SailPoint source schema to manage roles.
The Role group schema contains the following attributes by default.
| Attribute Name | Description |
|---|---|
| name | Role's unique identifier name |
| is_default | Indicates if the role is a default entitlement for any user |
| is_current | Indicates if the role is a current entitlement for any user |
| is_inherited | Indicates if the role is inherited by another entitlement |
| owner | Owner of the role |
| comment | Specifies a comment for the role |
| roles | List of inherited roles |
| databaseRoles | List of child database roles assigned to the role |
| privileges | Direct privileges assigned to the role |
Default Database Attributes
The Database Role group schema contains the following attributes by default.
| Attribute Name | Description |
|---|---|
| name | The Database Role's name |
| is_default | Indicates if the database role is a default database role |
| is_current | Indicates if the database role is a current role |
| is_inherited | Indicates if the database role is inherited by another database role |
| owner | Owner of the database role |
| comment | Comment for the database role |
| databaseRoles | List of child database roles assigned to the role |
| privileges | Direct privileges assigned to the database role |
Default Configurable Attributes
The following is a list of attributes that are not provided out of the box. You can add them to your schema to view various Snowflake user information.
| Attribute Name | Description |
|---|---|
| created_on | Timestamp indicating time when role was created. |
Default Machine Identity Attributes
Machine Identity attributes define the multiple types of machine identities that can be assigned to the managed system's user accounts.
For more information, refer to Machine Identity Security Overview.
The following list contains the default machine identity schema attributes. The attributes must be defined as strings if not otherwise specified.
| Attribute Name | Description |
|---|---|
| created_on | Timestamp for when the agent was created |
| name | Name of the agent |
| database_name | Database containing the agent |
| schema_name | Schema containing the agent |
| owner | Owner role of the agent |
| comment | Comment text for the agent |
| profile | Agent profile JSON (display_name, avatar, color) |
| roles | List of Snowflake roles that have direct privileges on this agent, derived from Snowflake grants. For example, USAGE, MONITOR, OWNERSHIP |
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.