Identity Provider API, REST: Synchronization.GetSynchronizationSettings

Field

Description

subjectContainerId

string

Required field. ID of the subject container.

The maximum string length in characters is 50.

Field

Description

subjectContainerId

string

ID of the subject container.

filter

SynchronizationFilter

Filter configuration for synchronization.

removeUserBehavior

enum (RemoveUserBehavior)

Behavior when removing users.

• REMOVE: Remove the user.
• BLOCK: Block the user.

synchronizationInterval

string (duration)

Interval between synchronization runs.

allowToCaptureUsers

boolean

Whether users can be captured during synchronization.

allowToCaptureGroups

boolean

Whether groups can be captured during synchronization.

userAttributeMappings[]

UserAttributeMapping

User attribute mappings.

groupAttributeMappings[]

GroupAttributeMapping

Group attribute mappings.

createdAt

string (date-time)

Timestamp when the settings were created.

String in RFC3339 text format. The range of possible values is from
0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z, i.e. from 0 to 9 digits for fractions of a second.

To work with values in this field, use the APIs described in the
Protocol Buffers reference.
In some languages, built-in datetime utilities do not support nanosecond precision (9 digits).

replacementDomain

string

Domain replacement configuration.

enablePasswordWriteback

boolean

Enables password writeback feature.

ldapSettings

LdapSettings

Settings for generic LDAP synchronization source.

Empty for Active Directory source. Required and fully populated for
generic LDAP source.

Field

Description

domain

string

Required field. Domain to synchronize.

The string length in characters must be 1-253.

groups[]

string

List of groups to synchronize.

The string length in characters for each value must be 1-253. The maximum number of elements is 10.

organizationUnits[]

string

List of organizational units to synchronize.

The string length in characters for each value must be 1-253. The maximum number of elements is 10.

Field

Description

source

string

Source attribute name.

The string length in characters must be 0-253.

target

enum (UserTargetAttribute)

Required field. Target attribute to map to.

• FULL_NAME: Full name attribute.
• GIVEN_NAME: Given name attribute.
• FAMILY_NAME: Family name attribute.
• EMAIL: Email attribute.
• PHONE_NUMBER: Phone number attribute.
• USERNAME: Username attribute.
• COMPANY_NAME: Company name attribute.
• JOB_TITLE: Job title attribute.
• DEPARTMENT: Department attribute.
• EMPLOYEE_ID: Employee ID attribute.

type

enum (MappingType)

Required field. Type of mapping.

• DIRECT: Direct mapping from source to target.
• EMPTY: Empty mapping (no source attribute).
• DIRECT_ARBITRARY_ATTRIBUTE: Direct mapping from an arbitrary source attribute

Field

Description

source

string

Source attribute name.

The string length in characters must be 0-253.

target

enum (GroupTargetAttribute)

Required field. Target attribute to map to.

• NAME: Name attribute.
• DESCRIPTION: Description attribute.

type

enum (MappingType)

Required field. Type of mapping.

• DIRECT: Direct mapping from source to target.
• EMPTY: Empty mapping (no source attribute).
• DIRECT_ARBITRARY_ATTRIBUTE: Direct mapping from an arbitrary source attribute

Field

Description

externalIdAttribute

string

Name of the LDAP attribute that holds the unique entry identifier.

dnAttribute

string

Name of the LDAP attribute that holds the DN of the entry.

userObjectClass

string

ObjectClass of users.

groupObjectClass

string

ObjectClass of groups.

accountDisabledAttribute

string

Name of the LDAP attribute that stores the account status.

accountDisabledValue

string

Value of account_disabled_attribute meaning the account is disabled.

accountEnabledValue

string

Value of account_disabled_attribute meaning the account is enabled.

passwordAttribute

string

Name of the LDAP attribute the agent writes the new password to during
password writeback.

deltaSyncMode

enum (LdapDeltaSyncMode)

Delta synchronization mode.

• LDAP_DELTA_SYNC_MODE_FULL_SYNC: Every run is a full sync; no replication token is used.

useRecursiveMembershipFilter

boolean

Enables the AD-extension matching rule
1.2.840.113556.1.4.1941 for the group-DN membership filter.