> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/reference/managed-system-fields.md).

# Managed system fields and the connector request

The complete managed-system form — every built-in field and the column it writes, the connector-specific dynamic fields, the attribute list that reaches the connector, and worked settings for LDAP, JD

## What this is, and when you need it

The catalogue behind [Configure a managed system](/administration-guide/lifecycle/configure-managed-system.md): what each field on the managed-system form writes, what a value means to a connector, and what the connector actually receives. Nothing here is a step.

## The managed-system form, field by field

Route `/webconsole/mngsystemlist` lists managed systems (as the connectivity dashboard); `/webconsole/mngsystem` opens the create form and `/webconsole/mngsystem?id=<MANAGED_SYSTEM_ID>` an existing one. **Save** writes the whole system — every field below and the attributes table with it — and audits `CREATE_MANAGED_SYSTEM` or `MODIFY_MANAGED_SYSTEM`.

The fields, in the order the form renders them, with the column each writes:

| Field                                            | Column                                         | What to enter, and what it does                                                                                                                                                                                                                                                                                  |
| ------------------------------------------------ | ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Connector**                                    | `CONNECTOR_ID`                                 | The connector definition. Required unless **Manual**. Also selects which dynamic fields appear — see below.                                                                                                                                                                                                      |
| **Managed System Name**                          | `NAME` (100)                                   | Include the environment. This name appears in policy maps, the reconciliation batch task name (`Reconcile=<name>`), the report path and every audit event.                                                                                                                                                       |
| **Description**                                  | `DESCRIPTION` (**80 chars**)                   | Truncates silently past 80. Name the target, the environment and the data direction.                                                                                                                                                                                                                             |
| **Manual**                                       | `IS_MANUAL_SYSTEM`                             | No connector needed; the generated resource's type becomes `MAN_MANAGED_SYS`; the health check and the down-check sweeper both skip it; no dynamic fields are persisted. See [Choose an onboarding pattern](/administration-guide/lifecycle/onboarding-patterns.md#manual-fulfilment).                           |
| **Active**                                       | `IS_ACTIVE` — entity default `true`            | Off while building. Active is what makes the heartbeat sweeper broadcast to this system's connector queue every 60 s.                                                                                                                                                                                            |
| **Show on User Change Password Screen**          | `CHANGE_END_USER` — entity default `true`      | Lets an end user pick this system when changing their password.                                                                                                                                                                                                                                                  |
| **Provision all users with this managed system** | `ASSIGN_TO_ALL` — default `false`              | Universal assignment. See [Grant birthright access](/administration-guide/lifecycle/birthright-access.md#universal-assignment-assign_to_all).                                                                                                                                                                    |
| **Supports Date for Affiliations**               | `SUPPORTS_DATE_FOR_AFFILIATIONS` — default `N` | **Suppresses immediate provisioning.** See below.                                                                                                                                                                                                                                                                |
| **Host URL**                                     | `HOST_URL` (80)                                | Goes on the wire to the connector as `url`. Some connectors leave it blank and use `CONNECTION_STRING` instead.                                                                                                                                                                                                  |
| **Port**                                         | `PORT`                                         | Goes on the wire as `port`. Reachability is from the connector host, not your workstation.                                                                                                                                                                                                                       |
| **Password Policy**                              | `POLICY_ID`                                    | The policy governing passwords for accounts on this system. Leave blank when the target owns its own passwords.                                                                                                                                                                                                  |
| **Communication Protocol**                       | `COMM_PROTOCOL` (20)                           | **Exactly two values, `SSL` and `CLEAR`, and the dropdown offers nothing else.** It is passed straight through to the connector as `communicationProtocol`; OpenIAM does not encrypt anything on the basis of it, so whether the transport is really encrypted is the connector's business and the URL scheme's. |
| **Login Id**                                     | `USER_ID` (150)                                | Goes on the wire as `login`. Format is the target's: `iam\Administrator` for the AD connector, a bind DN for LDAP, a database login for JDBC, a client ID for REST.                                                                                                                                              |
| **Password**                                     | `PSWD` (512)                                   | Stored encrypted; reads back as a mask. A mask proves the field is masked, not that the target accepted it.                                                                                                                                                                                                      |
| **Category**                                     | `CATEGORY_TYPE_ID`                             | An `APPLICATION_CATEGORY` resource, for the request catalog. Category alone is not catalog visibility.                                                                                                                                                                                                           |
| **Simulation Requests**                          | `SIMULATION_ACTIONS` (multi-select)            | Operations to capture instead of send. See [Simulation mode](/administration-guide/lifecycle/simulation-mode.md).                                                                                                                                                                                                |
| **Downstream Managed System**                    | `DOWNSTREAM_SYSTEM_ID`                         | The system that must run *after* this one. See below.                                                                                                                                                                                                                                                            |

Two more columns are set by the server rather than the form: `SKIP_GROUP_PROV` (entity default `true`) and `RESOURCE_ID`, which is the resource OpenIAM creates for the managed system on save. That resource is named `<managed system name>_<a timestamp>`, carries `COORELATED_NAME` equal to the managed-system name, and is typed `MANAGED_SYS` or `MAN_MANAGED_SYS`. It is where the attribute rows in the next section live. Find it under **Access Control → Resource** by searching the managed-system name; the timestamp suffix means the name is not exactly what you typed.

{% hint style="warning" %}
**Supports Date for Affiliations does not mean "the target enforces dates".** When it is ticked, an effective-dated membership change adds this managed system's resource to the set of resources OpenIAM skips for that save — that is, provisioning to this system is **skipped now** and left to the `FUTURE_USER_PROV` batch task to perform inside its date window. That task ships **disabled**. Tick this box and leave the task disabled and the target is never provisioned at all. The shipped seed sets `SUPPORTS_DATE_FOR_AFFILIATIONS = 'Y'` on managed systems `200` (SAP) and `201` (Oracle EBS) only.
{% endhint %}

## Connector-specific dynamic fields

Which of these appear is decided by the connector definition's page template, not by you — the mechanism is in [Connectors and managed systems](/administration-guide/lifecycle/connectors-and-managed-systems.md#connector-definitions-supply-dynamic-fields). The complete set is 24 fixed `UI_FIELD_ID` values, and a `UI_FIELD_ID` outside this list renders nothing at all, silently. Each one, and the `MANAGED_SYS` column it writes to:

| `UI_FIELD_ID`             | `MANAGED_SYS` column                            | Type in the form                                           |
| ------------------------- | ----------------------------------------------- | ---------------------------------------------------------- |
| `DRIVER_URL`              | `DRIVER_URL`                                    | text                                                       |
| `CONNECTION_STRING`       | `CONNECTION_STRING`                             | text                                                       |
| `KEY_FIELD_USER`          | `MNG_SYS_OBJECT_MATCH.KEY_FIELD` (`USER`)       | text                                                       |
| `BASE_DN_USER`            | `MNG_SYS_OBJECT_MATCH.BASE_DN` (`USER`)         | text                                                       |
| `SEARCH_BASE_DN_USER`     | `MNG_SYS_OBJECT_MATCH.SEARCH_BASE_DN` (`USER`)  | text                                                       |
| `SEARCH_FILTER_USER`      | `MNG_SYS_OBJECT_MATCH.SEARCH_FILTER` (`USER`)   | text                                                       |
| `KEY_FIELD_GROUP`         | `MNG_SYS_OBJECT_MATCH.KEY_FIELD` (`GROUP`)      | text                                                       |
| `BASE_DN_GROUP`           | `MNG_SYS_OBJECT_MATCH.BASE_DN` (`GROUP`)        | text                                                       |
| `SEARCH_BASE_DN_GROUP`    | `MNG_SYS_OBJECT_MATCH.SEARCH_BASE_DN` (`GROUP`) | text                                                       |
| `SEARCH_FILTER_GROUP`     | `MNG_SYS_OBJECT_MATCH.SEARCH_FILTER` (`GROUP`)  | text                                                       |
| `SEARCH_SCOPE`            | `SEARCH_SCOPE`                                  | select — `OBJECT_SCOPE`, `ONELEVEL_SCOPE`, `SUBTREE_SCOPE` |
| `PRIMARY_REPOSITORY`      | `PRIMARY_REPOSITORY`                            | boolean                                                    |
| `SECONDARY_REPOSITORY`    | `SECONDARY_REPOSITORY_ID`                       | managed-system autocomplete                                |
| `UPDATE_SECONDARY`        | `ALWAYS_UPDATE_SECONDARY`                       | boolean                                                    |
| `HANDLER5`                | `HNDLR_5`                                       | select — `LDAP`, `ACTIVE_DIRECTORY`, `EDIRECTORY`          |
| `ADD_HANDLER`             | `ADD_HNDLR`                                     | text                                                       |
| `MODIFY_HANDLER`          | `MODIFY_HNDLR`                                  | text                                                       |
| `DELETE_HANDLER`          | `DELETE_HNDLR`                                  | text                                                       |
| `PASSWORD_HANDLER`        | `SETPASS_HNDLR`                                 | text                                                       |
| `SUSPEND_HANDLER`         | `SUSPEND_HNDLR`                                 | text                                                       |
| `RESUME_HANDLER`          | `RESUME_HNDLR`                                  | text                                                       |
| `SEARCH_HANDLER`          | `SEARCH_HNDLR`                                  | text                                                       |
| `TEST_CONNECTION_HANDLER` | `TEST_CONNECTION_HNDLR`                         | text                                                       |
| `RECONCILE_HANDLER`       | `RECONCILE_RESOURCE_HNDLR`                      | text                                                       |
| `ATTRIBUTE_NAMES_HANDLER` | `ATTRIBUTE_NAMES_HNDLR`                         | text                                                       |

What each group means to a connector:

| Field group        | Fields                                                                                                                                                                                                  | Meaning                                                                                                                                                                                                                                                                                               |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Connection         | `DRIVER_URL` → `DRIVER_URL`, `CONNECTION_STRING` → `CONNECTION_STRING`                                                                                                                                  | For database-style connectors, the driver class and the full JDBC URL. When a connector uses a connection string, do **not** also fill Host URL and Port — you get two sources of truth on the wire.                                                                                                  |
| User object        | `KEY_FIELD_USER`, `BASE_DN_USER`, `SEARCH_BASE_DN_USER`, `SEARCH_FILTER_USER`                                                                                                                           | Written to the `MNG_SYS_OBJECT_MATCH` row with `OBJECT_TYPE = 'USER'`. Base DN is where objects are **created**; Search Base DN is where they are **looked up**. They are different columns and usually different values.                                                                             |
| Group object       | `KEY_FIELD_GROUP`, `BASE_DN_GROUP`, `SEARCH_BASE_DN_GROUP`, `SEARCH_FILTER_GROUP`                                                                                                                       | The same, on the `OBJECT_TYPE = 'GROUP'` row.                                                                                                                                                                                                                                                         |
| Scope              | `SEARCH_SCOPE`                                                                                                                                                                                          | `OBJECT_SCOPE`, `ONELEVEL_SCOPE` or `SUBTREE_SCOPE`, stored in the column as the ordinal `0`, `1` or `2` — so a break-glass query sees a number, not the name. Default `SUBTREE_SCOPE`.                                                                                                               |
| Repository         | `PRIMARY_REPOSITORY`, `SECONDARY_REPOSITORY`, `UPDATE_SECONDARY`                                                                                                                                        | Multi-repository designs. `SECONDARY_REPOSITORY` is a managed-system picker writing `SECONDARY_REPOSITORY_ID`.                                                                                                                                                                                        |
| Target type        | `HANDLER5` → `HNDLR_5`                                                                                                                                                                                  | `LDAP`, `ACTIVE_DIRECTORY` or `EDIRECTORY`. The dropdown label for the second is "Active Directory" but the **stored value is `ACTIVE_DIRECTORY`**, which is what you match on in a query. Goes on the wire as `TARGET_SYSTEM_TYPE`.                                                                  |
| Operation handlers | `ADD_HANDLER`, `MODIFY_HANDLER`, `DELETE_HANDLER`, `PASSWORD_HANDLER`, `SUSPEND_HANDLER`, `RESUME_HANDLER`, `SEARCH_HANDLER`, `TEST_CONNECTION_HANDLER`, `RECONCILE_HANDLER`, `ATTRIBUTE_NAMES_HANDLER` | Per-operation extension points. Their meaning is entirely connector-specific: for the LDAP/AD connector they are Groovy script paths; for SCIM they are **REST paths** and the labels are literally "Add URL", "Modify URL", "Delete URL". A typo breaks one operation and leaves the others passing. |

{% hint style="info" %}
`RECONCILE_HANDLER` (`RECONCILE_RESOURCE_HNDLR`) and `LOOKUP_HNDLR` are stored but **not forwarded** to the connector. Everything that is forwarded is listed under [What actually reaches the connector](#what-actually-reaches-the-connector), and nothing outside that list leaves OpenIAM. If your connector needs a reconcile handler, confirm against its own guide that it reads it from somewhere else; the simplest proof is a captured request — put the operation in **Simulation Requests** and read the attribute list on the captured request.
{% endhint %}

## What actually reaches the connector

Every connector request carries the same envelope, built from the managed system and the object type being provisioned. Knowing what is in it removes most of the guesswork about where to put a connector-specific value — and you can see the whole envelope for yourself by putting the operation in **Simulation Requests** and reading the captured request at `/webconsole/simulation?id=<MANAGED_SYSTEM_ID>`.

**Scalar fields** on every request: `requestID` (a fresh UUID), `managedSystemId`, `url` (`HOST_URL`), `port` (`PORT`), `communicationProtocol` (`COMM_PROTOCOL`), `login` (`USER_ID`), `password` (`PSWD`, decrypted).

**Attribute list**, built in this order:

1. Every `MANAGED_SYS_ATTRIBUTE` row: attribute name = `NAME`, values = `VALUE1` then `VALUE2` (both only if non-blank).
2. Every resource property on the managed system's resource (`RESOURCE_PROP.NAME` → its `RES_ATTRIBUTE_VALUES.ATTR_VALUE` list). **This is the general-purpose channel for connector-specific settings.**
3. `TARGET_SYSTEM_TYPE` ← `HNDLR_5`.
4. `DELETE_HANDLER`, `ADD_HANDLER`, `MODIFY_HANDLER`, `SEARCH_HANDLER` ← the matching `*_HNDLR` columns.
5. `SEARCH_SCOPE` ← the scope **name**, e.g. the string `SUBTREE_SCOPE`, not the ordinal stored in the column.
6. `CONNECTION_STRING`, `DRIVER_URL`, `TEST_CONNECTION_HANDLER`, `SUSPEND_HANDLER`, `RESUME_HANDLER`, `PASSWORD_HANDLER`, `ATTRIBUTE_NAMES_HANDLER`.
7. From the `MNG_SYS_OBJECT_MATCH` row for **the object type being provisioned**: `BASE_DN`, `KEY_FIELD`, `SEARCH_BASE_DN`, and — note the rename — `LOOKUP_QUERY` ← `SEARCH_FILTER`.
8. When the object type is not `GROUP`, from the `GROUP` match row: `GROUP_SEARCH_FILTER` ← its `SEARCH_FILTER`, and `GROUP_BASE_DN` ← its **`SEARCH_BASE_DN`** (not its `BASE_DN`).

Two of those renames catch people out: your user search filter arrives as `LOOKUP_QUERY`, and the group *base* DN a connector receives is your group *search* base DN.

## Managed-system attributes: the four names that mean something

The **Attributes** table on the managed-system form writes resource properties on the managed system's resource. Three columns — **Attribute Name**, **Metadata Element**, **Attribute Value** — and both Name and Value are required; a blank either way raises `One or more required fields are empty`.

Only four names are read by the provisioning service itself. Everything else you add is forwarded verbatim to the connector as an attribute, which is exactly how connector-specific settings are supposed to be carried.

| Name                       | When it is read                                              | Effect                                                                                                                                                                                                                                                                             |
| -------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `PRE_PROCESS`              | Every provisioning operation on an identity in this system   | Groovy pre-processor for this system. **Value must be a script registry ID, not a path.**                                                                                                                                                                                          |
| `POST_PROCESS`             | The same                                                     | Groovy post-processor for this system.                                                                                                                                                                                                                                             |
| `ON_DELETE`                | On a delete, and again when the identity's status is settled | `DELETE`, absent or blank → connector `Delete`; `DISABLE` → connector `Disable`; `UPDATE` → connector `Update`, and that third value is honoured on the delete path only, which is why `DELETE` and `DISABLE` are the only two values that behave the same wherever they are read. |
| `INCLUDE_IN_PASSWORD_SYNC` | On Set Password and on password sync from a source system    | **Only the literal `N` opts this system out** of password propagation; the test is case-insensitive. Any other value, and absence altogether, means "included".                                                                                                                    |

`PRE_PROCESS` and `POST_PROCESS` are the only two of these names OpenIAM declares as known properties — see [Managed-system attribute names](/administration-guide/reference/enums.md#managed-system-attribute-names). Attaching a processor is [Attach a provisioning processor](/administration-guide/lifecycle/provisioning-processors.md), its contract and nine methods are [Provisioning processor reference](/administration-guide/lifecycle/provisioning-processors/provisioning-processor-reference.md), and the whole `ON_DELETE` decision table is in [Configure provisioning](/administration-guide/lifecycle/configure-provisioning.md#the-on_delete-resource-property).

The shipped data also creates `INCLUDE_USER_OBJECT`, `PRINCIPAL_NAME`, `PRINCIPAL_PASSWORD` and `GROUP_MEMBERSHIP_ENABLED` on managed systems `101` (LDAP) and `105` (Linux), and has done since 2.3.0.0. **OpenIAM itself reads none of those four.** They exist to be forwarded to the connector, and whether your connector honours them is a question for its guide. Do not assume they still work because they are seeded — capture the operation in simulation and check the connector's own documentation for the attribute name.

{% hint style="danger" %}
`PRE_PROCESS` and `POST_PROCESS` must hold a Groovy **registry ID**. The shipped data holds paths, which still work only because the upgrade that introduced the Groovy manager rewrote them to IDs in place. A path you type today resolves to nothing, and OpenIAM silently substitutes the no-op default processor: the operation succeeds, the target is written, and your script never ran. **No Webconsole screen shows a script's registry ID** — the Groovy Manager copy button gives you the path — so ask OpenIAM support for the ID, or have whoever owns the deployment's integrations retrieve it. Then prove the script is really attached by making its first version write something you can see — an audit warning or a mail — because nothing on this screen distinguishes "no processor" from "processor that could not be found".
{% endhint %}

## Worked configuration 1: LDAP or Active Directory

The `LDAP_Connector` definition's page template, `LDAP_TEMPLATE`, ships as of 4.1.8.0 and exposes exactly six dynamic fields, all optional:

| Label on the form           | `UI_FIELD_ID`         | Order |
| --------------------------- | --------------------- | ----- |
| Object Primary Key for User | `KEY_FIELD_USER`      | 1     |
| Base DN for User            | `BASE_DN_USER`        | 2     |
| Search Base DN for User     | `SEARCH_BASE_DN_USER` | 3     |
| Search Filter for User      | `SEARCH_FILTER_USER`  | 4     |
| Search Scope                | `SEARCH_SCOPE`        | 5     |
| Target System Type          | `HANDLER5`            | 6     |

The shipped managed systems `101` (LDAP Managed System) and `110` (ACTIVE DIRECTORY) fill them like this. Read the current values off **Provisioning → Managed System** on your own deployment before relying on them; these are what a clean install seeds, and an upgraded deployment may have been changed:

| Setting                                   | OpenLDAP (`101`)                                  | Active Directory (`110`)                                              |
| ----------------------------------------- | ------------------------------------------------- | --------------------------------------------------------------------- |
| Connector                                 | `51` LDAP CONNECTOR                               | `51` LDAP CONNECTOR                                                   |
| Host URL                                  | `ldap://<OPENIAM_HOST>`                           | `ldaps://<AD_HOST>`                                                   |
| Port                                      | `389`                                             | `636`                                                                 |
| Communication Protocol                    | `CLEAR`                                           | `CLEAR` *(seeded value — set `SSL` for a real `ldaps://` deployment)* |
| Login Id                                  | a bind DN, e.g. `cn=admin,dc=openiam,dc=org`      | `<DOMAIN>\<SERVICE_ACCOUNT>`                                          |
| Target System Type (`HNDLR_5`)            | `LDAP`                                            | `ACTIVE_DIRECTORY`                                                    |
| Object Primary Key for User (`KEY_FIELD`) | `uid`                                             | `CN`                                                                  |
| Base DN for User                          | `ou=people,dc=openiam,dc=org`                     | `OU=Users,OU=<TEST_OU>,DC=example,DC=com`                             |
| Search Base DN for User                   | `dc=openiam,dc=org`                               | `DC=example,DC=com`                                                   |
| Search Filter for User                    | `(&(objectclass=inetOrgPerson)(uid=?))`           | `(&(objectclass=user)(sAMAccountName=?))`                             |
| Search Scope                              | `SUBTREE_SCOPE` (stored `2`)                      | `SUBTREE_SCOPE`                                                       |
| Attribute Names Handler                   | `attribute-lookup/LDAPAttibuteNamesLookup.groovy` | `attribute-lookup/ADAttibuteNamesLookup.groovy`                       |

The `?` in the search filter is the placeholder the connector substitutes the looked-up principal value into. It reaches the connector as the attribute `LOOKUP_QUERY`, not `SEARCH_FILTER`.

Resource properties on system `101`, as seeded:

{% code overflow="wrap" %}

```
INCLUDE_USER_OBJECT        = N        (forwarded to the connector; OpenIAM does not read it)
PRINCIPAL_NAME             = uid      (forwarded; OpenIAM does not read it)
PRINCIPAL_PASSWORD         = userPassword
INCLUDE_IN_PASSWORD_SYNC   = Y
ON_DELETE                  = DELETE
GROUP_MEMBERSHIP_ENABLED   = Y
PRE_PROCESS                = <script registry ID for prov-helper/LDAPPreProcessor>
POST_PROCESS               = <script registry ID for prov-helper/LDAPPostProcessor>
```

{% endcode %}

For the Windows AD connector, a user add reaches the connector with `url` as a bare host address, `login` in `DOMAIN\user` form, and a single managed-system attribute, `isUnknownAttrBindAllowed = True`. `PermittedDN` and `SearchQuery` are two more attributes that connector understands. All three are connector attribute names — put them in the **Attributes** table, not in a handler field. Capture an `Add` in simulation to see exactly what your deployment sends.

## Worked configuration 2: JDBC

The `JDBC_CONNECTOR` template, `JDBC_MAN_SYS_TEMPLATE`, ships as of 4.1.10.0 and exposes one built-in field — `CONNECTION_STRING`, labelled **Connection String**, `IS_REQUIRED = 'Y'` — plus one extra metadata element, `JDBC_DRIVER`, a required SELECT labelled **JDBC Driver** with six valid values:

| Stored value                                   | Label                            |
| ---------------------------------------------- | -------------------------------- |
| `org.mariadb.jdbc.Driver`                      | MariaDB (`STATIC_DEFAULT_VALUE`) |
| `com.mysql.jdbc.Driver`                        | MySQL                            |
| `com.ibm.db2.jcc.DB2Driver`                    | DB2                              |
| `org.postgresql.Driver`                        | PostgreSQL                       |
| `com.microsoft.sqlserver.jdbc.SQLServerDriver` | MSSQLServer                      |
| `oracle.jdbc.driver.OracleDriver`              | Oracle                           |

The shipped `JDBC_MS` managed system:

| Setting                                | Value                                                                                           |
| -------------------------------------- | ----------------------------------------------------------------------------------------------- |
| Connector                              | `JDBC_PC` JDBC Connector                                                                        |
| Connection String                      | `jdbc:mariadb://<DB_HOST>:3306/<DATABASE>` — seeded as `jdbc:mariadb://localhost:3306/database` |
| Login Id                               | `admin`                                                                                         |
| Host URL / Port                        | *blank* — the connection string carries both                                                    |
| Search Scope                           | `SUBTREE_SCOPE` (`2`)                                                                           |
| JDBC Driver (managed-system attribute) | `org.mariadb.jdbc.Driver`                                                                       |

Everything else the JDBC connector needs is a **resource property**, fifteen of them, seeded on `JDBC_MS` :

| Resource property                     | Seeded value               | Purpose                                                 |
| ------------------------------------- | -------------------------- | ------------------------------------------------------- |
| `USER_TABLE_NAME`                     | `USERS`                    | Table holding accounts                                  |
| `USER_ID_COLUMN_NAME`                 | `ID`                       | Its primary key                                         |
| `LOGIN_COLUMN_NAME`                   | `USER_NAME`                | The login column                                        |
| `INSERTION_SEQUENCE`                  | *(empty)*                  | Sequence to use on insert, where the database needs one |
| `USER_ID_COLUMN_NAME_IN_OTHER_TABLES` | `USER_ID`                  | Foreign key back to the user table                      |
| `GROUP_TABLE_NAME`                    | *(empty)*                  | Group table                                             |
| `GROUP_TABLE_ID_COLUMN_NAME`          | *(empty)*                  | Its primary key                                         |
| `GROUP_TABLE_NAME_COLUMN_NAME`        | *(empty)*                  | Its name column                                         |
| `GROUP_TABLE_MEMBERSHIP_NAME`         | *(empty)*                  | Membership join table                                   |
| `GROUP_MEMBERSHIP_USER_COLUMN_NAME`   | *(empty)*                  | Its user column                                         |
| `GROUP_MEMBERSHIP_GROUP_COLUMN_NAME`  | *(empty)*                  | Its group column                                        |
| `GROUP_MEMBERSHIP_ID_COLUMN_NAME`     | *(empty)*                  | Its primary key                                         |
| `GROUP_ATTRIBUTE_NAME`                | `groups`                   | Policy-map attribute name carrying memberships          |
| `PASSWORD_ATTRIBUTE_NAME`             | `TBL_NAME.PASSWORD_COLUMN` | Qualified `<table>.<column>` for the password           |
| `STATUS_ATTRIBUTE_NAME`               | `TBL_NAME.STATUS_COLUMN`   | Qualified `<table>.<column>` for account status         |

The last two ship as literal placeholders — `TBL_NAME.PASSWORD_COLUMN` is not a real table. Replace them or password and disable operations fail at the target with a SQL error naming a table called `TBL_NAME`.

## Worked configuration 3: SCIM (REST)

The `SCIM_CONNECTOR` template, `SCIM_TEMPLATE`, ships as of 4.1.7.0 and relabels the handler fields as URLs, which is the clearest illustration that a "handler" is whatever the connector says it is:

| Label on the form   | `UI_FIELD_ID`             | Column                  | Shipped value on `SCIM_MANAGED_SYS` |
| ------------------- | ------------------------- | ----------------------- | ----------------------------------- |
| Add URL             | `ADD_HANDLER`             | `ADD_HNDLR`             | `/v2/Users`                         |
| Modify URL          | `MODIFY_HANDLER`          | `MODIFY_HNDLR`          | `/v2/Users`                         |
| Delete URL          | `DELETE_HANDLER`          | `DELETE_HNDLR`          | `/v2/Users`                         |
| Change Password URL | `PASSWORD_HANDLER`        | `SETPASS_HNDLR`         | *(blank)*                           |
| Suspend URL         | `SUSPEND_HANDLER`         | `SUSPEND_HNDLR`         | `/v2/Users`                         |
| Resume URL          | `RESUME_HANDLER`          | `RESUME_HNDLR`          | `/v2/Users`                         |
| Search URL          | `SEARCH_HANDLER`          | `SEARCH_HNDLR`          | `/v2/Users?filter=userName eq`      |
| Test Connection URL | `TEST_CONNECTION_HANDLER` | `TEST_CONNECTION_HNDLR` | `/v2/Users`                         |

Note the trailing space in the Search URL: the connector appends the quoted principal value to build `/v2/Users?filter=userName eq "<value>"`. Keep it.

Plus two extra metadata elements, materialised as managed-system attributes:

| Attribute Name        | Type   | Required                  | Values                                                                                                        |
| --------------------- | ------ | ------------------------- | ------------------------------------------------------------------------------------------------------------- |
| `Authentication Type` | SELECT | yes, default `Basic Auth` | `Basic Auth` (labelled "Basic Auth (Base64)") or `Token` (labelled "Token (grant\_type=client\_credentials)") |
| `Get Token URL`       | TEXT   | no                        | The token endpoint, needed only when Authentication Type is `Token`                                           |

And the rest of the managed system:

| Setting                | Value                                                                                                       |
| ---------------------- | ----------------------------------------------------------------------------------------------------------- |
| Connector              | `SCIM_CONNECTOR` SCIM CONNECTOR                                                                             |
| Host URL               | `https://<TENANT_HOST>` — the base the handler paths are appended to                                        |
| Login Id / Password    | `<CLIENT_ID>` / `<CLIENT_SECRET>`                                                                           |
| Communication Protocol | `SSL`                                                                                                       |
| Search Scope           | `SUBTREE_SCOPE` (`2`) — inert for a REST target, but the column is `NOT NULL`-ish in practice and ships `2` |
| `MNG_SYS_OBJECT_MATCH` | two rows, `OBJECT_TYPE` `USER` and `GROUP`, every other column `NULL`                                       |

The two empty object-match rows are deliberate and worth copying: reconciliation and the group branch of the connector metadata lookup both find a row by object type, so a REST managed system that will ever reconcile groups needs the `GROUP` row to exist even with nothing in it.

## Related

* [Configure a managed system](/administration-guide/lifecycle/configure-managed-system.md) — the procedure these fields belong to.
* [Connectors and managed systems](/administration-guide/lifecycle/connectors-and-managed-systems.md) — where the dynamic fields come from.
* [Shipped connectors](/administration-guide/reference/shipped-connectors.md) — the connector definitions, their queues and their per-connector traps.
* [Attach a provisioning processor](/administration-guide/lifecycle/provisioning-processors.md) — where `PRE_PROCESS` and `POST_PROCESS` are set, and [the processor contract](/administration-guide/lifecycle/provisioning-processors/provisioning-processor-reference.md) behind them.
* [Enumerated values](/administration-guide/reference/enums.md#managed-system-attribute-names) — the declared attribute names and the search scopes.

*Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/administration-guide/reference/managed-system-fields.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.