Configuration Guide › Creating an Identity Manager Directory for an LDAP User Store › User, Group and Organization Managed Object Descriptions › Attribute Descriptions

Attribute Descriptions

An attribute stores information about an entry, such as a telephone number or address. An entry's attributes determine its profile.

In the directory configuration file, attributes are described in ImsManagedObjectAttr elements. In the User Object, Group Object and Organization Object sections of the directory configuration file, you can do the following:

• Modify default attribute descriptions to describe the attributes in your user store.
• Create new attribute descriptions by copying an existing description and modifying values as needed.

There is one ImsManagedObjectAttr element for each attribute in user, group, and organization profiles. For example, an ImsManagedObjectAttr element may describe a user ID.

An ImsManagedObjectAttr element resembles the following:

<ImsManagedObjectAttr physicalname="uid" displayname="User ID" description="User ID" valuetype="String" required="true" multivalued="false" wellknown="%USER_ID%" maxlength="0" />

The ImsManagedObjectAttr has the following parameters:

• physicalname

  This parameter must contain one of the following items:

  • The name of the LDAP attribute where the profile value is stored. For example, a user's ID is stored in the uid attribute in the user directory.

    Note: To improve performance, index LDAP attributes that are used in search queries in the User Console.

  • A well-known attribute. When you supply a well-known attribute, CA Identity Manager computes the value automatically. For example, when you specify the well-known attribute %ORG_MEMBERSHIP%, CA Identity Manager determines the organization to which the entry belongs based on the entry's DN.
• description

  Contains the description of the attribute

• displayname

  Specifies a unique name for the attribute.

  In the User Console, the display name appears in the list of attributes that are available to add to a task screen. This parameter is required.

  Note: Do not modify an attribute's displayname in the directory configuration file (directory.xml). To change the name of the attribute on a task screen, you can specify a label for the attribute in the task screen definition. For more information, see the Administration Guide.

• valuetype

  Specifies the attribute's data type. The valid values are as follows:

  • String

    The value can be any string.

    This is the default value.

  • Integer

    The value must be an integer.

    Note: Integer does not support decimal numbers.

  • Number

    The value must be an integer. The number option supports decimal numbers.

  • Date

    The value must parse to a valid date using the pattern:

    MM/dd/yyyy

  • ISODate

    The value must parse to a valid date using the pattern yyyy-MM-dd.

  • UnicenterDate

    The value must parse to a valid date using the pattern YYYYYYYDDD where:

    YYYYYYY is a seven number representation for year beginning with three zeroes. For example: 0002008

    DDD is the three number representation for the day beginning with zeroes, as needed. Valid values include 001 to 366.

  • Structured

    This type of attribute consists of structured data that enables a single attribute value to store multiple related values. For example, a structured attribute could contain First Name, Last Name, and Email Address values.

    These attributes may be used by certain endpoint types, but are managed through CA Identity Manager.

    Note: CA Identity Manager can display structured attributes in a table in the User Console. When users edit values in the table, they are stored in the user store and propagated back to the endpoint. For more information about displaying multi-valued attributes, see the Administration Guide.

• required

  Indicates whether the attribute is required, as follows:

  • True—The attribute is required
  • False—The attribute is optional (default)

  Note: If an attribute is required by the LDAP directory server, set the required parameter to true.

• multivalued

  Indicates whether the attribute can have multiple values. For example, the group membership attribute is multi-valued to store the user DN of each group member. The valid values are as follows:

  • True—The attribute can have multiple values
  • False—The attribute can have only a single value (default)

  Important! The Group Membership and Admin Roles attributes in the User object definition must be multivalued.

• wellknown

  Defines the name of the well-known attribute.

  Well-known attributes have a specific meaning in CA Identity Manager. They are identified by the following syntax:

  %ATTRIBUTENAME%

• maxlength

  Defines the maximum length that an attribute's value can have. Set the maxlength parameter to 0 to specify an unlimited length.

  Note: This parameter is required.

• permission

  Indicates whether an attribute's value can be modified in a task screen. The valid values are as follows:

  • READONLY

    The value is displayed but cannot be modified

  • WRITEONCE

    The value cannot be modified once the object is created. For example, a user ID cannot be changed after the user is created

  • READWRITE

    The value can be modified (default)

• hidden

  Indicates whether an attribute appears in Identity Manager task forms. The valid values are as follows:

  • True—The attribute is not displayed to users.
  • False—The attribute is displayed to users (default)

  Logical attributes use hidden attributes.

  Note: For more information, see the Programming Guide for Java.

• system

  Specifies attributes that are used by CA Identity Manager only, and should not be modified by users in the User Console. The valid values are as follows:

  • True—Users should not modify the attribute. The attribute will not appear in the Identity Manager user interface.
  • False—Users can modify this attribute. It is available to add to task screens in the Identity Manager user interface. (default)
• validationruleset

  Associates a validation rule set with the attribute.

  The validation rule set that you specify must be defined in a ValidationRuleSet element in the directory configuration file.

• objectclass

  Indicates the LDAP auxiliary class for a user, group, or organization attribute when the attribute is not part of the primary objectclass specified in the ImsManagedObject element.

  For example, suppose the primary object class for users is top, person, organizationalperson, which defines the following user attributes:

  • common name (cn)
  • surname (sn)
  • user id (uid)
  • password (userPassword)

To include the attribute employeeID, which is defined in the Employee auxiliary class, you would add the following attribute description:

<ImsManagedObjectAttr physicalname="employeeID" displayname="Employee ID" description="Employee ID" valuetype="String" required="true" multivalued="false" maxlength="0" objectclass="Employee"/>