Configuration Guide › LDAP User Store Management › User, Group and Organization Managed Object Descriptions › Managing Sensitive Attributes › Data Classification Attributes

Data Classification Attributes

The Data Classification element provides a way to associate additional properties with an attribute description. The values in this element determine how CA Identity Manager handles the attribute. This element supports the following parameters:

• sensitive

  Causes CA Identity Manager to display the attribute as a series of asterisks (*). This prevents the attribute from appearing in clear text.

  For example, you may configure the password attribute as sensitive.

  If you create a copy of an existing user in the User Console, this parameter also prevents the attribute from being copied to the new user.

• vst_hide

  Hides the attribute in the Event Details screen for the View Submitted Tasks tab. Unlike sensitive attributes, which are displayed as asterisks, vst_hidden attributes are not displayed.

  You can use this parameter to prevent changes to an attribute, such as salary, from displaying in View Submitted Tasks.

• ignore_on_copy

  Causes CA Identity Manager to ignore an attribute when an administrator creates a copy of an object in the User Console. For example, if you specify ignore_on_copy for the password attribute on a user object, CA Identity Manager does not apply the current user's password to the new user profile, which is created as a copy of the current user's profile.

• attributelevelencrypt

  Encrypts attribute values when they are stored in the user store. Identity Manager uses RC2 encryption or FIPS 140-2 encryption, if CA Identity Manager is FIPS 140-2 enabled.

  The attributes appear in clear text during runtime.

  Note: For more information about FIPS 140-2 support in CA Identity Manager, see the Administration Guide.

• previouslyencrypted

  Causes CA Identity Manager to detect and decrypt any encrypted values in the attribute when it accesses the object in the user store.

  You use this data classification to decrypt any previously encrypted values.

  The clear text value will be saved to the store when you save the object.