Connector Guides › Connectors Guide › Connecting to Endpoints › CA ACF2 Connector › LDAP Directory Services (LDS) › LDS Features

LDS Features

The LDS backend within CA IdentityMinder provides special processing when any of the following LDAP attributes are mapped to respective CA ACF2 fields in the LDS XREF field mapping:

• If LDAP attribute eTS390Role is specified as part of the command, the user is attached or removed from the specified Provisioning Role value. This may result in the addition or removal of accounts on any platform depending upon the Account Templates attached to that Provisioning Role. Typically, this attribute is mapped to a single-valued, user-defined field containing a comma-separated list of Provisioning Roles of which the user is a member.
• If the CA ACF2 password is mapped to the eTS390Password attribute, the password is applied to the Global User and automatically propagated to all accounts associated with that Global User.

  Note: This attribute should only be used by clients that do NOT explore/correlate their ACF accounts into CA IdentityMinder. Clients that do run explore/correlates should follow the instructions in the Password Synchronization feature bulletin.

• Password Synchronization - Password changes to ACF2 Loginids can be propagated into CA IdentityMinder to change a Global User's password and all accounts associated with the Global User. To accomplish this, an LDS record must be manually created (not from the LDS wizard) using the instructions from the Configuration and Usage section with the following changes:
  • Step 3: Set the USERDNS (user dns) as follows:

    	eTACFLidName=%L,eTACFLidContainerName=Accounts,
    

    	eTACFDirectoryName=www,
    

    	eTNamespaceName=CA-ACF2,dc=XXX,dc=eta
    

    where eTACFDirectoryName=www equals the CA ACF2 Endpoint name and dc=XXX is the name of the CA IdentityMinder domain for this LDAP node. The case of the domain name should be as it exists in CA IdentityMinder.

  • Step 4: Set the OBJCLASS (object class) to eTACFLid
  • Step 6: In the XREF section, add the entry: Password/eTSyncPassword
• If the CA ACF2 password is mapped to the eTPassword attribute, this causes the password to only be applied to the Global User with no propagation to other accounts.
• If LDAP attribute eTS390Profile is specified as part of the command, the user is attached or removed from the specified Role value. This may result in the addition or removal of accounts on any platform depending upon the Account Templates attached to that Provisioning Role.

  Note: Values specified for both eTS390Profile and eTS390Role must exist within CA IdentityMinder as valid Provisioning Role names.