Configuration Guide › LDAP User Store Management › User, Group, and Organization Managed Object Descriptions › Attribute Descriptions

Attribute Descriptions

An attribute stores information about an entry, such as a telephone number or address. An entry attribute determines its profile.

In the directory configuration file, attributes are described in ImsManagedObjectAttr elements. In the User Object, Group Object and Organization Object sections of the directory configuration file, you can do the following actions:

• Modify default attribute descriptions to describe the attributes in your user store.
• Create new attribute descriptions by copying an existing description and modifying values as needed.

For each attribute in user, group, and organization profiles, there is one ImsManagedObjectAttr element. For example, an ImsManagedObjectAttr element is described as a user ID.

An ImsManagedObjectAttr element resembles the following code:

<ImsManagedObjectAttr physicalname="uid" displayname="User ID" description="User ID" valuetype="String" required="true" multivalued="false" wellknown="%USER_ID%" maxlength="0" />

The ImsManagedObjectAttr has the following parameters:

physicalname

This parameter must contain one of the following items:

• The name of the LDAP attribute where the profile value is stored. For example, user ID is stored in the uid attribute in the user directory.

  Note: To improve performance, index LDAP attributes that are used in search queries in the User Console.

• A well-known attribute. When you supply a well-known attribute, CA IdentityMinder computes the value automatically. For example, on specifying a well-known attribute %ORG_MEMBERSHIP%, CA IdentityMinder determines the organization to which the entry belongs, based upon the DN of an entry.

description

Contains the description of the attribute

displayname

Specifies a unique name for the attribute.

In the User Console, the display name appears in the list of attributes that are available to add to a task screen. This parameter is required.

Note: Do not modify the displayname of an attribute in the directory configuration file (directory.xml). To change the name of the attribute on a task screen, you can specify a label for the attribute in the task screen definition. For more information, see the Administration Guide.

valuetype

Specifies data type of the attribute. The valid values are as follows:

String

The value can be any string.

This is the default value.

Integer

The value must be an integer.

Note: Integer does not support decimal numbers.

Number

The value must be an integer. The number option supports decimal numbers.

Date

The value must parse to a valid date using the pattern:

MM/dd/yyyy

ISODate

The value must parse to a valid date using the pattern yyyy-MM-dd.

UnicenterDate

The value must parse to a valid date using the pattern YYYYYYYDDD where:

YYYYYYY is a seven number representation for a year beginning with three zeros. For example: 0002008

DDD is the three number representation for the day beginning with zeros, as needed. Valid values include in range from 001 to 366.

Structured

This type of attribute consists of structured data that enables a single attribute value to store multiple related values. For example, a structured attribute contains values such as First Name, Last Name, and Email Address values.

Certain endpoint types use these attributes but are managed through CA IdentityMinder.

Note: CA IdentityMinder can display structured attributes in a table in the User Console. When users edit values in the table, the values are stored in the user store, propagating back to the endpoint. For more information about displaying multivalued attributes, see the Administration Guide.

required

Indicates whether the attribute is required, as follows:

• True—The attribute is required.
• False—The attribute is optional (default).

Note: If an attribute is required for an LDAP directory server, set the required parameter to true.

multivalued

Indicates whether the attribute can have multiple values. For example, the group membership attribute is multivalued to store the user DN of each group member. The valid values are as follows:

• True—The attribute can have multiple values.
• False—The attribute can have only a single value (default).

Important! The Group Membership and Admin Roles attributes in the User object definition must be multivalued.

wellknown

Defines the name of the well-known attribute.

Well-known attributes have a specific meaning in CA IdentityMinder. They are identified in the syntax:

%ATTRIBUTENAME%

maxlength

Defines the maximum length that a value of an attribute can have. Set the maxlength parameter to 0 to specify an unlimited length.

Note: This parameter is required.

permission

Indicates whether the value of an attribute can be modified in a task screen. The valid values are as follows:

READONLY

The value is displayed but cannot be modified.

WRITEONCE

The value cannot be modified once the object is created. For example, a user ID cannot be changed after the user is created.

READWRITE

The value can be modified (default).

hidden

Indicates whether an attribute appears in CA IdentityMinder task forms. The valid values are as follows:

• True—The attribute is not displayed to users.
• False—The attribute is displayed to users (default).

Logical attributes use hidden attributes.

Note: For more information, see the Programming Guide for Java.

system

Specifies only CA IdentityMinder used attributes. Users in the User Console not to modify the attributes. The valid values are as follows:

• True—Users cannot modify the attribute. The attribute is hidden in the CA IdentityMinder user interface.
• False—Users can modify this attribute. The attribute is available to add to task screens in the CA IdentityMinder user interface. (default)

validationruleset

Associates a validation rule-set with the attribute.

Verify that the validation rule set that you specify is defined in a ValidationRuleSet element in the directory configuration file.

objectclass

Indicates the LDAP auxiliary class for a user, group, or organization attribute when the attribute is not part of the primary objectclass specified in the ImsManagedObject element.

For example, assume that the primary object class for users is top, person, and organizationalperson, which defines the following user attributes:

• common name (cn)
• surname (sn)
• user id (uid)
• password (userPassword)

To include the attribute employeeID, which is defined in the Employee auxiliary class, you would add the following attribute description:

<ImsManagedObjectAttr physicalname="employeeID" displayname="Employee ID" description="Employee ID" valuetype="String" required="true" multivalued="false" maxlength="0" objectclass="Employee"/>