Installation Guides › Policy Server Installation Guide › Installing the Administrative UI › Configure an LDAP Directory Configuration File › User Managed Object Descriptions › How to Modify Attribute Descriptions

How to Modify Attribute Descriptions

An attribute stores information about an entry, such as a telephone number or address. An entry's attributes determine its profile.

In the directory configuration file, attributes are described in ImsManagedObjectAttr elements. In the User Object section of the directory configuration file, you can do the following:

• Modify default attribute descriptions to describe the attributes in your user store.
• Create new attribute descriptions by copying an existing description and modifying values as needed.

There is one ImsManagedObjectAttr element for each attribute in a user profile. For example, an ImsManagedObjectAttr element may describe a user ID.

An ImsManagedObjectAttr element resembles the following:

<ImsManagedObjectAttr physicalname="uid" displayname="User ID" description="User ID" valuetype="String" required="true" multivalued="false" wellknown="%USER_ID%" maxlength="0" />

The ImsManagedObjectAttr has the following parameters:

• physicalname

  This parameter must contain one of the following items:

  • The name of the LDAP attribute where the profile value is stored. For example, a user's ID is stored in the uid attribute in the user directory.

    Note: To improve performance, index LDAP attributes that are used in search queries in the Identity Manager User Console.

  • A well-known attribute. When you supply a well-known attribute, the Administrative UI computes the value automatically.
• description

  Contains the description of the attribute

• displayname

  Specifies a unique name for the attribute.

  Note: This parameter is required.

• valuetype

  Specifies the attribute's data type. The valid values are as follows:

  • String (Default value)
  • Number
  • Integer
  • Date
• required

  Indicates whether the attribute is required, as follows:

  • True—The attribute is required
  • False—The attribute is optional (default)

  Note: If an attribute is required by the LDAP directory server, set the required parameter to true.

• multivalued

  Indicates whether the attribute can have multiple values. For example, the group membership attribute is multi-valued to store the user DN of each group member. The valid values are as follows:

  • True—The attribute can have multiple values
  • False—The attribute can have only a single value (default)

  Important! The Group Membership and Admin Roles attributes in the User object definition must be multivalued.

• wellknown

  Defines the name of the well-known attribute.

  Well-known attributes have a specific meaning to the Administrative UI. They are identified by the following syntax:

  %ATTRIBUTENAME%

• maxlength

  Defines the maximum length that an attribute's value can have. Set the maxlength parameter to 0 to specify an unlimited length.

  Note: This parameter is required.

• objectclass

  Indicates the LDAP auxiliary class for a user attribute when the attribute is not part of the primary objectclass specified in the ImsManagedObject element.

  For example, suppose the primary object class for users is top, person, organizationalperson, which defines the following user attributes:

  • common name (cn)
  • surname (sn)
  • user id (uid)
  • password (userPassword)

To include the attribute employeeID, which is defined in the Employee auxiliary class, you would add the following attribute description:

<ImsManagedObjectAttr physicalname="employeeID" displayname="Employee ID" description="Employee ID" valuetype="String" required="true" multivalued="false" maxlength="0" objectclass="Employee"/>