Active Directory attributes for CA Identity Manager's required directory.xml fields

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal

Issue/Introduction

You are in the process of creating your directory.xml file for your Active Directory User Store and wanted to know if you had suggestions for the following required fields for CA Identity Manager:

##ADMIN_ROLE_CONSTRAINT
##ADMIN_SCOPE
##DISABLED_STATE (=userAccountControl?)
##PASSWORD_HINT (=userParameters?)
##GROUP_ADMIN
##SELF_SUBSCRIBING_FLAG

Environment

Identity Manager 14.x

Ca Directory

Resolution

CA Identity Manager will work with any attribute that meets the conditions stated in the "valuetype" sub-element of the corresponding attribute.

For example,

<ImsManagedObjectAttr physicalname="otherIpPhone" displayname="Admin roles" description="Used as a constraint for IM admin roles" valuetype="String" required="false" multivalued="true" wellknown="%ADMIN_ROLE_CONSTRAINT%" maxlength="0" system="true" hidden="true"/>

In this case, the attribute type for admin role constraint is of type String. So any attribute of type String (as defined by your Directory), will do just fine.

Having said that, here are some examples that have worked well in the past. The trickiest part is making sure that the attributes you use are not being used by another application accessing your Active Directory. When customers deploy this, it is a good idea to define custom attributes for those attributes that CA Identity Manager uses for special purposes - first four listed below:

<ImsManagedObjectAttr physicalname="otherIpPhone" displayname="Admin roles" description="Used as a constraint for IM admin roles" valuetype="String" required="false" multivalued="true" wellknown="%ADMIN_ROLE_CONSTRAINT%" maxlength="0" system="true" hidden="true"/>

<ImsManagedObjectAttr physicalname="otherMobile" displayname="Administrative Scope" description="User's Administrative Scope" valuetype="String" required="false" multivalued="true" wellknown="%ADMIN_SCOPE%" maxlength="0" system="true" hidden="true"/>

<ImsManagedObjectAttr physicalname="info" displayname="Disabled State" description="Disabled State" valuetype="String" required="false" multivalued="false" wellknown="%ENABLED_STATE%" maxlength="0"/>

<ImsManagedObjectAttr physicalname="wWWHomePage" displayname="Password Hint" description="Password Hint" valuetype="String" required="false" multivalued="false" wellknown="%PASSWORD_HINT%" maxlength="0"/>

<ImsManagedObjectAttr physicalname="url" displayname="Group Admin" description="Group Admin" valuetype="String" required="false" multivalued="true" wellknown="%GROUP_ADMIN%" maxlength="0" system="true" hidden="true"/>

<ImsManagedObjectAttr physicalname="info" displayname="Self Subscribing" description="Self Subscribing Flag" valuetype="String" required="false" multivalued="false" wellknown="%SELF_SUBSCRIBING%" maxlength="0"/>