Provisioning Manager Active Directory Attributes

[Anon Anon]

In the provisioning manager for Active Directory endpoint I would like to see or understand why not all the standard Active Directory Attributes are an option in Attribute Mapping.

For example - personalTitle, generationQualifier, personalTitle, etc...

My use case is that I need to store titles like PHD, MD, RN, etc... in an attribute somewhere in AD. The attributes that make most sense are not in the Provisioing Manager in the option list to map the attribute.

How do I get other standard, non-extended AD attributes to be used in the Attribute Map?

[Fernando Bruno Videla]

you must declare ad attributes you want to manage in the text file PS_HOME\data\ADS\schema.ext.

Look at this bookself article:


Connector Guides › Connectors Guide › Connecting to Endpoints › Active Directory Services Connector › Connector-Specific Features › Program Exits › Creating Custom ADS Attributes
Previous Topic: Passing Global User Attributes

Next Topic: Example Files

Creating Custom ADS Attributes
The file PS_HOME\data\ADS\schema.ext is used to create custom ADS attributes.

Note: You must first create this file.

Custom ADS attributes are placed one per line in the text file PS_HOME\data\ADS\schema.ext. This file is used to specify any custom ADS account attributes that have been added to the ADS schema and any ADS account attributes that do not actually exist in the ADS schema but are used in ADSExitUsrPreAdd.txt and ADSExitUsrPostAdd.txt. For more information on extending the ADS schema, see the topic Extending the ADS Schema in the ADS Defaults section.

To let the ADS connector know that the custom ADS account attribute being added is to be used for exit processing and does not exist in ADS, the attribute name in schema.ext must begin with eTADSExitOnly. This prefix lets the ADS connector know that the custom attribute can be passed to the ADS connector command line interface. Since the attribute does not exist in the ADS schema, the syntax and the single or multi-value indicator must be included in the schema.ext. These two values follow the attribute name and are delimited with a colon (:). An example of a line in schema.ext follows:

eTADSExitOnlyDiskSize:2.2.5.12:T
The syntax of the attribute is 2.2.5.12. These syntaxes are defined at the following website:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adsi/adsi/mapping_active_directory_syntax_to_adsi_syntax.asp

The following characters indicate the value of the attribute:

T indicates that the attribute is single-valued.
F indicates that the attribute is multivalued.
Note: Any changes to the schema.ext require a restart of the CA Identity Manager Provisioning service and the Provisioning Manager.

By default, any attribute listed is assumed to exist for both contacts and accounts. To indicate that a given attribute is to be defined for accounts or contacts only, add an optional prefix (account) or (contact) to the attribute name. Optionally, you can use the prefix (both) to indicate an attribute is valid for both accounts and contacts.

For example, your installation added three new attributes to the schema. BirthDate is valid for accounts only. SSN is valid for accounts and contacts. DoNotCall is valid for contacts only. You can add these entries into your schema.ext file as follows:

(account)BirthDate
(both)SSN
(contact)DoNotCall

[Anon Anon]

I saw this in the bookshelf but that file in that location doesn't exist.

D:\Program Files (x86)\CA\Identity Manager\Provisioning Server\data\ads

the only file in there is directory-name.dns

[Fernando Bruno Videla]

"Note: You must first create this file."

is just a text file, you must create it

[Anon Anon]

I have created schema.ext file and added one attribute "msRTCSIP-ArchivingEnabled".

Recycled provisioning and C++ services but i am not able to see any additional attribute on account template custom section .

Any thoughts appreciated !

[Anon Anon]

After extending the schema, the values imported will be in the eTADSPayload attribute. You will need to map a custom field to the appropriate offset of the Payload to retrieve the value.

[Anon Anon]

Thanks ! could you please explain more how to do that as documentation is not very much clear .

 

[Anon Anon]

After extending the schema, do an Explore/Correalate (E/C) with option to update Global User.

Using an LDAP browser, to your IMPS directory using:

Your IMPS hostname

Port 20391

Base DN: dc=etadb

Bind DN: eTDSAContainerName=DSAs,eTNamespaceName=CommonObjects,dc=etadb

navigate to :

eTADSAccountName=SomeUserAccount,eTADSContainerName=Users,eTADSDirectoryName=YourEndpointName,eTNamespaceName=ActiveDirectory,dc=im,dc=etadb

Look at the value for the: eTADSPayload attribute.

You would see see something like:

extendedAttribute1:01:0006=value1;extendedAttribute2:01:0007=value10;extendedAttribute2:01:0008=value100

You now need to take the appropriate offset from that value. E.g.: etadspayload[27,6]  // start at the 27 charcter and go for 6.

 

[Anon Anon]

Dudley, Do you know of any way this could work with custom attributes that do not have a fixed length?

Currently instead of using the eTADSpayload attribute we're attempting to write a policy Xpress reverse sync policy that uses an LDAP query to get the value of the attribute, but it seems there's no way outside of custom java code to set that value in the user store. It seems the reverse sync policy xpress policies have no concept of 'user' objects and instead only understand 'account' information. This is important because it limits the actions we're able to perform and inhibits us from setting a user attribute. In combination with this limitation we are also unable to set values using LDAP in an action rule preventing the attempted scenario described above from working.

 

 

[roded03]

Hello!

 

For me, with the IDM 12.6.8 release and with an exchange endpoint, I need to restart Java connector, C++ and provisioning to this work! 

[ivan leone]

Hi,
I followed the steps for extend the schema and I see the tab custom in account template with the attribute that I created. The attribute  is correctly propagated on the endpoint.
Now I want to create a correlation rule with this attribute for explore and correlate but I don't understand how to do. In provisioning Manager I don't see the custom attribute in the list. I try with paylod attribute but didn't work.