IBMAttributeTypes attribute

Edit online

You can use the IBMAttributeTypes attribute to define schema information that is not covered by the LDAP Version 3 standard for attributes.

Values of IBMAttributeTypes must comply with the following grammar:

IBMAttributeTypesDescription = "(" whsp
numericoid whsp
[ "DBNAME"qdescrs ]; at most 2 names (table, column)
[ "ACCESS-CLASS" whsp IBMAccessClass whsp ]
[ "LENGTH" wlen whsp ]; maximum length of attribute
[ "EQUALITY"whsp ]; create index for matching rule
[ "ORDERING"whsp ]; create index for matching rule
[ "APPROX"whsp ]; create index for matching rule
[ "SUBSTR"whsp ]; create index for matching rule
[ "REVERSE"whsp ]; reverse index for substring
[ "ENCRYPT"whsp scheme whsp ]; encryption scheme
[ "SECURE-CONNECTION-ONLY"whsp ] ; secure connection required
[ "RETURN-VALUE whsp returnValue whsp ]; value to be returned
[ "NONMATCHABLE whsp ] ;; attribute can only be used in existence filters
whsp ")"

scheme =
	"SSHA" /
	"AES-128" /
	"AES-192" /
	"AES-256" /
"SHA-224" /
	"SHA-256" /
	"SHA-384" /
	"SHA-512" /
	"SSHA-224" /
	"SSHA-256" /
	"SSHA-384" /
	"SSHA-512"

returnValue =
	"encrypted" /
	"type-only"

IBMAccessClass =
"NORMAL"/ ; this is the default
"SENSITIVE"/
"CRITICAL"/
"RESTRICTED"/
"SYSTEM"/

Numericoid

Used to correlate the value in attribute types with the value in IBMAttributeTypes.

DBNAME

You can provide two names at the most. The first is the table name that is used for this attribute. The second is the column name that is used for the fully normalized value of the attribute in the table. If you provide only one name, it is used as the table name as well as the column name. If you do not provide any DBNAMEs, then the short attribute name is used (from the attribute types).

ACCESS-CLASS

Attributes requiring similar permissions for access are grouped in classes. Attributes are mapped to their attribute classes in the directory schema file. These classes are discreet; access to one class does not imply access to another class. Permissions are set about the attribute access class as a whole. The permissions that are set on a particular attribute class apply to all attributes within that access class unless individual attribute access permissions are specified.

IBM® defines five attribute classes that are used in evaluation of access to user attributes: normal, sensitive, critical, system, and restricted. As examples, the attribute commonName belongs to the normal class, and the attribute userPassword belongs to the critical class. User-defined attributes belong to the normal access class unless otherwise specified. See Access rights for more information.

If ACCESS-CLASS is omitted, it defaults to normal.

LENGTH

The maximum length of this attribute. The length is expressed as the number of bytes. (IBM Security Verify Directory has a provision for increasing the length of an attribute.) In the attribute types value, the string:

( attr-oid ... SYNTAX syntax-oid{len} ... )

can be used to indicate that the attribute type with oid attr-oid has a maximum length.

If the length of an attribute needs to be reduced, see Manual procedure for changing existing attributes.

EQUALITY, ORDERING, APPROX, SUBSTR, REVERSE

If any of these attributes are used, an index is created for the corresponding matching rule. For good search performance, an EQUALITY index must be specified for any attribute that is used in search filters.