User entry attributes for default IBM Security Verify Access configurations

The adapter profile by default enables on the account form only IBM Security Verify Access attributes.

The attribute labels, names, and types are listed in Table 1.

The IBM Security Verify Access Adapter is designed to work with user entry attributes from object classes that are defined in the IBM Security Verify Access configuration. Typically for non-Active Directory configuration, the user entry object classes are inetOrgPerson, organizationPerson and Person. For Active Directory typical configuration, the user entry object class is User.

The adapter schema contains attributes from inetOrgPerson, organizationPerson, and Person object classes. These attributes are shown in Table 2.

The adapter schema also contains attributes from the User object class. Table 3 lists attributes from the User object class only. Some of these attributes have different names in the Identity server schema and Windows Active Directory schema. The names mapping and attribute description are also shown in this table.

Attributes such as userAccountControl, non-modifiable attributes such as the memberOf and logonHours attribute are not supported. These attributes have INTEGER8 syntax; hence it would be difficult to manage them on the account form.

To manage any of the user entry attributes, complete the following steps:

Manage inetOrgPerson entry attribute:

1. Include the attribute in targetProfile.json file:
   1. Copy the itamprofile.jar file into a temporary directory.
   2. Extract the contents of` the itamprofile.jar file into the temporary directory by running the following command:

      cd c:\temp
      jar -xvf itamprofile.jar
      

      The jar command creates the c:\temp\itamprofile directory.

   3. Open the targetProfile.json file in a text editor. Find the section for 'userExtension'. It looks like this:

      "userExtension": {
            	  "schema": "urn:ibm:idbrokerage:params:scim:schemas:extension:itamaccount:2.0:User",
             	 "definition": {
             	     "id": "urn:ibm:idbrokerage:params:scim:schemas:extension:itamaccount:2.0:User",
           	       "name": "CustomUserExtension",
          	        "description": "Security adapter view of a user",
          	        "attributes": [
                    		  {
                          		"name": "eruid",
                          		"type": "string",
                          		multiValued": false,
                          		"description": "A identifier used to uniquely identify a user",
                          		"required": true,
                          		"caseExact": false,
                          		"mutability": "immutable",
                          		"returned": "default",
                          		"uniqueness": "server",
                          		"specialFlags": "sys"
                      	}, 
      

      The attributes section contains an array of attribute definitions. Each definition is separated by a comma. You can add the required attributes to this section. An attribute object contains these fields:

      Field	Description
      name	Attribute name
      type	Data type (string, integer, boolean, binary)
      multiValued	True; if attribute can have multiple values
      description	Attribute description text
      required	True; if required attribute
      caseExact	True; if value is case sensitive
      mutability	Immutable, read, write, read-write
      returned	Use "default"
      uniqueness	Use "server"
      specialFlags	Use "none"
      canonicalValues	Optional list of valid values for this attribute as a JSON array

      The attribute object is enclosed in braces ({}). Each field has the name in quotes followed by a colon and the value. Each field is separated by a comma. Below is an example from the ISAM adapter:

        {
                          		"name": "eruid",
                          		"type": "string",
                          		multiValued": false,
                          		"description": "A identifier used to uniquely identify a user",
                          		"required": true,
                          		"caseExact": false,
                          		"mutability": "immutable",
                          		"returned": "default",
                          		"uniqueness": "server",
                          		"specialFlags": "sys"
                      	} 
      

      Add the attributes to the account class. For example:

      "userExtension": {
              "schema": "urn:ibm:idbrokerage:params:scim:schemas:extension:itamaccount:2.0:User",
              "definition": {
                  "id": "urn:ibm:idbrokerage:params:scim:schemas:extension:itamaccount:2.0:User",
                  "name": "CustomUserExtension",
                  "description": "Security adapter view of a user",
                  "attributes": [
                      {
                          "name": "eruid",
                          "type": "string",
                          "multiValued": false,
                          "description": "A identifier used to uniquely identify a user",
                          "required": true,
                          "caseExact": false,
                          "mutability": "immutable",
                          "returned": "default",
                          "uniqueness": "server",
                          "specialFlags": "sys"
                      },       
      
      	…
      
                       {
                          "name": "givenName",
                          "type": "string",
                          "multiValued": false,
                          "description": "givenName",
                          "required": false,
                          "caseExact": false,
                          "mutability": "readWrite",
                          "returned": "default",
                          "uniqueness": "none",
                          "specialFlags": "none"
                      }
                  ]
              },
      

      Ensure that each attribute definition is separated with a comma. Once the file is updated, verify the syntax is correct by using one of the available JSON lint sites.

   4. Create the profile JAR file and import to IBM Security Verify Governance.
2. Discovering attributes from a target system by following the steps given in the IBM Security Verify Governance documentation.

Manage User entry attribute

Discovering attributes from a target system by following the steps given in the IBM Security Verify Governance documentation/