Associating LDAP attributes to RACF fields

The user and group profile custom fields in the CSDATA segment are not predefined by RACF, but are defined in RACF by the user. If those fields are to be set and displayed using LDAP, then the user must add an attribute to the LDAP schema to represent each custom field. The attribute is defined in the LDAP schema using an attributeTypes value and an IBMAttributeTypes value. LDAP does not allow more than one attribute to be associated with the same RACF custom field.

• The attributeTypes value specifies the object identifier (OID), name, syntax, and equality rule of the attribute. The OID and name must not be in use in the schema. The attribute name can be the same as the RACF custom field name, or it can be different. For example, if the custom field name is phone, the attribute name could be phone, or workphone, or anything else that is not already in use. See Attribute types for more information about attributeTypes.
• The IBMAttributeTypes value must include the RACFFIELD keyword to identify the RACF custom field associated with the attribute. The RACFFIELD value specifies the resource profile name that is used to define the custom field in RACF, with periods (.) changed to dashes (-). For example, if the RACF custom field is defined by the USER.CSDATA.PHONE resource profile, RACFFIELD contains USER-CSDATA-PHONE. RACFFIELD also optionally specifies the type of RACF custom field. The accepted values are char, flag, hex, num, and qchar. If the RACF custom field is defined with TYPE(CHAR) FIRST(ANY) OTHER(ANY), then specify qchar in RACFFIELD to indicate that SDBM should put the attribute value in quotations when creating RACF commands. Otherwise, specify in RACFFIELD the same value as was used for TYPE when defining the custom field in RACF. If a type value is not specified in RACFFIELD, LDAP assumes that the custom field type is char. See Schema introduction for more information about IBMAttributeTypes.

For example, if the phone custom field is defined in the RACF user profile with TYPE(CHAR), the following attribute could be added to the LDAP schema to represent the custom field:

attributetypes: ( 
      phone-OID
      NAME 'phone'
      DESC 'Represents the PHONE field in the RACF user CSDATA segment'
      EQUALITY caseIgnoreMatch 
      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
      SINGLE-VALUE
      USAGE userApplications
      )
ibmattributetypes: (
      phone-OID
      ACCESS-CLASS sensitive
      RACFFIELD ('USER-CSDATA-PHONE' 'char')
      )

For example, if the PHONE and SSN custom fields are defined in RACF for the user profile and the LDAP attributes phone and socialSecurityNumber are defined in the LDAP schema to represent the custom fields, the following object class should be added to the LDAP schema:

objectclasses: (
      racfUserCsdataSegment-OID
      NAME 'racfUserCsdataSegment'
      DESC 'Represents the CSDATA segment in a z/OS RACF USER profile'
      SUP top
      AUXILIARY
      MAY ( phone $ socialSecurityNumber )
      )