Define the Resource Object Components

This section describes how to define the following resource object components:

• Defining Resource Object Classes

• Defining Resource ObjectTypes

• Defining Resource Object Features

• Defining Resource Object Attributes

• Defining Resource Forms

Defining Resource Object Classes

Object classes are handled differently for LDAP-based resource objects than for other resource objects.

LDAP-Based Resource Objects

LDAP-based resource objects can consist of more than one LDAP object class, where each object class is an extension of its parent object class. However, within LDAP, the complete set of these object classes is viewed and managed as a single object type within LDAP.

To manage this type of resource object within Identity Manager, include the XML element <ObjectClasses> within the <ObjectType> definition. The <ObjectClasses> element allows you to define the set of object classes that is associated with this <ObjectType> as well as the relationship of classes to each other.

Non-LDAP-Based Resource Objects

For non-LDAP-based resource objects, you can use the <ObjectType> to represent information other than the resource object type name.

In the following example, the primary attribute defines the object class to be used when creating and updating an object of this type. In this case, inetorgperson is the object class that is defined as the primary one because it is a subclass of the other listed object classes. The operator attribute specifies whether the list of object classes should be treated as one (logical AND) or treated as unique classes (logical OR) when listing or getting an object of this type. In this case, Identity Manager performs an AND operation on these object classes prior to any list or get requests for this object type.

Example 9–6 Using inetorgperson Object Class

<ObjectClasses primary=’inetorgperson’ operator=’AND’>\n"+
<ObjectClass name=’person’/>\n"+ <ObjectClass name=’organizationalPerson’/>\n"+
<ObjectClass name=’inetorgperson’/>\n"+ </ObjectClasses>\n"+

In the next example, all requests to create and/or update resource objects of this type are done using the groupOfUniqueNames object class. All list and get requests will query for all objects whose object class is either groupOfNames or groupOfUniqueNames.

Example 9–7 Using groupOfUniqueNames Object Class

<ObjectClasses primary=’groupOfUniqueNames’ operator=’OR’>\n"+
<ObjectClass name=’groupOfNames’/>\n"+ <ObjectClass name=’groupOfUniqueNames’/>\n"+
</ObjectClasses>\n"+

In this example, only one object class is defined so all create, get, list, and update operations are performed using object class organizationalUnit.

Example 9–8 Using organizationalUnit Object Class

<ObjectClasses operator=’AND’>\n"+ <ObjectClass name=’organizationalUnit’/>\n"+ </ObjectClasses>\n"+

Because there is only one object class, you can exclude the <ObjectClasses> section. If you exclude the <ObjectClasses> section, the object class defaults to the <ObjectType> name attribute value. However, if you want the object type name to differ from the resource object class name, you must include the <ObjectClasses> section with the single <ObjectClass> entry.

Defining Resource ObjectTypes

Resource Object types uniquely define a specific type of resource, and you define object types in the adapter’s prototypeXML string.

The XML <ObjectTypes> element is a container within the adapter’s prototypeXML string that contains one or more object type definitions to be managed on that resource. This <ObjectTypes> element fully describes the resource-specific object to Identity Manager, including the following:

• A list of specific object classes contained in the object type (required only for LDAP-compliant directories)

• A list of supported features

• A list of object type-specific attributes that are available within Identity Manager for editing and searching

The following table describes the supported attributes of the <ObjectType> element.

The following example shows ObjectType definitions:

Example 9–9 Example ObjectType Definitions

static final String prototypeXml =
"<Resource name=’Skeleton’ class= ’com.waveset.adapter.sample.SkeletonStandardResourceAdapter’
typeString=’Skeleton of a resource adapter’ typeDisplayString=’"+Messages.RESTYPE_SKELETON+"’>\n"+
  " <ObjectTypes>\n"+ 
  " <ObjectType name=’Group’ icon=’group’>\n"+ 
… other content defined below will go here … 
  " </ObjectType>\n"+ 
  " <ObjectType name=’Role’ icon=’ldap_role’>\n"+ 
… other content defined below will go here … 
  " </ObjectType>\n"+ 
  " <ObjectType name=’Organization’ icon=’folder_with_org’ container=’true’>\n"+ 
… other content defined below will go here … 
  "</ObjectType>\n"+ 
" </ObjectTypes>\n”+

Defining Resource Object Features

The <ObjectFeatures> section specifies a list of one or more features supported by this object type, where each object feature is directly tied to the implementation of the associated object type method in the resource adapter.

Each ObjectFeature definition must contain the name attribute, which specifies a feature name. The create and update features can specify a form attribute, which defines the resource form used to process create and update features. If you do not specify a form attribute, Identity Manager processes the create and update features with the same form used by all resources of a given type.

The following table describes the object feature mappings.

In the following example, the <ObjectFeatures> section includes all supported object features. Your resource adapter can support all of these features or just a subset of features. The more object features your adapter supports, the richer the object management function within Identity Manager.

Example 9–10 <ObjectFeatures> Section Including all Supported Object Features

 <ObjectFeatures>\n"+
   <ObjectFeature name=’create’ form=’My Create Position Form’/>
   <ObjectFeature name=’update’ form=’My Update Position Form’/>
   <ObjectFeature name=’create’/>\n"+
   <ObjectFeature name=’delete’/>\n"+
   <ObjectFeature name=’rename’/>\n"+
   <ObjectFeature name=’saveas’/>\n"+
   <ObjectFeature name=’find’/>\n"+
   <ObjectFeature name=’list’/>\n"+
   <ObjectFeature name=’view’/>\n"+
</ObjectFeatures>\n"+

Defining Resource Object Attributes

The <ObjectAttributes> section specifies the set of attributes to be managed and queried in Identity Manager. Each <ObjectAttribute> element name should be the same as the native resource attribute name. Unlike user attributes in Identity Manager, no attribute mapping is specified. Use only the native attribute names.

The following table describes attributes that are required for <ObjectAttributes>.

The following example shows an <ObjectAttributes> section defined in an <ObjectType>.

Example 9–11 <ObjectAttributes> Section Defined in an <ObjectType>

<ObjectAttributes idAttr=’dn’ displayNameAttr=’cn’ descriptionAttr=
       ’description’>\n"+
    <ObjectAttribute name=’cn’ type=’string’/>\n"+
    <ObjectAttribute name=’description’ type=’string’/>\n"+
    <ObjectAttribute name=’owner’ type=’distinguishedname’
namingAttr=’cn’/>\n"+
    <ObjectAttribute name=’uniqueMember’ type=’dn’ namingAttr=’cn’ />\n"+
 </ObjectAttributes>\n"+

The following table describes the <ObjectAttribute> attributes.

The methods in the resource adapter object type implementation are responsible for coercing all string values into the appropriate type based on the resource attribute name.

Defining Resource Forms

You must provide the following resource forms:

• A ResourceForm named <resource type> Create <object type> Form for each resource <ObjectType> that supports the Create feature.

  For example, AIX Create Group Form or LDAP Create Organizational Unit Form

• A ResourceForm named <resource type> Update <object type> Form for each resource <ObjectType> that supports the Update feature.

  For example, AIX Update Group Form or LDAP Update Organizational Unit Form

You can also assign an optional form that processes incoming data before storing it in Identity Manager. This resource form is a mechanism that transforms incoming data from the schema map and applies the transformed data to the User view. The sample form also performs actions, such as enabling and disabling an account, that are based on specific incoming data values such as employee status.

The following table describes attributes contained in the top-level namespace.

All values are strings unless otherwise specified.