Search Filter Configuration

The DSML search filter is translated to a set of repository attribute conditions. A necessary part of the translation involves mapping the external DSML attribute name to a queryable repository attribute. A set of attribute mappings for each searchable type must be defined in the configuration.

The filter is analyzed and processed according to one of the following categories:

• Fully-indexed. The filter is converted to equivalent attribute conditions that find exactly the required objects from the repository. In this case, there is no need to further filter the resulting objects. A fully indexed search is much faster than a partially indexed or unindexed search because it does not instantiate views of the queried objects.

• Partially-indexed. At least one attribute condition is derived from the filter that finds a superset of the required objects from the repository. For each object, the system instantiates a view of the object that contains, at minimum, those attributes specified in the filter. It also checks whether the object matches the filter.

• Unindexed. No attribute conditions can be derived from the filter to apply against the repository. This type is similar to a partially-indexed search, except that all objects in the repository of the requested type are processed.

• Unsupported. The filter cannot be evaluated. The search operation is rejected.

The SPML2 configuration object contains the following properties

• SearchIndexRequired. Specifies whether partially-indexed or unindexed searches are accepted. An example of a search that is not fully-indexed is one whose filter specifies a non-queryable attribute. The possible values are as follows:

  • full. Indicates that only fully indexed search operations are accepted. This is the default value.

  • partial. Indicates that partial or fully indexed search operations are accepted.

  • none. Indicates that unindexed search operations are accepted, in addition to partial and fully indexed operations.

• SearchSizeLimit. An integer value specifying the maximum total number of objects that can be returned from a search request. If the search creates an iterator, all subsequent iterator responses are counted toward the total. A value of 0 indicates there is no limit.

  When the limit is exceeded, results are returned up to the limit, and an informational message is returned to the client indicating that the limit was exceeded.

• SearchTimeLimit. An integer value specifying the maximum time, in seconds, that an individual SPMLv2 search request or iterator request is allowed to take before a response is returned. A value of 0 means there is no limit.

• queryMappings. A map of existing SPML attribute names and Identity Manager repository attribute names.

• IteratorTimeout. An integer value specifying the maximum time, in seconds, that an SPMLv2 iterator remains valid after it was last provided in a response. A value must be specified.

The following capabilities are not supported:

• org.openspml.v2.profiles.dsml.ApproxMatch

• org.openspml.v2.profiles.dsml.ExtensibleMatch