D User and Role API Reference

This appendix describes the attributes and parameters you use to develop applications with the User and Role API for LDAP repositories.

Note:

The User and Role API is deprecated. Oracle recommends that you use instead the Identity Governance Framework and migrate usage to this framework. For information about this migration, see Migrating to Identity Directory API Developer's Guide for Identity Governance Framework.

This appendix includes the following sections:

Mapping User Attributes to LDAP Directories
Mapping Role Attributes to LDAP Directories
Default Configuration Parameters

D.1 Mapping User Attributes to LDAP Directories

Table D-1 lists user attributes in the UserProfile.property file and the attribute that corresponds in the directory servers supported. IBM Tivoli and OpenLDAP use the same set of parameters. Microsoft ADAM and Microsoft Active Directory use the same set of parameters.

Table D-1 User Attributes in Directory Servers

User Attribute	Oracle Internet Directory	Embedded LDAP Server	Microsoft Active Directory	ODS EE	Novell eDirectory	OpenLDAP
GUID	orclguid	uid	objectguid	nsuniqueid	guid	entryuuid
USER_ID	username (see Note below)	uid	uid	uid	uid	uid
DISPLAY_NAME	displayname	displayname	displayname	displayname	displayname	displayname
BUSINESS_EMAIL	mail	mail	mail	mail	mail	mail
DESCRIPTION	description	description	description	description	description	description
EMPLOYEE_TYPE	employeeType	employeeType	employeeType	employeeType	employeeType	employeeType
DEPARTMENT	departmentnumber	departmentnumber	departmentnumber	departmentnumber	departmentnumber	departmentnumber
DATE_OF_BIRTH	orcldateofbirth	-	-	-	-	-
BUSINESS_FAX	facsimiletelephonenumber	facsimiletelephonenumber	facsimiletelephonenumber	facsimiletelephonenumber	facsimiletelephonenumber	facsimiletelephonenumber
BUSINESS_CITY	l	l	l	l	l	l
BUSINESS_COUNTRY	c	c	c	c	c	c
DATE_OF_HIRE	orclhiredate	-	-	-	-	-
NAME	cn	uid	cn	uid	cn	cn
PREFERRED_LANGUAGE	Preferredlanguage	preferredlanguage	preferredlanguage	preferredlanguage	preferredlanguage	preferredlanguage
BUSINESS_POSTAL_ADDR	postaladdress	postaladdress	postaladdress	postaladdress	postaladdress	postaladdress
MIDDLE_NAME	orclmiddlename	-	-	-	-	-
ORGANIZATIONAL_UNIT	ou	ou	ou	ou	ou	ou
WIRELESS_ACCT_NUMBER	orclwirelessaccountnumber	-	-	-	-	-
BUSINESS_PO_BOX	postofficebox	postofficebox	postofficebox	postofficebox	postofficebox	postofficebox
BUSINESS_STATE	St	st	st	st	st	st
HOME_ADDRESS	Homepostaladdress	homepostaladdress	homepostaladdress	homepostaladdress	homepostaladdress	homepostaladdress
NAME_SUFFIX	Generationqualifier	generationqualifier	generationqualifier	generationqualifier	generationqualifier	generationqualifier
BUSINESS_STREET	street	street	street	street	street	street
INITIALS	initials	initials	initials	initials	initials	initials
USER_NAME	username (see Note below)	uid	samaccountname	uid	uid	uid
BUSINESS_POSTAL_CODE	postalcode	postalcode	postalcode	postalcode	postalcode	postalcode
BUSINESS_PAGER	pager	pager	pager	pager	pager	pager
LAST_NAME	sn	sn	sn	sn	sn	sn
BUSINESS_PHONE	telephonenumber	telephonenumber	telephonenumber	telephonenumber	telephonenumber	telephonenumber
FIRST_NAME	givenname	givenname	givenname	givenname	givenname	givenname
TIME_ZONE	orcltimezone	-	-	-	-	-
MAIDEN_NAME	orclmaidenname	-	-	-	-	-
PASSWORD	userpasssword	userpasssword	userpasssword	userpasssword	userpasssword	userpasssword
DEFAULT_GROUP	orcldefaultprofilegroup	-	-	-	-	-
ORGANIZATION	o	o	o	o	o	o
HOME_PHONE	homephone	homephone	homephone	homephone	homephone	homephone
BUSINESS_MOBILE	mobile	mobile	mobile	mobile	mobile	mobile
UI_ACCESS_MODE	orcluiaccessibilitymode	-	-	-	-	-
JPEG_PHOTO	jpegphoto	jpegphoto	jpegphoto	jpegphoto	jpegphoto	jpegphoto
MANAGER	manager	manager	manager	manager	manager	manager
TITLE	title	title	title	title	title	title
EMPLOYEE_NUMBER	employeenumber	employeenumber	employeenumber	employeenumber	employeenumber	employeenumber
LDUser.PASSWORD	userpassword	userpassword	userpassword	userpassword	userpassword	userpassword

D.2 Mapping Role Attributes to LDAP Directories

Table D-2 lists each role attribute in UserProfile.property and its corresponding attribute in different directory servers. IBM Tivoli and OpenLDAP use the same set of parameters. Microsoft ADAM and Microsoft Active Directory use the same set of parameters.

Table D-2 Role Attributes in Directory Servers

Role Attribute	Oracle Internet Directory	Embedded LDAP Server	Microsoft Active Directory	ODS EE	Novell eDirectory	OpenLDAP
`DISPLAY_NAME`	displayname	-	displayname	displayname	displayname	displayname
`MANAGER`	-	-	-	-	-	-
`NAME`	cn	cn	cn	cn	cn	cn
`OWNER`	owner	owner	-	Owner	-	owner
`GUID`	orclguid	cn	objectguid	NSuniqueid	guid	entryuuid

D.3 Default Configuration Parameters

This section lists default configuration parameter values and the source of the value in different directory servers.

Table D-3 lists parameter values for Oracle Internet Directory and Microsoft Active Directory. Note that Active Directory requires SSL when setting sensitive information like passwords.

Table D-3 Oracle Internet Directory and Microsoft Active Directory Parameters

Parameter	Oracle Internet Directory	Microsoft Active Directory
RT_USER_OBJECT_CLASSES	#config	{"user" }
RT_USER_MANDATORY_ATTRS	#schema	#schema
RT_USER_CREATE_BASES	#config	cn=users,<subscriberDN>
RT_USER_SEARCH_BASES	#config	<subscriberDN>
RT_USER_FILTER_OBJECT_CLASSES	#config	{"user"}
RT_USER_SELECTED_CREATE_BASE	#config	cn=users,<subscriberDN>
RT_GROUP_OBJECT_CLASSES	#config	{"group" }
RT_GROUP_MANDATORY_ATTRS	#schema	#schema
RT_GROUP_CREATE_BASES	#config	<subscriberDN>
RT_GROUP_SEARCH_BASES	#config	<subscriberDN>
RT_GROUP_FILTER_OBJECT_CLASSES	#config	{"group"}
RT_GROUP_MEMBER_ATTRS	"uniquemember", "member"	"member"
RT_GROUP_SELECTED_CREATE_BASE	#config	<subscriberDN>
RT_GROUP_GENERIC_SEARCH_BASE	<subscriber-DN>	<subscriberDN>
RT_SEARCH_TYPE	#config	#config
ST_SUBSCRIBER_NAME	#config	NULL
ST_USER_NAME_ATTR	#config	cn
ST_USER_LOGIN_ATTR	#config	samaccountname
ST_GROUP_NAME_ATTR	#config	cn
ST_MAX_SEARCHFILTER_LENGTH	500	500
ST_BINARY_ATTRIBUTES	Binary Attribute	Binary Attribute + {objectguid, unicodepwd}
ST_LOGGER_NAME	oracle.idm.userrole	oracle.idm.userrole

Note:

The Binary Attributes include photo, personalsignature, audio, jpegphoto, javaSErializeddata, thumbnailphoto, thumbnaillogo, userpassword, usercertificate, cacertificate, authorityrevocationlist, certificaterevocationlist, crosscertificatepair, and x500UniqueIdentifier.

The config attribute is extracted from the meta information present in the directory. The schema attribute is extracted from the schema in the directory.

Table D-4 lists parameters for Oracle Directory Server Enterprise Edition and Novell eDirectory.

Table D-4 Directory Server Enterprise Edition and Novell eDirectory Parameters

Parameter	DS EE	Novell eDirectory
RT_USER_OBJECT_CLASSES	{"inetorgperson", "person", "organizationalperson" }	{ "person", "inetorgperson", "organizationalPerson", "ndsloginproperties" }
RT_USER_MANDATORY_ATTRS	#schema	#schema
RT_USER_CREATE_BASES	ou=people,<subscriberDN>	ou=users,<subscriberDN>
RT_USER_SEARCH_BASES	<subscriberDN>	<subscriberDN>
RT_USER_FILTER_OBJECT_CLASSES	{"inetorgperson", "person", "organizationalperson" }	{ "person", "inetorgperson", "organizationalPerson", "ndsloginproperties" }
RT_USER_SELECTED_CREATE_BASE	ou=people,<subscriberDN>	ou=users,<subscriberDN>
RT_GROUP_OBJECT_CLASSES	"groupofuniquenames"	{"group" }
RT_GROUP_MANDATORY_ATTRS	#schema	#schema
RT_GROUP_CREATE_BASES	ou=groups,<subscriberDN>	ou=groups,<subscriberDN>
RT_GROUP_SEARCH_BASES	<subscriberDN>	<subscriberDN>
RT_GROUP_FILTER_OBJECT_CLASSES	{"groupofuniquenames"}	{"group"}
RT_GROUP_MEMBER_ATTRS	"uniquemember"	"member"
RT_GROUP_SELECTED_CREATE_BASE	ou=groups,<subscriberDN>	ou=groups,<subscriberDN>
RT_GROUP_GENERIC_SEARCH_BASE	<subscriber-DN>	<subscriberDN>
RT_SEARCH_TYPE	#config	#config
ST_SUBSCRIBER_NAME	NULL	NULL
ST_USER_NAME_ATTR	uid	cn
ST_USER_LOGIN_ATTR	uid	cn
ST_GROUP_NAME_ATTR	cn	cn
ST_MAX_SEARCHFILTER_LENGTH	500	500
ST_BINARY_ATTRIBUTES	Binary Attribute	Binary Attribute + {objectguid, unicodepwd}
ST_LOGGER_NAME	oracle.idm.userrole	oracle.idm.userrole

Note:

The config attribute is extracted from the meta information present in the directory. The schema attribute is extracted from the schema in the directory.

Table D-5 lists the parameters for OpenLDAP and Oracle Virtual Directory.

Table D-5 OpenLDAP and Oracle Virtual Directory Parameters

Parameter	OpenLDAP	Oracle Virtual Directory
RT_USER_OBJECT_CLASSES	{"inetorgperson", "person", "organizationalperson" }	{"inetorgperson"}
RT_USER_MANDATORY_ATTRS	#schema	#schema
RT_USER_CREATE_BASES	ou=people,<subscriberDN>	<subscriberDN>
RT_USER_SEARCH_BASES	<subscriberDN>	<subscriberDN>
RT_USER_FILTER_OBJECT_CLASSES	{"inetorgperson", "person", "organizationalperson" }	{"inetorgperson"}
RT_USER_SELECTED_CREATE_BASE	ou=people,<subscriberDN>	<subscriberDN>
RT_GROUP_OBJECT_CLASSES	"groupofuniquenames"	{"groupofuniquenames"}
RT_GROUP_MANDATORY_ATTRS	#schema	#schema
RT_GROUP_CREATE_BASES	ou=groups,<subscriberDN>	<subscriberDN>
RT_GROUP_SEARCH_BASES	<subscriberDN>	<subscriberDN>
RT_GROUP_FILTER_OBJECT_CLASSES	"groupofuniquenames"	{"groupofuniquenames"}
RT_GROUP_MEMBER_ATTRS	"uniquemember"	"uniquemember"
RT_GROUP_SELECTED_CREATE_BASE	ou=groups,<subscriberDN>	<subscriberDN>
RT_GROUP_GENERIC_SEARCH_BASE	<subscriber-DN>	<subscriberDN>
RT_SEARCH_TYPE	#config	#config
ST_SUBSCRIBER_NAME	NULL	#config (namingcontexts)
ST_USER_NAME_ATTR	uid	cn
ST_USER_LOGIN_ATTR	uid	cn
ST_GROUP_NAME_ATTR	cn	cn
ST_MAX_SEARCHFILTER_LENGTH	500	500
ST_BINARY_ATTRIBUTES	Binary Attribute	Binary Attribute + {objectguid, unicodepwd}
ST_LOGGER_NAME	oracle.idm.userrole	oracle.idm.userrole

Note:

The config attribute is extracted from the meta information present in the directory. The schema attribute is extracted from the schema in the directory.

Table D-6 lists the embedded LDAP server parameters.

Table D-6 Embedded LDAP Parameters

Parameter	Default
RT_USER_OBJECT_CLASSES	{"inetorgperson", "person", "organizationalperson", "wlsUser"}
RT_USER_MANDATORY_ATTRS	#schema
RT_USER_CREATE_BASES	{"ou=people,<subscriberDN>"}
RT_USER_SEARCH_BASES	{"ou=people,<subscriberDN>"}
RT_USER_FILTER_OBJECT_CLASSES	{"inetorgperson", "wlsUser"}
RT_USER_SELECTED_CREATE_BASE	ou=people,<subscriberDN>
RT_GROUP_OBJECT_CLASSES	{"top","groupofuniquenames","groupOfURLs"}
RT_GROUP_MANDATORY_ATTRS	#schema
RT_GROUP_CREATE_BASES	{"ou=groups,<subscriberDN>"}
RT_GROUP_SEARCH_BASES	{"ou=groups,<subscriberDN>"}
RT_GROUP_FILTER_OBJECT_CLASSES	{"top","groupofuniquenames","groupOfURLs"}
RT_GROUP_MEMBER_ATTRS	"uniquemember"
RT_GROUP_SELECTED_CREATE_BASE	ou=groups,<subscriberDN>
RT_GROUP_GENERIC_SEARCH_BASE	<subscriberDN>
RT_SEARCH_TYPE	#config
ST_SUBSCRIBER_NAME	#config (namingcontexts)
ST_USER_NAME_ATTR	uid
ST_USER_LOGIN_ATTR	uid
ST_GROUP_NAME_ATTR	cn
ST_MAX_SEARCHFILTER_LENGTH	500
ST_BINARY_ATTRIBUTES	*(BBA) See note below about BBAs.
ST_LOGGER_NAME	oracle.idm.userrole