Attributes

Parameters name

Type

Mandatory

Description

Values (default value in bold)

Modifiable after creation

identifier

String

YES

The unique id of each Attribute that will be reused in the configuration (Features etc…).

It is case sensitive and no special characters (except - or _) are allowed.

-

NO

name

String

YES

The name of the Attribute.

Specifying the name first allows you to define automatically the identifier.
Maximum 128 characters.
The name may be different from the identifier.

-

YES

objectKind

Enum

NO

Used to dedicate an Attribute to an Object Kind.
If an Attribute is limited to an Object Kind, we prevent configuring the attribute on a Feature of another Object Kind.
Technical advantage: this Feature is useful to restrict the list of Attributes available when configuring an Object Type or a Feature, so that Attributes which do not make sense for a specific kind are not suggested. For example, the "firstname" Attribute does not make sense for an Object of Type "Organization". 

If no value entered, the attribute can be used on all Object Kind.

Identity, Resource, Organization, Role or Role publication

NO

confidentiality

Integer

NO

The purpose of confidentiality is to hide or not the Attribute.

Allows user to see the value of the Attribute if it corresponds to the level defined.
The more high it is, more confidential the Attribute is.

You must define a right on a Feature with a confidentiality level. If the confidentiality is set to 1, the user will be able to see Attributes which are confidentiality level 0 and 1. 

0, 1 or 2

YES

description

String

NO

The purpose of the Attribute.

-

YES

virtual

Boolean

NO

Used to indicate if the Attribute is a virtual or not.

A virtual Attribute is resolved (according to the resolve rule) each time it is accessed on the Object to which it is attached.
The value is not stored in the database. The value of the Attribute is visible in the audit only if the value has been modified.

This property can be used to put online help on a built-in Attribute.

ON or OFF

NO

highPriority

Boolean

NO

Prioritization level for changing the value of an Attribute.

If an Attribute is configured with a "high priority", when this Attribute is modified on an IDM object (either via a "create" or a "patch" operation), the event message triggered by this modification is generated with a "high priority" so that it is processed accordingly by other services listening on such an event messages.

For example, Synchronization service, upon the reception of such a "high priority" message, will trigger as soon as possible provisioning operations for the IDM object who is the subject of the message.

This is namely useful to quickly propagate an IDM password change to a provisioned LDAP directory, so that the user whose password was changed can immediately authenticate to this LDAP directory using the new password. The built-in IDM "password" attribute has indeed a high priority.

Some built-in Attributes (as password, enabled, ...) have this priority to high.

ON or OFF

YES

valueType

Type

NO

The type of the Attribute.

String, Date, Date & Time, Integer Number, Decimal Number, Binary, Boolean, Identity, Resource, Organization Role or Role publication

NO

minLength

Integer

NO

Minimum length of the string value type.

-

YES

maxLenght

Integer

NO

Maximum length of the string value type.

Beware if more than 255 characters are expected in the string, specify the max value

-

YES

choicesRule

Rule

NO

Used to build lists of choices (possible values to be chosen for an attribute).
Lists can be created either using a Reference Table or using a groovy script.

This rule serves as a validation rule.
Only on string Attributes. 

Reference Table or Groovy Script

YES

scope

Scope

NO

A Scope can limit the displayed results.

For example, you can define that "manager" Attribute must be:

• status = "NORMAL"

• object type = "collaborator"

In this case, the search results will only display the manager completing these criteria. 

Note that only searchable Attributes can be used in a Scope.
Only for Identity, Organization, Resource, Role and Role Publication value type.

-

YES

multiValued

Boolean

NO

Indicates if the Attribute can have several values (companies, supervisors ...)

Not applicable for boolean value type.

ON or OFF

NO

searchCriterion

Boolean

NO

Indicates if the Attribute can be used in search requests (as search criteria).

Not applicable for binary value type and virtual Attribute.

ON or OFF

YES

internalAttributeId

-

NO

This property is mapped with the physical Attribute of the database.
Internal Attribute id slot is used for performance (typically when searching) and also for indexing.

Recommendation : Choose automatic in order to let the application choose the internal Attribute id. The selection will be done in chronological order.

Note that an internal Attribute id is unique throughout the application except if the Attribute is dedicated to one specific kind.
The internal id cannot be changed after creation.

Automatic

NO

readOnly

Boolean

NO

Indicates if the Attribute can only be displayed and not modified.

Not applicable for binary value type.

ON or OFF

NO

initializationRule

Rule

NO

Used to set the value of the Attribute at the creation of the Object only.
Example: "badge authorized" Attribute is to set NO by default.

If a compute rule is configured on the same Attribute, the initialization rule have priority.

-

YES

computeRule

Rule

NO

Used to calculate (every time) the value (before storing it in the database) of the Attribute at each modification of the Object (even if the modification is not on this Attribute).
In general, the compute rule is based on several Attribute values.

For example: if the Object is an external, then the badge is not allowed.

Beware that compute rule doesn’t override the initialization rule (if any).

-

YES

normalizeRule

Rule

NO

Used to modify the entered value of the Attribute before storing it in the database.
Example: last name must always be stored in uppercase.

In this case, even if the value is not entered in uppercase, the value will be saved as defined in the rule.

Only for string value type.

-

YES

resolveRule

Rule

YES if virtual is set to ON

Same definition as compute rule but for virtual Attributes.

Only the resolve rule is mandatory for virtual Attributes.
It is not possible to use an id of a virtual Attribute in rule of a non-virtual Attribute.

-

YES

validationRule

Rule

NO

Used to validate the value of the Attribute (whether it's allowed or not).
If this rule is not respected, the creation or the modification of the Object is rejected with an error message.

-

YES

secret

Boolean

NO

Indicates if the Attribute is a secret and will not be displayed in clear text. 

Not applicable for binary value type.
Value is not displayed on the Screen and on the audit except when displaying or updating the Attribute definition itself.

ON or OFF

NO

encrypted

Boolean

NO

Indicates that the Attribute value is encrypted when stored.

Not applicable for boolean, decimal number, integer number, date and date & time value types

ON or OFF

NO

immutable

Boolean

NO

Indicates if the Attribute value cannot be changed once created.

ON or OFF

NO

system

Boolean

NO

Indicates if the Attribute is managed by system tasks only.
A system Attribute cannot be modified nor deleted by the interface.

ON or OFF

NO

unicityRule

Rule

NO

Used to define if the value is unique (at the creation of the Object).

Only if search criterion = ON and value type = String.

Characteristics:

• limited to Object Type: allows to apply the rule only on the defined Object Type (if set to ON).

• check on update: allows to check the rule on an update operation.

• search operator: allows to choose the search operator related to the rule.

• normalize rule: allows to define a normalization rule before the search.

-

YES

kind

Enum

YES

The kind of the Object.

Identity, Organization, Resource, Role, Role publication

YES

id

String

YES

The unique identifier of an Object Type that will be reused in the configuration (Features etc...)

-

YES

entityId

String

YES

The identifier key (not necessarily unique) and which allows to link siblings.

In other words, siblings have the same entityId.

Objects having the same entity_id share the same "structural" Attributes.

-

YES

type

String

YES

Type of an Object Kind, such as "employee" or "collaborator".

-

YES

status

String

YES

The status of the Object.

Draft, Normal, Delete

YES

enabled

Boolean

YES

Indicate if the Object is enabled or disabled.

Linked with the following attributes: objectActivationJob, enabledfrom, enabledUntil, disabledAt, activationMode.

true, false

YES

enabledFrom

Date & time

NO

The date from which the object is considered enabled.

-

YES

enabledUntil

Date & time

NO

The date from which the object is considered disabled.

-

YES

flags

String

NO

List of flags on the user.

Flags can be used to trigger action on specific population depending on context.

F00 to F15

YES

reservedFlags

String

NO

List of reservedFlags on the user. It can provide information on the last operation performed on the identity.

Contrary to flags attribute they can not be set by end user, they are only set by system.

BYPASS_DEDUP, BYPASS_INTEGRITY, BYPASS_UNICITY, BYPASS_VALIDATION, PASSWORD_EXPIRED, PASSWORD_GRACE

YES

createdAt

Date & time

The object creation date.

YES

disabledAt

Date & time

Date at which "enabled" was set to false.

YES

deletedAt

Date & time

Date at which "status" was set to delete. 

YES

updatedAt

Date & time

The object last update date.

YES

activationModes

String

Mode that can be used when activating/deactivating an Object. These are to be used, typically, in scripts.

By default : AUTO or Admin (can be updated using setting)

YES

By Random Identifier Generator: 

Not relevant on a resolve rule.

By groovy script:Used to combine several Attributes' values for another Attribute.

if ((!OBJECT.level || OBJECT.level == "P")) {
		if (OBJECT.status == ObjectStatus.DELETED) {
			return "S"
		} else if (!OBJECT.enabled) {
				return "IV"
		} else {
			return "V"
		}
	}
	return OBJECT.entityValidity  

In this case, the value of the "level" attribute is resolved according to the status.