[TDS learning document 5] IBM directory Schema Management 3 -- attributes

Author: gnuhpc
Source: http://www.cnblogs.com/gnuhpc/

Each directory entry has a set of attributes associated with its object class. Ibm tds expresses the data as a name-value pair, a descriptive attribute, such as CommonName (CN), or a specific information, such as the name of John Doe. The attribute here is the same level as the object class, not the attribute of the object class.
The ibmattributetypes attribute is used to describe schema information that is not involved in the LDAP v3 standard. Its syntax is as follows:
Ibmattributetypesdescription = "(" WHSP
Numericoid WHSP
["Dbname" qdescrs]; at most 2 names (Table, column)
["Access-class" WHSP ibmaccessclass WHSP]
["Length" wlen whsp]; Maximum length of attribute
["Equality" WHSP]; Create index for matching rule
["Ordering" WHSP]; Create index for matching rule
["Approx" WHSP]; Create index for matching rule
["Substr" WHSP]; Create index for matching rule
["Reverse" WHSP]; reverse index for substring
["Encrypt" WHSP scheme WHSP]; encryption scheme
["Secure-connection-only" WHSP]; secure connection required
["Return-value WHSP returnvalue WHSP]; value to be returned
["Nonmatchable WHSP]; attribute can only be used in existence Filters
WHSP ")"
Scheme =
"Ssha "/
AES-128 "/
AES-192 "/
AES-256"
Returnvalue =
"Encrypted "/
"Type-only"
Ibmaccessclass =
"Normal"/; this is the default
"Sensitive "/
"Critical "/
"Restricted "/
"System "/
Numericoid is used to associate the attribute type and value in ibmattributetypes.
Dbname: You can specify a maximum of two names. The first name is the name of the table that uses this attribute, and the second name is the name of the column where the value is fully normalized in this table. If only one is provided, the table is also the column name.
Access-class: similar access permissions are required to be integrated in the class. IBM has five attribute classes used to evaluate User Permissions: Normal, sensitive, critical, system, and restricted. This field is left blank to indicate the default value.
Length: the maximum length of an attribute, measured in bytes,
Equality, ordering, approx, substr, reverse: if these attributes are used, an index is created.
View attributes:
Idsldapsearch-B Cn = Schema-S base objectclass = * attributetypes ibmattributetypes
Add attributes:
Idsldapmodify-D <admindn>-W <adminpw>-I myschema. ldif
An example of myschema. ldif is as follows:
DN: Cn = Schema
Changetype: Modify
Add: attributetypes
Attributetypes: (myattribute-oId name ('myattribute ')
Desc 'an attribute I defined for my LDAP application'
Ity 2.5.13.2 syntax 1.3.6.1.4.1.1466.115.121.1.15
{200} usage userapplications)
-
Add: ibmattributetypes
Ibmattributetypes: (myattribute-oId dbname ('myattrtable' 'myattrcolumn ')
Access-class normal length 200)
Modify attributes:
Idsldapmodify-D <admindn>-W <adminpw>-I myschemachange. ldif
The content of myschemachange. ldif is shown as follows:
DN: Cn = Schema
Changetype: Modify
Replace: attributetypes
Attributetypes: (myattribute-oId name ('myattribute') DESC 'an attribute
I defined for my LDAP application 'Integrity 2.5.13.2
Syntax 1.3.6.1.4.1.1466.115.121.1.15 {200} usage userapplications)
-
Replace: ibmattributetypes
Ibmattributetypes: (myattribute-oId dbname ('myattrtable' 'myattrcolumn ')
Access-class normal length 200 duplicate ity substr)
Copy an attribute:
Let's take a look at the attributes in the schema.
Idsldapsearch-B Cn = Schema-S base objectclass = * attributetypes ibmattributetypes
Select the attributes you want to copy:
Idsldapmodify-D <admindn>-W <adminpw>-I <FILENAME>
<FILENAME> Format:
DN: Cn = Schema
Changetype: Modify
Add: attributetypes
Attributetypes: (<mynewattribute-oId> name' <mynewattripes> 'desc' <a new
Attribute I copied for my LDAP Application> ity 2.5.13.2
Syntax 1.3.6.1.4.1.1466.115.121.1.15 {200} usage userapplications)
-
Add: ibmattributetypes
Ibmattributetypes: (myattribute-oId dbname ('myattrtable' 'myattrcolumn ')
Access-class normal length 200)
Delete an attribute:
Idsldapmodify-D <admindn>-W <adminpw>-I myschemadelete. ldif
The myschemadelete. ldif file is shown as follows:
DN: Cn = Schema
Changetype: Modify
Delete: attributetypes
Attributetypes: (myattribute-oId)
-
Delete: ibmattributetypes
Ibmattributetypes: (myattribute-oId)
Encrypt an attribute:
Ldapmodify-D <admindn>-W <adminpw>
DN: Cn = Schema
Changetype: Modify
Replace: attributetypes
Attributetypes :( 0.9.2342.19200300.100.1.1 name 'uid' DESC 'Typically a user shortname or userid .'
Equality 1.3.6.1.4.1.1466.109.114.2 ordering 2.5.13.3 substr 2.5.13.4
Syntax 1.3.6.1.4.1.1466.115.121.1.15 usage userapplications)
-
Replace: ibmattributetypes
Ibmattributetypes :( 0.9.2342.19200300.100.1.1 dbname ('uid' uid ')
Access-class normal length 256 duplicate ity ordering substr approx
Encrypt aes256 secure-connection-required return-value encrypted ))
Manage unique attributes
The unique attribute ensures that a specific attribute always has a unique value in a directory. This attribute can only be specified in two portals: Cn = uniqueattributes, Cn = localhost and Cn = uniqueattributes, Cn = ibmpolicies.
Note: Binary attributes, operational attributes, configuration attributes, and
Objectclass attribute cannot be specified as a unique attribute.
Create a unique property:
Idsldapmodify-D <admindn>-W <adminpw>-I <FILENAME>
The format of the file is as follows:
DN: Cn = uniqueattributes, Cn = localhost
Changetype: add
IBM-uniqueattributetypes: Sn
Objectclass: Top
Objectclass: IBM-uniqueattributes
To add additional attributes:
Idsldapmodify-D <admindn>-W <adminpw>-I <FILENAME>
The file format is as follows:
DN: Cn = uniqueattributes, Cn = localhost
CN: uniqueattributes
Changetype: Modify
Add: IBM-uniqueattributetypes
IBM-uniqueattributetypes: aixadminuserid
-
Add: IBM-uniqueattributetypes
IBM-uniqueattributetypes: admingroupnames
Delete a unique attribute:
Idsldapmodify-D <admindn>-W <adminpw>-I <FILENAME>
DN: Cn = uniqueattributes, Cn = localhost
Changetype: Modify
CN: uniqueattributes
IBM-uniqueattributetypes: aixadminuserid

Author: gnuhpc
Source: http://www.cnblogs.com/gnuhpc/