Chapter 5 Communications Suite Delegated Administrator Classes and Attributes (Schema 2)

This chapter describes LDAP Schema 2 object classes and attributes used by Communications Suite Delegated Administrator.

Communications Suite Delegated Administrator provides a console and a command-line utility (commadmin) for provisioning Messaging Server users in an LDAP Schema 2 directory.

To provision Messaging Server users in an LDAP Schema 1 directory, you must use iPlanet Delegated Administrator, a deprecated tool. For information about object classes and attributes used by iPlanet Delegated Administrator, see Chapter 6, iPlanet Delegated Administrator Classes and Attributes (Schema 1)

The chapter is divided into two sections:

• Object Classes

• Attributes

The object classes and attributes are listed alphabetically.

Object Classes

The following object classes are used by Delegated Administrator to provision users in an LDAP Schema 2 directory:

• sunDelegatedOrganization

• sunMailOrganization

• sunManagedLocation

• sunManagedProvider

• sunSharedDomain

sunDelegatedOrganization

Supported by

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Definition

Object class that defines the properties of a business organization. For example, one property of sunDelegatedOrganization can designate a list of domain names the business organization can use for its users. Also, it can define the list of services designated by the provider organization, as available to the business organization, to be assigned to the users.

Superior Class

top

Object Class Type

auxiliary

OID

Unknown

Required Attributes

sunOrgType

Allowed Attributes

sunAvailableServices, sunAvailableDomainNames, sunMaxUsers, sunNumUsers, sunMaxGroupss, unNumGroups, sunEnableGAB, sunAllowMultipleServices, sunOrganizationSkin

sunMailOrganization

Supported by

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Definition

Object class to be added to a shared business organization that has mail service. sunMailOrganization adds two attributes (preferredMailHost and preferredMailMessageStore) that specify the mail host and message store partition where mail is stored for all users in the business organization.

You can only add the sunMailOrganization object class to a shared business organization (defined as shared with the sunOrgType attribute).

Do not add sunMailOrganization to a full domain business organization (defined as full with the sunOrgType attribute). For a full domain business organization, add the mailDomain object class, which also uses the preferredMailHost and preferredMailMessageStore attributes for provisioning the preferred mail host and message store for the domain.

Superior Class

top

Object Class Type

auxiliary

OID

oid-sunMailOrganization

Required Attributes

none

Allowed Attributes

preferredMailHost, preferredMailMessageStore

sunManagedLocation

Supported by

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Definition

Object class to be added to the user/group root suffix. This class maintains a pointer (in the form of a DN) to the location of the Business Organization Tree and Residential Tree. For example, o=Business and o=Residential, respectively.

Superior Class

top

Object Class Type

auxiliary

OID

Unknown

Required Attributes

none

Allowed Attributes

sunBusinessRoot, sunResidentialRoot, sunServicesRoot

sunManagedProvider

Supported by

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Definition

Object class used for storing the properties of a provider organization. Following are some of the properties maintained by sunManagedProvider:

• Types of business organizations this provider can create

• Where to create the business organizations

• Services available to this provider

• Domain names that can be used by the shared business organizations created under this provider organization

Superior Class

top

Object Class Type

auxiliary

OID

oid-sunManagedProvider

Required Attributes

None

Allowed Attributes

sunAllowBusinessOrgType, sunBusinessOrgBase, sunIncludeServices, sunExcludeServices, sunAssignableDomains, sunAllowMultipleDomains, sunProviderOrgDN

sunSharedDomain

Supported by

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Definition

Object class to designate a domain that can be shared across multiple business organizations (such as sesta.com).

The sunSharedDomain object class can designate a hosted domain as a shared domain. Underneath this shared domain, there can be multiple Provider Organizations. Under the Provider Organizations you can create multiple Business Organizations, all sharing the same namespace as the shared domain.

Superior Class

top

Object Class Type

auxiliary

OID

oid-sunSharedDomain

Required Attributes

none

Allowed Attributes

none

Attributes

The following attributes are used by Delegated Administrator to provision users in an LDAP Schema 2 directory:

• mailParentalControl

• mailSieveRuleRef

• preferredMailHost

• preferredMailMessageStore

• psIncludeInGAB

• sunAllowBusinessOrgType

• sunAllowMultipleDomains

• sunAllowMultipleServices

• sunAssignableDomains

• sunAvailableDomainNames

• sunAvailableServices

• sunBusinessOrgBase

• sunBusinessRoot

• sunEnableGAB

• sunExcludeServices

• sunIncludeServices

• sunMaxGroups

• sunMaxUsers

• sunNumGroups

• sunNumUsers

• sunOrganizationSkin

• sunOrgType

• sunProviderOrgDN

• sunResidentialRoot

• sunServicesRoot

mailParentalControl

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

cis, single-valued

Object Class

inetMailUser

Definition

Set to true when parental control is enabled for a user.

Messaging Server uses sieve rules to implement parental control (the ability of a family administrative account to specify mail delivery rules for one or more sub-accounts).

Parental control rules are stored in the family group entry (implemented by using mailSieveRuleSource as an attribute of the inetManagedGroup object class). When a head of family specifies parental control rules, the rules are transformed to sieve rules and stored in the family group entry.

When a sub-account is tagged for parental control, the DN of the family group entry is stored in the sub-account’s user entry (implemented with the mailSieveRuleRef attribute). In addition, the mailParentalControl attribute is set to true.

Allowed values: true, false

Default value: false

Example

mailParentalControl: true

OID

oid-mailParentalControl

mailSieveRuleRef

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

dn, single-valued

Object Class

inetMailUser

Definition

Specifies the DN of an LDAP entry. The referenced LDAP entry can contain additional mail filters in the entry’s mailSieveRuleSource attribute. Sieve rules specified in the referenced LDAP entry are applied before sieve rules specified in this user entry. This reference is used only when the mailParentalControl attribute is set to true.

Example

mailSieveRuleRef: cn=Sample Family Group,o=groups,o=Residential,o=userGroupRoot

OID

oid-mailSieveRuleRef

preferredMailHost

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

cis, single-valued

Object Classes

mailDomain, sunMailOrganization

Definition

If you are provisioning an LDAP Schema 2 directory with Communications Suite Delegated Administrator, use the following definition:

Sets the mail host name for new users in this business organization. When a user is created, the mailHost attribute of the user entry is filled by the value of preferredMailHost.

The preferredMailHost attribute is required when the business organization has a mail service.

If this is a full business organization, preferredMailHost is an attribute of the mailDomain object class. If this is a shared business organization, preferredMailHost is an attribute of the sunMailOrganization object class.

If you are provisioning an LDAP Schema 1 directory with iPlanet Delegated Administrator:

See preferredMailHost for a definition of how to use this attribute with Schema 1.

Example

preferredMailHost: mail.siroe.com

OID

2.16.840.1.113730.3.1.761

preferredMailMessageStore

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

cis, single-valued

Object Classes

mailDomain, sunMailOrganization

Definition

If you are provisioning an LDAP Schema 2 directory with Communications Suite Delegated Administrator, use the following definition:

Sets the message store partition name for new users in this business organization. When a user is created, the mailMessageStore attribute of the user entry is filled by the value of preferredMailMessageStore.

If the preferredMailMessageStore attribute is missing, Delegate Administrator leaves the mailMessageStore attribute empty and the access server assumes that the user’s mailbox is in the default partition of the server instance.

If this is a full business organization, preferredMailMessageStore is an attribute of the mailDomain object class. If this is a shared business organization, preferredMailMessageStore is an attribute of the sunMailOrganization object class.

If you are provisioning an LDAP Schema 1 directory with iPlanet Delegated Administrator:

See preferredMailMessageStore for a definition of how to use this attribute with Schema 1.

Example

preferredMailMessageStore: primary

OID

2.16.840.1.113730.3.1.762

psIncludeInGAB

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

cis, single-valued

Object Class

ipUser

Definition

Includes this user in the Global Address Book (GAB) and gives this user access to the Global Address Book.

Allowed values: true, false

Default value: true

Example

psIncludeInGAB: false

OID

oid-psIncludeInGAB

sunAllowBusinessOrgType

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

cis, multi-valued

Object Class

sunManagedProvider

Definition

Defines the types of business organizations this provider administrator can create.

This is a required attribute.

Allowed values:

• shared— Designates a business organization that is assigned to a shared domain. Multiple business organizations can be part of a shared domain. The business organization being created shares its namespace with the other organizations in the domain.

• full— Designates a business organization that is a full-fledged domain with an authorized domain name and its own unique namespace.

The sunAllowBusinessOrgType attribute can enable the provider to create

• Only shared business organizations (shared value only)

• Only business organizations that are real, full-fledged domains (full value only)

• Both shared and full-fledged business organizations (shared and full values)

Example

sunAllowBusinessOrgType: sharedsunAllowBusinessOrgType: full

OID

oid-sunAllowBusinessOrgType

sunAllowMultipleDomains

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

cis, single-valued

Object Class

sunManagedProvider

Definition

Determines whether this provider organization can create business organizations that permit multiple domain names or a single domain name for their users.

The sunAllowMultipleDomains attribute applies only to business organizations created in shared domains. If a business organization is created as a domain with its own namespace, it can always have multiple domain names specified with the associatedDomain attribute.

If the sunAllowMultipleDomains attribute is not present, the LDAP semantics allow multiple domain names for the users of the business organizations. (The default value is true.)

Allowed values: true, false

Example

sunAllowMultipleDomains: true

OID

oid-sunAllowMultipleDomains

sunAllowMultipleServices

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

cis, single-valued

Object Class

sunDelegatedOrganization

Definition

NOTE: This attribute is not being used for this release.

Enables you to assign multiple classes-of-service to users in this business organization.

Allowed values: true, false

Default value: true

If sunAllowMultipleServices has a value of false, users in this business organization can have at most one class-of-service.

Example

sunAllowMultipleServices: false

OID

oid-sunAllowMultipleServices

sunAssignableDomains

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

cis, multi-valued

Object Class

sunManagedProvider

Definition

Specifies a list of domain names the provider administrator can choose from when assigning domains to business organizations in this provider organization. This list is derived from the domain names specified in the sunPreferredDomain and associatedDomain attributes of the parent or ancestor shared domain node.

If the sunAssignableDomains attribute is not present, all of the sunPreferredDomain and associatedDomain attributes are available to be assigned to business organizations by this provider.

Example

sunAssignableDomains: sesta.com sunAssignableDomains: siroe.com sunAssignableDomains: varius.com

OID

oid-sunAssignableDomains

sunAvailableDomainNames

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

cis, multi-valued

Object Class

sunDelegatedOrganization

Definition

Specifies a list of domain names available for use by the business organization. This list is a subset of domain names derived from the sunAssignableDomains attribute in the provider organization.

If the sunAvailableDomainNames attribute is not present, all domains from the sunAssignableDomains attribute in the provider organization are available for use by this business organization.

Example

sunAvailableDomainNames: sesta.comsunAvailableDomainNames: siroe.com

OID

oid-sunAvailableDomainNames

sunAvailableServices

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

cis, multi-valued

Object Class

sunDelegatedOrganization

Definition

Specifies a list of classes-of-service available to the business organization for its users. Also specifies the number of instances of each named class-of-service.

This is a required attribute.

Format

servicename:number:number_assigned

where

number is the number of service packages allocated to the organization

number_assigned is the number of service packages assigned to users or groups in the organization. If no service packages have been assigned, the value of number_assigned is -1.

You can also use the following format:

servicename

If you specify servicename only—if you do not specify the number of services allocated and assigned—an unlimited number of that service is available to the business organization.

Example

sunAvailableServices:Gold:10:-1
sunAvailableServices:Mercury:20:5 
sunAvailableServices:Silver

In this example, 10 Gold services are available to the organization; none have been assigned. Twenty Mercury services are available to the organization; five have been assigned. An unlimited number of Silver services are available to the organization.

OID

oid-sunAvailableServices

sunBusinessOrgBase

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

dn, single-valued

Object Class

sunManagedProvider

Definition

Contains the DN for the node underneath which all full domains for this provider organization are to be created.

You can assign this attribute only if the sunAllowBusinessOrgType attribute was provisioned to allow full domains (sunAllowBusinessOrgType: full).

Example

sunBusinessOrgBase: o=providerorgDomainsRoot,o=Business,o=userGroupRoot

OID

oid-sunBusinessOrgBase

sunBusinessRoot

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

dn, single-valued

Object Class

sunManagedLocation

Definition

Holds the DN of the root entry that contains the business organization tree.

Example

sunBusinessRoot: o=Business,o=userGroupRoot

OID

oid-sunBusinessRoot

sunEnableGAB

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

cis, single-valued

Object Class

sunDelegatedOrganization

Definition

Enables use of a global address book for this business organization.

Allowed values: true, false

Default value: false

Example

sunEnableGAB: true

OID

oid-sunEnableGAB

sunExcludeServices

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

cis, multi-valued

Object Class

sunManagedProvider

Definition

Specifies a list of classes-of-service that will be excluded from the business organizations in this provider organization.

If both the sunIncludeServices and sunExcludeServices attributes are specified, only sunIncludeServices takes effect. If neither attribute is present, all classes-of-service found underneath the container specified with the sunServicesRoot attribute will also be available to the business organizations in this provider organization.

Example

sunExcludeServices: Bronze

OID

oid-sunExcludeServices

sunIncludeServices

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

cis, multi-valued

Object Class

sunManagedProvider

Definition

Specifies a list of the classes-of-service available to business organizations in this provider organization.

The complete list of classes-of-service available in this directory is found underneath the container specified with the sunServicesRoot attribute.

If the sunIncludeServices attribute is not present, all classes-of-service specified underneath the class-of-service container will also be available to the business organizations in this provider organization.

Example

sunIncludeServices: Gold

OID

oid-sunIncludeServices

sunMaxGroups

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

integer, single-valued

Object Class

sunDelegatedOrganization

Definition

Specifies the maximum number of groups that can be created in this business organization.

To enable the business organization to contain an unlimited number of groups, specify a value of -1.

Allowed values are integers.

Example

sunMaxGroups: 20

OID

oid-sunMaxGroups

sunMaxUsers

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

integer, single-valued

Object Class

sunDelegatedOrganization

Definition

Specifies the maximum number of users who can be created in this business organization.

To enable the business organization to contain an unlimited number of users, specify a value of -1.

Allowed values are integers.

Example

sunMaxUsers: 50

OID

oid-sunMaxUsers

sunNumGroups

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

integer, single-valued

Object Class

sunDelegatedOrganization

Definition

Specifies the current number of groups in this business organization.

Allowed values are integers.

Example

sunNumGroups: 8

OID

oid-sunNumGroups

sunNumUsers

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

integer, single-valued

Object Class

sunDelegatedOrganization

Definition

Specifies the current number of users in this business organization.

Allowed values are integers.

Example

sunNumUsers: 12

OID

oid-sunNumUsers

sunOrganizationSkin

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

cis, multi-valued

Object Class

sunDelegatedOrganization

Definition

This attribute is not currently implemented.

Enables this business organization to use a specified customization of the user interface (UI) to provide a specific look and feel for users in the organization.

The sunOrganizationSkin attribute is specified with a key-value pair. The key is the name of a skin to be used for the organization’s customized UI. The value identifies the jar file containing the skin.

Format

skinname:jarfile

Examples

sunOrganizationSkin: classic: classiclookandfeel.jarsunOrganizationSkin: modern: modernlookandfeel.jar

OID

oid-sunOrganizationSkin

sunOrgType

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

cis, single-valued

Object Class

sunDelegatedOrganization

Definition

Determines whether this business organization is part of a shared domain (shared) or is a full-fledged domain with its own namespace (full).

This is a required attribute.

Allowed values:

• shared— Designates a business organization that is assigned to a shared domain. Multiple business organizations can be part of a shared domain. This business organization shares its namespace with the other organizations in the domain.

• full— Designates a business organization that is a full-fledged domain with an authorized domain name and its own unique namespace.

Example

sunOrgType: shared

OID

oid-sunOrgType

sunProviderOrgDN

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

dn, single-valued

Object Class

sunManagedProvider

Definition

Contains the base DN that points to the business organization for this provider organization. The users of this provider organization are created in this business organization.

The provider organization cannot have any user entries directly under the provider organization node. All users in the provider organization must be managed in the separate business organization identified by the sunProviderOrgDN attribute. This business organization is like any other business organization.

Example

sunProviderOrgDN: o=providerorg,o=sesta.com,o=sharedDomainsRoot,o=Business

OID

oid-sunProviderOrgDN

sunResidentialRoot

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

dn, single-valued

Object Class

sunManagedLocation

Definition

Holds the DN of the root entry that contains the residential tree.

Example

sunResidentialRoot: o=Residential,o=userGroupRoot

OID

Unknown

sunServicesRoot

Origin

Messaging Server 6 2006Q2; Communications Suite Delegated Administrator

Syntax

dn, single-valued

Object Class

sunManagedLocation

Definition

Specifies the DN of the container of all the class-of-service definitions available to provider organizations in the directory.

Example

sunServicesRoot: o=Services,o=Business,o=userGroupRoot

OID

Unknown