The IDirectoryConfigurationAD type exposes the following members.

ToggleProperties

Type NameDescription
Public propertyAllowEmailOrUPNShortNames
A boolean that specifies whether an Active Directory configuration can use an email address or User Principal Name (UPN) as the user short name.

If the value of this property is false, the Active Directory security provider parses login user names (principal names) to determine if the name is in UPN format, meaning that it contains an @ character followed by at least one dot character (for example, jsmith@mydomain.com). If the principal name is in UPN format, it is assumed to take the form name@domain, where name is the user name and domain is the name of an Active Directory domain configured in Administration Console for Content Platform Engine. This special handling can be useful in some large Active Directory forest and domain setups, but prevents email addresses and certain UPNs from being used as the user short name.

If the value of this property is true, the Active Directory security provider does not parse the principal name, which allows email addresses and UPNs to be used as the user short name. Setting this property to true implies that ReturnNameAsDN is also set to true.

This property has a global effect. Therefore, it must be set the same (either all true or all false) for all Active Directory configurations defined for a Content Engine. If this property is not set the same for all configurations, the property value is implicitly false.

Public propertyClassDescription
The ClassDescription object containing the property metadata for the EngineObject.
(Inherited from IEngineObject.)
Public propertyConnectionTimeout
Specifies the Active Directory Service provider connection timeout in milliseconds. The default is 500 milliseconds. If the connection is across a WAN, consider increasing the value.

When getting back a collection of domain controllers for a given domain, use this property in an LDAP connection request to determine if a given domain controller in the domain is up and running. If a timeout exception occurs in the specified time, assume the domain controller is not running and try the next one.

Public propertyDirectoryServerHost
Identifies the LDAP directory server or servers to use. See also the DirectoryServerPort property.

The value of this property can be any one of the following:



  • Single host name, single IP address (all LDAP directory types)
    When the value is a host name, Content Engine attempts to connect to the directory server that runs on that host. Content Engine uses the port number specified by the DirectoryServerPort property for this connection attempt.
  • Single host name, multiple IP addresses (Microsoft® Active Directory and IBM® Tivoli® Directory Server)
    You can manually create DNS address records ("A" records) to assign the same host name to each of the different IP addresses. Failover using multiple IP addresses can be specified only when the value of the DirectoryServerType property is AD (Active Directory) or IBM (Tivoli Directory Server).

    The benefit of using multiple IP addresses for failover is that you do not need to modify a failover list when you change the host name, or when you decommission a domain controller or a Tivoli Directory Server. In addition, this option is useful when the Active Directory domain contains remote domain controllers but you want to connect only to local DCs (as opposed to using the "Domain name" option below). The DC connection attempts are done in parallel. The first successful connection is the DC used.


  • Domain name (Microsoft Active Directory)
    When the value is an Active Directory domain name and the value of the DirectoryServerType property is AD (Active Directory), Content Engine attempts to connect to any domain controller (DC) in the specified domain. Each DC must use the same LDAP port numbers (generally the case). The DC connection attempts are done in parallel. The first successful connection is the DC used.
  • Failover list (Microsoft Active Directory and IBM® Tivoli® Directory Server)
    When the value is a list of unique host names paired with port numbers, Content Engine attempts to connect to one of the directory servers represented in the list. (The DirectoryServerPort property is ignored.) A failover list can be specified only when the value of the DirectoryServerType property is AD (Active Directory). or IBM (Tivoli Directory Server). For Active Directory, each directory server represented in the failover list is expected to be an Active Directory domain controller (DC).

Failover list format
Format the failover list in the following manner:

        Hostname1:Port1 Hostname2:Port2 Hostname3:Port3 ... HostnameN:PortN

Separate the host name and port number pairs with one space character. In the following example, the first pair specifies LaurelTree as the machine name and 389 as the port number:

        LaurelTree:389 OliveTree:636 FigTree:389

Content Engine makes connection attempts to directory servers based on the order of the pairs in the list. The connection attempts stop when Content Engine either successfully connects to a directory server or exhausts the list. The connection attempts resume at the beginning of the list when Content Engine loses a previously established directory server connection.

For instance, given the example list, Content Engine first attempts to connect to the directory server on the LaurelTree machine on port 389. If that attempt fails, it attempts to connect to the directory server on the OliveTree machine on port 636. If that attempt succeeds, the connection attempts stop. If, later on, Content Engine loses the connection to the directory server on OliveTree, the connection attempts start over again with LaurelTree.

(Inherited from IDirectoryConfiguration.)
Public propertyDirectoryServerPassword
The UTF-8 encoded, non-encrypted user password for authenticating to a given directory server. To maintain password security, you can use this property only to set a password, not to read its value. Instead of returning a password value, this property returns a zero-length byte array if it has been set with a password and returns a null value if it has never been set.
(Inherited from IDirectoryConfiguration.)
Public propertyDirectoryServerPort
The port number of the directory server.

Content Engine ignores this property when the value of the DirectoryServerHost property is a failover list. For information about failover lists, see the DirectoryServerHost property.

(Inherited from IDirectoryConfiguration.)
Public propertyDirectoryServerProviderClass
Specifies the directory server provider class name. The value of this property defaults to the following strings for the directory server types that the FileNet® P8 Content Engine supports:
  • com.filenet.engine.security.ActiveDirectoryProvider (for Microsoft® Active Directory®)
  • com.filenet.engine.security.IBMTivoliProvider (for IBM® Tivoli®)
  • com.filenet.engine.security.EDirectoryProvider (for Novell eDirectory)
  • com.filenet.engine.security.SunOneProvider (for Oracle Directory Server (formerly SunOne))
  • com.filenet.engine.security.OIDProvider (for Oracle Internet Directory)
(Inherited from IDirectoryConfiguration.)
Public propertyDirectoryServerType
The type of directory server for the directory server configuration. The value for this property is one of the following:
  • AD (for Microsoft® Active Directory®)
  • ADAM (for Microsoft® Active Directory Application Mode) (Windows 2003) and for Microsoft® Active Directory Lightweight Directory Services (Windows 2008))
  • IBM (for IBM® Tivoli® Directory Server)
  • Novell (for Novell eDirectory)
  • OID (for Oracle Internet Directory)
  • SunOne (for Oracle Directory Server)
  • CA (for Computer Associates eTrust Directory Server)
  • Domino (for Domino Directory Server)
  • RadiantOne (for RadiantOne Directory Server)
  • VMM (for IBM Virtual Member Manager)
(Inherited from IDirectoryConfiguration.)
Public propertyDirectoryServerUserName
Specifies the user name for authenticating to the directory server. The following are examples of strings for Active Directory and Oracle Directory Server:
  • For Active Directory: "CN=test1,CN=Users,DC=myCompany,DC=com"
  • For Oracle Directory Server: "uid=admin,ou=administrators,ou=topologymanagement, o=netscaperoot"
(Inherited from IDirectoryConfiguration.)
Public propertyDisplayName
The user-readable, provider-specific name of an object. This property is usually the designated Name property of the object's class.

For ICmAuditProcessingBookmark and IAuditDefinition objects, this property is intended to identify client applications that process the audit log. For ICmAuditProcessingBookmark objects, this property, in support of the audit disposition feature, identifies the client that created the object. For IAuditDefinition objects, this property identifies a set of audit definitions for a given client or client functionality.

For ICmAuditProcessingBookmark and IAuditDefinition objects, it is recommended that you set this property. Specify a unique value to distinguish one client application from another. Note, however, that the server does not prevent identical display names across multiple ICmAuditProcessingBookmark or IAuditDefinition objects. Therefore, the client application is responsible for enforcing uniqueness.

(Inherited from IDirectoryConfiguration.)
Public propertyGCHost
Identifies the Microsoft® Active Directory global catalog (GC) or catalogs to use. See also the GCPort property.

The value of this property can be any one of the following:

  • Single host name, single IP address (all LDAP directory types)
    When the value is a host name, Content Engine attempt to connect to the GC that runs on that host. Content Engine uses the port number specified by the GCPort property for this connection attempt.
  • Single host name, multiple IP addresses (Microsoft® Active Directory)
    You can manually create DNS address records ("A" records) assigning the same host name to each of several different GC IP addresses. This is useful when the Active Directory domain is remote and you want to connect only to local GCs (as opposed to using the "Domain name" option below). The GC connection attempts are done in parallel. The first successful connection is the GC used.
  • Domain name (Microsoft Active Directory)
    When the value is an Active Directory domain name and the value of the DirectoryServerType property is AD (Active Directory), Content Engine attempts to connect to any GC in the specified domain. Each GC must use the same LDAP port numbers (generally the case). The GC connection attempts are done in parallel. The first successful connection is the GC used.
  • Failover list
    When the value is a list of host names paired with port numbers, Content Engine attempts to connect to one of the GCs represented in the list. (The GCPort property is ignored.)
  • No value
    When the value is null, Content Engine uses an internal mechanism to find a GC.

Failover list format
Format the failover list in the following manner:

        Hostname1:Port1 Hostname2:Port2 Hostname3:Port3 ... HostnameN:PortN

Separate the host name and port number pairs with one space character. In the following example, the first pair specifies LaurelTree as the machine name and 3268 as the port number.

        LaurelTree:3268 OliveTree:3269 FigTree:3268

Content Engine makes connection attempts to GCs based on the order of the pairs in the list. The connection attempts stop when Content Engine either successfully connects to a GC or exhausts the list. The connection attempts resume at the beginning of the list when Content Engine loses a previously established GC connection.

For instance, given the example list, Content Engine first attempts to connect to the GC on the LaurelTree machine on port 3268. If that attempt fails, it attempts to connect to the GC on the OliveTree machine on port 3269. If that attempt succeeds, the connection attempts stop. If, later on, Content Engine loses the connection to the GC on OliveTree, the connection attempts start over again with LaurelTree.

Public propertyGCPort
The port number of a Microsoft® Active Directory global catalog server.

Content Engine ignores this property when the value of the GCHost property is null or is a failover list. For information about failover lists, see the GCHost property.

Public propertyGroupBaseDN
Specifies the base Distinguished Name (DN) for searching for groups in the directory server.
(Inherited from IDirectoryConfiguration.)
Public propertyGroupDisplayNameAttribute
Specifies the directory server attribute to be used as the display name for a group. The default property value is dependent on the directory service type and is specified by the authentication provider's configuration.
(Inherited from IDirectoryConfiguration.)
Public propertyGroupMembershipSearchFilter
Specifies the search filter or provider-specific attribute for group membership lookups. When a search filter is specified, Content Platform Engine issues an LDAP query. For some LDAP providers, you can optionally specify a provider-specific attribute instead of a search filter. The use of an attribute speeds up initial logins to Content Platform Engine, especially if the user logging in is a member of many groups.

The following table shows the default value of this property for each of the supported service providers. Note that you can use a lookup attribute for some providers. If you specify an attribute, make sure to include the angle brackets (<attribute>).

ProviderSearch filterProvider attribute
Active DirectoryN/ADefault: null.

Do not change this value.

The provider uses its memberOf attribute to lookup group membership.

ADAM or AD LDSN/ADefault: <memberOf>

CPE 5.2.1.2-P8CPE-FP002 or later is required.

IBM TivoliDefault:

(|(&(objectclass=groupOfNames)(member={0}))(&(objectclass=groupOfUniqueNames)(uniqueMember={0})))

<ibm-allGroups>

CPE 5.2.1.2-P8CPE-FP002 or later is required.

Check the IBM Tivoli documentation to determine if your version supports this attribute.

Novell eDirectoryDefault:

(&(objectClass=groupOfNames)(member={0}))

<groupMembership>

CPE 5.2.1.2-P8CPE-FP002 or later is required.

Check the Novell eDirectory documentation to determine if your version supports this attribute.

Oracle Internet Directory (OID)Default:

(|(&(member={0})(objectClass=groupOfNames))(&(uniqueMember={0})(objectClass=groupOfUniqueNames)))

N/A
Oracle Directory Server Enterprise Edition

OR

Sun Directory Server Enterprise Edition

OR

SunOne

Default:

(&(objectClass=groupOfUniqueNames)(uniqueMember={0}))(|(&(member={0}))

N/A
Computer Associates eTrustDefault:

(&(cn={0})(objectClass=person))

N/A
(Inherited from IDirectoryConfiguration.)
Public propertyGroupNameAttribute
Defines the directory server attribute to be used as the short name for a group. The default value of this property is samAccountName for the Active Directory service provider and cn for all other supported directory service providers.
(Inherited from IDirectoryConfiguration.)
Public propertyGroupSearchFilter
Specifies the search filter for querying a group or groups. The filter must be in the following format: "(&(objectClass=user_defined_class)(an_attribute={0}))", where user_defined_class is the object class you want (for example, user) and an_attribute is the LDAP server-specific attribute (for example, samAccountName, cn, or uid).

The default value of this property is unique to the directory service provider, as follows:

  • ActiveDirectory: (&(objectClass=group)(samAccountName={0})), where samAccountName serves as the short name.
  • ADAM and AD LDS: (&(objectClass=group)(person={0}))
  • Oracle Directory Server: (&(objectClass=groupOfUniqueNames)(cn={0}))
  • Novell: (&(objectClass=groupOfNames)(cn={0}))
  • IBM: ((&(cn={0})(|(objectClass=groupOfNames)(objectClass=groupOfUniqueNames)))
  • OID: (&(cn={0})(|(objectClass=groupOfNames)(objectClass=groupOfUniqueNames)))
(Inherited from IDirectoryConfiguration.)
Public propertyGroupUniqueIDAttribute
Specifies the directory server attribute to be used as the unique identifier for a group, that is, for the Content Engine Group.Id property. The default property value is dependent on the directory server type and is specified by the authentication provider's configuration. See What are access rights? for a list of the default SID attributes for the supported authentication providers.
(Inherited from IDirectoryConfiguration.)
Public propertyId
A representation of the Globally Unique Identifier (GUID), a unique 128-bit number, that is assigned to this Content Engine object when the object is created. When converted to a string, the Id property is typically depicted as 32 hexadecimal characters enclosed by brackets in the following format: {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}. For example, {3F2504E0-4F89-11D3-9A0C-0305E82C3301}.

For IUser and IGroup classes, the Id property takes the value of the Security Identifier (SID) rather than the 128-bit GUID. The string representation of the SID is in this example format: S-1-5-21-1559522492-2815155736-3711640725-55269. When Active Directory is used as the directory service for IBM FileNet P8, IUser.Id and IGroup.Id always return the current SID for the principal, even if this user or group has only historical SIDs populating the Active Directory server.

For a given property representation, the Id property has the following characteristics:

  • PropertyDescription.Id is equal to PropertyTemplate.Id, which is equal to PropertyDefinition.PrimaryId.
  • PropertyDefinition.Id is not equal to PropertyDefinition.PrimaryId.
  • PropertyDefinition.Id is not equal to PropertyDescription.Id.

For a newly created document object, you can override the Id property of its associated VersionSeries object before you save or check in the document for the first time.

(Inherited from IDirectoryConfiguration.)
Public propertyIsSSLEnabled
Specifies whether the Secure Sockets Layer (SSL) protocol is enabled (true) or disabled (false) for communication to the SMTP server.
(Inherited from IDirectoryConfiguration.)
Public propertyProperties
The IProperties collection of properties for the EngineObject.
(Inherited from IEngineObject.)
Public propertyRestrictMembershipToConfiguredRealms
Restricts a group membership search to within the realms configured in Administration Console for Content Platform Engine.

A user can be in a configured realm but belong to a group in an unconfigured realm. By default (that is, when the property value is False), the server automatically searches cross-realm group membership (also called cross-domain group membership in Active Directory). If it reaches a realm that is not configured in Administration Console, the server returns a Realm not found error and group membership search processing stops. However, if the property value is True when this situation occurs, the server logs an informational message to the server error log and the group membership search continues.

NOTE This property is not supported for the Windows Active Directory Application Mode (ADAM) directory service provider. This is because ADAM does not support cross-realm group memberships (cross-partition memberships, in ADAM terminology).

(Inherited from IDirectoryConfiguration.)
Public propertyReturnNameAsDN
Specifies whether to return the user or group name in Distinguished Name (DN) format for Active Directory Service provider. By default, the Active Directory Service provider returns the user and group names in UPN format. If this property is set to True, the service provider returns the names in DN format, which is consistent with other types of directory service providers.
Public propertySearchCrossForestGroupMembership
Specifies whether the Active Directory Service provider performs cross-forest group membership searches. The default is False. To enable cross-forest group membership searches, set this property to True.
Public propertyUserBaseDN
Specifies the base Distinguished Name (DN) for searching for users in the directory server.
(Inherited from IDirectoryConfiguration.)
Public propertyUserDisplayNameAttribute
Specifies the directory server attribute to be used as the display name for a user. The default property value is dependent on the directory server type and is specified by the authentication provider's configuration.
(Inherited from IDirectoryConfiguration.)
Public propertyUserNameAttribute
Defines the directory server attribute to be used as the short name for a user. The default value of this property is unique to the directory service provider as follows:
  • Active Directory: samAccountName
  • Sun One: uid
  • Novell: cn
  • IBM: cn
  • ADAM: cn
  • OID: cn
(Inherited from IDirectoryConfiguration.)
Public propertyUserSearchFilter
Specifies the search filter for querying a user or users. The filter must be in the following format: "(&(objectClass=user_defined_class)(an_attribute={0}))", where user_defined_class is the object class you want (for example, user or person) and an_attribute is the LDAP server-specific attribute (for example, samAccountName, cn, or uid).

The default value of this property is unique to the directory service provider, as follows:

  • ActiveDirectory: (&(objectClass=user)(samAccountName={0})), where samAccountName serves as the short name.
  • ADAM and AD LDS: (&(objectClass=person)(member={0}))
  • Oracle Directory Server: (&(objectClass=person)(uid={0}))
  • Novell: (&(objectClass=person)(cn={0}))
  • IBM: (&(objectClass=person)(cn={0}))
  • OID: (&(objectClass=person)(cn={0}))
(Inherited from IDirectoryConfiguration.)
Public propertyUserUniqueIDAttribute
Specifies the directory server attribute to be used as the unique identifier for a user, that is, for the Content Engine User.Id property. The default property value is dependent on the directory server type and is specified by the authentication provider's configuration. See What are access rights? for a list of the default SID attributes for the supported authentication providers.
(Inherited from IDirectoryConfiguration.)

ToggleSee Also