Follow the steps below to create a custom attribute in OpenAM.

1. Create a backup copy of the configuration file for the iPlanetAmUserService.

   $ cd $HOME
   $ cp openam/config/xml/amUser.xml openam/config/xml/amUser.xml.orig

2. Edit the file to add your attribute as one of the list of <User> attributes.

   <AttributeSchema name="customAttribute"
       type="single"
       syntax="string"
       any="display"
       i18nKey="Custom Attribute">
   </AttributeSchema>

   Here, the name refers to the attribute type name used in LDAP. The i18nKey holds either the reference, or in this case the content, of the text that appears in the user interface.

3. Delete iPlanetAMUserService, and then create it from your updated configuration file.

   $ cd /path/to/tools/openam/bin/
   $ ssoadm
    delete-svc
    --adminid amadmin
    --password-file /tmp/pwd.txt
    --servicename iPlanetAMUserService
   
   Service was deleted.
   $ ssoadm
    create-svc
    --adminid amadmin
    --password-file /tmp/pwd.txt
    --xmlfile $HOME/openam/config/xml/amUser.xml
   
   Service was added.

Follow the steps below to update the identity repository LDAP schema for the custom attribute, and then update OpenAM to use the custom attribute and object class.

1. Prepare the attribute type object class definitions in LDIF format.

   $ cat custom-attr.ldif 
   dn: cn=schema
   changetype: modify
   add: attributeTypes
   attributeTypes: ( temp-custom-attr-oid NAME 'customAttribute' EQUALITY case
    IgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstrings
    Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE userApplications )
   -
   add: objectClasses
   objectClasses: ( temp-custom-oc-oid NAME 'customObjectclass' SUP top AUX
    ILIARY MAY customAttribute )
   

2. Add the schema definitions to the directory.

   $ /path/to/OpenDJ/bin/ldapmodify
    --port 1389
    --hostname openam.example.com
    --bindDN "cn=Directory Manager"
    --bindPassword password
    --filename custom-attr.ldif
   Processing MODIFY request for cn=schema
   MODIFY operation successful for DN cn=schema

3. In OpenAM console, browse to Access Control > Realm Name > Data Stores > Data Store Name.

4. Add the object class, here customObjectclass, to the LDAP User Object Class list.

5. Add the attribute type, here customAttribute, to the LDAP User Attributes list.

6. Save your work.

Follow these steps to make the new attribute editable by users. The steps imply use of the embedded configuration directory. If you use a different directory server to store the configuration, then adapt them for your tools.

1. Login to the control panel for the embedded configuration directory.

   $ ./openam/opends/bin/control-panel &

   Connect using bind DN cn=Directory Manager and the the password for amadmin.

2. Select Manage Entries to open the LDAP browser.

3. Search with LDAP Filter: set to ou=SelfWriteAttributes, and then expand the tree views to see the two entries found.

4. In the entry under iPlanetAMPolicyService, edit the sunKeyValue attribute to add your custom attribute to the list of self-writable attributes, as in <Value>customAttribute</Value>.

5. In the entry under sunEntitlementIndexes, edit the sunKeyValue attribute to add your custom attribute to the list of self-writable attributes, as in replacing the last \n in the list with ,\n \"customAttribute\"\n.

6. Restart OpenAM or the web container where it runs.

   $ /etc/init.d/tomcat stop
   $ /etc/init.d/tomcat start

7. Login to OpenAM console as a user to check that a user can save a value for your new, custom attribute.

   

   
   [D]