The Liberty Personal Profile Service is an identity service that contains default attributes and values that can be queried and modified. Based on the Liberty ID-SIS Personal Profile Service Specification, the OpenSSO Liberty Personal Profile Service also provides a framework to add attributes which are not specifically defined. According to the specification, these extensions can be configured specifically as new attributes under an already defined container or group of attributes (for example, under /PP/CommonName, /PP/LegalIdentity, or /PP/AddressCard) or globally as new attributes under a specific extension attribute container defined as /PP/Extension. Currently, OpenSSO only supports the configuration of new attributes globally by defining a schema under the extension attribute container. Following is the OpenSSO schema for /PP/Extension.

<?xml version="1.0" encoding="UTF-8" ?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema";
  xmlns="http://www.sun.com/identity/liberty/pp";
  targetNamespace="http://www.sun.com/identity/liberty/pp";>
  <xs:annotation>
      <xs:documentation>
      </xs:documentation>
  </xs:annotation>

  <xs:element name="PPISExtension">
     <xs:complexType>
        <xs:simpleContent>
           <xs:extension base="xs:string">
              <xs:attribute name="name" type="xs:string" use="required"/>
           </xs:extension>
        </xs:simpleContent>
     </xs:complexType>
   </xs:element>
</xs:schema>

• Adding the Attribute to a Directory
• Configuring OpenSSO with the New Attribute
• Testing the New Attribute

Adding the Attribute to a Directory

OpenSSO defines a schema for each attribute exposed in the Liberty Personal Profile Service. Each attribute also maps to a corresponding LDAP attribute. For example, the specification attribute /PP/CommonName/CN is defined as sunIdentityServerPPCommonNameCN in the Liberty Personal Profile Service and mapped to the CN LDAP attribute. So, for each extension attribute defined, there must be a corresponding LDAP schema and attribute. The schema can be defined in either of two ways:

1. Define an OpenSSO compliant XML service file
2. Define a new LDAP object class with corresponding attributes

dn: cn=schema
changetype: modify
add: attributeTypes
attributeTypes: ( creditcard-oid NAME 'creditcard' DESC 'Sample CreditCard'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Sun Java System Identity Management')
objectClasses: ( extensionPPService-oid NAME 'extensionPPService' DESC 'PP Extensions OC'
SUP top AUXILIARY MAY ( creditcard )  X-ORIGIN 'Sun Java System Identity Management' )

Configuring OpenSSO with the New Attribute

1. Click on the Web Services tab.
2. Click on the Liberty Personal Profile tab.
3. Click New under PPLDAP Attribute Map.
4. Define a new mapping as creditcard to creditcard.
5. Add creditcard as a new attribute under Extension Container Attributes.
6. Save the configuration.

Testing the New Attribute