RapidIdentity Cloud Account Attributes

LDAP account entries must contain the following values:

• objectClass=idautoPerson

• A unique idautoId value

• At least one unique idautoPersonUserNameMV value

Format the Distinguished Name (DN) for accounts as follows:

idautoID=<idautoID_value>,ou=Accounts,dc=meta

Table 1. Core Attributes

Attribute Name	Friendly Name	Data Type	Multi-Valued	Unique	Indexes	Description/Constraints
idautoID	ID	UUID	N	Y	eq	Unique UUID of the account; must not be changed after initial creation
idautoPersonUserNameMV	Usernames	String	Y	Y	eq, sub	Unique usernames for the account
givenName	First Name	String	N	N	eq, sub	Account holder's first name
sn	Last Name	String	N	N	eq, sub	Account holder's last name
displayName	Display Name	String	N	N	eq, sub	Constructed by RapidIdentity Connect, typically the account holder's first and last name
mail	Email	String	N	Y	eq, sub	Primary organizational email account
idautoPersonEmailAddresses	Email Addresses	String	Y	N	eq, sub	Current and past email addresses
idautoPersonHomeEmail	Personal Email Address	String	N	N	eq, sub	Personal email address for password reset and authentication
idautoDisabled	-	Boolean	N	N	eq	If TRUE, the account is considered DISABLED in RapidIdentity. The attribute should be cleared rather than set to FALSE when re-enabling the account.
userPassword	-	Binary	N	N	-	Hashed account password
idauto-pwdPrivate	-	Binary	N	N	-	Encrypted password managed by the Identity Automation password filter (read-only)
idauto-pwdPrivateTS	-	DateTime	N	N	eq	The date and time when the idauto-pwdPrivate value was last set (read-only)
idautoPersonPhotoURL	Photo URL	String	N	N	-	The URL of the account holder's profile image
mobile	Mobile Numbers	String	Y	N	-	The account holder's mobile phone numbers
manager	Manager	DN	Y	N	eq	The DNs of the account holder's managers
directReports	Direct Reports	DN	Y	N	eq	The DNs of the account holder's direct reports (read-only)
idautoPersonEndDate	Expiration Date	DateTime	N	N	eq	Expiration date for sponsored accounts in the following format: yyyyMMddHHmmssZ. Can store disable date from source systems for non-sponsored student accounts.
employeeType	Role	String	Y	N	eq	Valid values: staff, student, teacher, sponsored, parent. ID Hub only supports policies for staff, student, and teacher. Displays as Account Type in RapidIdentity.
idautoChallengeSet	-	String	Y	N	-	Stores RapidIdentity challenge question and answer data. Existing data must not be updated by a RapidIdentity Connect Action Set.
idautoChallengeSetTimestamp	-	DateTime	N	N	-	Date/time when the account holder last added challenge questions/answers. Can be cleared to force another challenge setup at next login.
idautoRequestAssociations	-	String	Y	N	eq	Contains the IDs of all granted, bound workflow entitlements for the account holder. Data must not be updated by a RapidIdentity Connect Action Set.
idautoPersonClaimCode	Claim Code	String	N	N	eq	Stores an arbitrary claim code used by the default RapidIdentity claim policy. Minimum length of 8 characters.
idautoPersonClaimFlag	Claimed	Boolean	N	N	-	Set to TRUE by RapidIdentity when an account is successfully claimed. Used as a filter term in the default claim policy to prevent an account from being claimed more than once. The attribute should be cleared rather than set to FALSE when an account is unclaimed.
memberOf	-	DN	Y	N	-	Read-only, slapo overlay for reverse group membership management