LDAP directories are composed of objects with attributes. The objects are arranged hierarchically within special objects called containers; containers can hold both regular objects and other containers. Each object is of a particular class, which defines what attributes that object can have and other information.
The definition of object classes and the hierarchy of containers in an LDAP directory is called a schema. Each LDAP directory has a schema, which can be extended by importing another schema into it. The MLDAP ESM comes with the Micro Focus Schema which can be imported into your LDAP server. It is also possible to adapt an existing schema to replace part of the Micro Focus schema, but that requires advanced LDAP knowledge. The rest of this discussion assumes you are using the standard Micro Focus schema.
All objects have a Distinguished Name or DN, which is a string made up of components in the form type=value, separated by commas. The DN is unique among all the objects in the directory. Objects also have a Common Name or CN, which is a simple string (possibly including spaces). CNs are not unique across the directory, but may be required to be unique within a certain scope, such as within the object's container.
The standard Micro Focus LDAP Schema puts all of its objects in an outer container called the Application Partition. By default this is named:
CN=Micro Focus,CN=Program Data,DC=local
Within the application partition, we define containers for users, user groups, and resources:
CN=Enterprise Server Users,CN=Micro Focus,CN=Program Data,DC=local CN=Enterprise Server User Groups,CN=Micro Focus,CN=Program Data,DC=local CN=Enterprise Server Resources,CN=Micro Focus,CN=Program Data,DC=local
The Enterprise Server Users container will hold one object of class microfocus-MFDS-User for each user defined for Enterprise Server. This object class, also defined by the Micro Focus schema, includes the user name (as its CN), password (or a password verifier such as a hash value), user information used within MTO such as an optional operator class, and security information such as expiration date and whether login is allowed.
The Enterprise Server User Groups container holds objects of class microfocus-MFDS-Group, which simply contain the name of the group (as CNs) and the list of users who belong to that group. User groups simplify writing resource security rules for multiple users, as rules can be applied to entire groups as well as to users.
Each group member can be either the name of a user, or the group keyword followed by the name of another group. In the latter case, all the members of the named group are included in the group being defined. These "nested groups" can be used to define a hierarchy of groups, for example collecting several groups of developers into a single "ALLDEV" group. They can also be used to create very large groups, when the number of users for a group exceeds the maximum size of a multi-valued attribute supported by your LDAP server.
The Enterprise Server Resources container holds additional containers, one for each resource class. All protected resources (programs, transactions, datasets, etc) belong to a resource class (not to be confused with an LDAP object class), which in effect specifies the namespace for the resource name. That is, you can define resources with the same name, provided they belong to different classes. MTO resources use various class names defined by IBM. Non-MTO resources, such as Enterprise Server configuration definitions in MFDS, use resource class names defined by Micro Focus (using syntax that's not permitted for MTO resource class names, to avoid collisions). Users can also define their own resource classes for performing explicit access checks in applications.
Each resource class is defined as a container in Enterprise Server Resources, with the class name becoming the CN of the class container.
Within each class container are zero or more resource objects, of class microfocus-MFDS-Resource. For these objects, the CN can either be a full resource name, such as a transaction name or a dataset name, or it can be a partially- or fully-wildcarded name, which will match various resource names. This lets you write a single rule to apply to multiple resources. Wildcards are discussed in more detail in the Wildcards topic.
Each resource object also has an attribute named microfocus-MFDS-Resource-ACE, which is a multivalued attribute that holds the Access Control List (ACL) that specifies access rights for that resource. (Each entry in an ACL is referred to as an Access Control Entry, or ACE.) ACLs are discussed in more detail in the Resource Access Control Lists topic.