--- title: Creating user-defined virtual attributes description: Create a user-defined virtual attribute in PingDirectory with dsconfig to hard-code a value for matching entries. component: pingdirectory version: 11.1 page_id: pingdirectory:pingdirectory_server_administration_guide:pd_ds_create_user_defined_virtual_attributes canonical_url: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_create_user_defined_virtual_attributes.html llms_txt: https://docs.pingidentity.com/pingdirectory/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: September 13, 2023 page_aliases: ["pd_ds_create_user_defined_virtual_attr_interactive.adoc", "pd_ds_create_user_defined_virtual_attr_dsconfig_non_int.adoc"] section_ids: creating-a-user-defined-virtual-attribute-in-interactive-mode: Creating a user-defined virtual attribute in interactive mode about-this-task: About this task steps: Steps example: Example: result: Result: example-2: Example: result-2: Result: creating-a-user-defined-virtual-attribute-using-dsconfig-in-non-interactive-mode: Creating a user-defined virtual attribute using dsconfig in non-interactive mode about-this-task-2: About this task steps-2: Steps example-3: Example: --- # Creating user-defined virtual attributes User-defined virtual attributes allow you to specify an explicit value to use for the virtual attribute. There are no restrictions on the length of the value for a user-defined virtual attribute. You must only ensure that the new virtual attribute conforms to your schema, or you will see an error message when you configure it. You can define your virtual attributes using the `dsconfig` tool from the `Standard object menu`. Only the value property is specific to the user-defined virtual attribute. All of the other properties are common across all kinds of virtual attributes, which include the following: | Property | Description | | ---------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `enabled` | Indicates whether the virtual attribute should be used. | | `attribute-type` | The attribute type for the virtual attribute that is generated. | | `base-dn``group-dn``filter` | Can be used to select which entries are eligible to contain the virtual attribute. | | `client-connection-policy` | Can be used to select which entries are eligible to contain the virtual attribute. | | `conflict-behavior` | Used to indicate how the server should behave if there are one or more real values for the same attribute type in the same entry.The server can either return only the real values, only the virtual values, or merge both real and virtual values. | | `require-explicit-request-by-name` | Used to indicate whether the server should only generate values for the virtual attribute if it was included in the list of requested attributes. | | `multiple-virtual-attribute-evaluation-order-index``multiple-virtual-attribute-merge-behavior` | Used to control the behavior of the server if multiple virtual attributes can be used to contribute values to the same attribute. | ## Creating a user-defined virtual attribute in interactive mode ### About this task The following example shows how to create a user-defined virtual attribute that assigns an Employee Password Policy to any entry that matches the filter `"(employeeType=employee)"`. ### Steps 1. To configure the user-defined virtual attribute: 1. Run `dsconfig`. 2. Specify the connection port, bind DN, password, and host information. 3. Type the LDAP connection parameter for your PingDirectory server: * For LDAP, enter `1`. * For SSL, enter `2`. * For StartTLS, enter `3`. 2. To change the object menu, in the PingDirectory server main menu, type `o`, and then type the number to select `Standard`. 3. In the PingDirectory server main menu, type the number corresponding to virtual attributes. 4. To create a new virtual attribute, in the `Virtual Attribute management` menu, type the number. 5. Use an existing virtual attribute as a template for your new attribute, or create a new attribute from scratch. In this example, type `n` to create a new Virtual Attribute from scratch. 6. In the `Virtual Attribute Type` menu, enter a number corresponding to the type of virtual attribute that you want to create. In this example, type the number corresponding to User Defined Virtual Attribute. 7. Enter a name for the new virtual attribute. In this example, enter `Employee Password Policy Assignment`. 8. In the `Enabled Property` menu, enter the number to set the property to `TRUE` (enable). 9. In the `Attribute-Type Property` menu, type the `attribute-type` property for the new virtual attribute. You can enter the OID number or attribute name. The `attribute-type` property must conform to your schema. For this example, type `ds-pwp-password-policy-dn`. 10. Enter the value for the virtual attribute, and then press Enter or Return to continue. In this example, enter `cn=Employee Password Policy,cn=Password Policies,cn=config`, and then type Enter or Return to continue. 11. In the `User Defined Virtual Attributes` menu, enter a description for the virtual attribute. Though optional, this step is useful if you plan to create multiple virtual attributes. Enter the option to change the value, and then type a description of the virtual attribute. In this example, type `Virtual attribute that assigns the Employee Password Policy to all entries that match (employeeType=employee)`. 12. In the `User Defined Virtual Attribute` menu, type the number corresponding to the filter. 13. In the `Filter Property` menu, enter the option to add one or more filter properties, type the filter, and then press Enter to continue. In this example, type `(employeeType=employee)`. Press the number to use the filter value entered. 14. In the `User Defined Virtual Attribute` menu, type `f` to finish creating the virtual attribute. 15. Verify that the attribute was created successfully. 1. Add the `employeeType=employee` attribute to an entry, such as `uid=user.0`, using `ldapmodify`. 2. Add the `employeeType=contractor` attribute to another entry, such as `uid=user.1`. 16. To search for the user with the `employeeType=employee` attribute, such as `uid=user.0`, use `ldapsearch`. #### Example: ```shell $ bin/ldapsearch --baseDN dc=example,dc=com "(uid=user.0)" \ ds-pwp-password-policy-dn ``` #### Result: The `ds-pwp-password-policy-dn` attribute has the assigned password policy as its value. ``` dn: uid=user.0,ou=People,dc=example,dc=com ds-pwp-password-policy-dn: cn=Employee Password Policy,cn=Password Policies,cn=config ``` 17. Run `ldapsearch` again using the filter `(uid=user.1)`. #### Example: ```shell $ bin/ldapsearch --baseDN dc=example,dc=com "(uid=user.1)" \ ds-pwp-password-policy-dn ``` #### Result: The `ds-pwp-password-policy-dn` attribute is not present in the entry because the entry has the attribute `employeeType=contractor`. ``` dn: uid=user.1,ou=People,dc=example,dc=com ``` ## Creating a user-defined virtual attribute using `dsconfig` in non-interactive mode ### About this task You can create a virtual attribute in non-interactive command-line mode using `dsconfig`. ### Steps * To set up the Employee Password Policy Assignment virtual attribute introduced in the previous section, run the following command. #### Example: ```shell $ bin/dsconfig create-virtual-attribute \ --name "Employee Password Policy Assignment" \ --type user-defined \ --set enabled:true \ --set attribute-type:ds-pwp-password-policy-dn \ --set "filter:(employeeType=employee)" \ --set "value:cn=Employee Password Policy,cn=Password Policies,cn=config" ```