---
title: Indexing grant attributes in PingDS
description: If you use PingDS to store OAuth persistent grants for PingFederate, you must index the grant attributes.
component: pingfederate
version: 13.1
page_id: pingfederate:administrators_reference_guide:pf_index_grant_attributes_pingds
canonical_url: https://docs.pingidentity.com/pingfederate/13.1/administrators_reference_guide/pf_index_grant_attributes_pingds.html
llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
section_ids:
  about-this-task: About this task
  steps: Steps
  related-links: Related links
---

# Indexing grant attributes in PingDS

If you use PingDS to store OAuth persistent grants for PingFederate, you must index the grant attributes.

## About this task

Index these OAuth grant attributes using the procedure below.

| Attribute name                       | Index type |
| ------------------------------------ | ---------- |
| `accessGrantGuid`                    | equality   |
| `accessGrantUniqueUserIdentifier`    | equality   |
| `accessGrantHashedRefreshTokenValue` | equality   |
| `accessGrantClientId`                | equality   |
| `accessGrantExpiresTime`             | ordering   |
| `accessGrantGrantType`               | equality   |

|   |                                                                                                                                                                                                                                                                                                            |
| - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | If you're using the deprecated `org.sourceid.oauth20.token.AccessGrantManagerLDAPPingDSImpl`, change all `accessGrantExpiresTime` references to `accessGrantExpires`.If you're using PingDS V2, `org.sourceid.oauth20.token.AccessGrantManagerLDAPPingDSV2Impl`, continue to use `accessGrantExpiresTime`. |

## Steps

1. Create the indexes using the PingDS `dsconfig` utility.

   The `dsconfig` utility is interactive, letting you enter command arguments. The following examples create the required indexes.

   ```shell
   $ dsconfig create-backend-index \
       --hostname localhost \
       --port 4444 \
       --bindDN uid=admin \
       --bindPassword password \
       --backend-name dsEvaluation \
       --index-name accessGrantGuid \
       --set index-type:equality \
       --usePkcs12TrustStore /path/to/opendj/config/keystore \
       --trustStorePassword:file /path/to/opendj/config/keystore.pin \
       --no-prompt
   ```

   ```shell
   $ dsconfig create-backend-index \
       --hostname localhost \
       --port 4444 \
       --bindDN uid=admin \
       --bindPassword password \
       --backend-name dsEvaluation \
       --index-name accessGrantUniqueUserIdentifier \
       --set index-type:equality \
       --usePkcs12TrustStore /path/to/opendj/config/keystore \
       --trustStorePassword:file /path/to/opendj/config/keystore.pin \
       --no-prompt
   ```

   ```shell
   $ dsconfig create-backend-index \
       --hostname localhost \
       --port 4444 \
       --bindDN uid=admin \
       --bindPassword password \
       --backend-name dsEvaluation \
       --index-name accessGrantHashedRefreshTokenValue \
       --set index-type:equality \
       --usePkcs12TrustStore /path/to/opendj/config/keystore \
       --trustStorePassword:file /path/to/opendj/config/keystore.pin \
       --no-prompt
   ```

   ```shell
   $ dsconfig create-backend-index \
       --hostname localhost \
       --port 4444 \
       --bindDN uid=admin \
       --bindPassword password \
       --backend-name dsEvaluation \
       --index-name accessGrantClientId \
       --set index-type:equality \
       --usePkcs12TrustStore /path/to/opendj/config/keystore \
       --trustStorePassword:file /path/to/opendj/config/keystore.pin \
       --no-prompt
   ```

   ```shell
   $ dsconfig create-backend-index \
       --hostname localhost \
       --port 4444 \
       --bindDN uid=admin \
       --bindPassword password \
       --backend-name dsEvaluation \
       --index-name accessGrantExpiresTime \
       --set index-type:ordering \
       --usePkcs12TrustStore /path/to/opendj/config/keystore \
       --trustStorePassword:file /path/to/opendj/config/keystore.pin \
       --no-prompt
   ```

   ```shell
   $ dsconfig create-backend-index \
       --hostname localhost \
       --port 4444 \
       --bindDN uid=admin \
       --bindPassword password \
       --backend-name dsEvaluation \
       --index-name accessGrantGrantType \
       --set index-type:equality \
       --usePkcs12TrustStore /path/to/opendj/config/keystore \
       --trustStorePassword:file /path/to/opendj/config/keystore.pin \
       --no-prompt
   ```

2. After adding the indexes, build the indexes using the `rebuild-index` utility.

   The following example builds the required indexes.

   ```shell
   $ rebuild-index \
       --hostname localhost \
       --port 4444 \
       --bindDN uid=admin \
       --bindPassword password \
       --baseDN dc=example,dc=com \
       --index accessGrantGuid \
       --index accessGrantUniqueUserIdentifier \
       --index accessGrantHashedRefreshTokenValue \
       --index accessGrantClientId \
       --index accessGrantExpiresTime \
       --index accessGrantGrantType \
       --usePkcs12TrustStore /path/to/opendj/config/keystore \
       --trustStorePassword:file /path/to/opendj/config/keystore.pin
   ```

## Related links

* [Configure indexes](https://docs.pingidentity.com/pingds/latest/config-guide/idx-config.html)