This OU is used to store users who are identified as short and long-term guests, i.e. all user profiles that do not qualify as student, staff, faculty or other known HCM affiliate types are stored under this OU.
The following authZ-related attributes and objectclasses can be applied to various Guests types:
- Attribute definitions
attributeTypes: ( 22.214.171.124.4.1.49126.96.36.199.1 NAME 'berkeleyEduAuthZ' DESC 'Berkeley Campus Application Authorizations' SYNTAX 188.8.131.52.4.1.14184.108.40.206.15 X-ORIGIN ( 'user defined' 'berkeley.edu University defined' ) ) attributeTypes: ( 220.127.116.11.4.1.4918.104.22.168.2 NAME 'berkeleyEduAuthZSponsorUid' DESC 'UC Berkeley Campus Application Authz sponsor uid' SYNTAX 22.214.171.124.4.1.14126.96.36.199.15 X-ORIGIN ( 'user defined' 'berkeley.edu University defined' ) )
- Objectclass definitions
objectClasses: ( 188.8.131.52.4.1.4995.2.600.11 NAME 'berkeleyEduAuthZClass' DESC 'custom authorizations object class' SUP top STRUCTURAL MUST ( uid $ berkeleyEduAuthZ $ berkeleyEduAuthZSponsorUid ) MAY ( berkeleyEduAffExpDate ) X-ORIGIN ( 'user defined' 'berkeley.edu University defined' ) )
Authoritative Data for Guests
The CalNet Guest account creation application stores the data directly into the campus directory (LDAP) and is therefore the authoritative source of all CalNet Guest data. CalNet Guest accounts are also populated in Active Diretory to support AD dependent applications.
Account Creation - When do records enter LDAP?
The CalNet Guest account information is immediately added to the LDAP under ou=guests and assigned a new affiliate type: berkeleyEduAffiliations=GUEST-TYPE-COLLABORATOR . That way site administrators can add CalNet Guest accounts to internal roles even before the CalNet Guest account has activated his/her account. The CalNet Guest account is also propagated to the AD under ou=guests.
Public and Private Attributes
The CalNet Guest account LDAP attributes are distributed as follows:
• givenName (First Name)
• sn (Last Name)
• berkeleyEduNameSalutation (Salutation)
• berkeleyEduMiddleName (Middle Name)
• berkeleyEduNameGenerational (Generational suffix)
• berkeleyEduNameHonorifics (Degree suffix to name)
• mail (Email Address)
• telephoneNumber (Telephone Number)
• berkeleyEduIMScreenName (IM Screen Name)
• berkeleyEduIMProtocol (IM Service)
CalNet Guests can not update these attributes and the privacy settings themselves in the UC Berkeley CalNet Directory until they become an official student by using Bearfacts for one time only or they become and official employee using the CalNet Manage Your Identity program.
Some additional attributes and sample values available for Guest CalNet accounts:
- berkeleyEduAffiliations: GUEST-TYPE-COLLABORATOR
- berkeleyEduAffExpDate: 20130310234336Z
- berkeleyEduFirstName: CollabGuest
- berkeleyEduKerberosPrincipalString: collabguest-test7
- berkeleyEduLastName: Test
- displayName: CollabGuest Test
Creating CalNet Guest accounts
For information on eligibility and how to create a CalNet Guest Account, please CalNet Guest Accounts.