Guests OU

Guests (ou=guests,dc=berkeley,dc=edu)

This OU is used to store users who are identified as short and long-term guests, i.e. all user profiles that do not qualify as student, staff, faculty or other known HCM affiliate types are stored under this OU.

The following authZ-related attributes and objectclasses can be applied to various Guests types:

  • Attribute definitions
    attributeTypes: ( 1.3.6.1.4.1.4995.2.200.11.1 NAME 'berkeleyEduAuthZ' DESC 'Berkeley Campus Application Authorizations' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'user defined' 'berkeley.edu University defined' ) ) attributeTypes: ( 1.3.6.1.4.1.4995.2.200.11.2 NAME 'berkeleyEduAuthZSponsorUid' DESC 'UC Berkeley Campus Application Authz sponsor uid' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN ( 'user defined' 'berkeley.edu University defined' ) )
  • Objectclass definitions
    objectClasses: ( 1.3.6.1.4.1.4995.2.600.11 NAME 'berkeleyEduAuthZClass' DESC 'custom authorizations object class' SUP top STRUCTURAL MUST ( uid $ berkeleyEduAuthZ $ berkeleyEduAuthZSponsorUid ) MAY ( berkeleyEduAffExpDate ) X-ORIGIN ( 'user defined' 'berkeley.edu University defined' ) )

Authoritative Data for Guests

The CalNet Guest account creation application stores the data directly into the campus directory (LDAP) and is therefore the authoritative source of all CalNet Guest data. CalNet Guest accounts are also populated in Active Diretory to support AD dependent applications.

Account Creation - When do records enter LDAP?

The CalNet Guest account information is immediately added to the LDAP under ou=guests and assigned a new affiliate type: berkeleyEduAffiliations=GUEST-TYPE-COLLABORATOR . That way site administrators can add CalNet Guest accounts to internal roles even before the CalNet Guest account has activated his/her account. The CalNet Guest account is also propagated to the AD under ou=guests. 

Public and Private Attributes

The CalNet Guest account LDAP attributes are distributed as follows:

Public
• givenName (First Name)
• sn (Last Name)

Private
• berkeleyEduNameSalutation (Salutation)
• berkeleyEduMiddleName (Middle Name)
• berkeleyEduNameGenerational (Generational suffix)
• berkeleyEduNameHonorifics (Degree suffix to name)
• mail (Email Address)
• telephoneNumber (Telephone Number)
• berkeleyEduIMScreenName (IM Screen Name)
• berkeleyEduIMProtocol (IM Service)

CalNet Guests can not update these attributes and the privacy settings themselves in the UC Berkeley CalNet Directory until they become an official student by using Bearfacts for one time only or they become and official employee using the CalNet Manage Your Identity program.

Some additional attributes and sample values available for Guest CalNet accounts:

  • berkeleyEduAffiliations: GUEST-TYPE-COLLABORATOR
  • berkeleyEduAffExpDate: 20130310234336Z
  • berkeleyEduFirstName: CollabGuest
  • berkeleyEduKerberosPrincipalString: collabguest-test7
  • berkeleyEduLastName: Test
  • displayName: CollabGuest Test

Creating CalNet Guest accounts

For information on eligibility and how to create a CalNet Guest Account, please CalNet Guest Accounts.