Attribute Policies

---

Content: 

Overview 

Cayosoft Administrator has granular control over how attribute data is presented or modified through Attribute Policies. Attribute Policies can be set globally for all or a specific set of objects over the desired scope (Administrative Units). These policies make attribute data visibility and enforcement easy to configure.

 

Video tutorial

In this video guide, you will learn what the Attribute Policies are and see examples of how to configure a web form where all settings are read-only and how to configure possible values.

 

What can Attribute Policies do?

• Make a value required

• Make a value or control read-only

• Hide a value or control

• Set Minimum and maximum length for data entry

• Adds a Mask to control the format in which the data must be entered

• Adds a generation rule for how attribute values can be constructed

• Sets Default values

• Sets lists of Possible values and converts entry fields into drop-down menus

• A label used on dialog boxes

 

How the attribute policies work on Modify action

For details, review the following article: How the attribute policies work on Modify action.

 

How the attribute policies work on copied web actions

When you copy the default web action and configure the Attribute Policy, you should restart the Administrator Service for this attribute policy to be applied correctly. 

 

The resultant set of attribute policies

When multiple Attribute Policy Rules affect the same web action, Cayosoft Administrator applies a specific algorithm to calculate the resultant set of attribute policies to enforce. This KB article describes this algorithm: How to calculate resultant set for conflicting attribute policy rules.

 

Example of Attribute Policies

Make all controls read-only on the User Properties form

For details please see this article: Role-based delegation. 

 

Best practices for general rules

In some cases, you might need to configure some general rules, for example, hide a license in all web actions or set possible values for the department for all actions. Follow the steps below to configure the general rules:

1. Open the Cayosoft Administrator console.

2. In Admin Console navigate to Home > Configuration > Web Portal > Attribute Policies.

3. Click Add Attribute Policy at the top right.
   

4. Enter a name for the New policy, for example, Hide license in WA Policy.

5. Expand the Policy Details of the new policy.

6. Click Add Scope at the bottom right corner of the Policy Scope section.

7. Depending on your business needs, configure the following:
   • Admin Units: If you want to apply the policy to all admin units, select the All Admin Units checkbox.
   • Web Queries: If you want to apply the policy to all web queries, select the All Web Queries checkbox.
   • Web Actions: If you want to apply the policy to all web actions, select the All Web Actions checkbox.
     
     Recommended:

     To set up general rules, it's better to use [All Web Queries][All Actions] rather than 'Check All'.

     Difference Between [All Web Queries][All Actions] and 'Check All':

     • Using 'Check All':

       • Creates multiple records, one for each selected action.
       • This can lead to slower page loading times.
       • If a new query/action is added later, it won't be automatically included in this Attribute Policy.

     • Using [All Web Queries][All Actions]:

       • Creates a single record.
       • This results in better performance with faster page loading.
       • Any new web query/action added in the future will be automatically picked up by this Attribute Policy.

     By using [All Web Queries][All Actions], you ensure that your Attribute Policy remains comprehensive, up-to-date, and performs efficiently without needing manual updates whenever new queries or actions are added.

8. Continue with the configuration as needed.

Force User must change password True by default

1. Open the Cayosoft Administrator console.

2. In Admin Console navigate to Home > Configuration > Web Portal > Attribute Policies.

3. Click Add Attribute Policy at the top right:

4. Enter a name for the New policy, for example, Password Reset Policy.

5. Expand the Policy Details of the new policy.

6. Click Add Scope at the bottom right corner of the Policy Scope section.

   

7. In Specify Policy Scope dialog do the following:

8. Select the Active Directory Admin Unit in the first column.

9. Select the AD Users Web Query in the second column.

   Note: If needed, you can select additional web queries like AD User Templates, AD Users (Inactive), or AD Users (Locked out).

10. Select Clone User, New User, and Reset Password in the third column.

11. Click OK

12. Click the newly created scope to select it.

13. In the Attribute policy settings section, select the User must change password at next logon attribute.
    
    

14. Click Edit Policy.

15. Click Default Value then enter TRUE in the field next to the checkbox.

    

16. Click OK.

17. Click Save Changes to save the policy.

 

Hide Alternative e-mail address and Phone number from Reset my password and Unlock my account Web UI forms 

1. Open the Cayosoft Administrator console.

2. In Admin Console navigate to Home > Configuration > Web Portal > Attribute Policies.

3. Click the button Add Attribute Policy in the upper right corner.

4. Enter the name of the new policy then expand the Policy Details.

5. Click Add Scope in the Policy Scope section.

6. In the Specify Policy Scope dialog, select the My Profile & Password in the first column titled Admin Units.

7. Select My Profile & Password Rules in the second column titled All Web Queries.

8. Select Self-Service - Password Self-Service Enroll in the third column titled All Actions.

9. Click OK.

10. Click the newly created scope to select it.

11. In the Attribute policy setting section locate and then double-click on the Alternative Email Address attribute.

12. Check the Is Hidden option at the top, then click OK.

13. Do the same actions for the Mobile Phone Number attribute.

14. Click Save Changes.

 

Disable Auto Replies controls on the Mailbox action

1. Open the Cayosoft Administrator console

2. In Admin Console navigate to Home > Configuration > Web Portal > Attribute Policies

3. Click the button Add Attribute Policy in the upper right corner

4. Enter the name of the new policy then expand the Policy Details

5. Click Add in the Policy Scope section

6. In the Specify Policy Scope dialog, select the Active Directory in the first column titled Admin Units

7. Select AD Users in the second column titled Web Queries

8. Click OK

9. Click the newly created scope to select it

10. In the Attribute policy setting section locate and then double-click on the Duration(Days) attribute

11. Check the Is ReadOnly option at the top, then click OK

12. Using the same procedure performed in steps 10 and 11, check Is ReadOnly for the following attributes:

    • End Time

    • OOFEndTime

    • OOFMode

    • OOFOutsideMode

    • OOFStartTime

    • Send a reply once to each sender inside my organization

    • Send a reply once to each sender outside my organization

    • Start Time:

13. Click Save Changes to save the policy

 

Set a default password during user creation

1. Open the Cayosoft Administrator console

2. In Admin Console navigate to Home > Configuration > Web Portal > Attribute Policies

3. Click the button Add Attribute Policy in the upper right corner

4. Enter the name of the new policy then expand the Policy Details

5. Click Add in the Policy Scope section

6. In the Specify Policy Scope dialog, select the Active Directory in the first column titled Admin Units

7. Select AD Users in the second column titled Web Queries

   Note: You can select additional web queries if needed like AD User Templates, AD Users (Inactive), or AD Users (Locked out)

8. Select New User and Clone User in the third column titled Web Actions

9. Click OK

10. Click the newly created scope to select it

11. In the Attribute policy settings section, select Auto-generated password Attribute

12. Click Edit Policy

13. Click Default Value then enter False in the field next to the checkbox
    
    

14. Click OK

15. In the Attribute policy settings section, select Password

16. Click Edit policy

17. Check Default Value then enter P@ssword123 in the field next to the checkbox

    Note: P@ssword123 is used here only for example purposes, any value entered must meet the Active Directory password complexity rules.

18. Click OK

19. Click Save Changes

 

Set visibility of Mailbox buttons for New User, Clone User, and Enable Mailbox Actions

Using the Attribute policy you can hide or display Exchange buttons on the New User creation wizard.  

1. Open the Cayosoft Administrator console

2. In Admin Console navigate to Home > Configuration > Web Portal > Attribute Policies

3. Click the button Add Attribute Policy in the upper right corner

4. Enter the name of the new policy then expand the Policy Details

5. Click Add in the Policy Scope section

6. In the Specify Policy Scope dialog, select the Active Directory in the first column titled Admin Units

7. Select AD Users in the second column titled Web Queries

   Note: You can select additional web queries if needed like AD User Templates, AD Users (Inactive), or AD Users (Locked out)

8. Select New User, Clone User, and Enable Mailbox in the third column titled Web Actions

9. Click OK

10. Click the newly created scope to select it

11. In the Attribute policy settings section, select the MailboxType attribute

12. Click Edit Policy

13. Click Default Value then enter the number in the field next to the checkbox that corresponds to the default button you wish to be selected.

    For AD, On-premises Exchange, and Office 365 Hybrid Mode the options are:

    0 for No mailbox

    1 for Exchange On-Premises

    2 for Exchange Remote

    3 for Office 365

    For AD & Office 365 Only Hybrid Mode, the options are:

    0~No mailbox

    3~Office 365

14. Click the Possible Values checkbox then enter the following values in the field to the right

    Note: You can specify the text on the button by entering it to the right of the numeric value after a ~.

    

15. For AD, On-premises Exchange, and Office 365 Hybrid Mode the options are:
    0~No mailbox
    1~Exchange On-Premises
    2~Exchange Remote
    3~Office 365
    For AD & Office 365 Only Hybrid Mode, the options are:
    0~No mailbox
    3~Office 365
16. Click OK
17. Save the policy

 

Set Default UPN suffix for New Shared, Room, and Equipment Mailboxes

Add the ability to have the Default UPN suffix set to “Use Web Query Default Domain” for New Shared Mailbox, New Room Mailbox, and New Equipment Mailbox

1. Select property UserPrincipalNameSuffix and click Edit Policy

2. Select the checkbox Default value and enter the value you want to be initial on the page

   The value should begin with @ and look something like @domain.com

3. Select the Possible values checkbox and add here other values, separated by a new line or comma, values also should begin with @

4. Click OK to close the dialog

5. Click Save Changes

 

Limit the list of possible email suffixes in the Mailbox web action

1. Open the Cayosoft Administrator console

2. In Admin Console navigate to Home > Configuration > Web Portal > Attribute Policies

3. Click the button Add Attribute Policy in the upper right corner

4. Enter the name of the new policy then expand the Policy Details

5. Click Add in the Policy Scope section

6. In the Specify Policy Scope dialog, select the Active Directory in the first column titled Admin Units

7. Select AD Users in the second column titled Web Queries

8. Select Mailbox in the third column titled Web Actions

9. Click OK

10. Click the newly created scope to select it

11. In the Attribute policy settings section, select E-mail Addresses (Suffixes)

12. Click Edit Policy

13. Click the Possible Values checkbox then enter the possible email suffixes without '@'

14.  Save changes

 

Set the default Mailbox type button for New Shared, Room, and Equipment Mailboxes

Add the ability to set the default mailbox type to “Office 365 Exchange Remote” for New Shared Mailbox, New Room Mailbox, and New Equipment Mailbox:

1. Select property Mailbox Type and click Edit Policy

2. Select the Default Value checkbox and type here 2

   0 means no mailbox

   1 means on-premises

   2 means remote mailbox

   3 means Office 365 only

   Available options are dependent upon configuration. 0,1,2 are available when AD, Exchange, and Office extensions are enabled whereas 0,3 are available when only AD and Office 365 extensions are enabled.

3. Click OK to close the dialog

4. Click Save Changes

 

Control Phone Number Format using a Mask

The entry format of any phone number attribute can be controlled by adding an Attribute Policy that contains a formatting Mask. Masks are regular expressions that determine how the number must be entered by the user.

Creating an Attribute Policy with a proper scope

1. Open the Cayosoft Administrator console

2. In Admin Console navigate to Home > Configuration > Web Portal > Attribute Policies

3. Click Add Attribute Policy at the top right

4. Enter a name for the New policy, for example, Office Phone Mask

5. Expand the Policy Details of the new policy

6. If you need the policy to be applied to everyone who is using Cayosoft Web Interface leave the radio button Policies Applied to everyone selected. Overwise, select Policies applied only to specific Trustees, then click the Add button and select required users or groups

7. Click Add Scope at the bottom right corner of the Policy Scope section

8. In Specify Policy Scope dialog do the following:

   • Select the Active Directory admin unit in the first column

     (you can select any other AD units if needed)

   • Select the AD Users Web Query in the second column

     Note: You can select additional web queries if needed like, AD User Templates, AD Users (Inactive), or AD Users (Locked out)

   • Select Properties in the third column

9. Click OK

 

Add Mask on the Office Phone attribute

1. Click the scope in the policy to select it

2. In the Attribute policy settings section, select the Office Phone attribute (you can use search to find it)

3. Click Edit Policy

4. Select checkbox near Mask field and set it to \+1\s[0-9]{10}\b

5. Specify Error text - it will appear if a user entered the incorrect value: Phone number must be in the format +1 2223334444

6. Click OK

7. Click Save Changes to save the policy

 

How to prohibit group membership modification

1. Open the Cayosoft Administrator console

2. In Admin Console navigate to Home > Configuration > Web Portal > Attribute Policies

3. Click Add Attribute Policy at the top right

4. Enter a name for the New policy

5. Click Add Scope at the bottom right corner of the Policy Scope section and define policy scope, for example, Active Directory > AD Groups  > Membership

6. In the Attribute policy settings section, select the Members attribute

7. Click Edit Policy

8. Check Is Read-only

9. Click OK

10. Click Save Changes

 

Set default value for Administrator Unit for cloud object creation actions

1. Open the Administrator console.

2. In Administrator Console navigate to Home > Configuration > Web Portal > Attribute Policies.

3. Click Add Attribute Policy at the top right.

4. Enter a name for the New policy.

5. Click Add Scope at the bottom right corner of the Policy Scope section and define policy scope, for example, Microsoft 365 > Users  > New User.

6. In the Attribute policy settings section, select the Parent container Azure AD Administrative Unit attribute.
7. Click Edit Policy.
8. Select the default Admin Unit from the list of Azure Admin Units.

9. Click OK.

10. Click Save Changes.

 

How to hide a tab on the Web Portal form

With the Attribute Policy, it is possible to hide any tab on the Web Portal form. In the example below, we will hide the Info tab on the User Properties form.

1. Open the Cayosoft Administrator console.

2. In Admin Console navigate to Home > Configuration > Web Portal > Attribute Policies

3. Click Add Attribute Policy at the top right.

4. Enter a name for the New policy.

5. Specify if the policy should be applied to everyone or to only specified trustees.
6. Specify policy scope: Active Directory > AD Users > Properties.
7. In Attribute policy settings check Show Property ID.
8. Each tab on the Web Portal form has a prefix tab in the attribute display name in the Attribute policy settings list:
9. Open Attribute policy settings for the Info tab and check Is Hidden.
10. Save changes.

Login to Web Portal, find a user in AD Users web query, and open user properties. The info tab will not be displayed on the user properties form.

 

How to hide a specific license plan(s) from the New User web action

In this example, we will configure the Attribute Policy to hide a specific Office 365 license plan from the New User action in the Active Directory Web Query for all users:

1. Open Cayosoft Administrator Console.
2. Navigate to Home > Configuration > Web Portal > Attribute Policies.
3. Click the button Add Attribute Policy in the upper right corner.
4. Enter the name of the new policy, then expand the Policy Details.
5. Click Add in the Policy Scope section.
6. On the Specify Policy Scope dialog, select the Active Directory in the first column titled Admin Units.
7. Select AD Users in the second column titled Web Queries.
   Note: You can select additional web queries if needed like AD User Templates, AD Users (Inactive), or AD Users (Locked out).
8. Select New User in the third column titled Web Actions.
   Note: You can also select other actions that have Assign License functionality, like Clone User, Office 365 License, and Enable Mailbox.
   
9. Click OK.
10. Click the newly created scope to select it.
11. In the Attribute policy settings section, select License Options Attribute.
12. Click Edit Policy.
13. Select Hide in the drop-down near the desired license plan(s).
    
    Note: You can also hide or make read-only specific license plan options instead of the entire plan: leave the setting for the plan as "<Not Set>", expand the plan, and select desired visibility near each license option.
14. Click OK to close the dialog.
15. Click Save Changes.

How to make a license plan be selected by default

If you need to make some license plans selected by default, you can select checkbox near this plan on the Attribute Policy Setting dialog. Be aware, that this option doesn't work if the plan visibility is set to Hide:

 

How to set a license plan to a read-only state

Read Only and Read Only [include child] options are useful if you want these plans to be always checked or unchecked on UI when assigning licenses.

Read Only on a license plan applies to the license plan itself, but you still be able to change options in it. If you choose Read Only [include child] for a plan you won't be able to change plan options also.

 

Uniqueness Names Generation in Attribute Policy

Generation Rules in Web Interface

Cayosoft Administrator facilitates user creation by autogeneration naming attributes. After the admin enters First and Last Names on the New User form other attributes are automatically populated based on generation rules configured in Administrator Console.

Default name generation rules are configured for Display Name, Full name (cn), UserPrincipalName prefix, SamAccountName, and Mail properties on Active Directory extension settings. You can easily customize these rules so they will correspond to your organization's requirements and policies. These defaults are applied when a user using New User and Clone User actions. Name generation rules can also be controlled on a web action level, for most advanced scenarios and edge cases. Out of the box, name generation settings on web actions (New User and Clone User) are set to use default rules from the AD Extension. 

So, if you want to use different generations for New User and Clone User rules you can change the 'Use default generation rule' setting by any other from predefined values in the drop-down menu or even create your own rules in Expression builder (to do this, click on [...] button near the desired attribute). To turn autogeneration off, you need to select the 'No Generation' value.

If there is a need to use different generation rules in different locations, account types, or other scopes, an Attribute Policy can be used.

So, on New User and Clone User actions for any specific attribute generation rules are applied in the following order:

1. Attribute Policy 
2. Web Action
3. AD extension.

For example, this is how our program will look for the generation rule for Display Name: first, it will check if there is an appropriate Attribute Policy for the current scope and trustee (user logged in to Web Interface), if there is no such policy it will look into the New User action settings, and if the action settings say to use defaults, it will look into the Active Directory extension settings.

In addition, some naming attributes (UserPrincipalName, Full name (cn), samAccountName) must be unique within the Active Directory forest, and Cayosoft Administrator can also simplify name validating and will automatically create a unique name in the environment (please see Name conflict resolution and alternative names generation section below in this article).

Generation rules in templates

Our template rules (for example 'Text file | Create AD Users', 'Import SQL Data | Create AD Users', or 'Import Oracle Data | Create AD Users') has very similar functionality for new users naming attributes generation.

The only difference is that autogeneration can be set only directly in the rule settings, it is not affected either by the Active Directory extension settings or by the Attribute Policies.

Name conflict resolution and alternative name generation

As it was mentioned above, naming attributes should be unique in Active Directory. By default, Cayosoft shows an error if a generated value already exists in the environment and you need to correct the name manually to continue user account creation. Instead of manually resolving such errors you can use the Name conflict resolution option.

This option is also available in the Active Directory extension, New User/Clone User web actions, and Attribute Policy.

There are 4 settings for name conflict resolution:

• Stop and notify user - the default value of this setting. This means that if one of the naming attributes (Display Name, Full name (cn), UserPrincipalName prefix, SamAccountName, Mail) already exists in the Active directory wizard stops and shows an error message. You need to go back to the first page of the form and correct the duplicate value manually.

  For example, you have a common generation rule for Display name as 'FirstName LastName' and trying to create a user with First name: 'John', Last name: 'Brown'. Cayosoft Administrator will automatically generate the display name 'John Brown' and if it already exists - you will see an error after clicking on the Create button on the form and you'll need to return to the first page and correct the Display Name value.

• Continue and suffix the user name with a numeric counter. If you select this option, the numeric counter will be added to the duplicated naming attribute automatically, no errors will appear on the wizard. By default, the counter starts with 1.

  If you want to customize the format (start from a specific number or use 2 digits) you need to specify a format in the Alternate Generation Rules > Counter format field.

  For example, you have a common generation rule for Display name as 'FirstName LastName' and trying to create a user with First name: 'John', Last name: 'Brown'. Cayosoft Administrator will automatically generate the display name 'John Brown'. After you click on the Create button if a user with this display name already exists, the user will be created automatically with counter: 'John Brown1', no error appears on the form.

• Try alternative generation rule on fail stop and notify user. In this case, if a user with a naming attribute already exists in AD, Cayosoft will try the alternative generation rule, and show an error only if an alternatively generated name attribute also exists in the system. The alternative generation rules should be configured in the Alternate Generation Rules section and they should be different from common generation rules.

  For example, you have a common generation rule for Display name as 'FirstName LastName', and alternative generation as 'FirstName FirstInitial. LastName' and trying to create a user with the First name: 'John', Last name: 'Brown', and Initials: 'T'. After you click on the Create button if a user with the name 'John Brown' already exists in AD, Cayosoft will try to create 'John T. Brown'. If this user is also present in AD - it will show an error on the wizard and you have to go back to the first page and fix names manually.

• Try the alternative generation rule on fail continue and suffix the user name with a numeric counter. If this option is selected and the user already exists in the system, Cayosoft will try an alternative generation, and if such user also exists will add a numeric counter to the commonly generated rule.

  If you want to customize the format (start from a specific number or use 2 digits) you need to specify the format in the Alternate Generation Rules > Counter format field.

  For example, you have a common generation rule for Display name as 'FirstName LastName', and alternative generation as 'FirstName FirstInitial. LastName' and trying to create a user with the First name: 'John', Last name: 'Brown', and Initials: 'T'. After you click on the Create button if a user with the name 'John Brown' already exists in AD, Cayosoft will try to create 'John T. Brown'. If this user is also present in AD - it will create a user with the name 'John Brown1', and no error appears on the form.

The name conflict resolution option is common for all naming attributes in Active Directory extension and New/Clone User settings, and it also can be granularly applied in the Attribute Policy for naming attributes (Display Name, Full name (cn), UserPrincipalName prefix, SamAccountName, Mail).

Example: create an attribute policy for Display Name with alternate names resolution and counter 

Creating an Attribute Policy with proper scope

1. Open the Cayosoft Administrator console

2. In Admin Console navigate to Home > Configuration > Web Portal > Attribute Policies

3. Click Add Attribute Policy at the top right

4. Enter a name for the New policy, for example, Sales Department Name Generation

5. Expand the Policy Details of the new policy

6. If you need the policy to be applied to everyone who is using Cayosoft Web Interface leave the radio button Policies Applied to everyone selected. Otherwise, select Policies applied only to specific Trustees, then click the Add button and select required users or groups

7. Click Add Scope at the bottom right corner of the Policy Scope section

8. In Specify Policy Scope dialog do the following:

   1. Select the Active Directory admin unit in the first column

      (you can select any other AD units if needed)

   2. Select the AD Users Web Query in the second column

      Note: You can select additional web queries if needed like AD User Templates, AD Users (Inactive), or AD Users (Locked out)

   3. Select Properties in the third column

9. Click OK

Add name generation rules to the Attribute Policy

In this example, we will create a generation rule Surname + ', ' + GivenName for Display Name. Steps to create a rule for other naming attributes such as Full name (cn), UserPrincipalName prefix, SamAccountName, and Mail are the same.

1. Click the scope in the policy to select it

2. In the Attribute policy settings section, select the Display Name attribute (you can use search to find it)

3. Click Edit Policy

4. Select the Generation value checkbox and click the […] button to open Expression Builder

5. In the Join tokens method section select With custom delimiter and enter ', ' (without quotes)

   

6. In the Tokens section click the Add button, select property Surname in the opened dialog, and click OK
7. In the Tokens section click the Add button again, select property GivenName in the opened dialog, and click OK

   Note 1: SamAccountName and UserPrincipalName do not allow some special characters, so you also need to select the radio button 'Characters prohibited for SamAccountName/UserPrincipalName' for these properties to avoid errors on creation.

   Note 2: SamAccountName is limited to 20 characters in Active Directory, so you need to select the checkbox Limit Length at the very bottom of the dialog and ensure that the value is set to 20

   

8. Click OK to close the Expression Builder dialog

9. Click OK to close the Attribute Policy editor

10. Click Save Changes

Add alternative name generation rule to Attribute Policy

In the example below, we will add an alternative name generation rule that will continue to fail with a numeric counter to created before attribute policy for Display Name.

1. Click the scope in the policy to select it

2. In the Attribute policy settings section, select the Display Name attribute (you can use search to find it)

3. Click Edit Policy

4. Select the checkbox Name conflict resolution and choose to Try alternative generation rule on fail continue and suffix the user name with a numeric counter option in a drop-down list.

5. Click the […] button to open Expression Builder

6. In the Join tokens method section select With space character radio button

7. In the Tokens section click the Add button, select property Surname in the opened dialog, and click OK

8. Repeat this action to add Initials and GivenName properties

9. Click OK to close the Expression Builder dialog

   Note 1: If you want Counter to start with a specific number, for example, 5, you should enter 5 in the Counter format field.

   

   Note 2: If you need to use 2 digits in the counter you should enter 00 in the Counter format field

   

10. Click OK to close the Attribute Policy editor

11. Click Save Changes

 

Possible Values setting configuration

In version 7.2.0 Possible Values setting is improved:

1. Possible values can be applied to multiline controls like the Street field on the User Properties form. 
2. For multiline controls "{c}" and "{n}" tokens can be used to add a comma symbol or newline respectively.
3. Allow user input checkbox to be added. The user can either pick a value from possible values or set his value. 

 

Allow user input

When configuring possible values in the attribute policy, you can check to Allow user input setting so users can input the attribute value that is not in the list of possible values. 

For example, if you define possible values for the Department attribute and check to Allow user input, a delegated administrator that will modify a user account in Web Portal will be able to input the Department value that is not in the list of possible values. 

 

Add a comma symbol to possible attribute values

When configuring possible values in attribute policy, you can use the comma symbol as a part of the value.  You should use the "{c}" token in a possible value string that would add a comma symbol.

For example, a possible value like "Company A, Inc" should look like "Company A{c} Inc."

Add newline (carriage return) to possible attribute values

When configuring possible values for multivalue attributes in attribute policy, you can use multi-line values. You should use a carriage return token "{n}" in the possible value string for this. 

For example, the user Street address attribute configuration should look like this:

 

 

Override Label

When you add custom attributes to the Other Attributes section in New Object or Properties web actions, you can use the Attribute Policy to override the label and to display the custom attribute name on the form in the Web Portal.

1. In Attribute Policy settings select Other Attribute for which a custom attribute is specified
2. Open Attribute Policy settings for Other attribute 
3. Check Override Label and type the setting name: Phone Number
4. Save changes

After that, this attribute will have the Phone number name on the New User wizard in the Web Portal.