Example: Attribute-Based Data Partitioning

In attribute-based data partitioning, the attributes of one principal type are distributed over several data sources.

Denise DeLassandros wants to store user attributes firstname , lastname and email on the directory service, and all other user attributes on the database of the SAP NetWeaver Application Server (AS) Java. As a result:

• The user management engine (UME) searches the directory service for the attributes firstname , lastname and email
• The attributes firstname and lastname are populated whenever a user object is populated from the directory service data source
• The attributes firstname and lastname can be modified because the directory service data source is not read only, but the email attribute cannot be modified
• All other user attributes are stored in the AS Java database

Denise modifies her data source configuration file as follows:

Example

<dataSource id="CORP_LDAP"
      className="com.sap.security.core.persistence.datasource.imp.LDAPPersistence"
      isReadonly="false"
      isPrimary="true">
    ...
    <responsibleFor>
      <principals>
        <principal type="USER">
          <!-- Substructure specified means responsible
          for the specified namespace attribute tuples 
          of principals of type "USER" -->
          <nameSpace name="com.sap.security.core.usermanagement">
            <attributes>
              <attribute name="firstname" populateInitially="true"/>
              <attribute name="lastname" populateInitially="true"/>
              <attribute name="email" readonly="true"/>
            </attributes>
          </nameSpace>
        </principal>
      </principals>
    </responsibleFor>
    <notResponsibleFor>
    </notResponsibleFor>
    ...
</dataSource>

<dataSource id="PRIVATE_DATASOURCE"
      className="com.sap.security.core.persistence.datasource.imp.DataBasePersistence"
      isReadonly="false"
      isPrimary="true">
    ...
    <responsibleFor>
      <principals>
        <principal type="USER">
          <!-- No substructure specified means responsible
          for all namespace attribute tuples of principals
          of type "USER" except the ones in the
          notResponsibleFor subsection -->
        </principal>
      </principals>
    </responsibleFor>
    <notResponsibleFor>
    </notResponsibleFor>
    ...
</dataSource>