eDirectory Identity Manager Roles

Use this profile when eDirectory Identity Manager owns role assignments on user entries and clients need to browse roles, groups, and membership counts through IdentityScribe.

Import The Profile

Start from your normal production config, define the user, role, and group transcribes, then include the profile after those transcribes:

include required("production.conf")

# Configure database, ldap, auth, and the user/role/group transcribes here.

include required("edirectory-idm.conf")

The profile is additive. It appends IDM attributes and index coverage to existing transcribes, and it adds virtual attributes for high-fanout reverse views. If your transcribe names differ from user, role, or group, copy the profile and adjust the paths.

User Attributes

Track role and group membership on the user side:

Attribute	Purpose
`nrfMemberOf`	Effective role membership. Use this for "users holding this role" searches and counts.
`nrfAssignedRoles`	Direct role assignments. Values include assignment metadata after the role DN.
`nrfInheritedRoles`	Role assignments inherited through hierarchy.
`nrfGroupRoles`	Role assignments inherited through group membership.
`nrfContainerRoles`	Role assignments inherited through containers.
`nrfAssociatedRoles`	Implicit role assignment details where present.
`groupMembership`	User-side group membership. This powers the virtual group `member` view.
`nrfAssignedResources`	Assigned resources.
`DirXML-EntitlementRef`	Entitlement references.

Add these attributes to transcribes.user.ldap.attributes and transcribes.user.indices.value-match. The path-style role attributes are matched by their role-DN prefix, so they need query coverage even though the full value contains metadata.

Role Attributes

Store role metadata, hierarchy, and status on the role side:

Attribute	Purpose
`nrfLocalizedNames`, `nrfLocalizedDescrs`	Display labels and descriptions.
`nrfRoleCategoryKey`	Role category filters.
`nrfRoleLevel`	Role level filters.
`nrfStatus`	Role status filters.
`nrfParentRoles`, `nrfChildRoles`	Role hierarchy display.
`nrfImplicitGroups`	Groups connected to the role where eDirectory provides plain DN values.
`owner`	Role ownership display and filters.

Do not sync the physical equivalentToMe value for large role sets. The profile exposes equivalentToMe as a virtual attribute backed by user nrfMemberOf, so IdentityHub-style "roles for this user" queries still work without storing a large reverse list on every role. The profile also exposes roleMembers as a clearer virtual name for the same reverse view.

Group Attributes

When users carry groupMembership, prefer that user-side value over syncing very large group member lists. The profile exposes group member virtually from user groupMembership, which supports group membership filters while keeping the large reverse list out of stored group entries.

If your directory does not provide groupMembership, remove ldap.virtual-attributes.member from the profile and sync the physical group member attribute instead.

Track these group-side attributes for metadata and IDM links:

Attribute	Purpose
`cn`, `description`	Group labels and search.
`nrfDynamicMember`	Dynamic group membership metadata.
`nrfAssociatedRoles`	Roles associated with the group.
`nrfAssignedResources`	Resources associated with the group.
`owner`	Group ownership display and filters.

Count Defaults

LDAP clients often treat Simple Paged Results and VLV response sizes as membership counts. For that reason, query.default-count defaults to exact, and the LDAP channel inherits it. A client that does not need a count can send the eDirectory disable-count control.

Keep REST, GraphQL, and MCP at their channel defaults unless callers require exact totals by default:

query.default-count = "exact"
channels.rest.default-count = "estimated"
channels.graphql.default-count = "estimated"
channels.mcp.default-count = "estimated"

Use a channel override when one integration needs different behavior:

channels.ldap.default-count = "estimated"
channels.identity-hub.default-count = "exact"