Access Manager OAuth 2.0 implementation stores the client application information, which a user authorizes to access attributes and resources. This information is unique per user. Store it as part of a user object in the user store. If you already have an attribute, use it in Authorization Grant LDAP Attribute while defining Global Settings.
If a free attribute is unavailable, then extend the User Object schema to add a new single-valued binary (LDAP) or stream (eDirectory) attribute with a name. Access Manager stores an XML object in this attribute for each user authorization.
NOTE:The LDAP super administrator must have write access to this user attribute to allow saving the token information. Access Manager uses this attribute to revoke refresh tokens.
An example for extending the schema of a User Object in eDirectory
Click to Roles and Tasks > Schema > Create Attribute.
Specify Attribute Name as nidsOAuthGrant.
Click Next.
Select Stream under Syntax.
Click Next.
Select Single Valued.
Click Next > Finish.
Go to Roles and Tasks > Schema > Add Attribute.
Select Person under Available Classes.
Click OK.
Move nidsOAuthGrant from Available optional attributes to Optional attributes.
Click OK.
An example for extending the schema of a user object in Active Directory
In Windows, Start > Run > mmc.
Click File > Add/Remove Snap-in.
Select Active Directory Schema and click Add.
Expand Active Directory schema, then right click Attributes > Create Attribute.
In Create New Attribute, specify the following:
Common Name: nidsOAuthGrant
LDAP Name: nidsOAuthGrant
Unique X500 Object ID: 1.3.6.1.4.1.1466.115.121.1.5
Select Syntax as Octet string. Ensure that Multi-Valued is deselected.
Click OK.
Expand Active Directory schema, then click Classes > person.
Right click person, then click Properties.
Click the Attribute tab, then click Add.
Select the attribute that you created (nidsOAuthGrant), then click OK.
Click OK to close all property windows, then add the attribute to person class.
Sample: Extending the schema of a user object in Active Directory Lightweight Directory Services
Go to Active Directory Lightweight Directory Services (AD LDS) schema.
Right-click the schema name, then click New > Object.
Select attributeSchema and click Next.
Specify a common-name and click Next.
Specify 4 for the oMSyntax attribute and click Next.
Specify a LDAP-Display-Name and click Next. This value must be same as the common-name.
Specify True for the isSingleValued attribute and click Next.
Specify 2.5.5.10 for the attributeSyntax attribute and click Next.
Specify 1.2.840.113556.1.9000.50.1 for the attributeID attribute and click Next.
Click Finish.
Navigate to cn=Person class, double-click to edit an attribute.
Select mayContain attribute and click Edit.
Specify the attribute name (common-name) and click Add > OK > Apply > OK.
Right-click the Schema > Update Schema Now.
NOTE:While creating a new user, the msDS-UserAccountDisabled attribute is set to true by default. Change the value to false.