Displaying LDAP attributes and object classes when setting form-specific access

Use the Schema option in the "Form and Field access at target" dialog box to control whether the dialog box shows the directory contents in terms of LDAP object classes and attributes or in terms of Domino® forms and fields.

About this task

Domino® is selected by default, meaning the dialog box shows Domino® forms and fields. To show LDAP object classes and attributes, select LDAP next to the Schema option.

When you set a subject's access to a form or field, the access setting automatically applies to the corresponding LDAP object class or attribute, if there is one. Similarly, if you set a subject's access to an object class or attribute, the access also applies to the corresponding form or field if there is one.

For example, if you deny a subject Read access to the InternetAddress field of a Person form when Domino® is selected as the Schema option, the subject is also denied LDAP Read access to the mail attribute of the dominoPerson object class that shows when LDAP is selected as the Schema option. If the Schema option is set to LDAP and you deny a subject Read access to the mail attribute of the dominoPerson object class, the subject is also denied Read access to the InternetAddress field of a Person form that shows when the Domino® is selected as a Schema option.

Some object classes and attributes that the Form and Field access at target dialog box displays when you select LDAP as the Schema option do not correspond to forms and fields and are useful only for controlling LDAP access. For example, the object class residentialPerson does not correspond to a form. Similarly, some forms and fields that the dialog box displays when you select Domino® as the Schema option do not correspond to LDAP object classes and attributes and are useful only for controlling Notes® or Web user access. For example, the form DirectoryProfile does not correspond to an object class.

Note: Domino® uses the Domino® LDAP Schema database (SCHEMA.NSF) to generate the LDAP object classes and attributes that display when you choose LDAP for the Schema option in the dialog box. So to use the LDAP schema option, the directory for which you are setting access must be located on a server that runs the LDAP service. If you extend the schema, you can use the extended ACL to control access to the new object classes and attributes.