Active_Directory_to_inetOrg

5-4 Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory

5.2.2 Common_Name_to_Given_Name

Creates a virtual common name attribute by combining values from two attributes, default sn and givenname. The Common_Name_to_Given_Name mapping is typically used with the Database Adapter, which may have only a first and last name, but no full name.

5.2.3 ConditionalPublish

Removes the attributes specified if the conditional value in another attribute is met. The ConditionalPublish mapping is useful to hide FERPA protected attributes in a higher education environment.

5.2.4 DB_Groups

Use this template to map a table that describes a group into a valid LDAP group. The first column is assumed to be cn, that is, the name of the group. The second column is assumed to be the uniquemember. With uniquemember, the DN is stripped so that only the RDN value is used inside the table. For example, converting: uniqueMember=cn=XXX,ou=testusers to uniqeMember=XXX.

5.2.5 Map_DB_Password

Maps inbound binary syntax passwords to IA5String passwords compatible with the database.

5.3 Example Mapping Deployments

This topic provides two examples for common mapping deployments and contains the following sections: ■ Constructing Common Name Attributes from Givenname and Surname Attributes ■ Mapping Microsoft Active Directory Schema

5.3.1 Constructing Common Name Attributes from Givenname and Surname Attributes

Overview This example explains how to create a common name cn from a givenname and a surname sn. This type of mapping deployment is useful when using a Database Adapter to provide an LDAP interface to a user data stored in a database. While LDAP directories generally store a cn, databases tend to store only a first name and last name. When performing a search, it could become very complicated when filtering on Note: This mapping does not support substring filters for common name attributes. Note: If you associate the Map_DB_Password Mapping with a Database Adapter, then perform an LDAP modify with changetype Add and a binary attribute such as UserPassword with its value already existing in Oracle Virtual Directory, a duplicate row is added in the database if the primary key constraint is not present in the database table. Understanding Oracle Virtual Directory Mapping 5-5 common name. For example, the filter cn=Marc Boorshtein would have to read givenName=Marcsn=Boorshtein. Mapping Requirements The following is a list of hypothetical requirements for this example mapping: ■ When data is retrieved from the adapter, you want to form a cn by combining givenname with sn. ■ On the inbound side, you want to split cn into givenname and sn. If cn is present in the attribute request list, the list is changed to include givenname and sn. ■ If the inbound operation is a search operation, you want to check the search filter and convert the cn appropriately. Mapping def parceCNval: return splitval, ,2 def inbound: map the cn filters if operation == get: if haveAttributecn: addAttributegivenName addAttributesn cnFilters = findFilterscn for filter in cnFilters: target,op,val = filter.contents givenNameVal, snVal = parceCNval givenNameFilter = createFiltergivenName,op,givenNameVal snFilter = createFiltersn,op,snVal filter.contents = createAndFilter[givenNameFilter,snFilter] def outbound: outbound stuff addAttributeValuecn,getAttributeValuegivenName + + getAttributeValuesn Inbound Processing In the inbound function you want to convert any cn into separate givenname and sn attributes. For a search, you want to convert search filters for cn into a combined filter for givenname and sn so you create a new function, parceCN. On the first line of the mapping, the split function is imported from the Python string module. The parseCN Python function is defined to take a cn and split it into a first and last name based on detecting a space. Next, you define the inbound function. The inbound function could deal with any LDAP operation, but in this case, you are interested in looking at search operations. The first line after inbound is therefore an if block that tests the value of operation. The variable operation contains either add, bind, delete, get, modify, or rename. Note: In reality, this is more complex, for example, when middle names are used. For the purposes of this example, consider this simple case to get started. Contact your Oracle Support representative for help with advanced mapping situations.