LDAP Modify

Introduction

Use this valve to modify an LDAP entry based on values in an item.

An LDAP modify request contains one or more modifications that are applied to the target entry. The following modification types are supported

• ADD
• REPLACE
• DELETE

Each modification uses the name and the value of a property on the current item and therefor item property names must match the LDAP entry names (specified in the LDAP schema). By default the item id is used as the distinguished name (DN) of the entry to modify. If dn_parameter is set, that value is used instead.

Prerequisites

Before using this valve the LdapClient module must be configured and deployed.

Configuration

Note

Valve name: LDAPModify

Common LDAP valve configuration can be found here.

Properties

Name	Description	Default	Mandatory	Expanded
add	List of item properties to add.	N/A
replace	List of item properties to replace.	N/A
delete	List of item properties to delete.	N/A
ignore_empty_values	Ignore empty values in add and replace modifications. If all configured attributes have empty values the LDAP request is skipped and the valve succeeds without error.	false
dn_parameter	If not using item.id() as DN value.	N/A

Example

{
  "name" : "LDAPModify",
  "config" : {
    "destination" : "default",
    "dn_parameter" : "${item.dn}",
    "add" : "mail,mobile"
  }
}

Audit

Every successful modify operation publishes raw changes to the platform audit trail automatically — there is no audit flag to configure on the valve or the LdapClient anymore. Whether anything is actually recorded depends on whether an Audit module is deployed to consume it.

Note

Attribute values matching a sensitive keyword (password, unicodePwd, pwd, and similar) are masked as ***** before publishing.

Valve config

{
  "name": "LDAPModify",
  "config": {
    "replace": ["cn"]
  }
}

Published change

[
  { "field": "cn", "operation": "REPLACE", "after_value": "Demo User Modified" }
]

• object_type user, package_type UserUpdated — always, regardless of which attribute is actually modified. Modifying a group's member attribute through this valve is still published as UserUpdated on the group's own DN; use the Audit module's enrichment.ldap.object_types.<type>.reference_attributes configuration to attribute such a change to the referenced member instead
• object_id — the DN of the modified entry, taken from item.id() (or dn_parameter)
• one change per attribute in add, replace, or delete; operation reflects the modification type. A delete of an entire attribute (no specific value) publishes with no after_value

Only the after-value of each write is published — this valve does not capture a before-value. See Audit for how published changes are grouped into events and change packages, and for the built-in UI and REST API to view them.